# Completed plans: windows-threadpool-sys
Checklists whose planned work is complete. A checklist reappears in
[PLANS.md](PLANS.md) if new work is planned against it; the row here stays as the record of the work that was
finished. Individual milestones are archived in [COMPLETED-CHECKLIST.md](COMPLETED-CHECKLIST.md).
| Path to CHECKLIST.md | Completion Date | Brief description | Design Notes |
|---|---|---|---|
| [CHECKLIST.md](CHECKLIST.md) | 2026-08-17 | Thread pool complete: callback environment, private pools, cleanup groups whose members the borrow checker protects, work, one-shot and periodic timers as distinct types, waits that own a handle of proven provenance, and the `TP_IO` backend over the shared seam, with examples, generated documentation, and an opt-in timer stress suite. | [../../DESIGN-NOTES.md](../../DESIGN-NOTES.md) |
| [CHECKLIST.md](CHECKLIST.md) | 2026-08-21 | Reopened for M17: a wait target now owns its close routine, so `ThreadpoolWait` can watch a handle released by something other than `CloseHandle` (the `FindCloseChangeNotification` case). Covers both teardown paths -- direct drop and cleanup-group release -- and breaks `WaitableHandle::into_handle`, which now returns `Result<OwnedHandle, Self>` rather than hand out the wrong destructor. Unblocks windows-file-watcher M6.1. | [../../DESIGN-NOTES.md](../../DESIGN-NOTES.md) |
| [CHECKLIST.md](CHECKLIST.md) | 2026-08-21 | Reopened for M18: stop containing callback panics. Every trampoline wrapped its callback in `catch_unwind` and discarded the payload, quietly forgiving violations of the contract's own "must not unwind across the FFI boundary" rule. Removed across all five trampolines, with the six tests that asserted it replaced by a subprocess harness proving the abort. Breaking: a panicking callback now ends the process. | [../../DESIGN-NOTES.md](../../DESIGN-NOTES.md) |
| [CHECKLIST.md](CHECKLIST.md) | 2026-09-27 | Reopened for M-T1: lifecycle parity in the concurrency trace. The trace stamped the wait object from creation through every arming to close, but the timer, periodic timer and I/O object only where their callbacks ran -- so a capture could not tell an object dispatched late from one established late. Twenty-four call sites added, bringing all of them to parity and closing the same hole in the wait's plain `disarm` and the work object's teardown. Serves windows-ioring-sys M26.13's experiment 3. | [../../DESIGN-NOTES.md](../../DESIGN-NOTES.md) |
| [CHECKLIST.md](CHECKLIST.md) | 2026-09-27 | Reopened for M-T2: the trace installs a vectored exception handler when it turns on, recording each first-chance exception's code and raise address. Written to change nothing -- it declines every exception, never initialises from the handler, and takes the buffer lock without blocking -- and guarded by a test that raises a real one. | [../../DESIGN-NOTES.md](../../DESIGN-NOTES.md) |
| [CHECKLIST.md](CHECKLIST.md) | 2026-09-27 | Reopened for M-T3: bracket every Win32 call that blocks or takes a pool lock under a separate `syscall` target, so a call that blocked is an interval rather than a late timestamp; and census the OS-invoked callbacks, which found the caller-supplied wait close routine untraced. | [../../DESIGN-NOTES.md](../../DESIGN-NOTES.md) |
| [CHECKLIST.md](CHECKLIST.md) | 2026-10-01 | Reopened for M-T4, M-T5 and M-T6: teardown drains rather than cancels, the undischarged-obligation report, and cancellation that repairs the pool it may have wedged. `try_cancel_pending` is renamed to say it is best-effort and registers a repair; a `self-heal` timer submits that pre-created repair to any pool a cancellation may have severed; `stop_and_drain` becomes the uniform name of the synchronous close. Closes with the `fail-fast` feature (default off), which turns an undischarged drain at `Drop` into a panic -- and whose first armed run measured this whole workspace against the protocol and found four crates not conformant, all since fixed. | [../../DESIGN-NOTES.md](../../DESIGN-NOTES.md#cancellation-self-heals) |