napi_async_runtime/

async_runtime.rs

//! Shared async/CPU/blocking scheduler.
//! See the implementation notes in this crate's README.

use std::{
  any::Any,
  collections::VecDeque,
  fmt,
  future::Future,
  mem::ManuallyDrop,
  panic::{AssertUnwindSafe, catch_unwind, resume_unwind},
  pin::Pin,
  sync::{
    Arc, LazyLock, Weak,
    atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
  },
  task::{Context, Poll, Waker},
  time::{Duration, Instant},
};

use arc_swap::ArcSwapOption;
use rustc_hash::{FxHashMap, FxHashSet};

use crate::MAX_ASYNC_RUNTIME_WORKER_THREADS;
use crate::sync::{BoundedWaits, Condvar, Mutex, MutexGuard, UnboundedCondvar};
// Both users are MultiThread pool tests.
#[cfg(all(test, napi_runtime_os_threads))]
use async_task::Task;
use async_task::{FallibleTask, Runnable};
use futures::{
  FutureExt,
  future::{AbortHandle, AbortRegistration, Abortable},
};

#[cfg(napi_runtime_os_threads)]
use crossbeam_deque::{Injector, Steal};
#[cfg(napi_runtime_os_threads)]
use futures::channel::oneshot;
#[cfg(all(test, napi_runtime_os_threads))]
use rayon::max_num_threads;
#[cfg(napi_runtime_os_threads)]
use rayon::{ThreadPool, ThreadPoolBuilder};

/// Stable scheduler identities are equality capabilities. Exhaustion must fail
/// before reuse can authorize a stale handle or collide in an indexed queue.
fn next_unique_id(counter: &AtomicU64, exhausted: &'static str) -> u64 {
  counter
    .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |id| id.checked_add(1))
    .expect(exhausted)
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RuntimeFlavor {
  CurrentThread,
  MultiThread,
}

#[derive(Debug, Clone)]
pub struct RuntimeOptions {
  pub flavor: RuntimeFlavor,
  /// Physical worker count for [`RuntimeFlavor::MultiThread`]; forced to 1 on
  /// [`RuntimeFlavor::CurrentThread`]. Validation clamps it to
  /// `2..=max_async_runtime_worker_threads()`, so MultiThread always has at
  /// least two lanes.
  ///
  /// The scheduler NEVER probes the CPU count on a wasm target, because there
  /// is nothing truthful to probe: `std::thread::available_parallelism()`
  /// answers `Ok(1)` on `wasm32-wasip1-threads`, so the default lands on the
  /// clamped minimum of two. The host has the real number
  /// (`os.availableParallelism()` in Node, `navigator.hardwareConcurrency` in
  /// a browser) and must pass it through [`configure`] or
  /// [`configure_partial`] before the first async call.
  ///
  /// Peak thread count is `worker_threads + 1`: [`sleep_until`] lazily spawns
  /// one non-Rayon timekeeper thread on the first timer registration. Under
  /// `wasm32-wasip1-threads` each of those is a Node Worker, so budget for
  /// `worker_threads + 1` of them, not `worker_threads`.
  pub worker_threads: usize,
  pub max_blocking_tasks: usize,
  pub thread_name_prefix: String,
  /// Deadline-based `block_on` deadlock detection: bounds how long a
  /// runtime-owned park (the CurrentThread `block_on` parker and
  /// MultiThread COOPERATIVE driver parks -- never the foreign/napi
  /// whole-build park) may sleep with ZERO runtime progress before
  /// panicking with the typed [`BlockOnDeadlock`] diagnostic. `None` (the
  /// default) disables deadline detection: a legitimately long park (e.g.
  /// awaiting a slow JS plugin) must never panic a production build. The
  /// runtime itself never reads the environment; the embedder resolves its
  /// own configuration (conventionally a [`PARK_DEADLINE_ENV`]-style
  /// variable) into this field at addon load. The
  /// threadless-wasm CERTAIN deadlock check is independent of this knob and
  /// always on.
  pub park_deadline: Option<Duration>,
  /// MultiThread drainer idle-linger budget (see `MultiThreadExecutor::drain`):
  /// after running the runnable/blocking queues empty a drainer parks on its
  /// own parker for up to this long before returning its thread to rayon, so
  /// a wave landing within the budget resumes it with one targeted wake
  /// instead of a `spawn_fifo` respawn through rayon's idle protocol.
  /// `Duration::ZERO` disables lingering (legacy exit-and-respawn on every
  /// empty queue). Validation clamps the budget to
  /// [`MAX_DRAIN_LINGER_MICROS`]: a linger occupies a pool worker and an
  /// `active_drainers` slot while idle, so an unbounded value would pin
  /// workers indefinitely. As with `park_deadline`, the runtime itself never
  /// reads the environment; the embedder resolves its configuration
  /// (conventionally [`DRAIN_LINGER_ENV`], which the napi adapter's `install`
  /// resolves for hosts that use it) into this field at addon load. Ignored
  /// by the CurrentThread flavor, which has no pool drainers.
  pub drain_linger: Duration,
}

/// A partial update to the runtime options exposed by the binding.
///
/// [`configure_partial`] merges these fields into the latest configured
/// options, validates the merged candidate, and commits it while holding the
/// runtime controller lock. Fields that are not exposed for partial updates,
/// such as `thread_name_prefix` and `park_deadline`, remain unchanged.
#[derive(Debug, Clone, Copy, Default)]
pub struct RuntimeOptionsPatch {
  pub flavor: Option<RuntimeFlavor>,
  pub worker_threads: Option<usize>,
  pub max_blocking_tasks: Option<usize>,
  /// `Some(Duration::ZERO)` disables lingering; other values are clamped to
  /// [`MAX_DRAIN_LINGER_MICROS`] by validation.
  pub drain_linger: Option<Duration>,
}

impl RuntimeOptionsPatch {
  fn apply_to(self, options: &mut RuntimeOptions) {
    if let Some(flavor) = self.flavor {
      options.flavor = flavor;
    }
    if let Some(worker_threads) = self.worker_threads {
      options.worker_threads = worker_threads;
    }
    if let Some(max_blocking_tasks) = self.max_blocking_tasks {
      options.max_blocking_tasks = max_blocking_tasks;
    }
    if let Some(drain_linger) = self.drain_linger {
      options.drain_linger = drain_linger;
    }
  }
}

impl Default for RuntimeOptions {
  fn default() -> Self {
    let worker_threads = std::thread::available_parallelism()
      .map_or(1, usize::from)
      .min(MAX_ASYNC_RUNTIME_WORKER_THREADS);
    Self {
      flavor: if cfg!(target_family = "wasm") {
        RuntimeFlavor::CurrentThread
      } else {
        RuntimeFlavor::MultiThread
      },
      worker_threads,
      max_blocking_tasks: worker_threads,
      thread_name_prefix: "napi-async-runtime".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
  }
}

impl RuntimeOptions {
  fn validate(self) -> Result<Self, RuntimeConfigError> {
    #[cfg(not(napi_runtime_os_threads))]
    let rayon_max_threads = None;
    #[cfg(napi_runtime_os_threads)]
    let rayon_max_threads = Some(crate::max_async_runtime_worker_threads());
    self.validate_with_rayon_max_threads(rayon_max_threads)
  }

  fn validate_with_rayon_max_threads(
    mut self,
    rayon_max_threads: Option<usize>,
  ) -> Result<Self, RuntimeConfigError> {
    if self.worker_threads == 0 {
      return Err(RuntimeConfigError(
        "worker_threads must be greater than zero".to_string(),
      ));
    }
    if self.max_blocking_tasks == 0 {
      return Err(RuntimeConfigError(
        "max_blocking_tasks must be greater than zero".to_string(),
      ));
    }
    // A lingering drainer occupies a pool worker and an `active_drainers`
    // slot while idle, so an unbounded budget (e.g. an env typo resolving to
    // u64::MAX microseconds) would pin workers indefinitely and wedge every
    // idle-wait. Clamp instead of erroring: like the thread-count clamps
    // below, an out-of-range value is a tuning excess, not a topology error.
    // ZERO passes through unchanged and means "lingering disabled".
    self.drain_linger = self.drain_linger.min(MAX_DRAIN_LINGER);
    if self.flavor == RuntimeFlavor::CurrentThread {
      self.worker_threads = 1;
      self.max_blocking_tasks = 1;
    } else {
      let Some(rayon_max_threads) = rayon_max_threads else {
        return Err(RuntimeConfigError(
          "the multi-thread runtime is unavailable in this threadless WebAssembly build \
           (wasm32-wasip1 / wasm32-unknown-unknown); build for wasm32-wasip1-threads to use it"
            .to_string(),
        ));
      };
      if rayon_max_threads < 2 {
        return Err(RuntimeConfigError(
          "Rayon must support at least two worker threads for the multi-thread runtime".to_string(),
        ));
      }
      // Blocking closures execute on the shared Rayon pool. Keep one execution
      // lane available for runnable futures and timer service even when every
      // admitted blocking job is stalled. MultiThread therefore has a truthful
      // minimum of two physical/configured workers rather than a hidden reserve.
      // Apply both this crate's production ceiling and Rayon's platform cap
      // before deriving the blocking allowance, so a silently reduced physical
      // pool cannot consume that reserved lane.
      self.worker_threads = self
        .worker_threads
        .clamp(2, MAX_ASYNC_RUNTIME_WORKER_THREADS)
        .min(rayon_max_threads);
      let blocking_capacity = self.worker_threads - 1;
      self.max_blocking_tasks = self.max_blocking_tasks.min(blocking_capacity);
    }
    Ok(self)
  }
}

/// Environment variable that arms deadline-based `block_on` deadlock
/// detection: milliseconds a runtime-owned park may sleep with zero runtime
/// progress before panicking (see [`RuntimeOptions::park_deadline`]).
/// Missing, non-numeric or `0` all mean "disabled". The runtime does NOT
/// read this variable itself: the embedding host's env-resolution parses it
/// once at addon load and hands the result to [`configure`] through
/// [`RuntimeOptions::park_deadline`]. The name is the conventional default;
/// hosts may resolve their own variable into the same field.
pub const PARK_DEADLINE_ENV: &str = "NAPI_RUNTIME_PARK_DEADLINE_MS";

/// Environment variable overriding the MultiThread drainer idle-linger budget
/// in MICROSECONDS ([`RuntimeOptions::drain_linger`], consumed by
/// `MultiThreadExecutor::drain`). After a drainer runs the runnable/blocking
/// queues empty it parks on its own [`DriverParker`] (registered with
/// `parked_drivers`) for up to this long before returning its thread to
/// rayon. A wave of work arriving within the budget is resumed by ONE
/// targeted condvar wake instead of a `spawn_fifo` respawn through rayon's
/// idle protocol -- whose per-transition cost (a wake cascade plus 33
/// `sched_yield` rounds and a full steal sweep on EVERY worker that was
/// woken) is what makes system CPU scale with the worker count under
/// wave-shaped loads. `0` disables lingering (legacy exit-and-respawn on
/// every empty queue); values above [`MAX_DRAIN_LINGER_MICROS`] are clamped.
/// A frame's TOTAL lingering residence is additionally capped at
/// [`DRAIN_LINGER_FRAME_FACTOR`] times this budget so periodic sub-budget
/// work cannot pin a rayon worker inside one drain frame forever.
///
/// Like [`PARK_DEADLINE_ENV`], the runtime does NOT read this variable
/// itself: it is resolved once at addon load into
/// [`RuntimeOptions::drain_linger`] -- by the napi adapter's `install` (via
/// `resolve_drain_linger`) for hosts that use it, while hosts owning their
/// own env resolution may resolve their own variable into the same field. A
/// present-but-non-numeric value keeps the host-provided field (which
/// defaults to [`DEFAULT_DRAIN_LINGER_MICROS`]).
pub const DRAIN_LINGER_ENV: &str = "NAPI_RUNTIME_DRAIN_LINGER_US";

/// Default drainer idle-linger budget (µs): [`RuntimeOptions::drain_linger`]'s
/// default, applied when no host configuration or [`DRAIN_LINGER_ENV`]
/// override resolves a different value.
pub const DEFAULT_DRAIN_LINGER_MICROS: u64 = 500;

/// Ceiling on [`RuntimeOptions::drain_linger`] in MICROSECONDS (100ms).
/// Validation (and, defensively, executor construction) clamps the budget
/// here: lingering exists to bridge micro-scale gaps between scheduling
/// waves, and a lingering drainer holds a pool worker plus an
/// `active_drainers` slot while idle, so budgets beyond this bound stop
/// tuning the wave optimization and start pinning workers.
pub const MAX_DRAIN_LINGER_MICROS: u64 = 100_000;

/// [`DEFAULT_DRAIN_LINGER_MICROS`] as a `Duration`.
const DEFAULT_DRAIN_LINGER: Duration = Duration::from_micros(DEFAULT_DRAIN_LINGER_MICROS);

/// [`MAX_DRAIN_LINGER_MICROS`] as a `Duration`.
const MAX_DRAIN_LINGER: Duration = Duration::from_micros(MAX_DRAIN_LINGER_MICROS);

/// Bound on a single drain frame's TOTAL lingering residence, as a multiple
/// of the per-episode idle budget (default 16 x 500us = 8ms). The per-episode
/// deadline alone does NOT bound how long a drain frame occupies its rayon
/// worker: every executed work unit re-arms it, so periodic sub-budget work
/// (e.g. a timer publishing one short task every <500us) would keep the frame
/// resident FOREVER -- and a raw rayon job spawned onto the pool (which only
/// a worker that returned to rayon's scheduler can run) would starve behind
/// it indefinitely. Once cumulative residence past the frame's FIRST idle
/// observation reaches this bound, the drainer exits through the unchanged
/// `finish_draining` path even though more sub-budget work may be arriving;
/// the exit-and-respawn through rayon's queue is exactly the interleaving
/// point that lets pending raw rayon work (par_iter splits, `pool.spawn`
/// jobs) take the worker before the re-armed FIFO drain.
#[cfg(napi_runtime_os_threads)]
const DRAIN_LINGER_FRAME_FACTOR: u32 = 16;

/// Ceiling on the frame residence bound so an absurd [`DRAIN_LINGER_ENV`]
/// value cannot arm a deadline beyond the platform's representable range.
#[cfg(napi_runtime_os_threads)]
const MAX_DRAIN_LINGER_FRAME_RESIDENCE: Duration = Duration::from_secs(60);

/// True on builds where no second thread can EVER deliver a wake to a parked
/// `block_on`: every wasm build except the threaded WASI target (i.e. the
/// single-thread `wasm32-wasip1` build and `wasm32-unknown-unknown`). On such
/// a build a CurrentThread park decision with an empty queue and no pending
/// wake token is a PROVABLE deadlock. The threaded wasi build
/// (`wasm32-wasip1-threads`) has real OS threads, so its parks are not
/// provably dead and fall under the optional deadline detection instead, like
/// native builds.
///
/// `napi_runtime_wasi_threads` is emitted by this crate's build.rs for the exact
/// `wasm32-wasip1-threads` cargo TARGET. It is NOT derivable from built-in
/// cfgs: on current rustc the two WASI targets expose identical cfg sets --
/// `cfg!(target_feature = "atomics")` is false even on the threads target
/// (verified empirically; embedders needing the same discrimination use the
/// same build.rs mechanism).
const THREADLESS_BUILD: bool = cfg!(all(target_family = "wasm", not(napi_runtime_wasi_threads)));

/// Threaded WASI: refresh this thread's view of the shared memory size where
/// work that another thread built starts or resumes on it. A no-op on every
/// other target.
///
/// V8 updates a shared wasm memory's size only on the thread that grew it.
/// The other threads keep checking `memory.fill`, `memory.copy` and atomics
/// (and, without V8's trap handler, every load and store) against their old
/// size, so they trap on pages another thread grew. napi's allocator
/// wrappers refresh under their lock, which covers a block the thread
/// allocates itself, but not one handed over from another thread: a task
/// that allocated on one worker and resumes on another, or a blocking
/// closure whose captures the submitter built. The receiving thread may fill
/// or copy into that memory without allocating first. So this runs at every
/// handoff:
///
/// - before each `Runnable::run`, in both flavors: every task poll, and
///   async-task's header atomics, which run before the future's own `poll`;
/// - before each `block_on` poll (CurrentThread, and MultiThread's parking
///   and cooperative loops): the caller parks between polls while other
///   threads grow the memory and finish the awaited work;
/// - at the start of `RegisteredBlockingFunction::run`: every queued
///   blocking closure, in both flavors;
/// - before the CurrentThread inline blocking closure. It runs on the
///   submitting thread, so there is no handoff, but that thread may be
///   behind all the same.
///
/// The check is one atomic load and one thread-local load, and it calls
/// `memory.grow(0)` only when another thread has seen a larger memory
/// (`napi_sys::wasi_heap_sync::refresh_if_behind`, which also counts those
/// refreshes). The state lives in napi-sys because napi's allocator writes it
/// and napi cannot depend on this crate (a cargo cycle through the default
/// `napi` feature). There is no public API: hosts get the refresh by running
/// work on this scheduler.
#[cfg(napi_runtime_wasi_threads)]
#[inline(always)]
fn on_thread_handoff() {
  napi_sys::wasi_heap_sync::refresh_if_behind();
}

/// See the threaded-WASI version above; nothing to refresh here.
#[cfg(not(napi_runtime_wasi_threads))]
#[inline(always)]
fn on_thread_handoff() {}

#[derive(Debug, Clone)]
pub struct RuntimeConfigError(String);

impl fmt::Display for RuntimeConfigError {
  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
    f.write_str(&self.0)
  }
}

impl std::error::Error for RuntimeConfigError {}

/// Which self-detected `block_on` deadlock class fired.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum BlockOnDeadlockKind {
  /// CurrentThread on a threadless build: the park decision found an empty
  /// queue and no pending wake token, and no other thread exists that could
  /// ever deliver one -- a PROVABLE deadlock, detected unconditionally (not
  /// timing-based).
  CurrentThreadCertain,
  /// [`Self::CurrentThreadCertain`] detected while a HOST timer was pending.
  /// The timer does not make the park any less dead on a threadless build:
  /// its host callback (the JS `setTimeout` relay) can only run on the very
  /// thread that is about to park, so it can never fire while `block_on`
  /// holds that thread. A distinct kind only so the diagnostic can name the
  /// shape the user actually hit.
  CurrentThreadCertainTimerBacked,
  /// Threaded CurrentThread: a `block_on` park outlived the configured
  /// deadline with zero runtime progress.
  CurrentThreadDeadline,
  /// MultiThread: a cooperative pool driver's re-entrant `block_on` park
  /// outlived the configured deadline with zero executor progress. The
  /// foreign/napi whole-build park is exempt by design.
  MultiThreadCooperativeDeadline,
}

/// Typed panic payload for a self-detected `block_on` deadlock. Thrown with
/// `std::panic::panic_any` at the park DECISION (never merely on a `Pending`
/// return, because a self-waking future is not a deadlock), so the
/// runtime fails loudly instead of freezing the thread (and, in the
/// CurrentThread-on-JS-thread case, the whole JS event loop, where not even
/// test-harness timeouts can fire). When the panic unwinds out of a spawned
/// task's poll, `JoinError::from_panic` preserves this diagnostic's message.
#[derive(Debug, Clone)]
pub struct BlockOnDeadlock {
  pub kind: BlockOnDeadlockKind,
  /// The armed deadline for the deadline-based kinds; `None` for the provable
  /// threadless case.
  pub park_deadline: Option<Duration>,
}

impl BlockOnDeadlock {
  fn current_thread_certain() -> Self {
    Self {
      kind: BlockOnDeadlockKind::CurrentThreadCertain,
      park_deadline: None,
    }
  }

  fn current_thread_certain_timer_backed() -> Self {
    Self {
      kind: BlockOnDeadlockKind::CurrentThreadCertainTimerBacked,
      park_deadline: None,
    }
  }

  fn current_thread_deadline(deadline: Duration) -> Self {
    Self {
      kind: BlockOnDeadlockKind::CurrentThreadDeadline,
      park_deadline: Some(deadline),
    }
  }

  // The MultiThread executor (and thus this constructor's caller) does not
  // exist on wasm builds.
  #[cfg(napi_runtime_os_threads)]
  fn multi_thread_cooperative(deadline: Duration) -> Self {
    Self {
      kind: BlockOnDeadlockKind::MultiThreadCooperativeDeadline,
      park_deadline: Some(deadline),
    }
  }
}

impl fmt::Display for BlockOnDeadlock {
  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
    let deadline_ms = self
      .park_deadline
      .map_or(0, |deadline| deadline.as_millis());
    match self.kind {
      BlockOnDeadlockKind::CurrentThreadCertain => f.write_str(
        "provable async-runtime deadlock: `block_on` on the CurrentThread flavor is about to \
         park with an empty task queue and no pending wake on a threadless build -- no other \
         thread exists that could ever deliver the wake, so this park would never end. This is \
         the block_on-awaiting-JS hazard: native code called `block_on` on a future that \
         (transitively) awaits a JS continuation (e.g. a threadsafe-function callback, like the \
         dynamic-import-vars plugin's `resolver`), but the only thread that could run that \
         continuation is the one now parking.",
      ),
      BlockOnDeadlockKind::CurrentThreadCertainTimerBacked => f.write_str(
        "provable async-runtime deadlock: `block_on` on the CurrentThread flavor is about to \
         park with an empty task queue on a threadless build while a host timer is pending. \
         The pending timer is no rescue: its host callback (the JS `setTimeout` relay) can \
         only run on the very thread that is now parking, so it can never fire, and no other \
         thread exists that could ever deliver a wake. This is the block_on-awaiting-JS \
         hazard: native code called `block_on` on a future that (transitively) awaits a JS \
         continuation, but the only thread that could run that continuation is the one now \
         parking.",
      ),
      BlockOnDeadlockKind::CurrentThreadDeadline => write!(
        f,
        "suspected async-runtime deadlock: `block_on` on the CurrentThread flavor parked for \
         {deadline_ms}ms (the host-configured park deadline / RuntimeOptions::park_deadline) with an empty \
         task queue, no pending wake and ZERO runtime progress across the whole window. This is \
         the signature of the block_on-awaiting-JS hazard: a `block_on` on the JS thread \
         awaiting a JS continuation (e.g. a threadsafe-function callback) that can only run \
         once this thread returns to the event loop. If this park is legitimate, raise or unset \
         the deadline.",
      ),
      BlockOnDeadlockKind::MultiThreadCooperativeDeadline => write!(
        f,
        "suspected async-runtime deadlock: a cooperative pool driver's re-entrant `block_on` \
         parked for {deadline_ms}ms (the host-configured park deadline / RuntimeOptions::park_deadline) with \
         no runnable or blocking work available and ZERO executor progress across the whole \
         window -- the awaited future's wake (often a JS continuation) can no longer arrive. \
         The foreign-thread whole-build `block_on` park is exempt from this deadline by design. \
         If this park is legitimate, raise or unset the deadline.",
      ),
    }
  }
}

impl std::error::Error for BlockOnDeadlock {}

#[derive(Debug)]
pub struct JoinError {
  message: String,
}

impl JoinError {
  fn from_panic(panic: &(dyn Any + Send + 'static)) -> Self {
    Self {
      // The typed deadlock diagnostic first: a deadline firing inside a
      // spawned task's poll unwinds into the spawn wrapper's catch_unwind and
      // surfaces here -- the diagnostic text must survive the trip.
      message: if let Some(deadlock) = panic.downcast_ref::<BlockOnDeadlock>() {
        deadlock.to_string()
      } else if let Some(message) = panic.downcast_ref::<&str>() {
        (*message).to_string()
      } else if let Some(message) = panic.downcast_ref::<String>() {
        message.clone()
      } else {
        "async runtime task panicked".to_string()
      },
    }
  }
}

impl fmt::Display for JoinError {
  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
    f.write_str(&self.message)
  }
}

impl std::error::Error for JoinError {}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum BlockOnOutcome {
  Completed,
  Stopped,
}

fn discard_panic_payload(payload: Box<dyn Any + Send + 'static>) {
  // The original unwind is already caught, so ordinary payloads should be
  // destroyed normally. A hostile payload destructor can panic again; catch
  // that nested unwind and leak only its new payload, whose destructor is
  // likewise untrusted.
  if let Err(nested_payload) = catch_unwind(AssertUnwindSafe(|| drop(payload))) {
    std::mem::forget(nested_payload);
  }
}

#[derive(Default)]
struct RetainedPanicPayload(Option<Box<dyn Any + Send + 'static>>);

impl RetainedPanicPayload {
  fn capture(&mut self, payload: Box<dyn Any + Send + 'static>) {
    if self.0.is_some() {
      discard_panic_payload(payload);
    } else {
      self.0 = Some(payload);
    }
  }

  fn is_some(&self) -> bool {
    self.0.is_some()
  }

  fn resume(mut self) -> ! {
    resume_unwind(
      self
        .0
        .take()
        .expect("a retained panic payload must remain owned"),
    )
  }
}

impl Drop for RetainedPanicPayload {
  fn drop(&mut self) {
    if let Some(payload) = self.0.take() {
      discard_panic_payload(payload);
    }
  }
}

fn catch_unwind_contained<T>(function: impl FnOnce() -> T) -> Option<T> {
  match catch_unwind(AssertUnwindSafe(function)) {
    Ok(value) => Some(value),
    Err(payload) => {
      discard_panic_payload(payload);
      None
    }
  }
}

struct ContainedArc<T: ?Sized> {
  value: Option<Arc<T>>,
}

impl<T: ?Sized> ContainedArc<T> {
  fn new(value: Arc<T>) -> Self {
    Self { value: Some(value) }
  }

  fn get(&self) -> &T {
    self
      .value
      .as_deref()
      .expect("the contained Arc must remain owned")
  }

  #[cfg(test)]
  fn into_inner(mut self) -> Arc<T> {
    self
      .value
      .take()
      .expect("the contained Arc must remain owned")
  }
}

impl<T: ?Sized> Drop for ContainedArc<T> {
  fn drop(&mut self) {
    if let Some(value) = self.value.take() {
      let _ = catch_unwind_contained(|| drop(value));
    }
  }
}

struct ContainedArcSnapshot<I: Copy, T: ?Sized> {
  values: Vec<(I, Arc<T>)>,
}

impl<I: Copy, T: ?Sized> ContainedArcSnapshot<I, T> {
  fn new(values: Vec<(I, Arc<T>)>) -> Self {
    Self { values }
  }

  fn as_slice(&self) -> &[(I, Arc<T>)] {
    &self.values
  }

  fn len(&self) -> usize {
    self.values.len()
  }

  fn is_empty(&self) -> bool {
    self.values.is_empty()
  }

  fn pop(&mut self) -> Option<(I, ContainedArc<T>)> {
    self
      .values
      .pop()
      .map(|(id, value)| (id, ContainedArc::new(value)))
  }
}

impl<I: Copy, T: ?Sized> Drop for ContainedArcSnapshot<I, T> {
  fn drop(&mut self) {
    while let Some((_, value)) = self.values.pop() {
      let _ = catch_unwind_contained(|| drop(value));
    }
  }
}

struct PanicContainedWaker {
  waker: ManuallyDrop<Waker>,
  generation: Option<u64>,
}

impl std::task::Wake for PanicContainedWaker {
  fn wake(self: Arc<Self>) {
    let _generation = RuntimeGenerationGuard::enter_optional(self.generation);
    let _ = catch_unwind_contained(|| self.waker.wake_by_ref());
  }

  fn wake_by_ref(self: &Arc<Self>) {
    let _generation = RuntimeGenerationGuard::enter_optional(self.generation);
    let _ = catch_unwind_contained(|| self.waker.wake_by_ref());
  }
}

impl Drop for PanicContainedWaker {
  fn drop(&mut self) {
    let _generation = RuntimeGenerationGuard::enter_optional(self.generation);
    let _ = catch_unwind_contained(|| {
      // SAFETY: this is the sole destruction path for the underlying waker.
      unsafe { ManuallyDrop::drop(&mut self.waker) };
    });
  }
}

fn panic_contained_waker(waker: Waker) -> Waker {
  Waker::from(Arc::new(PanicContainedWaker {
    waker: ManuallyDrop::new(waker),
    generation: active_runtime_generation(),
  }))
}

struct PanicContainedWakerSource {
  waker: ManuallyDrop<Waker>,
  generation: Option<u64>,
}

impl PanicContainedWakerSource {
  fn new(waker: Waker) -> Self {
    Self {
      waker: ManuallyDrop::new(waker),
      generation: active_runtime_generation(),
    }
  }

  fn as_waker(&self) -> &Waker {
    &self.waker
  }
}

impl Drop for PanicContainedWakerSource {
  fn drop(&mut self) {
    let _generation = RuntimeGenerationGuard::enter_optional(self.generation);
    let _ = catch_unwind_contained(|| {
      // SAFETY: this is the sole destruction path for the source waker.
      unsafe { ManuallyDrop::drop(&mut self.waker) };
    });
  }
}

struct PanicContainedWakerCache {
  source: PanicContainedWakerSource,
  contained: Waker,
}

impl PanicContainedWakerCache {
  fn new(waker: &Waker) -> Self {
    let generation = active_runtime_generation();
    let _generation = RuntimeGenerationGuard::enter_optional(generation);
    let source = PanicContainedWakerSource::new(waker.clone());
    let contained = panic_contained_waker(source.as_waker().clone());
    Self { source, contained }
  }

  fn update(&mut self, waker: &Waker) {
    let will_wake = {
      let _generation = RuntimeGenerationGuard::enter_optional(self.source.generation);
      self.source.as_waker().will_wake(waker)
    };
    if !will_wake {
      *self = Self::new(waker);
    }
  }

  fn contained(&self) -> &Waker {
    &self.contained
  }
}

fn wake_waker_contained(waker: Waker) {
  // `Waker::wake` consumes the waker, so a panicking wake followed by a
  // panicking RawWaker destructor would double-panic before the outer catch
  // could regain control. Borrow for the wake and contain destruction
  // separately.
  let _ = catch_unwind_contained(|| waker.wake_by_ref());
  let _ = catch_unwind_contained(|| drop(waker));
}

fn catch_unwind_join_error<T>(function: impl FnOnce() -> T) -> Result<T, JoinError> {
  match catch_unwind(AssertUnwindSafe(function)) {
    Ok(value) => Ok(value),
    Err(payload) => {
      let error = JoinError::from_panic(&*payload);
      discard_panic_payload(payload);
      Err(error)
    }
  }
}

fn panic_payload_to_join_error(payload: Box<dyn Any + Send + 'static>) -> JoinError {
  let error = JoinError::from_panic(&*payload);
  discard_panic_payload(payload);
  error
}

struct ContainedTaskOutput<T> {
  output: ManuallyDrop<T>,
  generation: u64,
}

impl<T> ContainedTaskOutput<T> {
  fn new(output: T, generation: u64) -> Self {
    Self {
      output: ManuallyDrop::new(output),
      generation,
    }
  }

  fn into_inner(mut self) -> T {
    // SAFETY: ownership moves to the JoinHandle caller and `self` is then
    // forgotten so its Drop implementation cannot run a second time.
    let output = unsafe { ManuallyDrop::take(&mut self.output) };
    std::mem::forget(self);
    output
  }
}

impl<T> Drop for ContainedTaskOutput<T> {
  fn drop(&mut self) {
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let _ = catch_unwind_contained(|| {
      // SAFETY: this is the sole destruction path while the output remains
      // retained by a JoinHandle.
      unsafe { ManuallyDrop::drop(&mut self.output) };
    });
  }
}

#[cfg(napi_runtime_os_threads)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
struct BlockingJobId(u64);

#[cfg(napi_runtime_os_threads)]
static NEXT_BLOCKING_JOB_ID: AtomicU64 = AtomicU64::new(1);

#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEPENDENCY_CLAIM_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_DISPATCH_CLAIM_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_DISPATCH_PUBLICATION_BLOCKED_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_DISPATCH_RECOVERY_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_FAILED_PUBLICATION_RETIRED_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_DISPATCH_CALL_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_BLOCKING_CLAIM_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static CURRENT_THREAD_RUNNABLE_CLAIM_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static MULTI_THREAD_WORK_CLAIMED_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static MULTI_THREAD_WORK_STARTED_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static DEPENDENCY_PREDICATE_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
  static BEFORE_OWNED_BLOCKING_QUEUE_CLAIM_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
  static WORKER_TLS_DROP_PROBE: std::cell::RefCell<Option<WorkerTlsDropProbe>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
struct WorkerTlsDropProbe {
  action: Option<WorkerTlsDropAction>,
}

// LOADER-LOCK RULE for every probe action below: TLS destructors run at
// thread exit -- on Windows inside `LdrShutdownThread`, which HOLDS the
// process loader lock while walking TLS callbacks. Any cross-thread wait
// here (condvar, channel recv, barrier, joining a thread) therefore freezes
// every other `thread::spawn` and thread-exit in the process -- and, with
// RUST_BACKTRACE=1, even panic reporting (dbghelp loads DLLs under the same
// lock). A previous `Wait { entered, release }` action parked the FIRST
// exiting worker's destructor on a condvar; the SECOND worker then could not
// even enter its destructor (loader lock), the release condition (both
// entered) became unsatisfiable, and the whole test suite went silent until
// the CI step timeout (Windows x64 jobs, runs 29195160953 / 86662331487).
// Destructor actions may only RECORD (atomic stores, non-blocking sends);
// ordering invariants are asserted from OUTSIDE, after `shutdown()` returns.
#[cfg(all(test, napi_runtime_os_threads))]
// `ReenterLifecycle`'s only constructor re-execs the test binary, which WASI
// cannot do, so on wasm the variant is declared but never built.
#[cfg_attr(target_family = "wasm", allow(dead_code))]
enum WorkerTlsDropAction {
  /// Record-only: bump the shared counter so the harness can assert -- the
  /// instant `shutdown()` returns -- that every worker TLS destructor had
  /// already completed (the join barrier includes destructor completion).
  Record { completed: Arc<AtomicUsize> },
  ReenterLifecycle {
    controller: Arc<RuntimeController>,
    completed: std::sync::mpsc::Sender<(Result<(), String>, Result<(), String>)>,
  },
}

#[cfg(all(test, napi_runtime_os_threads))]
impl Drop for WorkerTlsDropProbe {
  fn drop(&mut self) {
    match self
      .action
      .take()
      .expect("worker TLS drop probe action already consumed")
    {
      WorkerTlsDropAction::Record { completed } => {
        completed.fetch_add(1, Ordering::SeqCst);
      }
      // Both lifecycle re-entries FAIL FAST from a stopping-generation worker
      // (short state-mutex acquisitions, no cross-thread wait), and the send
      // is non-blocking -- loader-lock safe. The owning test additionally
      // isolates itself in a watchdogged subprocess.
      WorkerTlsDropAction::ReenterLifecycle {
        controller,
        completed,
      } => {
        let start = controller.start().map_err(|error| error.to_string());
        let shutdown = controller.shutdown().map_err(|error| error.to_string());
        let _ = completed.send((start, shutdown));
      }
    }
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_dependency_claim_test_hook() {
  if let Some(hook) = DEPENDENCY_CLAIM_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_dispatch_claim_test_hook() {
  if let Some(hook) = CURRENT_THREAD_DISPATCH_CLAIM_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_dispatch_publication_blocked_test_hook() {
  if let Some(hook) =
    CURRENT_THREAD_DISPATCH_PUBLICATION_BLOCKED_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_dispatch_recovery_test_hook() {
  if let Some(hook) =
    CURRENT_THREAD_DISPATCH_RECOVERY_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_failed_publication_retired_test_hook() {
  if let Some(hook) =
    CURRENT_THREAD_FAILED_PUBLICATION_RETIRED_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_dispatch_call_test_hook() {
  if let Some(hook) = CURRENT_THREAD_DISPATCH_CALL_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_dispatch_returned_test_hook() {
  if let Some(hook) =
    CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_blocking_claim_test_hook() {
  if let Some(hook) = CURRENT_THREAD_BLOCKING_CLAIM_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_current_thread_runnable_claim_test_hook() {
  if let Some(hook) = CURRENT_THREAD_RUNNABLE_CLAIM_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_multi_thread_work_claimed_test_hook() {
  if let Some(hook) = MULTI_THREAD_WORK_CLAIMED_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_multi_thread_work_started_test_hook() {
  if let Some(hook) = MULTI_THREAD_WORK_STARTED_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_dependency_predicate_test_hook() {
  if let Some(hook) = DEPENDENCY_PREDICATE_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_before_owned_blocking_queue_claim_test_hook() {
  if let Some(hook) =
    BEFORE_OWNED_BLOCKING_QUEUE_CLAIM_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(napi_runtime_os_threads)]
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
struct BlockingDependency {
  job: BlockingJobId,
  owner: Option<BlockingOwnerToken>,
}

#[cfg(napi_runtime_os_threads)]
#[derive(Debug)]
struct DependencyClaim {
  claimed: AtomicBool,
  transition: Mutex<()>,
}

#[cfg(napi_runtime_os_threads)]
impl DependencyClaim {
  fn new() -> Self {
    Self {
      claimed: AtomicBool::new(false),
      transition: Mutex::new(()),
    }
  }

  fn is_live(&self) -> bool {
    !self.claimed.load(Ordering::Acquire)
  }

  fn cancel_link(&self, link: &DependencyLink) {
    let _transition = self
      .transition
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    link.cancel();
  }

  fn try_claim(&self, link: &DependencyLink) -> bool {
    let _transition = self
      .transition
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    #[cfg(test)]
    run_dependency_claim_test_hook();
    if self.claimed.load(Ordering::Acquire) || !link.is_live() {
      return false;
    }
    self.claimed.store(true, Ordering::Release);
    true
  }
}

#[cfg(napi_runtime_os_threads)]
#[derive(Debug)]
struct DependencyLink {
  live: AtomicBool,
  parent: Option<Weak<DependencyLink>>,
}

#[cfg(napi_runtime_os_threads)]
impl DependencyLink {
  fn root() -> Arc<Self> {
    Arc::new(Self {
      live: AtomicBool::new(true),
      parent: None,
    })
  }

  fn derived(parent: &Arc<Self>) -> Arc<Self> {
    Arc::new(Self {
      live: AtomicBool::new(true),
      parent: Some(Arc::downgrade(parent)),
    })
  }

  fn is_live(&self) -> bool {
    if !self.live.load(Ordering::Acquire) {
      return false;
    }
    let Some(parent) = &self.parent else {
      return true;
    };
    let Some(mut current) = parent.upgrade() else {
      return false;
    };
    loop {
      if !current.live.load(Ordering::Acquire) {
        return false;
      }
      let Some(parent) = &current.parent else {
        return true;
      };
      let Some(next) = parent.upgrade() else {
        return false;
      };
      current = next;
    }
  }

  fn cancel(&self) {
    self.live.store(false, Ordering::Release);
  }
}

#[cfg(napi_runtime_os_threads)]
#[derive(Clone, Copy, PartialEq, Eq, Hash)]
struct DependencyPublicationIdentity {
  job: BlockingJobId,
  claim: *const DependencyClaim,
  link: *const DependencyLink,
}

#[cfg(napi_runtime_os_threads)]
#[derive(Clone, Debug)]
struct DependencyPublication {
  dependency: BlockingDependency,
  claim: Arc<DependencyClaim>,
  link: Arc<DependencyLink>,
}

#[cfg(napi_runtime_os_threads)]
impl DependencyPublication {
  fn owned(dependency: BlockingDependency) -> Self {
    Self {
      dependency,
      claim: Arc::new(DependencyClaim::new()),
      link: DependencyLink::root(),
    }
  }

  fn derived(&self, owner: Option<BlockingOwnerToken>) -> Self {
    Self {
      dependency: BlockingDependency {
        owner: self.dependency.owner.or(owner),
        ..self.dependency
      },
      claim: Arc::clone(&self.claim),
      link: DependencyLink::derived(&self.link),
    }
  }

  fn with_owner_if_none(mut self, owner: Option<BlockingOwnerToken>) -> Self {
    self.dependency.owner = self.dependency.owner.or(owner);
    self
  }

  fn same_as(&self, other: &Self) -> bool {
    self.dependency == other.dependency
      && Arc::ptr_eq(&self.claim, &other.claim)
      && Arc::ptr_eq(&self.link, &other.link)
  }

  fn identity(&self) -> DependencyPublicationIdentity {
    DependencyPublicationIdentity {
      job: self.dependency.job,
      claim: Arc::as_ptr(&self.claim),
      link: Arc::as_ptr(&self.link),
    }
  }

  fn immediate_source_identity(&self) -> Option<DependencyPublicationIdentity> {
    Some(DependencyPublicationIdentity {
      job: self.dependency.job,
      claim: Arc::as_ptr(&self.claim),
      link: self.link.parent.as_ref()?.as_ptr(),
    })
  }

  fn is_derived_from(&self, source: &Self) -> bool {
    self.immediate_source_identity() == Some(source.identity())
  }

  fn is_live(&self) -> bool {
    self.claim.is_live() && self.link.is_live()
  }

  fn cancel(&self) {
    self.claim.cancel_link(&self.link);
  }

  fn try_claim(&self) -> bool {
    self.claim.try_claim(&self.link)
  }
}

#[cfg(napi_runtime_os_threads)]
struct TaskDependencyEntry {
  sequence: u64,
  publication: DependencyPublication,
}

#[cfg(napi_runtime_os_threads)]
struct SelectedDependencyPublication {
  sequence: u64,
  publication: DependencyPublication,
}

#[cfg(napi_runtime_os_threads)]
#[derive(Clone, Copy)]
enum OwnerDependencyMode {
  Available,
  Exact,
}

#[cfg(napi_runtime_os_threads)]
#[derive(Default)]
struct TaskDependencyState {
  current: VecDeque<TaskDependencyEntry>,
  next_sequence: u64,
  unowned_sequences: VecDeque<u64>,
  owner_sequences: FxHashMap<BlockingOwnerToken, VecDeque<u64>>,
  // NOTE: there is deliberately no `job_sequences` index. It used to be a
  // `FxHashMap<BlockingJobId, FxHashSet<u64>>` costing TWO heap allocations
  // per blocking dispatch (the map's table plus an inner set that almost
  // always held exactly one sequence). Its only job was to let a dropped
  // blocking `JoinHandle` find the entry it had published, and the handle can
  // simply remember the `sequence` `append` gave it: `current` is positionally
  // indexed by sequence via `entry_in`, so the handle retires its own entry in
  // O(1) with no map, no hash, and no scan. `next_sequence` never rewinds, so
  // a remembered sequence can never alias a later entry.
  waiter: Option<Waker>,
}

#[cfg(napi_runtime_os_threads)]
impl TaskDependencyState {
  /// Publish `publication` and return the sequence it was filed under, so the
  /// publisher can retire exactly this entry later in O(1).
  fn append(&mut self, publication: DependencyPublication) -> u64 {
    let sequence = self.next_sequence;
    self.next_sequence = self
      .next_sequence
      .checked_add(1)
      .expect("task dependency sequence space exhausted");
    match publication.dependency.owner {
      Some(owner) => self
        .owner_sequences
        .entry(owner)
        .or_default()
        .push_back(sequence),
      None => self.unowned_sequences.push_back(sequence),
    }
    self.current.push_back(TaskDependencyEntry {
      sequence,
      publication,
    });
    sequence
  }

  fn entry_in(
    current: &VecDeque<TaskDependencyEntry>,
    sequence: u64,
  ) -> Option<&TaskDependencyEntry> {
    let front = current.front()?.sequence;
    let index = usize::try_from(sequence.checked_sub(front)?).ok()?;
    let entry = current.get(index)?;
    (entry.sequence == sequence).then_some(entry)
  }

  fn entry(&self, sequence: u64) -> Option<&TaskDependencyEntry> {
    Self::entry_in(&self.current, sequence)
  }

  fn entry_mut(&mut self, sequence: u64) -> Option<&mut TaskDependencyEntry> {
    let front = self.current.front()?.sequence;
    let index = usize::try_from(sequence.checked_sub(front)?).ok()?;
    let entry = self.current.get_mut(index)?;
    (entry.sequence == sequence).then_some(entry)
  }

  fn remove_sequence_indexes(&mut self, sequence: u64, dependency: BlockingDependency) {
    match dependency.owner {
      Some(owner) => {
        let remove_owner = self
          .owner_sequences
          .get_mut(&owner)
          .is_some_and(|sequences| {
            if sequences.front() == Some(&sequence) {
              sequences.pop_front();
            }
            sequences.is_empty()
          });
        if remove_owner {
          self.owner_sequences.remove(&owner);
        }
      }
      None => {
        if self.unowned_sequences.front() == Some(&sequence) {
          self.unowned_sequences.pop_front();
        }
      }
    }
  }

  fn clear_indexes(&mut self) {
    self.unowned_sequences.clear();
    self.owner_sequences.clear();
  }
}

#[cfg(napi_runtime_os_threads)]
struct TaskDependency {
  state: Mutex<TaskDependencyState>,
  owner_hint: Option<BlockingOwnerToken>,
  has_current: AtomicBool,
  generation: u64,
  #[cfg(test)]
  entry_visits: AtomicUsize,
}

#[cfg(napi_runtime_os_threads)]
impl Default for TaskDependency {
  fn default() -> Self {
    Self::new(u64::MAX, None)
  }
}

#[cfg(napi_runtime_os_threads)]
impl TaskDependency {
  fn new(generation: u64, owner_hint: Option<BlockingOwnerToken>) -> Self {
    Self {
      state: Mutex::new(TaskDependencyState::default()),
      owner_hint,
      has_current: AtomicBool::new(false),
      generation,
      #[cfg(test)]
      entry_visits: AtomicUsize::new(0),
    }
  }

  fn new_task(generation: u64) -> Self {
    Self::new(generation, None)
  }

  fn notify_waiter(&self, waiter: Option<Waker>) {
    if let Some(waiter) = waiter {
      let _generation = RuntimeGenerationGuard::enter(self.generation);
      wake_waker_contained(waiter);
    }
  }

  fn clear_waiter(&self) {
    let waiter = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .waiter
      .take();
    if let Some(waiter) = waiter {
      let _generation = RuntimeGenerationGuard::enter(self.generation);
      let _ = catch_unwind_contained(|| drop(waiter));
    }
  }

  fn clear(&self) {
    let waiter = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if state.current.is_empty() {
        None
      } else {
        for current in state.current.drain(..) {
          current.publication.cancel();
        }
        state.clear_indexes();
        self.has_current.store(false, Ordering::Release);
        state.waiter.take()
      }
    };
    self.notify_waiter(waiter);
  }

  /// Retire the single entry filed under `sequence`, in O(1).
  ///
  /// This replaces a job-id lookup through a `job_sequences` index. `current`
  /// is positionally indexed by sequence, so the publisher that remembers the
  /// sequence `append` returned can cancel exactly its own entry without a
  /// map and without a scan. `entry_in` re-checks `entry.sequence == sequence`
  /// after the positional lookup and `next_sequence` never rewinds, so a
  /// sequence whose entry has already been drained (`begin_poll`) or pruned
  /// resolves to `None` rather than aliasing a later entry.
  fn retire(&self, sequence: u64) {
    let waiter = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let cancelled = match state.entry_mut(sequence) {
        Some(current) => {
          self.note_entry_visit();
          current.publication.cancel();
          true
        }
        None => false,
      };
      if cancelled {
        self.prune_stale_prefix(&mut state);
        state.waiter.take()
      } else {
        None
      }
    };
    self.notify_waiter(waiter);
  }

  fn clear_if_publications(&self, publications: &[DependencyPublication]) {
    let Some(first_publication) = publications.first() else {
      return;
    };
    let publication_identities = (publications.len() > 1).then(|| {
      publications
        .iter()
        .map(DependencyPublication::identity)
        .collect::<FxHashSet<_>>()
    });
    let waiter = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let removed = state
        .current
        .iter_mut()
        .filter_map(|current| {
          self.note_entry_visit();
          let is_derived = publication_identities.as_ref().map_or_else(
            || current.publication.is_derived_from(first_publication),
            |identities| {
              current
                .publication
                .immediate_source_identity()
                .is_some_and(|identity| identities.contains(&identity))
            },
          );
          if !is_derived {
            return None;
          }
          current.publication.cancel();
          Some(current.sequence)
        })
        .collect::<Vec<_>>();
      // No `job_sequences` index to maintain; the cancelled entries stay in
      // `current` until `prune_stale_prefix` retires them, exactly as before.
      if removed.is_empty() {
        None
      } else {
        self.prune_stale_prefix(&mut state);
        state.waiter.take()
      }
    };
    self.notify_waiter(waiter);
  }

  /// Publish an owned dependency and return the sequence it was filed under,
  /// so the caller can [`retire`](Self::retire) exactly this entry in O(1).
  fn set_owned(&self, dependency: BlockingDependency) -> u64 {
    let publication = DependencyPublication::owned(BlockingDependency {
      owner: dependency.owner.or(self.owner_hint),
      ..dependency
    });
    self.set_entry(publication)
  }

  /// Whether `sequence` still resolves to a LIVE entry in this state.
  ///
  /// A publisher uses this to decide whether its earlier publication still
  /// stands. `false` means the entry was drained by `begin_poll`, pruned, or
  /// cancelled (by a lending claim, say), so a fresh publication is needed.
  fn holds_live(&self, sequence: u64) -> bool {
    let state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    TaskDependencyState::entry_in(&state.current, sequence).is_some_and(|entry| {
      self.note_entry_visit();
      entry.publication.is_live()
    })
  }

  fn set_borrowed(&self, publication: &DependencyPublication) {
    let _sequence = self.set_entry(publication.derived(self.owner_hint));
  }

  fn set_entry(&self, publication: DependencyPublication) -> u64 {
    let (sequence, waiter) = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      // Owned publications and propagated publications both create a fresh
      // local liveness link, so identity cannot already exist in this state.
      let sequence = state.append(publication);
      self.has_current.store(true, Ordering::Release);
      (sequence, state.waiter.take())
    };
    self.notify_waiter(waiter);
    sequence
  }

  fn note_entry_visit(&self) {
    #[cfg(test)]
    self.entry_visits.fetch_add(1, Ordering::Relaxed);
  }

  fn prune_stale_prefix(&self, state: &mut TaskDependencyState) {
    while state.current.front().is_some_and(|current| {
      self.note_entry_visit();
      !current.publication.is_live()
    }) {
      let current = state
        .current
        .pop_front()
        .expect("the stale prefix entry must exist");
      state.remove_sequence_indexes(current.sequence, current.publication.dependency);
    }
    self
      .has_current
      .store(!state.current.is_empty(), Ordering::Release);
  }

  fn first_live_sequence(
    &self,
    current: &VecDeque<TaskDependencyEntry>,
    sequences: &mut VecDeque<u64>,
  ) -> Option<u64> {
    loop {
      let sequence = *sequences.front()?;
      let Some(entry) = TaskDependencyState::entry_in(current, sequence) else {
        sequences.pop_front();
        continue;
      };
      self.note_entry_visit();
      if entry.publication.is_live() {
        return Some(sequence);
      }
      sequences.pop_front();
    }
  }

  fn first_live_owner_sequence(
    &self,
    state: &mut TaskDependencyState,
    owner: BlockingOwnerToken,
  ) -> Option<u64> {
    let sequence = {
      let current = &state.current;
      state
        .owner_sequences
        .get_mut(&owner)
        .and_then(|sequences| self.first_live_sequence(current, sequences))
    };
    if sequence.is_none() {
      state.owner_sequences.remove(&owner);
    }
    sequence
  }

  fn first_live_unowned_sequence(&self, state: &mut TaskDependencyState) -> Option<u64> {
    self.first_live_sequence(&state.current, &mut state.unowned_sequences)
  }

  #[cfg(test)]
  fn get(&self) -> Option<DependencyPublication> {
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .current
      .iter()
      .find(|current| current.publication.is_live())
      .map(|current| current.publication.clone())
  }

  fn snapshot_all_live(&self) -> Vec<DependencyPublication> {
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .current
      .iter()
      .filter(|current| {
        self.note_entry_visit();
        current.publication.is_live()
      })
      .map(|current| current.publication.clone())
      .collect()
  }

  fn select_for_owner(&self, owner: BlockingOwnerToken) -> Option<SelectedDependencyPublication> {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    self.prune_stale_prefix(&mut state);
    let exact_sequence = self.first_live_owner_sequence(&mut state, owner);
    let unowned_sequence = self.first_live_unowned_sequence(&mut state);
    let (sequence, bind_owner) = match (exact_sequence, unowned_sequence) {
      (Some(exact), Some(unowned)) if exact <= unowned => (exact, false),
      (Some(_) | None, Some(unowned)) => (unowned, true),
      (Some(exact), None) => (exact, false),
      (None, None) => return None,
    };
    if bind_owner {
      let removed = state.unowned_sequences.pop_front();
      debug_assert_eq!(removed, Some(sequence));
      let current = state
        .entry_mut(sequence)
        .expect("the selected dependency must remain indexed");
      debug_assert_eq!(current.publication.dependency.owner, None);
      current.publication.dependency.owner = Some(owner);
      // A previous exact-owner query may have observed no entry. Publishing
      // this sequence at the front makes the newly bound dependency visible
      // immediately without restarting a global scan.
      state
        .owner_sequences
        .entry(owner)
        .or_default()
        .push_front(sequence);
    }
    let publication = state
      .entry(sequence)
      .expect("the selected dependency must remain indexed")
      .publication
      .clone();
    Some(SelectedDependencyPublication {
      sequence,
      publication,
    })
  }

  fn has_live_owner_dependency(
    &self,
    owner: BlockingOwnerToken,
    mode: OwnerDependencyMode,
  ) -> bool {
    #[cfg(all(test, napi_runtime_os_threads))]
    run_dependency_predicate_test_hook();
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    self.prune_stale_prefix(&mut state);
    if self.first_live_owner_sequence(&mut state, owner).is_some() {
      return true;
    }
    matches!(mode, OwnerDependencyMode::Available)
      && self.first_live_unowned_sequence(&mut state).is_some()
  }

  #[cfg(test)]
  fn get_dependency(&self) -> Option<BlockingDependency> {
    self.get().map(|publication| publication.dependency)
  }

  #[cfg(test)]
  fn get_dependencies(&self) -> Vec<BlockingDependency> {
    self
      .snapshot_all_live()
      .into_iter()
      .map(|publication| publication.dependency)
      .collect()
  }

  #[cfg(test)]
  fn reset_entry_visits(&self) {
    self.entry_visits.store(0, Ordering::Relaxed);
  }

  #[cfg(test)]
  fn entry_visits(&self) -> usize {
    self.entry_visits.load(Ordering::Relaxed)
  }

  /// Atomically reserve `job` for exact-dependency execution. A dependency
  /// transition that wins this race makes the claim fail, so lending can never
  /// execute a stale job copied from an earlier poll.
  fn try_claim(&self, selected: &SelectedDependencyPublication) -> bool {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let Some(current) = state.entry(selected.sequence) else {
      return false;
    };
    self.note_entry_visit();
    if !current.publication.same_as(&selected.publication) || !selected.publication.try_claim() {
      return false;
    }
    let dependency = current.publication.dependency;
    state
      .entry_mut(selected.sequence)
      .expect("the claimed dependency must remain indexed")
      .publication
      .cancel();
    state.remove_sequence_indexes(selected.sequence, dependency);
    self.prune_stale_prefix(&mut state);
    true
  }

  fn register_waiter_and_get(&self, waker: &Waker) -> Vec<DependencyPublication> {
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let Some(waker) = catch_unwind_contained(|| waker.clone()) else {
      return Vec::new();
    };
    let (previous, unused, current) = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let current = state
        .current
        .iter()
        .filter(|current| current.publication.is_live())
        .map(|current| current.publication.clone())
        .collect();
      if state
        .waiter
        .as_ref()
        .is_some_and(|previous| previous.will_wake(&waker))
      {
        (None, Some(waker), current)
      } else {
        (state.waiter.replace(waker), None, current)
      }
    };
    if let Some(previous) = previous {
      let _ = catch_unwind_contained(|| drop(previous));
    }
    if let Some(unused) = unused {
      let _ = catch_unwind_contained(|| drop(unused));
    }
    current
  }

  fn begin_poll(&self) {
    if !self.has_current.load(Ordering::Acquire) {
      return;
    }
    let waiter = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if state.current.is_empty() {
        self.has_current.store(false, Ordering::Release);
        None
      } else {
        for previous in state.current.drain(..) {
          previous.publication.cancel();
        }
        state.clear_indexes();
        self.has_current.store(false, Ordering::Release);
        state.waiter.take()
      }
    };
    self.notify_waiter(waiter);
  }

  #[cfg(test)]
  fn register_waiter(&self, waker: &Waker) {
    let _ = self.register_waiter_and_get(waker);
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for TaskDependency {
  fn drop(&mut self) {
    let state = self
      .state
      .get_mut()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    for current in state.current.drain(..) {
      current.publication.cancel();
    }
    if let Some(waiter) = state.waiter.take() {
      let _generation = RuntimeGenerationGuard::enter(self.generation);
      let _ = catch_unwind_contained(|| drop(waiter));
    }
  }
}

#[cfg(napi_runtime_os_threads)]
thread_local! {
  static CURRENT_DEPENDENCY_STACK: std::cell::RefCell<Vec<Arc<TaskDependency>>> =
    const { std::cell::RefCell::new(Vec::new()) };
}

#[cfg(napi_runtime_os_threads)]
struct TaskDependencyGuard(Arc<TaskDependency>);

#[cfg(napi_runtime_os_threads)]
impl TaskDependencyGuard {
  fn enter(dependency: &Arc<TaskDependency>) -> Self {
    let dependency = Arc::clone(dependency);
    CURRENT_DEPENDENCY_STACK.with(|stack| stack.borrow_mut().push(Arc::clone(&dependency)));
    Self(dependency)
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for TaskDependencyGuard {
  fn drop(&mut self) {
    CURRENT_DEPENDENCY_STACK.with(|stack| {
      let current = stack
        .borrow_mut()
        .pop()
        .expect("blocking dependency context underflow");
      debug_assert!(Arc::ptr_eq(&current, &self.0));
    });
  }
}

#[cfg(napi_runtime_os_threads)]
struct BlockOnDependencyGuard {
  dependency: Arc<TaskDependency>,
  _context: TaskDependencyGuard,
}

#[cfg(napi_runtime_os_threads)]
impl BlockOnDependencyGuard {
  fn enter(generation: u64) -> Self {
    let owner = BLOCKING_OWNER.with(std::cell::Cell::get);
    let dependency = Arc::new(TaskDependency::new(generation, owner));
    let context = TaskDependencyGuard::enter(&dependency);
    Self {
      dependency,
      _context: context,
    }
  }

  fn clear(&self) {
    self.dependency.clear();
  }
}

/// A dependency this handle published, remembered well enough to retire it in
/// O(1).
///
/// The sequence alone is not enough: sequences are allocated per
/// `TaskDependency`, so applying one to a different state would cancel an
/// unrelated entry. The state's identity therefore travels with it, as a
/// `Weak` rather than a raw pointer so a freed state cannot be impersonated by
/// a later allocation reusing its address -- a `Weak` keeps the allocation
/// itself reserved, so the pointer stays unique even after the state is gone.
///
/// It is deliberately NOT a strong `Arc`: a handle can be polled under many
/// frames over its life, and holding each one alive to remember it would retain
/// one dead `TaskDependency`, with its deque and index maps, per frame the
/// handle has ever seen.
#[cfg(napi_runtime_os_threads)]
struct PublishedBlockingDependency {
  state: Weak<TaskDependency>,
  sequence: u64,
}

/// Every publication a blocking handle has made, one per dependency frame it
/// has been polled under.
///
/// A handle publishes once per Pending poll into whichever frame is on top of
/// `CURRENT_DEPENDENCY_STACK`. Re-polling under a frame it has already
/// published into supersedes that frame's entry, so the common case is exactly
/// one publication and `rest` never allocates.
///
/// Retiring EVERY publication is load-bearing. Dropping a blocking handle
/// detaches rather than dequeues, so any entry left live keeps a job that
/// nobody awaits selectable for owner-lane lending -- and `select_for_owner`
/// picks the LOWEST live sequence, so a forgotten entry outranks dependencies
/// published after it. Lending then runs the detached job inline in the owner's
/// single lane, which deadlocks if that job waits on the dependency it
/// displaced. The job-id index this replaces cancelled every entry for the job
/// in the frame it was called on, so nothing was forgotten; a handle that
/// remembered only its newest publication would forget both a repeat poll in
/// one frame and a poll under a nested frame.
#[cfg(napi_runtime_os_threads)]
#[derive(Default)]
struct PublishedBlockingDependencies {
  first: Option<PublishedBlockingDependency>,
  rest: Vec<PublishedBlockingDependency>,
}

#[cfg(napi_runtime_os_threads)]
impl PublishedBlockingDependency {
  /// Whether this publication is still worth remembering.
  ///
  /// A token stops standing when its frame is gone -- a dropped
  /// `TaskDependency` already cancelled every entry it held -- or when the
  /// frame no longer holds the entry as live, because its `begin_poll` drained
  /// `current`, `prune_stale_prefix` retired it, or a lending claim took it.
  ///
  /// Absence from this thread's dependency stack deliberately does NOT count.
  /// It would bound this list more tightly, but it is not sound: a `JoinHandle`
  /// is `Send + Unpin`, so a safe adapter can serialise one behind a mutex and
  /// poll it from several tasks, and then a frame parked on another thread can
  /// still be awaiting a handle that is being polled here. Retiring on local
  /// absence would take that frame's publication away while it still needs it
  /// for owner-lane lending.
  fn still_stands(&self) -> bool {
    self
      .state
      .upgrade()
      .is_some_and(|state| state.holds_live(self.sequence))
  }
}

#[cfg(napi_runtime_os_threads)]
impl PublishedBlockingDependencies {
  /// Forget publications whose frame is gone.
  ///
  /// A dropped `TaskDependency` cancels every entry it holds, so an expired
  /// token has nothing left to retire. Discarding it here is what keeps this
  /// list at the handle's currently-live frame count rather than the total
  /// number of frames it has ever been polled under: without it, a pending
  /// handle carried through a sequence of completed tasks would accumulate one
  /// token per task and the lookup below would grow with it.
  /// Forget publications that no longer stand.
  ///
  /// A token is obsolete once its frame is gone -- a dropped `TaskDependency`
  /// cancels every entry it holds, so there is nothing left to retire -- or
  /// once that frame no longer holds the entry, because its `begin_poll`
  /// drained `current`. Dropping both kinds keeps this list at the handle's
  /// currently-live frame count rather than the number of frames it has ever
  /// been polled under.
  ///
  /// Testing the second condition costs a lock, so it is confined to the
  /// multi-frame path: a handle polled under a single frame -- the
  /// overwhelmingly common case -- reuses its one token and never reaches it.
  /// Without that condition a handle carried through many tasks whose
  /// `JoinHandle`s are still held would keep one token per task, since those
  /// handles keep the states alive, and both this walk and detach would grow
  /// with that count.
  fn prune(&mut self) {
    if self.rest.is_empty() {
      if self
        .first
        .as_ref()
        .is_some_and(|first| first.state.strong_count() == 0)
      {
        self.first = None;
      }
      return;
    }
    self.rest.retain(PublishedBlockingDependency::still_stands);
    if self
      .first
      .as_ref()
      .is_some_and(|first| !first.still_stands())
    {
      self.first = self.rest.pop();
    }
  }

  fn publish(&mut self, state: Arc<TaskDependency>, dependency: BlockingDependency) {
    self.prune();
    let target = Arc::as_ptr(&state);
    if let Some(existing) = self
      .first
      .iter_mut()
      .chain(self.rest.iter_mut())
      .find(|published| std::ptr::eq(published.state.as_ptr(), target))
    {
      // The entry this handle already published into this frame still says the
      // frame depends on this job, so a repeat Pending poll must LEAVE IT
      // ALONE. Publishing again would append at the tail, and
      // `select_for_owner` picks the LOWEST live sequence, so re-polling a
      // handle would push its own dependency behind ones published after it.
      // In an H1 -> H2 -> H1 poll pass that reorders H1 behind H2, and if H2
      // waits on H1 the owner lane lends H2 inline while H1 stays queued
      // forever. Keeping the original sequence preserves the publication order
      // the job index produced, and skips a `DependencyClaim`/`DependencyLink`
      // pair per repeat poll.
      if state.holds_live(existing.sequence) {
        return;
      }
      // The entry was drained, pruned or claimed, so it no longer stands and
      // this frame needs a fresh one. Reusing the token keeps the list at one
      // entry per frame.
      existing.sequence = state.set_owned(dependency);
      return;
    }
    let sequence = state.set_owned(dependency);
    let published = PublishedBlockingDependency {
      state: Arc::downgrade(&state),
      sequence,
    };
    match &mut self.first {
      slot @ None => *slot = Some(published),
      Some(_) => self.rest.push(published),
    }
  }

  /// Retire every publication, each against the state it was filed in.
  ///
  /// This is exactly inverse to publication, so it can never cancel an entry
  /// this handle did not create. It cannot strand a frame either: a frame is
  /// only stranded if it is parked awaiting something, and it cannot be parked
  /// awaiting a handle that is concurrently being dropped, because the handle
  /// is owned by the future that frame is driving. A frame that has already
  /// gone cancelled its entries in its own `Drop`, so an expired token is
  /// simply skipped.
  fn retire_all(self) {
    for published in self.first.into_iter().chain(self.rest) {
      if let Some(state) = published.state.upgrade() {
        state.retire(published.sequence);
      }
    }
  }
}

#[cfg(napi_runtime_os_threads)]
fn record_blocking_dependency(
  published: &mut PublishedBlockingDependencies,
  dependency: BlockingDependency,
) {
  let current = CURRENT_DEPENDENCY_STACK.with(|stack| stack.borrow().last().cloned());
  if let Some(current) = current {
    let dependency = BlockingDependency {
      owner: dependency
        .owner
        .or_else(|| BLOCKING_OWNER.with(std::cell::Cell::get)),
      ..dependency
    };
    published.publish(current, dependency);
  }
}

#[cfg(napi_runtime_os_threads)]
fn propagate_blocking_dependency(publication: DependencyPublication) {
  let current = CURRENT_DEPENDENCY_STACK.with(|stack| stack.borrow().last().cloned());
  if let Some(current) = current {
    let owner = BLOCKING_OWNER.with(std::cell::Cell::get);
    let publication = publication.with_owner_if_none(owner);
    current.set_borrowed(&publication);
  }
}

#[cfg(napi_runtime_os_threads)]
fn clear_blocking_dependency(published: PublishedBlockingDependencies) {
  // Retire against the states that were published to, NOT against whatever
  // frame happens to be on top of the stack at drop time. The frame that
  // published is the frame whose dependency graph is now wrong.
  published.retire_all();
}

#[cfg(napi_runtime_os_threads)]
fn clear_propagated_blocking_dependencies(publications: &[DependencyPublication]) {
  let current = CURRENT_DEPENDENCY_STACK.with(|stack| stack.borrow().last().cloned());
  if let Some(current) = current {
    current.clear_if_publications(publications);
  }
}

enum JoinHandleInner<T> {
  Task {
    task: FallibleTask<Result<ContainedTaskOutput<T>, JoinError>>,
    awaiter: Option<PanicContainedWakerCache>,
    #[cfg(napi_runtime_os_threads)]
    dependency: Arc<TaskDependency>,
  },
  #[cfg(napi_runtime_os_threads)]
  Blocking {
    receiver: oneshot::Receiver<Result<ContainedTaskOutput<T>, JoinError>>,
    dependency: BlockingDependency,
    /// Every dependency this handle has published, so detaching retires each
    /// in O(1) instead of searching for them by job id.
    published: PublishedBlockingDependencies,
  },
  Ready(Option<Result<ContainedTaskOutput<T>, JoinError>>),
}

pub struct JoinHandle<T>(JoinHandleInner<T>);

impl<T> Unpin for JoinHandle<T> {}

impl<T> JoinHandle<T> {
  fn detach_task(&mut self) {
    let inner = std::mem::replace(&mut self.0, JoinHandleInner::Ready(None));
    match inner {
      JoinHandleInner::Task {
        task,
        awaiter: _,
        #[cfg(napi_runtime_os_threads)]
        dependency,
      } => {
        #[cfg(napi_runtime_os_threads)]
        let current_dependencies = dependency.snapshot_all_live();
        #[cfg(napi_runtime_os_threads)]
        dependency.clear_waiter();
        task.detach();
        #[cfg(napi_runtime_os_threads)]
        // Dependency cleanup may wake an arbitrary caller-provided waker.
        // Retire the task first, then contain the notification boundary so
        // reentrant wake code cannot observe a half-detached handle.
        let _ = catch_unwind_contained(|| {
          clear_propagated_blocking_dependencies(&current_dependencies);
        });
      }
      #[cfg(napi_runtime_os_threads)]
      JoinHandleInner::Blocking {
        receiver,
        dependency: _,
        published,
      } => {
        // A completed result may already be buffered in the receiver. Its
        // destructor is user code and must receive the same containment as an
        // immediate CurrentThread result.
        let _ = catch_unwind_contained(|| drop(receiver));
        // Notify only after receiver retirement, and keep that arbitrary waker
        // behind an independent unwind boundary.
        let _ = catch_unwind_contained(|| clear_blocking_dependency(published));
      }
      JoinHandleInner::Ready(result) => {
        let _ = catch_unwind_contained(|| drop(result));
      }
    }
  }

  pub fn detach(mut self) {
    self.detach_task();
  }
}

impl<T> Drop for JoinHandle<T> {
  fn drop(&mut self) {
    // Tokio's JoinHandle detaches on drop. Preserve that compatibility:
    // fire-and-forget callers must not silently cancel work merely because
    // they ignore the returned handle.
    self.detach_task();
  }
}

impl<T> Future for JoinHandle<T> {
  type Output = Result<T, JoinError>;

  fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
    match &mut self.get_mut().0 {
      JoinHandleInner::Task {
        task,
        awaiter: awaiter_slot,
        #[cfg(napi_runtime_os_threads)]
        dependency,
      } => {
        let awaiter = match awaiter_slot {
          Some(awaiter) => {
            awaiter.update(cx.waker());
            awaiter
          }
          None => awaiter_slot.insert(PanicContainedWakerCache::new(cx.waker())),
        };
        let contained_waker = awaiter.contained();
        let mut contained_cx = Context::from_waker(contained_waker);
        let poll = Pin::new(task).poll(&mut contained_cx);
        #[cfg(napi_runtime_os_threads)]
        if poll.is_pending() {
          for current_dependency in dependency.register_waiter_and_get(contained_waker) {
            propagate_blocking_dependency(current_dependency);
          }
        } else {
          dependency.clear_waiter();
        }
        if poll.is_ready() {
          *awaiter_slot = None;
        }
        match poll {
          Poll::Ready(Some(result)) => Poll::Ready(result.map(ContainedTaskOutput::into_inner)),
          Poll::Ready(None) => Poll::Ready(Err(JoinError {
            message: "async runtime stopped before the task completed".to_string(),
          })),
          Poll::Pending => Poll::Pending,
        }
      }
      #[cfg(napi_runtime_os_threads)]
      JoinHandleInner::Blocking {
        receiver,
        dependency,
        published,
      } => {
        let poll = Pin::new(receiver).poll(cx);
        if poll.is_pending() {
          record_blocking_dependency(published, *dependency);
        }
        match poll {
          Poll::Ready(Ok(result)) => Poll::Ready(result.map(ContainedTaskOutput::into_inner)),
          Poll::Ready(Err(_)) => Poll::Ready(Err(JoinError {
            message: "async runtime stopped before the blocking task completed".to_string(),
          })),
          Poll::Pending => Poll::Pending,
        }
      }
      JoinHandleInner::Ready(result) => Poll::Ready(
        result
          .take()
          .expect("JoinHandle polled after completion")
          .map(ContainedTaskOutput::into_inner),
      ),
    }
  }
}

#[derive(Debug, Clone, Copy)]
pub struct RuntimeMetricsSnapshot {
  pub flavor: RuntimeFlavor,
  pub worker_threads: usize,
  pub max_blocking_tasks: usize,
  pub tasks_spawned: u64,
  pub tasks_completed: u64,
  pub tasks_panicked: u64,
  pub runnable_schedules: u64,
  pub runnable_polls: u64,
  pub queued_runnables: u64,
  pub max_queued_runnables: u64,
  pub active_runnables: u64,
  pub max_active_runnables: u64,
  pub blocking_tasks_started: u64,
  pub blocking_tasks_completed: u64,
  pub active_blocking_tasks: u64,
  pub max_active_blocking_tasks: u64,
}

#[derive(Default)]
struct RuntimeMetrics {
  tasks_spawned: AtomicU64,
  tasks_completed: AtomicU64,
  tasks_panicked: AtomicU64,
  runnable_schedules: AtomicU64,
  runnable_polls: AtomicU64,
  queued_runnables: AtomicU64,
  max_queued_runnables: AtomicU64,
  active_runnables: AtomicU64,
  max_active_runnables: AtomicU64,
  // Bumped at ENQUEUE time (before the queue push), the blocking-side twin of
  // `runnable_schedules`. Internal-only (not exported in the public snapshot):
  // it exists so the deadlock detector's progress fingerprint can observe a
  // blocking submission the moment it is made -- `blocking_tasks_started`
  // only advances once a worker RUNS the job, which may be arbitrarily later.
  blocking_tasks_scheduled: AtomicU64,
  blocking_tasks_started: AtomicU64,
  blocking_tasks_completed: AtomicU64,
  active_blocking_tasks: AtomicU64,
  max_active_blocking_tasks: AtomicU64,
  // Seqlock generation around resets. The deadlock detector snapshots
  // resettable counters, so it must distinguish identical counter values from
  // different reset generations instead of mistaking that ABA for no progress.
  reset_generation: AtomicU64,
  reset_lock: Mutex<()>,
}

#[cfg(test)]
thread_local! {
  static RUNTIME_METRICS_HIGH_WATER_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
}

#[cfg(test)]
fn run_runtime_metrics_high_water_test_hook() {
  if let Some(hook) = RUNTIME_METRICS_HIGH_WATER_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

impl RuntimeMetrics {
  fn runnable_scheduled(&self) {
    self.runnable_schedules.fetch_add(1, Ordering::Relaxed);
    let queued = self.queued_runnables.fetch_add(1, Ordering::Relaxed) + 1;
    #[cfg(test)]
    run_runtime_metrics_high_water_test_hook();
    self
      .max_queued_runnables
      .fetch_max(queued, Ordering::Relaxed);
  }

  fn runnable_started(&self) -> ActiveRunnableGuard<'_> {
    self.queued_runnables.fetch_sub(1, Ordering::Relaxed);
    self.runnable_polls.fetch_add(1, Ordering::Relaxed);
    let active = self.active_runnables.fetch_add(1, Ordering::Relaxed) + 1;
    #[cfg(test)]
    run_runtime_metrics_high_water_test_hook();
    self
      .max_active_runnables
      .fetch_max(active, Ordering::Relaxed);
    ActiveRunnableGuard { metrics: self }
  }

  #[cfg(any(napi_runtime_os_threads, test))]
  fn runnable_cancelled(&self) {
    self.queued_runnables.fetch_sub(1, Ordering::Relaxed);
  }

  /// Enqueue-time twin of [`Self::runnable_scheduled`] for blocking work:
  /// called BEFORE the blocking-queue push, so the deadlock detector's
  /// fingerprint sees a submission even when no worker has started the job.
  fn blocking_scheduled(&self) {
    self
      .blocking_tasks_scheduled
      .fetch_add(1, Ordering::Relaxed);
  }

  fn blocking_started(self: &Arc<Self>, count_active_lane: bool) -> BlockingTaskGuard {
    self.blocking_tasks_started.fetch_add(1, Ordering::Relaxed);
    if count_active_lane {
      let active = self.active_blocking_tasks.fetch_add(1, Ordering::Relaxed) + 1;
      #[cfg(test)]
      run_runtime_metrics_high_water_test_hook();
      self
        .max_active_blocking_tasks
        .fetch_max(active, Ordering::Relaxed);
    }
    BlockingTaskGuard {
      metrics: Arc::clone(self),
      count_active_lane,
    }
  }

  fn snapshot(&self, options: &RuntimeOptions) -> RuntimeMetricsSnapshot {
    let queued_runnables = self.queued_runnables.load(Ordering::Relaxed);
    let active_runnables = self.active_runnables.load(Ordering::Relaxed);
    let active_blocking_tasks = self.active_blocking_tasks.load(Ordering::Relaxed);
    RuntimeMetricsSnapshot {
      flavor: options.flavor,
      worker_threads: options.worker_threads,
      max_blocking_tasks: options.max_blocking_tasks,
      tasks_spawned: self.tasks_spawned.load(Ordering::Relaxed),
      tasks_completed: self.tasks_completed.load(Ordering::Relaxed),
      tasks_panicked: self.tasks_panicked.load(Ordering::Relaxed),
      runnable_schedules: self.runnable_schedules.load(Ordering::Relaxed),
      runnable_polls: self.runnable_polls.load(Ordering::Relaxed),
      queued_runnables,
      max_queued_runnables: self
        .max_queued_runnables
        .load(Ordering::Relaxed)
        .max(queued_runnables),
      active_runnables,
      max_active_runnables: self
        .max_active_runnables
        .load(Ordering::Relaxed)
        .max(active_runnables),
      blocking_tasks_started: self.blocking_tasks_started.load(Ordering::Relaxed),
      blocking_tasks_completed: self.blocking_tasks_completed.load(Ordering::Relaxed),
      active_blocking_tasks,
      max_active_blocking_tasks: self
        .max_active_blocking_tasks
        .load(Ordering::Relaxed)
        .max(active_blocking_tasks),
    }
  }

  /// Coarse liveness fingerprint for deadline-based deadlock detection (wake
  /// -path §8.5): any of these counters advancing between two reads means the
  /// runtime did SOMETHING (scheduled or polled a runnable, completed a task,
  /// scheduled, started or finished a blocking job), so a parked driver
  /// observing an advance re-arms its deadline instead of firing. Both ENQUEUE
  /// counters (`runnable_schedules`, `blocking_tasks_scheduled`) are included
  /// so a submission is progress the moment it is made -- not only once a
  /// worker gets to run it.
  fn progress_fingerprint(&self) -> ProgressFingerprint {
    loop {
      let reset_generation = self.reset_generation.load(Ordering::SeqCst);
      if !reset_generation.is_multiple_of(2) {
        std::hint::spin_loop();
        continue;
      }
      let fingerprint = ProgressFingerprint {
        reset_generation,
        runnable_schedules: self.runnable_schedules.load(Ordering::Relaxed),
        runnable_polls: self.runnable_polls.load(Ordering::Relaxed),
        tasks_completed: self.tasks_completed.load(Ordering::Relaxed),
        blocking_tasks_scheduled: self.blocking_tasks_scheduled.load(Ordering::Relaxed),
        blocking_tasks_started: self.blocking_tasks_started.load(Ordering::Relaxed),
        blocking_tasks_completed: self.blocking_tasks_completed.load(Ordering::Relaxed),
      };
      if self.reset_generation.load(Ordering::SeqCst) == reset_generation {
        return fingerprint;
      }
    }
  }

  fn reset(&self) {
    let reset_guard = self
      .reset_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    // Event counters are safe to reset independently. Live gauges are not:
    // queued/active guards may still hold a future decrement, and zeroing a
    // gauge underneath them wraps the unsigned counter on completion.
    //
    // High-water gauges remain lifetime values. Resetting them concurrently
    // with fetch_max would either lose a real peak or require synchronization
    // on every hot-path metric update.
    let reset_generation = self.reset_generation.load(Ordering::SeqCst);
    let Some(resetting_generation) = reset_generation.checked_add(1) else {
      drop(reset_guard);
      panic!("runtime metrics reset generation space exhausted");
    };
    let Some(settled_generation) = resetting_generation.checked_add(1) else {
      drop(reset_guard);
      panic!("runtime metrics reset generation space exhausted");
    };
    self
      .reset_generation
      .store(resetting_generation, Ordering::SeqCst);
    self.tasks_spawned.store(0, Ordering::Relaxed);
    self.tasks_completed.store(0, Ordering::Relaxed);
    self.tasks_panicked.store(0, Ordering::Relaxed);
    self.runnable_schedules.store(0, Ordering::Relaxed);
    self.runnable_polls.store(0, Ordering::Relaxed);
    self.blocking_tasks_scheduled.store(0, Ordering::Relaxed);
    self.blocking_tasks_started.store(0, Ordering::Relaxed);
    self.blocking_tasks_completed.store(0, Ordering::Relaxed);
    self
      .reset_generation
      .store(settled_generation, Ordering::SeqCst);
  }
}

/// See [`RuntimeMetrics::progress_fingerprint`].
#[derive(Clone, Copy, PartialEq, Eq)]
struct ProgressFingerprint {
  reset_generation: u64,
  runnable_schedules: u64,
  runnable_polls: u64,
  tasks_completed: u64,
  blocking_tasks_scheduled: u64,
  blocking_tasks_started: u64,
  blocking_tasks_completed: u64,
}

struct ActiveRunnableGuard<'a> {
  metrics: &'a RuntimeMetrics,
}

impl Drop for ActiveRunnableGuard<'_> {
  fn drop(&mut self) {
    self
      .metrics
      .active_runnables
      .fetch_sub(1, Ordering::Relaxed);
  }
}

struct BlockingTaskGuard {
  metrics: Arc<RuntimeMetrics>,
  count_active_lane: bool,
}

impl Drop for BlockingTaskGuard {
  fn drop(&mut self) {
    if self.count_active_lane {
      self
        .metrics
        .active_blocking_tasks
        .fetch_sub(1, Ordering::Relaxed);
    }
    self
      .metrics
      .blocking_tasks_completed
      .fetch_add(1, Ordering::Relaxed);
  }
}

static NEXT_RUNTIME_GENERATION: AtomicU64 = AtomicU64::new(0);

fn next_runtime_generation() -> u64 {
  next_unique_id(
    &NEXT_RUNTIME_GENERATION,
    "async runtime generation id space exhausted",
  )
}

thread_local! {
  static ACTIVE_RUNTIME_GENERATION: std::cell::Cell<Option<u64>> =
    const { std::cell::Cell::new(None) };
}

fn active_runtime_generation() -> Option<u64> {
  ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get)
}

struct RuntimeGenerationGuard {
  previous: Option<u64>,
}

impl RuntimeGenerationGuard {
  fn enter(generation: u64) -> Self {
    Self::enter_optional(Some(generation))
  }

  fn enter_optional(generation: Option<u64>) -> Self {
    Self {
      previous: ACTIVE_RUNTIME_GENERATION.with(|current| current.replace(generation)),
    }
  }
}

impl Drop for RuntimeGenerationGuard {
  fn drop(&mut self) {
    ACTIVE_RUNTIME_GENERATION.with(|current| current.set(self.previous));
  }
}

struct ContainedFuture<F> {
  future: ManuallyDrop<F>,
  generation: u64,
}

impl<F> ContainedFuture<F> {
  fn new(future: F, generation: u64) -> Self {
    Self {
      future: ManuallyDrop::new(future),
      generation,
    }
  }
}

impl<F: Future> Future for ContainedFuture<F> {
  type Output = F::Output;

  fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
    // SAFETY: `future` is never moved after `ContainedFuture` is pinned.
    let this = unsafe { self.get_unchecked_mut() };
    let _generation = RuntimeGenerationGuard::enter(this.generation);
    // SAFETY: `ManuallyDrop<F>` has the same layout as `F`, and the field is
    // structurally pinned for the lifetime of `self`.
    unsafe { Pin::new_unchecked(&mut *this.future) }.poll(cx)
  }
}

impl<F> Drop for ContainedFuture<F> {
  fn drop(&mut self) {
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let _ = catch_unwind_contained(|| {
      // SAFETY: this is the sole destruction path for `future`.
      unsafe { ManuallyDrop::drop(&mut self.future) };
    });
  }
}

#[derive(Default)]
struct GenerationStop {
  stopping: AtomicBool,
  publication: Mutex<()>,
  parkers: Mutex<Vec<Weak<DriverParker>>>,
}

impl GenerationStop {
  fn is_stopping(&self) -> bool {
    self.stopping.load(Ordering::Acquire)
  }

  fn publication_guard(&self) -> GenerationStopPublicationGuard<'_> {
    #[cfg(all(test, napi_runtime_os_threads))]
    run_before_generation_stop_publication_lock_test_hook();
    self.runnable_claim_guard()
  }

  fn runnable_claim_guard(&self) -> GenerationStopPublicationGuard<'_> {
    GenerationStopPublicationGuard {
      stop: self,
      _publication: self
        .publication
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner),
    }
  }

  fn publish_stopping(&self) {
    self.publication_guard().publish_stopping();
  }

  fn register(self: &Arc<Self>, parker: &Arc<DriverParker>) -> GenerationStopGuard {
    {
      let mut parkers = self
        .parkers
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      parkers.retain(|candidate| candidate.strong_count() != 0);
      parkers.push(Arc::downgrade(parker));
    }
    if self.is_stopping() {
      parker.unpark();
    }
    GenerationStopGuard {
      stop: Arc::clone(self),
      parker: Arc::downgrade(parker),
    }
  }

  /// Wake every active `block_on` frame without changing the generation state.
  /// The number of parkers is bounded by concurrent explicit drivers. Waking
  /// all avoids directing a queue wake only to a newer driver that is blocked
  /// inside its poll while an older driver is already asleep.
  fn wake_all(&self) -> usize {
    let mut count = 0;
    let mut registered = self
      .parkers
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    registered.retain(|candidate| {
      let Some(parker) = candidate.upgrade() else {
        return false;
      };
      count += 1;
      // `DriverParker::unpark` invokes no user code and never enters the
      // generation registry, so waking under this lock is non-reentrant.
      parker.unpark();
      true
    });
    count
  }

  fn begin_shutdown(&self) {
    self.publish_stopping();
    let parkers = {
      let mut registered = self
        .parkers
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let parkers = registered
        .iter()
        .filter_map(Weak::upgrade)
        .collect::<Vec<_>>();
      registered.clear();
      parkers
    };
    for parker in parkers {
      parker.unpark();
    }
  }
}

struct GenerationStopPublicationGuard<'a> {
  stop: &'a GenerationStop,
  _publication: MutexGuard<'a, ()>,
}

impl GenerationStopPublicationGuard<'_> {
  fn is_stopping(&self) -> bool {
    self.stop.is_stopping()
  }

  fn publish_stopping(&self) {
    self.stop.stopping.store(true, Ordering::Release);
  }
}

struct GenerationStopGuard {
  stop: Arc<GenerationStop>,
  parker: Weak<DriverParker>,
}

impl Drop for GenerationStopGuard {
  fn drop(&mut self) {
    let Some(parker) = self.parker.upgrade() else {
      return;
    };
    let mut registered = self
      .stop
      .parkers
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if let Some(index) = registered.iter().position(|candidate| {
      candidate
        .upgrade()
        .is_some_and(|value| Arc::ptr_eq(&value, &parker))
    }) {
      registered.swap_remove(index);
    }
  }
}

/// Whether a work-pending read may wait for the locks its sources live under.
#[derive(Clone, Copy)]
enum PendingRead {
  /// Wait for each lock, for the exact answer. Only `begin_shutdown` reads
  /// its verdict this way; the host's poll never does.
  Locked,
  /// Never wait: a source whose lock another thread holds reads as pending.
  /// For the host's poll, which must never block; see
  /// `RuntimeController::runtime_work_pending` for why a held lock is not
  /// always about to come back.
  NonBlocking,
}

impl PendingRead {
  /// `pending` applied to the state behind `mutex`, or `true` without looking
  /// when this is [`Self::NonBlocking`] and another thread holds the lock.
  /// Poison is ignored, as at every other lock site here.
  fn read<T>(self, mutex: &Mutex<T>, pending: impl FnOnce(&T) -> bool) -> bool {
    let state = match self {
      Self::Locked => mutex.lock(),
      Self::NonBlocking => match mutex.try_lock() {
        Ok(state) => Ok(state),
        Err(std::sync::TryLockError::Poisoned(poisoned)) => Err(poisoned),
        Err(std::sync::TryLockError::WouldBlock) => return true,
      },
    };
    pending(&state.unwrap_or_else(std::sync::PoisonError::into_inner))
  }
}

struct GenerationWorkState {
  closed: bool,
  next_task_id: u64,
  active: usize,
  abort_handles: FxHashMap<u64, AbortHandle>,
}

struct GenerationWork {
  id: u64,
  state: Mutex<GenerationWorkState>,
  idle: Condvar,
}

impl GenerationWork {
  fn new() -> Arc<Self> {
    Arc::new(Self {
      id: next_runtime_generation(),
      state: Mutex::new(GenerationWorkState {
        closed: false,
        next_task_id: 0,
        active: 0,
        abort_handles: FxHashMap::default(),
      }),
      idle: Condvar::new(),
    })
  }

  fn try_register_async(self: &Arc<Self>) -> Option<(AbortRegistration, GenerationWorkGuard)> {
    let (abort_handle, abort_registration) = AbortHandle::new_pair();
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if state.closed {
      return None;
    }
    let task_id = state.next_task_id;
    let Some(next_task_id) = state.next_task_id.checked_add(1) else {
      drop(state);
      panic!("async runtime generation task id space exhausted");
    };
    state.next_task_id = next_task_id;
    state.active += 1;
    state.abort_handles.insert(task_id, abort_handle);
    Some((
      abort_registration,
      GenerationWorkGuard {
        work: Arc::clone(self),
        task_id: Some(task_id),
      },
    ))
  }

  fn try_register_work(self: &Arc<Self>) -> Option<GenerationWorkGuard> {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if state.closed {
      return None;
    }
    state.active += 1;
    Some(GenerationWorkGuard {
      work: Arc::clone(self),
      task_id: None,
    })
  }

  fn close_and_abort(&self) {
    // Take the handles out instead of cloning them into a new `Vec`: nothing
    // is allocated under the state lock, and no guard retiring later frees a
    // handle under it (see `GenerationWorkGuard::drop`). Admission is closed
    // in the same critical section, so no handle can be added afterwards.
    let abort_handles = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.closed = true;
      std::mem::take(&mut state.abort_handles)
    };
    for abort_handle in abort_handles.values() {
      abort_handle.abort();
    }
  }

  fn wait_until_idle(&self) {
    self.wait_until_idle_retiring(|| false, || {});
  }

  /// The predicate `wait_until_idle` sleeps on, read without sleeping;
  /// `read` decides whether it may wait for the state lock.
  fn has_active_work(&self, read: PendingRead) -> bool {
    read.read(&self.state, |state| state.active != 0)
  }

  /// Wait until every registered guard has retired, retiring deferred work
  /// on this stack whenever `has_deferred` reports some. Such work (a runnable
  /// rejected after the executor queue closed, or the runnables a terminal
  /// failure transition moved aside on a waker's stack) holds guards, so the
  /// generation can only become idle once the waiter drops them; `retire`
  /// runs with no lock held. `notify_idle_waiters` publishes new deferred
  /// work under the state lock, so a check made here cannot miss it.
  fn wait_until_idle_retiring(&self, has_deferred: impl Fn() -> bool, retire: impl Fn()) {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    while state.active != 0 {
      if has_deferred() {
        drop(state);
        retire();
        state = self
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        continue;
      }
      state = self
        .idle
        .wait(state)
        .unwrap_or_else(std::sync::PoisonError::into_inner);
    }
  }

  fn notify_idle_waiters(&self) {
    let _state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    self.idle.notify_all();
  }
}

struct GenerationWorkGuard {
  work: Arc<GenerationWork>,
  task_id: Option<u64>,
}

impl Drop for GenerationWorkGuard {
  fn drop(&mut self) {
    // The removed handle is usually the last owner of the task's abort state,
    // so dropping it frees memory and drops the waker parked there. Neither
    // runs under the state lock: the host's work-pending poll reads it, and
    // on `wasm32-wasip1-threads` a trap in there unwinds nothing, which
    // would leave the lock held for good.
    let abort_handle = {
      let mut state = self
        .work
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let abort_handle = self
        .task_id
        .and_then(|task_id| state.abort_handles.remove(&task_id));
      state.active = state
        .active
        .checked_sub(1)
        .expect("generation work count underflow");
      if state.active == 0 {
        self.work.idle.notify_all();
      }
      abort_handle
    };
    drop(abort_handle);
  }
}

/// Keeps accepted async work registered until the complete task generator has
/// been destroyed. In particular, an executor queue may close after
/// registration but before the initial runnable is published. `async-task`
/// then drops the generator unpolled, whose compiler-generated capture order
/// must not be allowed to retire the generation guard before user captures.
struct RegisteredTaskFuture<F> {
  future: ManuallyDrop<F>,
  registration: Option<GenerationWorkGuard>,
  generation: u64,
}

impl<F> RegisteredTaskFuture<F> {
  fn new(future: F, registration: GenerationWorkGuard, generation: u64) -> Self {
    Self {
      future: ManuallyDrop::new(future),
      registration: Some(registration),
      generation,
    }
  }
}

impl<F: Future> Future for RegisteredTaskFuture<F> {
  type Output = F::Output;

  fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
    // SAFETY: `future` is never moved after `RegisteredTaskFuture` is pinned.
    let this = unsafe { self.get_unchecked_mut() };
    let _generation = RuntimeGenerationGuard::enter(this.generation);
    // SAFETY: `ManuallyDrop<F>` has the same layout as `F`, and the field is
    // structurally pinned for the lifetime of `self`.
    unsafe { Pin::new_unchecked(&mut *this.future) }.poll(cx)
  }
}

impl<F> Drop for RegisteredTaskFuture<F> {
  fn drop(&mut self) {
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let _ = catch_unwind_contained(|| {
      // SAFETY: this is the sole destruction path for `future`.
      unsafe { ManuallyDrop::drop(&mut self.future) };
    });
    // Shutdown/restart may observe this generation idle only after every user
    // capture and caught panic payload above has retired.
    drop(self.registration.take());
  }
}

#[cfg(napi_runtime_os_threads)]
struct RegisteredBlockingFunction<F> {
  function: Option<F>,
  registration: Option<GenerationWorkGuard>,
  generation: u64,
}

#[cfg(napi_runtime_os_threads)]
impl<F> RegisteredBlockingFunction<F> {
  fn new(function: F, registration: GenerationWorkGuard, generation: u64) -> Self {
    Self {
      function: Some(function),
      registration: Some(registration),
      generation,
    }
  }

  fn run<T>(mut self) -> Result<T, JoinError>
  where
    F: FnOnce() -> T,
  {
    on_thread_handoff();
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let result = catch_unwind_join_error(
      self
        .function
        .take()
        .expect("blocking function must be available"),
    );
    drop(self.registration.take());
    result
  }
}

#[cfg(napi_runtime_os_threads)]
impl<F> Drop for RegisteredBlockingFunction<F> {
  fn drop(&mut self) {
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    if let Some(function) = self.function.take() {
      let _ = catch_unwind_contained(|| drop(function));
    }
    // A submission accepted by the controller may reach a queue that shutdown
    // already closed. Keep it registered until all captured user state above
    // has been destroyed on the submitting thread.
    drop(self.registration.take());
  }
}

fn run_runnable(metrics: &RuntimeMetrics, runnable: Runnable) {
  on_thread_handoff();
  let _active = metrics.runnable_started();
  let _ = catch_unwind_contained(|| runnable.run());
}

#[cfg(napi_runtime_os_threads)]
enum RunnableClaim {
  Empty,
  Run(Runnable),
  Cancel(Runnable),
}

static NEXT_RUNTIME_EXECUTOR_ID: AtomicU64 = AtomicU64::new(1);
static NEXT_CURRENT_THREAD_DISPATCH_ID: AtomicU64 = AtomicU64::new(0);

fn next_current_thread_dispatch_id() -> u64 {
  next_unique_id(
    &NEXT_CURRENT_THREAD_DISPATCH_ID,
    "CurrentThread dispatch id space exhausted",
  )
  .checked_add(1)
  .expect("CurrentThread dispatch id space exhausted")
}

struct CurrentThreadBlockingAdmission {
  state: Mutex<CurrentThreadBlockingAdmissionState>,
}

struct CurrentThreadBlockingAdmissionState {
  owner: Option<BlockingOwnerToken>,
  closed: bool,
  #[cfg(napi_runtime_os_threads)]
  queue: BlockingQueue,
}

struct CurrentThreadExecutor {
  id: u64,
  generation: u64,
  stop: Arc<GenerationStop>,
  queue: Mutex<CurrentThreadQueue>,
  blocking_admission: CurrentThreadBlockingAdmission,
  draining: AtomicBool,
  scheduler_idle_lock: Mutex<CurrentThreadSchedulerState>,
  scheduler_idle: Condvar,
  /// Exact nonzero internal capability for the currently published host turn.
  /// The host registry maps this to distinct registration-scoped delivery
  /// capabilities, so delayed drive/cancel calls cannot cross host attempts.
  dispatch_pending: AtomicU64,
  /// Exact capability of the one replacement dispatch allowed after a host
  /// scheduler rejects an accepted callback. A second matching cancellation
  /// fails the queued work instead of retrying forever.
  recovery_dispatch: AtomicU64,
  /// Terminal dispatch failure rejects scheduler publications and admission
  /// from the moment it is claimed (under `scheduler_idle_lock`) until
  /// `cancel_work_after_host_dispatch_failure` reopens the executor under the
  /// queue lock: after cancelling the queued work on a clean stack, or as
  /// soon as it has moved that work aside on a waker's stack.
  cancelling_failed_dispatch: AtomicBool,
  task_dispatch: fn(u64) -> CurrentThreadHostDispatchResult,
  task_drivers: &'static CurrentThreadTaskDriverRegistry,
  metrics: Arc<RuntimeMetrics>,
  // Deadlock detection. `threadless`: no second thread can EVER deliver a
  // wake to a parked `block_on`, so a park decision with an
  // empty queue and no pending wake token is a PROVABLE deadlock (panic
  // immediately, no timing involved). `park_deadline`: on threaded builds,
  // the optional bound for a park with zero runtime progress -- off unless
  // configured, because a legitimately long park must never panic a
  // production build.
  threadless: bool,
  park_deadline: Option<Duration>,
  // HOST-driver timers currently armed on this runtime.
  // On the THREADED CT flavor a pending entry is a future wake token -- the
  // host event loop's timer callback -- so the deadline verdict treats a LIVE
  // wait (deadline still in the future) as a legitimate park. On a THREADLESS
  // build it is NOT a wake token (the host relay shares the parked thread and
  // can never run); there the CERTAIN check only consults it to pick the
  // timer-backed variant of the typed diagnostic. Shared with the `Sleep`
  // futures minted for this executor (they insert at first poll and remove on
  // completion/drop).
  host_timers: Arc<HostTimerRegistry>,
  // The generation this executor serves, attached by its `RuntimeBackend`.
  // A runnable rejected after the queue closed still owns its
  // `GenerationWorkGuard`, so `schedule` must wake the generation's idle
  // waiter, which retires such runnables on its own stack.
  generation_work: ArcSwapOption<GenerationWork>,
}

impl Drop for CurrentThreadExecutor {
  fn drop(&mut self) {
    // Last drain point for rejected work (each runnable still owns its
    // `GenerationWorkGuard`) when no idle wait ran after the queue closed.
    self.retire_rejected_work();
  }
}

struct CurrentThreadQueue {
  closed: bool,
  runnables: VecDeque<Runnable>,
  /// Runnables the executor owes a cancellation: the work that was queued
  /// when a terminal dispatch failure happened (moved here by
  /// `cancel_work_after_host_dispatch_failure`), a schedule that arrived
  /// while that transition held the executor closed, or a schedule that
  /// arrived after shutdown closed the queue. Their `queued_runnables` debit
  /// has already been taken. They are dropped only on clean stacks: by the
  /// transition itself when it is not on a waker's stack, and otherwise by
  /// `retire_rejected_work` at host entry points (a host turn, delivery
  /// completion, driver unregistration, a drain request) outside `schedule`
  /// and on the shutdown side (`begin_shutdown`, the generation's idle wait,
  /// `wait_until_scheduler_idle`, the executor's destructor). Never on the
  /// waker's stack: that waker may run while its producer holds a mutex
  /// (`futures::Shared` wakes awaiters under its `wakers` lock) that the
  /// rejected future's destructor re-locks. See `CurrentThreadScheduleScope`.
  rejected: Vec<Runnable>,
  /// Blocking jobs queued when a terminal dispatch failure happened. Same
  /// contract as `rejected`: dropping a job destroys its closure and its
  /// result sender, which wakes the awaiting task.
  #[cfg(napi_runtime_os_threads)]
  rejected_blocking: Vec<Box<dyn FnOnce() + Send + 'static>>,
}

#[derive(Default)]
struct CurrentThreadSchedulerState {
  active_host_turns: usize,
  active_dispatch_calls: usize,
  dispatch_publications: Vec<CurrentThreadDispatchPublication>,
}

struct CurrentThreadDispatchPublication {
  dispatch: u64,
  republish_requested: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
enum CurrentThreadDispatchRequest {
  Accepted,
  Coalesced,
  Unavailable,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
struct CurrentThreadTaskDispatchFailure {
  dispatch: u64,
  epoch: u64,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
enum CurrentThreadHostDispatchResult {
  Accepted,
  Unavailable,
  Failed(CurrentThreadTaskDispatchFailure),
}

enum CurrentThreadDispatchPublicationStep {
  Republish,
  Complete(Option<CurrentThreadHostDispatchResult>),
}

struct CurrentThreadHostTurn {
  executor: Arc<CurrentThreadExecutor>,
  draining: bool,
  _generation: RuntimeGenerationGuard,
}

impl CurrentThreadHostTurn {
  fn drive(&mut self) {
    let executor = Arc::clone(&self.executor);
    executor.drive_admitted_host_turn(self);
  }

  fn release_draining(&mut self) {
    if !self.draining {
      return;
    }
    let _scheduler = self
      .executor
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    self.executor.draining.store(false, Ordering::Release);
    self.draining = false;
  }
}

impl Drop for CurrentThreadHostTurn {
  fn drop(&mut self) {
    let mut scheduler = self
      .executor
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if self.draining {
      self.executor.draining.store(false, Ordering::Release);
      self.draining = false;
    }
    scheduler.active_host_turns = scheduler
      .active_host_turns
      .checked_sub(1)
      .expect("CurrentThread active host-turn count underflow");
    self.executor.scheduler_idle.notify_all();
  }
}

/// Retains one admitted CurrentThread host callback in its runtime generation.
///
/// The host must keep this opaque lease alive until its native callback has
/// acknowledged or failed the delivery and destroyed every callback-owned
/// payload. The `Rc` marker prevents moving a TLS generation guard to another
/// thread before it restores the callback thread's prior runtime identity.
#[must_use = "the host callback lease must outlive delivery completion and callback payloads"]
pub struct CurrentThreadTaskCallbackLease {
  _host_turn: CurrentThreadHostTurn,
  _not_send: std::marker::PhantomData<std::rc::Rc<()>>,
}

impl CurrentThreadTaskCallbackLease {
  fn new(host_turn: CurrentThreadHostTurn) -> Self {
    Self {
      _host_turn: host_turn,
      _not_send: std::marker::PhantomData,
    }
  }
}

struct CurrentThreadDispatchCall<'a> {
  executor: &'a CurrentThreadExecutor,
  publication: Option<u64>,
  _generation: RuntimeGenerationGuard,
}

impl CurrentThreadDispatchCall<'_> {
  fn finish_publication(&mut self, scheduler: &mut CurrentThreadSchedulerState) {
    let dispatch = self
      .publication
      .expect("the CurrentThread dispatch call must own a publication");
    let index = scheduler
      .dispatch_publications
      .iter()
      .position(|publication| publication.dispatch == dispatch)
      .expect("the CurrentThread dispatch publication must remain registered");
    scheduler.dispatch_publications.swap_remove(index);
    self.publication = None;
  }
}

impl Drop for CurrentThreadDispatchCall<'_> {
  fn drop(&mut self) {
    let mut scheduler = self
      .executor
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if let Some(dispatch) = self.publication.take()
      && let Some(index) = scheduler
        .dispatch_publications
        .iter()
        .position(|publication| publication.dispatch == dispatch)
    {
      scheduler.dispatch_publications.swap_remove(index);
    }
    scheduler.active_dispatch_calls = scheduler
      .active_dispatch_calls
      .checked_sub(1)
      .expect("CurrentThread active dispatch-call count underflow");
    self.executor.scheduler_idle.notify_all();
  }
}

thread_local! {
  /// Depth of the `CurrentThreadExecutor::schedule` frames on this thread that
  /// a waker could have entered. `async-task` runs its scheduler callback for
  /// two different reasons: a wake, which any `Waker` can raise from any stack,
  /// and the very first schedule of a freshly submitted task, which `spawn`
  /// makes on its caller's own stack. Only the wake can arrive while a foreign
  /// mutex is held (`futures::Shared` wakes its awaiters under its `wakers`
  /// lock), so only `schedule` enters this scope; `schedule_submission` does
  /// not. A nonzero depth therefore marks a stack that may be a waker's, and
  /// nothing that destroys user futures inline may run on it: their destructors
  /// can re-lock that same mutex.
  static CURRENT_THREAD_SCHEDULE_DEPTH: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
}

/// RAII marker for one waker-reachable `CurrentThreadExecutor::schedule` frame;
/// see `CURRENT_THREAD_SCHEDULE_DEPTH`.
struct CurrentThreadScheduleScope;

impl CurrentThreadScheduleScope {
  fn enter() -> Self {
    CURRENT_THREAD_SCHEDULE_DEPTH.with(|depth| {
      depth.set(
        depth
          .get()
          .checked_add(1)
          .expect("CurrentThread schedule depth exhausted"),
      );
    });
    Self
  }

  /// True while this thread is inside `schedule`: the stack may be a waker's.
  fn is_active() -> bool {
    CURRENT_THREAD_SCHEDULE_DEPTH.with(|depth| depth.get() != 0)
  }
}

impl Drop for CurrentThreadScheduleScope {
  fn drop(&mut self) {
    CURRENT_THREAD_SCHEDULE_DEPTH.with(|depth| {
      depth.set(
        depth
          .get()
          .checked_sub(1)
          .expect("CurrentThread schedule depth underflow"),
      );
    });
  }
}

thread_local! {
  /// Set while this thread is inside the retirement publication a waker-stack
  /// terminal failure issues for itself; see
  /// `CurrentThreadExecutor::request_rejected_work_retirement`. That
  /// publication calls the host driver again, so a runnable another thread
  /// queues meanwhile can drive a nested terminal transition on this same
  /// stack. Without this flag the nested transition would publish again, and a
  /// producer that keeps queueing work could recurse the stack without bound.
  ///
  /// It is thread-local, not per-executor: the bound it enforces is a stack
  /// bound. A terminal transition on ANOTHER thread finds this flag clear and
  /// keeps publishing its own continuation, which is what it should do -- its
  /// stack is its own.
  ///
  /// A nested transition records nothing when it returns. What it owes is
  /// executor state, not a message: it moved work into `queue.rejected` and
  /// consumed the dispatch that was outstanding, and the owning frame re-reads
  /// exactly that (`needs_rejected_work_retirement_dispatch`) before each of
  /// its turns. A separate "requested" flag used to carry it and could be
  /// discarded -- by a nested call whose request the owner never took, and
  /// then by the owner itself when the attempt budget ran out under it.
  static CURRENT_THREAD_RETIRING_REJECTED_WORK: std::cell::Cell<bool> =
    const { std::cell::Cell::new(false) };
}

/// RAII marker for the frame that owns this thread's retirement publication;
/// see `CURRENT_THREAD_RETIRING_REJECTED_WORK`.
struct CurrentThreadRejectedWorkRetirementScope;

impl CurrentThreadRejectedWorkRetirementScope {
  /// `None` when this thread is already publishing a retirement turn. The
  /// caller returns without publishing, and loses nothing by it: what it owes
  /// is the executor state the owning frame re-reads before its next turn.
  fn enter() -> Option<Self> {
    CURRENT_THREAD_RETIRING_REJECTED_WORK.with(|active| {
      if active.replace(true) {
        // The owning frame keeps the flag. Do not write this as `then_some`:
        // its argument is eager, so the guard would be constructed here and
        // its destructor would clear the owner's flag on the way out.
        return None;
      }
      Some(Self)
    })
  }
}

impl Drop for CurrentThreadRejectedWorkRetirementScope {
  fn drop(&mut self) {
    CURRENT_THREAD_RETIRING_REJECTED_WORK.with(|active| active.set(false));
  }
}

struct CurrentThreadDispatchCancellationGuard<'a>(&'a CurrentThreadExecutor);

impl Drop for CurrentThreadDispatchCancellationGuard<'_> {
  fn drop(&mut self) {
    self
      .0
      .cancelling_failed_dispatch
      .store(false, Ordering::Release);
  }
}

enum CurrentThreadDispatchFailureAction<'a> {
  None,
  Cancel(CurrentThreadDispatchCancellationGuard<'a>),
  Publish {
    dispatch: u64,
    call: CurrentThreadDispatchCall<'a>,
  },
}

struct CurrentThreadDispatchFailureRecovery<'a> {
  action: CurrentThreadDispatchFailureAction<'a>,
  _registry_cancellation: CurrentThreadRegistryCancellationGuard<'a>,
}

struct CurrentThreadRegistryCancellationGuard<'a> {
  registry: &'a CurrentThreadTaskDriverRegistry,
  failure: Option<CurrentThreadTaskDispatchFailure>,
}

impl CurrentThreadRegistryCancellationGuard<'_> {
  fn new(
    registry: &CurrentThreadTaskDriverRegistry,
    failure: CurrentThreadTaskDispatchFailure,
  ) -> CurrentThreadRegistryCancellationGuard<'_> {
    CurrentThreadRegistryCancellationGuard {
      registry,
      failure: Some(failure),
    }
  }
}

impl Drop for CurrentThreadRegistryCancellationGuard<'_> {
  fn drop(&mut self) {
    if let Some(failure) = self.failure.take() {
      let _ = catch_unwind_contained(|| self.registry.finish_cancellation(failure));
    }
  }
}

struct CurrentThreadBlockingGuard<'a> {
  executor: &'a CurrentThreadExecutor,
  owner: BlockingOwnerToken,
  previous_owner: Option<BlockingOwnerToken>,
  owns_lane: bool,
}

impl CurrentThreadBlockingGuard<'_> {
  fn counts_active_lane(&self) -> bool {
    self.owns_lane
  }
}

impl Drop for CurrentThreadBlockingGuard<'_> {
  fn drop(&mut self) {
    BLOCKING_OWNER.with(|current| current.set(self.previous_owner));
    if !self.owns_lane {
      return;
    }
    let mut state = self
      .executor
      .blocking_admission
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    debug_assert_eq!(state.owner, Some(self.owner));
    state.owner = None;
    drop(state);
    self.executor.stop.wake_all();
  }
}

impl CurrentThreadExecutor {
  /// Bound one host callback so a self-waking task cannot monopolize the
  /// JavaScript event loop. Remaining work is continued in a fresh host turn.
  const HOST_TURN_RUNNABLE_BUDGET: usize = 64;
  /// Force one blocking turn after this many consecutive runnable polls.
  #[cfg(napi_runtime_os_threads)]
  const RUNNABLE_FAIRNESS_QUANTUM: usize = 16;
  /// How many retirement turns one waker-stack terminal failure may take --
  /// the turns another thread's submissions can inflate. The one offer nothing
  /// can inflate follows them; see `request_rejected_work_retirement`.
  const REJECTED_WORK_RETIREMENT_ATTEMPTS: usize = 8;

  /// Build-default construction, kept for the pre-existing unit tests
  /// (production goes through [`Self::with_detection`] in
  /// `RuntimeBackend::new`, which also resolves the env deadline).
  #[cfg(test)]
  fn new(metrics: Arc<RuntimeMetrics>) -> Self {
    Self::with_detection(metrics, THREADLESS_BUILD, None)
  }

  /// Full constructor for the deadlock-detection knobs: `new` fixes
  /// `threadless` to the build's [`THREADLESS_BUILD`] with the deadline off;
  /// `RuntimeBackend::new` resolves the deadline from
  /// `RuntimeOptions::park_deadline` / [`PARK_DEADLINE_ENV`]; tests inject a
  /// native `threadless` stand-in and short deadlines through it.
  #[cfg(test)]
  fn with_detection(
    metrics: Arc<RuntimeMetrics>,
    threadless: bool,
    park_deadline: Option<Duration>,
  ) -> Self {
    Self::with_generation(
      metrics,
      threadless,
      park_deadline,
      u64::MAX,
      Arc::new(GenerationStop::default()),
    )
  }

  fn with_generation(
    metrics: Arc<RuntimeMetrics>,
    threadless: bool,
    park_deadline: Option<Duration>,
    generation: u64,
    stop: Arc<GenerationStop>,
  ) -> Self {
    Self {
      id: next_unique_id(
        &NEXT_RUNTIME_EXECUTOR_ID,
        "async runtime executor id space exhausted",
      ),
      generation,
      stop,
      queue: Mutex::new(CurrentThreadQueue {
        closed: false,
        runnables: VecDeque::new(),
        rejected: Vec::new(),
        #[cfg(napi_runtime_os_threads)]
        rejected_blocking: Vec::new(),
      }),
      blocking_admission: CurrentThreadBlockingAdmission {
        state: Mutex::new(CurrentThreadBlockingAdmissionState {
          owner: None,
          closed: false,
          #[cfg(napi_runtime_os_threads)]
          queue: BlockingQueue {
            closed: false,
            head: None,
            tail: None,
            jobs: FxHashMap::default(),
          },
        }),
      },
      draining: AtomicBool::new(false),
      scheduler_idle_lock: Mutex::new(CurrentThreadSchedulerState::default()),
      scheduler_idle: Condvar::new(),
      dispatch_pending: AtomicU64::new(0),
      recovery_dispatch: AtomicU64::new(0),
      cancelling_failed_dispatch: AtomicBool::new(false),
      task_dispatch: dispatch_current_thread_tasks,
      task_drivers: &CURRENT_THREAD_TASK_DRIVERS,
      metrics,
      threadless,
      park_deadline,
      host_timers: Arc::new(HostTimerRegistry::default()),
      generation_work: ArcSwapOption::empty(),
    }
  }

  fn attach_generation_work(&self, work: &Arc<GenerationWork>) {
    self.generation_work.store(Some(Arc::clone(work)));
  }

  /// Whether `queue.rejected` (or `queue.rejected_blocking`) holds work the
  /// executor still owes a cancellation.
  fn has_rejected_work(&self) -> bool {
    self.rejected_work_pending(PendingRead::Locked)
  }

  /// [`Self::has_rejected_work`]; `read` decides whether it may wait for the
  /// queue lock.
  fn rejected_work_pending(&self, read: PendingRead) -> bool {
    read.read(&self.queue, |queue| {
      #[cfg(napi_runtime_os_threads)]
      let has_rejected_blocking = !queue.rejected_blocking.is_empty();
      #[cfg(not(napi_runtime_os_threads))]
      let has_rejected_blocking = false;
      !queue.rejected.is_empty() || has_rejected_blocking
    })
  }

  /// The predicate `wait_until_scheduler_idle` sleeps on, read without
  /// sleeping; `read` decides whether it may wait for the scheduler lock.
  fn scheduler_work_pending(&self, read: PendingRead) -> bool {
    read.read(&self.scheduler_idle_lock, |idle| {
      idle.active_host_turns != 0 || idle.active_dispatch_calls != 0
    })
  }

  /// Cancel every rejected runnable and blocking job. Runs on the caller's
  /// stack with no executor lock held; the caller must not be inside a waker
  /// invocation (see `CurrentThreadQueue::rejected`). Dropping a runnable can
  /// wake a parked task whose schedule is rejected again (the queue closed,
  /// or a nested terminal transition moved it here), so drain until nothing
  /// remains. This terminates: every drop closes one task for good, so the
  /// closed-queue rejections are bounded by the live tasks, and a nested
  /// transition needs two more host-failed deliveries of its own.
  fn retire_rejected_work(&self) {
    if !self.has_rejected_work() {
      return;
    }
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    loop {
      #[cfg(napi_runtime_os_threads)]
      let (rejected, rejected_blocking) = {
        let mut queue = self
          .queue
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        if queue.rejected.is_empty() && queue.rejected_blocking.is_empty() {
          return;
        }
        (
          std::mem::take(&mut queue.rejected),
          std::mem::take(&mut queue.rejected_blocking),
        )
      };
      #[cfg(not(napi_runtime_os_threads))]
      let rejected = {
        let mut queue = self
          .queue
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        if queue.rejected.is_empty() {
          return;
        }
        std::mem::take(&mut queue.rejected)
      };
      for runnable in rejected {
        let _ = catch_unwind_contained(|| drop(runnable));
      }
      #[cfg(napi_runtime_os_threads)]
      for job in rejected_blocking {
        let _ = catch_unwind_contained(|| drop(job));
      }
    }
  }

  /// Host-side entry points (a host turn, delivery completion, driver
  /// registration or unregistration, drain requests) retire rejected work
  /// here. They are clean stacks unless the host called back synchronously
  /// from inside a publication that a waker's `schedule` started; that case
  /// leaves the work for the next entry.
  fn retire_rejected_work_off_waker_stack(&self) {
    if CurrentThreadScheduleScope::is_active() {
      return;
    }
    self.retire_rejected_work();
  }

  /// Whether the executor still owes its rejected work a continuation: work is
  /// parked in `queue.rejected` (or `queue.rejected_blocking`) and no host
  /// dispatch is outstanding to bring the clean stack that retires it.
  ///
  /// This is the whole state a retirement turn acts on. Nothing else needs to
  /// be remembered across a turn, on this thread or on the executor: a nested
  /// terminal transition that ran inside a turn's publication changed exactly
  /// these two things (it moved more work aside and consumed the dispatch),
  /// so re-reading them is the same as being told.
  fn needs_rejected_work_retirement_dispatch(&self) -> bool {
    self.dispatch_pending.load(Ordering::Acquire) == 0 && self.has_rejected_work()
  }

  /// The continuation a terminal failure reached on a waker's stack owes
  /// itself.
  ///
  /// That branch of `cancel_work_after_host_dispatch_failure` may not destroy
  /// anything where it stands, so it parks the work in `queue.rejected` and
  /// reopens. Reopening alone is not a continuation: the transition consumed
  /// the executor's one outstanding host request (`dispatch_pending` is 0) and
  /// left the queue empty, so `has_serviceable_work` is false and nothing --
  /// not `request_drain_if_work_remains`, not a wake of an already-parked task
  /// -- publishes again. A wake that loses both of its publications therefore
  /// produced no host turn at all, and the parked runnables kept their
  /// `GenerationWorkGuard`s and their `JoinHandle`s forever.
  ///
  /// A host turn is the clean stack that retires them: `drive_admitted_host_turn`
  /// calls `retire_rejected_work_off_waker_stack` before it polls anything. So
  /// ask for one, and keep asking while the host refuses and the work is still
  /// owed a stack -- the host is racing its own teardown, not necessarily dead,
  /// and a refusal says nothing about the driver that answers next (a second
  /// registered host, or the same one once its delivery backlog clears).
  ///
  /// What may be published on this stack is bounded, in two different ways,
  /// because there are two different things to bound.
  ///
  /// * `REJECTED_WORK_RETIREMENT_ATTEMPTS` bounds the turns a PRODUCER can
  ///   inflate. Each turn calls the driver again, so another thread can queue
  ///   a runnable while the publication is in flight; the host can then fail
  ///   that delivery and the replacement it reserves for the new work, and a
  ///   second terminal transition runs nested on this stack. It may not
  ///   publish where it stands -- that is what would recurse without bound --
  ///   so `CURRENT_THREAD_RETIRING_REJECTED_WORK` sends it back, and this
  ///   frame takes its next turn instead. Every such turn is two more host
  ///   callbacks and two more producer submissions, and the producer's own
  ///   drain request coalesces behind the publication already in flight, so it
  ///   never runs dry: measured without a budget, 32768 submissions produced
  ///   32769 deliveries inside one wake, and a producer left running for 400ms
  ///   held this single `schedule` callback -- and the `futures::Shared`
  ///   `wakers` mutex under it -- for 432ms. Eight turns cap that at 16 host
  ///   callbacks, a small constant to run under a foreign lock; two turns are
  ///   all the known interleaving needs.
  /// * `publish_final_rejected_work_retirement` bounds nothing, because
  ///   nothing can inflate it. It is the one delivery this stack offers with
  ///   the terminal-cancellation claim held, so no producer can interleave
  ///   with it and no nested transition can consume it. It is what the budget
  ///   may not be allowed to swallow: a producer that queues its last runnable
  ///   inside the eighth turn spends the budget and then goes quiescent, and
  ///   without this offer a host that would have accepted the very next
  ///   delivery is never asked, leaving the `JoinHandle`s pending and their
  ///   `GenerationWorkGuard`s held until unrelated work or shutdown arrives.
  ///
  /// * One ordinary publication follows an ACCEPTED final offer whose dispatch
  ///   the host consumed on this stack. A driver may claim, drive and
  ///   acknowledge the delivery inside `dispatch`, and that turn can do
  ///   nothing: it is on this waker's stack, so
  ///   `retire_rejected_work_off_waker_stack` returns at nonzero depth, and the
  ///   claim is still held, so `take_runnable` returns `None`. All it did was
  ///   take the continuation. The state it leaves -- work parked, no dispatch
  ///   outstanding -- is the state a REFUSED offer leaves, so it is owed the
  ///   same thing, and the same condition
  ///   (`needs_rejected_work_retirement_dispatch`) says so. The executor is
  ///   open again by then, which is what `5857092f` reopened it for, so this
  ///   takes the ordinary path. It is one publication and not a loop: a
  ///   terminal transition nested inside it finds
  ///   `CURRENT_THREAD_RETIRING_REJECTED_WORK` held by this frame and publishes
  ///   nothing, and this frame is returning.
  ///
  /// So the turns stop at the first of: a dispatch outstanding (a delivery the
  /// host accepted, or one it failed and replaced, is the continuation --
  /// `drive_admitted_host_turn` retires on it), nothing left owed, no live
  /// host, and the budget -- and the budget is followed by the final offer,
  /// which is followed by one ordinary publication if the host took it without
  /// leaving the work a stack.
  ///
  /// Nothing is destroyed here: this adds no `retire_rejected_work` call. A
  /// nested transition inside any of these publications still sees the outer
  /// `CurrentThreadScheduleScope` and takes the waker branch, and the
  /// `complete_current_thread_task_delivery` the driver runs there reaches only
  /// `retire_rejected_work_off_waker_stack`, which returns at nonzero depth.
  ///
  /// When the host refuses the final offer too -- or consumes it and then the
  /// publication that follows it, never leaving this waker's stack -- that is
  /// terminal by construction and honest: the work waits for the next host that
  /// registers
  /// (`request_drain_if_queued` retires before it publishes) or for shutdown
  /// (`begin_shutdown`, `wait_until_idle_retiring`, `wait_until_scheduler_idle`,
  /// `Drop`). With no host that accepts there is no stack on which user futures
  /// may be destroyed. Handing them to a helper thread was rejected --
  /// threadless wasm has none, and host-affine futures must be destroyed on a
  /// host or shutdown thread.
  ///
  /// Rejected alternatives: a time budget -- it leaves the number of host
  /// callbacks open, pins nothing an assertion can check, and reads a clock on
  /// a stack meant to do as little as possible; yielding the thread -- it does
  /// not release the producer's mutex, which is the thing being held; parking
  /// the leftover need on the executor for the next depth-0 entry -- those
  /// entries already retire `queue.rejected` unconditionally, and in the
  /// interleaving that needs it there is no next entry at all, which is why
  /// the continuation has to be a delivery; and making EVERY turn a claimed
  /// one like the final offer -- it is uninflatable for the same reason it
  /// cancels a runnable that races it, and paying that for the ordinary turns
  /// would undo what `5857092f` reopened the executor for.
  fn request_rejected_work_retirement(self: &Arc<Self>) {
    if !self.has_rejected_work() {
      return;
    }
    let Some(_retirement) = CurrentThreadRejectedWorkRetirementScope::enter() else {
      // Nested inside this thread's own retirement publication. Publishing
      // here is what would recurse the stack; the frame that owns the
      // publication takes the next turn, and reads what this one moved aside
      // off the executor rather than off a flag.
      return;
    };
    for _ in 0..Self::REJECTED_WORK_RETIREMENT_ATTEMPTS {
      if !self.needs_rejected_work_retirement_dispatch() {
        return;
      }
      if matches!(
        self.request_drain_with(next_current_thread_dispatch_id),
        CurrentThreadDispatchRequest::Unavailable
      ) {
        // Stopping, or no live driver: there is no host to offer anything to.
        return;
      }
    }
    if self.publish_final_rejected_work_retirement()
      && self.needs_rejected_work_retirement_dispatch()
    {
      // The host ACCEPTED the offer and consumed its dispatch without leaving
      // the work a stack: a turn it claims and drives inside `dispatch` runs
      // on this same waker's stack, where `retire_rejected_work_off_waker_stack`
      // returns at nonzero depth, and it runs with the claim held, where
      // `take_runnable` returns `None`. Such a turn can do nothing at all; all
      // it did was take the continuation. The state it left is the state a
      // refused offer leaves, and the invariant is the same, so it is owed the
      // same thing: work is parked and no dispatch is outstanding, so publish
      // one.
      //
      // This is the ordinary publication path -- the executor is open again,
      // which is what `5857092f` reopened it for -- and it is made once, not
      // looped. It cannot recurse: a terminal transition nested inside it
      // finds `CURRENT_THREAD_RETIRING_REJECTED_WORK` held by this frame and
      // publishes nothing, and this frame has already returned its budget. A
      // host that consumes this one on the waker's stack too has never left
      // that stack, which is the limit already documented above: with no host
      // turn on a clean stack there is nowhere to destroy a user future.
      let _ = self.request_drain_with(next_current_thread_dispatch_id);
    }
  }

  /// The one delivery this stack offers that a producer cannot inflate, made
  /// after `REJECTED_WORK_RETIREMENT_ATTEMPTS` turns were spent without
  /// leaving a dispatch outstanding.
  ///
  /// It holds the terminal-cancellation claim across the host callback. That
  /// claim is what makes it terminal rather than the ninth of an unbounded
  /// series: `schedule` consults it under the queue lock and parks a racing
  /// runnable in `queue.rejected` instead of queueing it, so no serviceable
  /// work can appear during the publication, and
  /// `begin_host_dispatch_failure_transition_locked` returns `None` while it is
  /// held, so a failure of this delivery reserves no replacement and reaches no
  /// terminal transition. One host callback, no recursion, no budget needed.
  ///
  /// A runnable that does race it is cancelled with the work already parked
  /// rather than queued. That is the same outcome the nested terminal
  /// transitions in the turns above give it, and this is reached only after
  /// the host has refused every one of them.
  ///
  /// Returns whether the host ACCEPTED the offer. An accepted offer is not by
  /// itself a continuation: a driver may claim, drive and acknowledge the
  /// delivery inside `dispatch`, and that turn runs on this waker's stack with
  /// the claim held, so it can neither retire (`retire_rejected_work_off_waker_stack`
  /// returns at nonzero depth) nor drain (`take_runnable` returns `None` while
  /// the claim is held) -- it only consumes `dispatch_pending`. The caller
  /// re-reads `needs_rejected_work_retirement_dispatch` and publishes once more
  /// when that happened.
  fn publish_final_rejected_work_retirement(self: &Arc<Self>) -> bool {
    if !self.needs_rejected_work_retirement_dispatch() {
      return false;
    }
    let Some(cancelling) = self.begin_failed_dispatch_cancellation() else {
      // Another terminal transition owns the executor; it carries its own
      // continuation.
      return false;
    };
    let dispatch = next_current_thread_dispatch_id();
    let dispatch_call = {
      let mut scheduler = self.lock_scheduler_for_publication();
      self.dispatch_pending.store(dispatch, Ordering::Release);
      self
        .begin_host_dispatch_publication(&mut scheduler, dispatch)
        .expect("a fresh CurrentThread retirement dispatch must own its publication")
    };
    let result = self.publish_host_dispatch(dispatch, dispatch_call);
    {
      // Reopen while holding the queue lock, the way the transition does:
      // `schedule` consults the flag under it, so every runnable parked during
      // the publication is already in `queue.rejected` when the executor opens.
      let _queue = self
        .queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      drop(cancelling);
    }
    // Those parked runnables carry their `GenerationWorkGuard`s and were
    // pushed without notifying; a waiting shutdown retires them on its stack.
    if let Some(work) = self.generation_work.load_full() {
      work.notify_idle_waiters();
    }
    result == CurrentThreadHostDispatchResult::Accepted
  }

  fn fresh_owner_token(&self) -> BlockingOwnerToken {
    BlockingOwnerToken {
      executor_id: self.id,
      frame: next_unique_id(
        &NEXT_BLOCKING_FRAME,
        "blocking owner frame id space exhausted",
      ),
    }
  }

  fn enter_blocking_owner(
    &self,
    owner: BlockingOwnerToken,
    owns_lane: bool,
  ) -> CurrentThreadBlockingGuard<'_> {
    let previous_owner = BLOCKING_OWNER.with(|current| current.replace(Some(owner)));
    CurrentThreadBlockingGuard {
      executor: self,
      owner,
      previous_owner,
      owns_lane,
    }
  }

  fn schedule_blocking<F, T>(
    self: &Arc<Self>,
    function: F,
    registration: GenerationWorkGuard,
  ) -> JoinHandle<T>
  where
    F: FnOnce() -> T + Send + 'static,
    T: Send + 'static,
  {
    // See the implementation notes in this crate's README.
    self.metrics.blocking_scheduled();
    let mut function = Some(function);
    let mut registration = Some(registration);
    let ambient_owner = BLOCKING_OWNER
      .with(std::cell::Cell::get)
      .filter(|owner| owner.executor_id == self.id);
    let mut run_owner = None;
    let mut owns_lane = false;
    let mut rejected = false;

    #[cfg(napi_runtime_os_threads)]
    let (sender, receiver) = oneshot::channel();
    #[cfg(napi_runtime_os_threads)]
    let dependency = BlockingDependency {
      job: BlockingJobId(next_unique_id(
        &NEXT_BLOCKING_JOB_ID,
        "blocking job id space exhausted",
      )),
      owner: ambient_owner,
    };
    #[cfg(napi_runtime_os_threads)]
    let mut queued = false;

    {
      let mut state = self
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      #[cfg(all(test, napi_runtime_os_threads))]
      run_current_thread_blocking_claim_test_hook();
      // Shutdown publishes generation stop before taking this mutex. Recheck
      // it while admission is serialized so work cannot claim or queue for the
      // CurrentThread lane after stop publication.
      if self.stop.is_stopping()
        || state.closed
        || self.cancelling_failed_dispatch.load(Ordering::Acquire)
      {
        rejected = true;
      } else if ambient_owner.is_some() && state.owner == ambient_owner {
        run_owner = ambient_owner;
      } else {
        #[cfg(napi_runtime_os_threads)]
        let queue_empty = state.queue.is_empty();
        #[cfg(not(napi_runtime_os_threads))]
        let queue_empty = true;

        if state.owner.is_none() && queue_empty {
          let owner = self.fresh_owner_token();
          state.owner = Some(owner);
          run_owner = Some(owner);
          owns_lane = true;
        } else {
          #[cfg(napi_runtime_os_threads)]
          {
            let function = function
              .take()
              .expect("blocking function must be available");
            let registration = registration
              .take()
              .expect("blocking registration must be available");
            let generation = self.generation;
            let function = RegisteredBlockingFunction::new(function, registration, generation);
            state.queue.push(QueuedBlocking {
              id: dependency.job,
              run: Box::new(move || {
                let _generation = RuntimeGenerationGuard::enter(generation);
                let result = function
                  .run()
                  .map(|output| ContainedTaskOutput::new(output, generation));
                let _ = sender.send(result);
              }),
            });
            queued = true;
          }
          #[cfg(not(napi_runtime_os_threads))]
          {
            // This arm is threadless by construction: without
            // `napi_runtime_os_threads` no second thread exists to reach
            // unrelated concurrent admission. Same-stack nesting carries
            // `ambient_owner` and takes the borrowing branch above. On
            // `wasm32-wasip1-threads` a second thread DOES reach here, which
            // is why that target takes the queueing branch instead.
            rejected = true;
          }
        }
      }
    }

    #[cfg(napi_runtime_os_threads)]
    if queued {
      self.stop.wake_all();
      if self.has_serviceable_blocking_work() && !self.draining.load(Ordering::Acquire) {
        self.request_drain();
      }
      return JoinHandle(JoinHandleInner::Blocking {
        receiver,
        dependency,
        published: PublishedBlockingDependencies::default(),
      });
    }

    if rejected {
      let _generation = RuntimeGenerationGuard::enter(self.generation);
      let _ = catch_unwind_contained(|| drop(function.take()));
      drop(registration.take());
      return JoinHandle(JoinHandleInner::Ready(Some(Err(JoinError {
        message: "the async runtime stopped before the blocking task could start".to_string(),
      }))));
    }

    let owner = run_owner.expect("accepted CurrentThread blocking work must own or borrow a lane");
    let blocking = self.enter_blocking_owner(owner, owns_lane);
    let _registration = registration
      .take()
      .expect("blocking registration must be available");
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let result = {
      let _task = self.metrics.blocking_started(blocking.counts_active_lane());
      on_thread_handoff();
      catch_unwind_join_error(
        function
          .take()
          .expect("blocking function must be available"),
      )
    }
    .map(|output| ContainedTaskOutput::new(output, self.generation));
    drop(blocking);
    #[cfg(napi_runtime_os_threads)]
    if owns_lane && !self.draining.load(Ordering::Acquire) {
      // An admitted host turn already owns a bounded queue driver. Let its
      // outer loop service the released FIFO so blocking work cannot bypass
      // the host-turn budget and monopolize the JavaScript event loop.
      self.service_queued_blocking_work();
    }
    JoinHandle(JoinHandleInner::Ready(Some(result)))
  }

  #[cfg(napi_runtime_os_threads)]
  fn take_queued_blocking(
    &self,
  ) -> Option<(
    Box<dyn FnOnce() + Send + 'static>,
    CurrentThreadBlockingGuard<'_>,
  )> {
    let (job, owner) = {
      let mut state = self
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      #[cfg(all(test, napi_runtime_os_threads))]
      run_current_thread_blocking_claim_test_hook();
      if self.stop.is_stopping()
        || state.closed
        || self.cancelling_failed_dispatch.load(Ordering::Acquire)
        || state.owner.is_some()
      {
        return None;
      }
      let job = state.queue.pop_front()?;
      let owner = self.fresh_owner_token();
      state.owner = Some(owner);
      (job, owner)
    };
    Some((job, self.enter_blocking_owner(owner, true)))
  }

  #[cfg(napi_runtime_os_threads)]
  fn run_one_blocking(&self) -> bool {
    let Some((job, blocking)) = self.take_queued_blocking() else {
      return false;
    };
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    {
      let _task = self.metrics.blocking_started(true);
      let _ = catch_unwind_contained(job);
    }
    drop(blocking);
    true
  }

  #[cfg(napi_runtime_os_threads)]
  fn service_queued_blocking_work(&self) {
    while self.run_one_blocking() {}
  }

  #[cfg(napi_runtime_os_threads)]
  fn has_serviceable_blocking_work(&self) -> bool {
    let state = self
      .blocking_admission
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    !state.closed && state.owner.is_none() && !state.queue.is_empty()
  }

  #[cfg(napi_runtime_os_threads)]
  fn try_run_owned_blocking(&self, dependency: &TaskDependency) -> bool {
    let Some(ambient_owner) = BLOCKING_OWNER
      .with(std::cell::Cell::get)
      .filter(|owner| owner.executor_id == self.id)
    else {
      return false;
    };
    let Some(current) = dependency.select_for_owner(ambient_owner) else {
      return false;
    };
    let job = {
      let mut state = self
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      #[cfg(all(test, napi_runtime_os_threads))]
      run_current_thread_blocking_claim_test_hook();
      if self.stop.is_stopping()
        || state.closed
        || self.cancelling_failed_dispatch.load(Ordering::Acquire)
        || state.owner != Some(ambient_owner)
      {
        return false;
      }
      if dependency.try_claim(&current) {
        state.queue.remove(current.publication.dependency.job)
      } else {
        None
      }
    };
    let Some(job) = job else {
      return false;
    };
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let _task = self.metrics.blocking_started(false);
    let _ = catch_unwind_contained(job);
    true
  }

  fn close_blocking_admission(&self) {
    #[cfg(napi_runtime_os_threads)]
    let queued = {
      let mut state = self
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.closed = true;
      state.queue.closed = true;
      state.queue.take_all()
    };
    #[cfg(not(napi_runtime_os_threads))]
    {
      let mut state = self
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.closed = true;
    }
    #[cfg(napi_runtime_os_threads)]
    for job in queued {
      let _ = catch_unwind_contained(|| drop(job));
    }
  }

  #[cfg(test)]
  fn with_task_dispatch(
    metrics: Arc<RuntimeMetrics>,
    task_dispatch: fn(u64) -> CurrentThreadHostDispatchResult,
  ) -> Self {
    Self::with_task_dispatch_registry(metrics, task_dispatch, &CURRENT_THREAD_TASK_DRIVERS)
  }

  #[cfg(test)]
  fn with_task_dispatch_registry(
    metrics: Arc<RuntimeMetrics>,
    task_dispatch: fn(u64) -> CurrentThreadHostDispatchResult,
    task_drivers: &'static CurrentThreadTaskDriverRegistry,
  ) -> Self {
    let mut executor = Self::new(metrics);
    executor.task_dispatch = task_dispatch;
    executor.task_drivers = task_drivers;
    executor
  }

  /// A wake, or any other schedule whose stack the executor does not own.
  /// `async-task` hands every `Waker::wake` to this callback, so the frame may
  /// belong to a producer that is holding its own mutex; see
  /// `CURRENT_THREAD_SCHEDULE_DEPTH`.
  fn schedule(self: &Arc<Self>, runnable: Runnable) {
    let _scope = CurrentThreadScheduleScope::enter();
    self.schedule_runnable(runnable);
  }

  /// The first schedule of a freshly submitted task, made by the caller of
  /// `spawn` on its own stack. No waker is involved, so a terminal dispatch
  /// failure reached from here may cancel the rejected work inline -- and it
  /// must, because a submission that publishes no host delivery has no other
  /// continuation: nothing would ever reach `retire_rejected_work`, and the
  /// returned `JoinHandle` would stay pending with its generation guard held.
  fn schedule_submission(self: &Arc<Self>, runnable: Runnable) {
    self.schedule_runnable(runnable);
  }

  fn schedule_runnable(self: &Arc<Self>, runnable: Runnable) {
    self.metrics.runnable_scheduled();
    {
      let mut queue = self
        .queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      // Never drop a rejected runnable here: that destroys the future inline
      // on the waker's thread, and a waker can be invoked while its producer
      // holds a mutex that this future's destructor needs (`futures::Shared`
      // wakes under its `wakers` lock and its clone re-locks it on drop).
      if queue.closed {
        // A wake can be in flight when shutdown starts: `async-task` marks
        // the task SCHEDULED before it invokes this closure, so the abort
        // that `close_and_abort` issues coalesces with the in-flight wake and
        // `begin_shutdown` closes the queue without waiting for it to land.
        // The runnable still owns its `GenerationWorkGuard`; hand it to the
        // shutdown side and wake the generation's idle waiter to retire it.
        self
          .metrics
          .queued_runnables
          .fetch_sub(1, Ordering::Relaxed);
        queue.rejected.push(runnable);
        drop(queue);
        if let Some(work) = self.generation_work.load_full() {
          work.notify_idle_waiters();
        }
        return;
      }
      if self.cancelling_failed_dispatch.load(Ordering::Acquire) {
        // A terminal failure transition is claimed but has not yet moved the
        // queue and reopened (it does both under this lock): the runnable
        // joins the work that transition cancels.
        self
          .metrics
          .queued_runnables
          .fetch_sub(1, Ordering::Relaxed);
        queue.rejected.push(runnable);
        return;
      }
      queue.runnables.push_back(runnable);
    }
    // Queue work and only then wake an explicit block_on driver. This is still
    // enqueue-only with respect to the wake caller: polling happens on the
    // driver's thread, never inline from an arbitrary waker invocation.
    self.stop.wake_all();
    if !self.draining.load(Ordering::Acquire) {
      self.request_drain();
    }
  }

  /// Ask the host to enter a fresh JavaScript turn before polling queued work.
  ///
  /// A `Waker` may be invoked while its producer holds an internal mutex
  /// (`futures::Shared` does this). Polling inline from the scheduler callback
  /// can then re-enter that future and self-deadlock on the same mutex. Once a
  /// host dispatcher has accepted work, this executor stays host-driven for
  /// the rest of its generation; a temporarily missing env leaves work queued
  /// for the next registration or for shutdown cancellation.
  fn request_drain(self: &Arc<Self>) {
    let _ = self.request_drain_with(next_current_thread_dispatch_id);
  }

  fn lock_scheduler_for_publication(&self) -> MutexGuard<'_, CurrentThreadSchedulerState> {
    #[cfg(all(test, napi_runtime_os_threads))]
    match self.scheduler_idle_lock.try_lock() {
      Ok(scheduler) => scheduler,
      Err(std::sync::TryLockError::WouldBlock) => {
        run_current_thread_dispatch_publication_blocked_test_hook();
        self
          .scheduler_idle_lock
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
      }
      Err(std::sync::TryLockError::Poisoned(error)) => error.into_inner(),
    }
    #[cfg(any(not(test), not(napi_runtime_os_threads)))]
    self
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
  }

  fn request_drain_with(
    self: &Arc<Self>,
    next_dispatch: impl FnOnce() -> u64,
  ) -> CurrentThreadDispatchRequest {
    let mut scheduler = self.lock_scheduler_for_publication();
    if self.stop.is_stopping() || self.cancelling_failed_dispatch.load(Ordering::Acquire) {
      return CurrentThreadDispatchRequest::Unavailable;
    }
    if self.draining.load(Ordering::Acquire) || self.dispatch_pending.load(Ordering::Acquire) != 0 {
      return CurrentThreadDispatchRequest::Coalesced;
    }
    let dispatch = next_dispatch();
    if self
      .dispatch_pending
      .compare_exchange(0, dispatch, Ordering::AcqRel, Ordering::Acquire)
      .is_err()
    {
      return CurrentThreadDispatchRequest::Coalesced;
    }
    let dispatch_call = self
      .begin_host_dispatch_publication(&mut scheduler, dispatch)
      .expect("a fresh CurrentThread dispatch must own its publication");
    drop(scheduler);
    match self.publish_host_dispatch(dispatch, dispatch_call) {
      CurrentThreadHostDispatchResult::Accepted | CurrentThreadHostDispatchResult::Failed(_) => {
        CurrentThreadDispatchRequest::Accepted
      }
      CurrentThreadHostDispatchResult::Unavailable => CurrentThreadDispatchRequest::Unavailable,
    }
  }

  fn claim_dispatch_call<'a>(
    &'a self,
    scheduler: &mut CurrentThreadSchedulerState,
  ) -> CurrentThreadDispatchCall<'a> {
    let generation = RuntimeGenerationGuard::enter(self.generation);
    let active_dispatch_calls = scheduler
      .active_dispatch_calls
      .checked_add(1)
      .expect("CurrentThread active dispatch-call count exhausted");
    scheduler.active_dispatch_calls = active_dispatch_calls;
    CurrentThreadDispatchCall {
      executor: self,
      publication: None,
      _generation: generation,
    }
  }

  fn begin_host_dispatch_publication<'a>(
    &'a self,
    scheduler: &mut CurrentThreadSchedulerState,
    dispatch: u64,
  ) -> Option<CurrentThreadDispatchCall<'a>> {
    // See the implementation notes in this crate's README.
    if let Some(publication) = scheduler
      .dispatch_publications
      .iter_mut()
      .find(|publication| publication.dispatch == dispatch)
    {
      publication.republish_requested = true;
      return None;
    }
    let mut dispatch_call = self.claim_dispatch_call(scheduler);
    scheduler
      .dispatch_publications
      .push(CurrentThreadDispatchPublication {
        dispatch,
        republish_requested: false,
      });
    dispatch_call.publication = Some(dispatch);
    Some(dispatch_call)
  }

  fn publish_host_dispatch(
    self: &Arc<Self>,
    dispatch: u64,
    mut dispatch_call: CurrentThreadDispatchCall<'_>,
  ) -> CurrentThreadHostDispatchResult {
    let mut panic_payload = RetainedPanicPayload::default();
    loop {
      let result = match catch_unwind(AssertUnwindSafe(|| {
        #[cfg(all(test, napi_runtime_os_threads))]
        run_current_thread_dispatch_call_test_hook();
        let result = (self.task_dispatch)(dispatch);
        #[cfg(all(test, napi_runtime_os_threads))]
        run_current_thread_dispatch_returned_test_hook();
        result
      })) {
        Ok(result) => Some(result),
        Err(payload) => {
          panic_payload.capture(payload);
          None
        }
      };

      let step = catch_unwind(AssertUnwindSafe(|| {
        let (republish, cancelling, failure, result) = {
          let mut scheduler = self
            .scheduler_idle_lock
            .lock()
            .unwrap_or_else(std::sync::PoisonError::into_inner);
          let index = scheduler
            .dispatch_publications
            .iter()
            .position(|publication| publication.dispatch == dispatch)
            .expect("the CurrentThread dispatch publication must remain registered");
          let dispatch_remains_pending = self.dispatch_pending.load(Ordering::Acquire) == dispatch;
          let republish = dispatch_remains_pending
            && !self.stop.is_stopping()
            && !self.cancelling_failed_dispatch.load(Ordering::Acquire)
            && scheduler.dispatch_publications[index].republish_requested;
          if republish {
            if let Some(CurrentThreadHostDispatchResult::Failed(failure)) = result {
              let _ = self.task_drivers.rearm_failed_publication(failure);
            }
            scheduler.dispatch_publications[index].republish_requested = false;
            (true, None, None, result)
          } else {
            dispatch_call.finish_publication(&mut scheduler);
            let failure = if let Some(CurrentThreadHostDispatchResult::Failed(failure)) = result {
              #[cfg(all(test, napi_runtime_os_threads))]
              run_current_thread_failed_publication_retired_test_hook();
              self.begin_host_dispatch_failure_locked(&mut scheduler, failure)
            } else {
              None
            };
            let cancelling = (result == Some(CurrentThreadHostDispatchResult::Unavailable)
              && dispatch_remains_pending)
              .then(|| self.retire_unavailable_host_dispatch_locked(dispatch))
              .flatten();
            let result = if result == Some(CurrentThreadHostDispatchResult::Unavailable)
              && !dispatch_remains_pending
            {
              // A synchronous callback may already have consumed, cancelled, or
              // superseded this exact capability.
              Some(CurrentThreadHostDispatchResult::Accepted)
            } else {
              result
            };
            (false, cancelling, failure, result)
          }
        };

        if republish {
          return CurrentThreadDispatchPublicationStep::Republish;
        }
        if let Some(cancelling) = cancelling {
          self.cancel_work_after_host_dispatch_failure(cancelling);
        }
        if let Some(failure) = failure {
          self.run_host_dispatch_failure(failure.action);
        }
        CurrentThreadDispatchPublicationStep::Complete(result)
      }));

      match step {
        Ok(CurrentThreadDispatchPublicationStep::Republish) => {}
        Ok(CurrentThreadDispatchPublicationStep::Complete(result)) => {
          if panic_payload.is_some() {
            panic_payload.resume();
          }
          return result
            .expect("a CurrentThread host dispatch without a result must resume its panic");
        }
        Err(payload) => {
          panic_payload.capture(payload);
          panic_payload.resume();
        }
      }
    }
  }

  fn claim_host_turn(
    self: &Arc<Self>,
    scheduler: &mut CurrentThreadSchedulerState,
  ) -> CurrentThreadHostTurn {
    scheduler.active_host_turns = scheduler
      .active_host_turns
      .checked_add(1)
      .expect("CurrentThread active host-turn count exhausted");
    self.draining.store(true, Ordering::Release);
    CurrentThreadHostTurn {
      executor: Arc::clone(self),
      draining: true,
      _generation: RuntimeGenerationGuard::enter(self.generation),
    }
  }

  fn try_admit_host_turn(self: &Arc<Self>, dispatch: u64) -> Option<CurrentThreadHostTurn> {
    let mut scheduler = self
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if self.stop.is_stopping() || self.draining.load(Ordering::Acquire) {
      return None;
    }
    if dispatch == 0
      || self
        .dispatch_pending
        .compare_exchange(dispatch, 0, Ordering::AcqRel, Ordering::Acquire)
        .is_err()
    {
      return None;
    }
    #[cfg(all(test, napi_runtime_os_threads))]
    run_current_thread_dispatch_claim_test_hook();
    let _ =
      self
        .recovery_dispatch
        .compare_exchange(dispatch, 0, Ordering::AcqRel, Ordering::Acquire);
    Some(self.claim_host_turn(&mut scheduler))
  }

  #[cfg(test)]
  fn try_admit_host_turn_without_dispatch(self: &Arc<Self>) -> Option<CurrentThreadHostTurn> {
    let mut scheduler = self
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if self.stop.is_stopping() || self.draining.load(Ordering::Acquire) {
      return None;
    }
    Some(self.claim_host_turn(&mut scheduler))
  }

  #[cfg(test)]
  fn drive_host_turn(self: &Arc<Self>) {
    let dispatch = self.dispatch_pending.load(Ordering::Acquire);
    let host_turn = if dispatch == 0 {
      self.try_admit_host_turn_without_dispatch()
    } else {
      self.try_admit_host_turn(dispatch)
    };
    if let Some(mut host_turn) = host_turn {
      host_turn.drive();
    }
  }

  #[cfg(test)]
  fn drive_host_turn_for_dispatch(self: &Arc<Self>, dispatch: u64) {
    if let Some(mut host_turn) = self.try_admit_host_turn(dispatch) {
      host_turn.drive();
    }
  }

  /// Drive a host turn whose scheduler role was claimed while the controller
  /// still held the lifecycle mutex. See
  /// the implementation notes in this crate's README.
  fn drive_admitted_host_turn(self: &Arc<Self>, host_turn: &mut CurrentThreadHostTurn) {
    // A host turn is the continuation a terminal failure on a waker's stack
    // relies on: cancel the work it moved aside before polling anything new.
    self.retire_rejected_work_off_waker_stack();
    #[cfg(napi_runtime_os_threads)]
    let mut runnable_streak = 0usize;
    for _ in 0..Self::HOST_TURN_RUNNABLE_BUDGET {
      #[cfg(napi_runtime_os_threads)]
      if runnable_streak >= Self::RUNNABLE_FAIRNESS_QUANTUM {
        runnable_streak = 0;
        if self.run_one_blocking() {
          continue;
        }
      }
      if self.drain_one() {
        #[cfg(napi_runtime_os_threads)]
        {
          runnable_streak += 1;
        }
        continue;
      }
      #[cfg(napi_runtime_os_threads)]
      if self.run_one_blocking() {
        runnable_streak = 0;
        continue;
      }
      break;
    }
    // A bounded turn releases queue-drain exclusivity before publishing its
    // continuation, but remains an active host turn until that publication
    // returns. Shutdown waits for the latter lifecycle role, not merely the
    // former exclusivity bit.
    host_turn.release_draining();
    self.request_drain_if_work_remains();
  }

  fn request_drain_if_queued(self: &Arc<Self>) {
    self.retire_rejected_work_off_waker_stack();
    if !self.has_serviceable_work() {
      return;
    }
    let mut scheduler = self.lock_scheduler_for_publication();
    if self.stop.is_stopping()
      || self.cancelling_failed_dispatch.load(Ordering::Acquire)
      || self.draining.load(Ordering::Acquire)
    {
      return;
    }
    let dispatch = self.dispatch_pending.load(Ordering::Acquire);
    if dispatch == 0 {
      drop(scheduler);
      self.request_drain_if_work_remains();
      return;
    }

    // A newly registered host joins the existing all-host race through its own
    // delivery token. Reusing the executor capability preserves every other
    // host's accepted attempt and lets old registration tokens fail closed.
    let Some(dispatch_call) = self.begin_host_dispatch_publication(&mut scheduler, dispatch) else {
      return;
    };
    drop(scheduler);
    let _ = self.publish_host_dispatch(dispatch, dispatch_call);
  }

  fn retire_unavailable_host_dispatch_locked(
    &self,
    dispatch: u64,
  ) -> Option<CurrentThreadDispatchCancellationGuard<'_>> {
    if self
      .dispatch_pending
      .compare_exchange(dispatch, 0, Ordering::AcqRel, Ordering::Acquire)
      .is_err()
    {
      return None;
    }
    if self
      .recovery_dispatch
      .compare_exchange(dispatch, 0, Ordering::AcqRel, Ordering::Acquire)
      .is_ok()
    {
      self.begin_failed_dispatch_cancellation()
    } else {
      None
    }
  }

  fn cancel_host_dispatch(self: &Arc<Self>, failure: CurrentThreadTaskDispatchFailure) {
    // See the implementation notes in this crate's README.
    let failure = {
      let mut scheduler = self
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      self.begin_host_dispatch_failure_locked(&mut scheduler, failure)
    };
    if let Some(failure) = failure {
      self.run_host_dispatch_failure(failure.action);
    }
    self.retire_rejected_work_off_waker_stack();
  }

  fn begin_host_dispatch_failure_locked<'a>(
    &'a self,
    scheduler: &mut CurrentThreadSchedulerState,
    failure: CurrentThreadTaskDispatchFailure,
  ) -> Option<CurrentThreadDispatchFailureRecovery<'a>> {
    if !self.task_drivers.is_current_failure(failure) {
      return None;
    }
    let registry_cancellation =
      CurrentThreadRegistryCancellationGuard::new(self.task_drivers, failure);
    let action = self.begin_host_dispatch_failure_transition_locked(scheduler, failure.dispatch);
    Some(CurrentThreadDispatchFailureRecovery {
      action,
      _registry_cancellation: registry_cancellation,
    })
  }

  fn begin_host_dispatch_failure_transition_locked<'a>(
    &'a self,
    scheduler: &mut CurrentThreadSchedulerState,
    dispatch: u64,
  ) -> CurrentThreadDispatchFailureAction<'a> {
    if dispatch == 0
      || self
        .dispatch_pending
        .compare_exchange(dispatch, 0, Ordering::AcqRel, Ordering::Acquire)
        .is_err()
    {
      return CurrentThreadDispatchFailureAction::None;
    }
    #[cfg(all(test, napi_runtime_os_threads))]
    run_current_thread_dispatch_recovery_test_hook();

    if self
      .recovery_dispatch
      .compare_exchange(dispatch, 0, Ordering::AcqRel, Ordering::Acquire)
      .is_ok()
    {
      // The one fresh-turn replacement failed too. Polling inline here would
      // re-enter the host callback, while another retry could spin forever.
      // Claim terminal cancellation before allowing another publication.
      return self.begin_failed_dispatch_cancellation().map_or(
        CurrentThreadDispatchFailureAction::None,
        CurrentThreadDispatchFailureAction::Cancel,
      );
    }

    if self.stop.is_stopping()
      || self.cancelling_failed_dispatch.load(Ordering::Acquire)
      || self.draining.load(Ordering::Acquire)
      || !self.has_serviceable_work()
    {
      return CurrentThreadDispatchFailureAction::None;
    }

    // Consume the failed capability and reserve its sole replacement while
    // publication is excluded. A newly registered host can only join this
    // tagged replacement, never publish an untagged dispatch in between.
    let replacement = next_current_thread_dispatch_id();
    self.recovery_dispatch.store(replacement, Ordering::Release);
    self.dispatch_pending.store(replacement, Ordering::Release);
    let dispatch_call = self
      .begin_host_dispatch_publication(scheduler, replacement)
      .expect("a reserved CurrentThread replacement must own its publication");
    CurrentThreadDispatchFailureAction::Publish {
      dispatch: replacement,
      call: dispatch_call,
    }
  }

  #[cfg(test)]
  fn cancel_host_dispatch_for_test(self: &Arc<Self>, dispatch: u64) {
    let failure = {
      let mut scheduler = self
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      self.begin_host_dispatch_failure_transition_locked(&mut scheduler, dispatch)
    };
    self.run_host_dispatch_failure(failure);
  }

  fn run_host_dispatch_failure(self: &Arc<Self>, failure: CurrentThreadDispatchFailureAction<'_>) {
    match failure {
      CurrentThreadDispatchFailureAction::None => {}
      CurrentThreadDispatchFailureAction::Cancel(cancelling) => {
        self.cancel_work_after_host_dispatch_failure(cancelling);
      }
      CurrentThreadDispatchFailureAction::Publish { dispatch, call } => {
        let _ = self.publish_host_dispatch(dispatch, call);
      }
    }
  }

  fn has_serviceable_work(&self) -> bool {
    let has_queued_runnable = {
      let queue = self
        .queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      !queue.closed && !queue.runnables.is_empty()
    };
    #[cfg(napi_runtime_os_threads)]
    let has_queued_blocking = self.has_serviceable_blocking_work();
    #[cfg(not(napi_runtime_os_threads))]
    let has_queued_blocking = false;
    has_queued_runnable || has_queued_blocking
  }

  fn request_drain_if_work_remains(self: &Arc<Self>) {
    if self.has_serviceable_work() && !self.draining.load(Ordering::Acquire) {
      self.request_drain();
    }
  }

  fn begin_failed_dispatch_cancellation(
    &self,
  ) -> Option<CurrentThreadDispatchCancellationGuard<'_>> {
    if self
      .cancelling_failed_dispatch
      .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
      .is_err()
    {
      return None;
    }
    self.dispatch_pending.store(0, Ordering::Release);
    self.recovery_dispatch.store(0, Ordering::Release);
    Some(CurrentThreadDispatchCancellationGuard(self))
  }

  /// Terminal failure transition. The work queued at this point (runnables
  /// and blocking jobs) is what the failure cancels. It is MOVED into the
  /// rejected lists under the queue lock, with its `queued_runnables` debit,
  /// and what happens next depends on the stack:
  ///
  /// * On a clean stack -- a host entry point, or the submission `spawn` made
  ///   on its caller's own stack -- the rejected work is dropped right here,
  ///   with the executor still closed so that the tasks those drops wake are
  ///   rejected and cancelled with it, and the executor reopens under the
  ///   queue lock once nothing remains. This is the observable behaviour
  ///   terminal cancellation always had: queued work and everything it wakes
  ///   settle at once, and no later host work is published. A submission whose
  ///   two publications both failed has no other continuation -- it produced no
  ///   host turn -- so cancelling here is what keeps its `JoinHandle` from
  ///   staying pending forever with its generation guard held.
  /// * On a waker's stack (reached through `schedule`, whose publication the
  ///   host failed synchronously) nothing may be dropped: the waker's
  ///   producer may hold a lock the destructors re-lock. The executor reopens
  ///   at once instead -- staying closed would leave it without a continuation
  ///   while the driver stays registered -- and then publishes one fresh host
  ///   dispatch of its own (`request_rejected_work_retirement`). That turn is
  ///   the clean stack on which `retire_rejected_work` cancels the moved work;
  ///   without it a wake that lost both of its publications left no request
  ///   behind at all, and the moved runnables kept their `JoinHandle`s and
  ///   `GenerationWorkGuard`s until an unrelated entry happened to arrive.
  ///
  /// This cannot repeat unboundedly inside one `schedule`. Reaching here
  /// again needs a fresh publication and two more host-failed deliveries, and
  /// the queue is already empty once the move is done; the publications
  /// `request_rejected_work_retirement` makes are the only way such a fresh
  /// publication can start on this stack, and
  /// `CURRENT_THREAD_RETIRING_REJECTED_WORK` keeps a nested transition from
  /// publishing there -- it returns, and the frame that owns the publication
  /// reads what it moved aside off the executor and takes the next turn. Those
  /// turns stop at `REJECTED_WORK_RETIREMENT_ATTEMPTS`, so a sustained
  /// producer cannot turn this stack into a service loop, and are followed by
  /// the one offer a producer cannot inflate; see
  /// `request_rejected_work_retirement`.
  fn cancel_work_after_host_dispatch_failure(
    self: &Arc<Self>,
    cancelling: CurrentThreadDispatchCancellationGuard<'_>,
  ) {
    let mut cancelling = Some(cancelling);
    // Blocking work first: the claimed flag blocks admission and claims, so
    // nothing can join or leave the FIFO between this take and the reopen.
    #[cfg(napi_runtime_os_threads)]
    let queued_blocking = {
      let mut state = self
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.queue.take_all()
    };
    {
      let mut queue = self
        .queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let moved = u64::try_from(queue.runnables.len()).expect("queued runnable count overflow");
      // Rejected runnables carry their `queued_runnables` debit already.
      self
        .metrics
        .queued_runnables
        .fetch_sub(moved, Ordering::Relaxed);
      let runnables = std::mem::take(&mut queue.runnables);
      queue.rejected.extend(runnables);
      #[cfg(napi_runtime_os_threads)]
      queue.rejected_blocking.extend(queued_blocking);
      if CurrentThreadScheduleScope::is_active() {
        // Reopen while holding the queue lock: `schedule` consults the flag
        // under this same lock, so every runnable this transition rejects is
        // already in the list, and every later schedule is queued and
        // published.
        drop(cancelling.take());
        drop(queue);
        // The moved runnables still own their `GenerationWorkGuard`s; a
        // waiting shutdown retires them on its own stack.
        if let Some(work) = self.generation_work.load_full() {
          work.notify_idle_waiters();
        }
        // During normal operation there is no such waiter, and this branch
        // published no host delivery. Ask for the host turn that retires the
        // moved work: it is the only continuation this stack may leave behind.
        self.request_rejected_work_retirement();
        return;
      }
    }

    // Clean stack: cancel now. Dropping a runnable can wake a parked task
    // whose schedule `schedule` then rejects into `queue.rejected` (the flag
    // is still set); drop those too, outside any lock, until none remain.
    // Reopen while holding the queue lock, so no runnable can be rejected
    // after the final pass.
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    loop {
      #[cfg(napi_runtime_os_threads)]
      let (rejected, rejected_blocking) = {
        let mut queue = self
          .queue
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        if queue.rejected.is_empty() && queue.rejected_blocking.is_empty() {
          drop(cancelling.take());
          break;
        }
        (
          std::mem::take(&mut queue.rejected),
          std::mem::take(&mut queue.rejected_blocking),
        )
      };
      #[cfg(not(napi_runtime_os_threads))]
      let rejected = {
        let mut queue = self
          .queue
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        if queue.rejected.is_empty() {
          drop(cancelling.take());
          break;
        }
        std::mem::take(&mut queue.rejected)
      };
      for runnable in rejected {
        let _ = catch_unwind_contained(|| drop(runnable));
      }
      #[cfg(napi_runtime_os_threads)]
      for job in rejected_blocking {
        let _ = catch_unwind_contained(|| drop(job));
      }
    }
  }

  fn take_runnable(&self) -> Option<Runnable> {
    // Terminal dispatch cancellation publishes while holding `scheduler_idle_lock`;
    // generation shutdown publishes while holding `stop.publication`. Claiming
    // under both locks gives each publication one exact ordering edge with the
    // runnable queue. The guards are released before polling user code.
    let scheduler = self
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    #[cfg(all(test, napi_runtime_os_threads))]
    run_current_thread_runnable_claim_test_hook();
    let stop_publication = self.stop.publication_guard();
    if stop_publication.is_stopping() || self.cancelling_failed_dispatch.load(Ordering::Acquire) {
      return None;
    }
    let runnable = {
      let mut queue = self
        .queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if queue.closed {
        None
      } else {
        queue.runnables.pop_front()
      }
    };
    drop(stop_publication);
    drop(scheduler);
    runnable
  }

  fn drain_one(&self) -> bool {
    let runnable = self.take_runnable();
    if let Some(runnable) = runnable {
      #[cfg(napi_runtime_os_threads)]
      let _non_owner = BlockingOwnerGuard::enter(None);
      run_runnable(&self.metrics, runnable);
      true
    } else {
      false
    }
  }

  /// Drive `future` to completion on this thread, draining queued runnables
  /// between polls. This loop OWNS its park site: the future is polled with
  /// this frame's own [`DriverParker`] as its waker, so the park DECISION can
  /// inspect the wake token directly instead of handing it to
  /// `futures::executor::block_on`'s opaque parker:
  ///
  ///   * `Pending` + queue empty + wake token pending: a self-waking future
  ///     (the `PendThenReady` shape) -- consume the token and re-poll. NOT a
  ///     park, NOT a deadlock; panic only at the park decision, never at
  ///     Pending-return.
  ///   * `Pending` + queue empty + NO token, threadless build: PROVABLE
  ///     deadlock -- no other thread exists that could ever deliver the wake
  ///     (the block_on-awaiting-JS class). Panic immediately with the typed
  ///     [`BlockOnDeadlock`] diagnostic. A pending HOST timer is no
  ///     rescue here: its `setTimeout` relay shares this very thread, so it
  ///     can never fire while the park holds it -- it only selects the
  ///     timer-backed variant of the same certain diagnostic.
  ///   * `Pending` + queue empty + NO token, threaded build: park. When a
  ///     `park_deadline` is armed, the park is bounded with progress-based
  ///     reset (see [`park_with_deadline`]) and panics typed if a full
  ///     window passes with zero runtime progress.
  fn block_on(self: &Arc<Self>, mut future: Pin<&mut dyn Future<Output = ()>>) -> BlockOnOutcome {
    let parker = Arc::new(DriverParker::default());
    let _stop_registration = self.stop.register(&parker);
    #[cfg(napi_runtime_os_threads)]
    let dependency = BlockOnDependencyGuard::enter(self.generation);
    let waker = std::task::Waker::from(Arc::clone(&parker));
    let mut cx = Context::from_waker(&waker);
    #[cfg(napi_runtime_os_threads)]
    let mut runnable_streak = 0usize;
    loop {
      if self.stop.is_stopping() {
        return BlockOnOutcome::Stopped;
      }
      #[cfg(napi_runtime_os_threads)]
      dependency.clear();
      on_thread_handoff();
      if future.as_mut().poll(&mut cx).is_ready() {
        return BlockOnOutcome::Completed;
      }
      // Shutdown must outrank queue work and self-wake permits. Otherwise an
      // always-self-waking future can continue before reaching the park-site
      // check forever while its generation work guard blocks quiescence.
      if self.stop.is_stopping() {
        return BlockOnOutcome::Stopped;
      }
      #[cfg(napi_runtime_os_threads)]
      if runnable_streak >= Self::RUNNABLE_FAIRNESS_QUANTUM {
        runnable_streak = 0;
        if self.try_run_owned_blocking(&dependency.dependency) || self.run_one_blocking() {
          continue;
        }
      }
      if self.drain_one() {
        #[cfg(napi_runtime_os_threads)]
        {
          runnable_streak += 1;
        }
        continue;
      }
      #[cfg(napi_runtime_os_threads)]
      if self.try_run_owned_blocking(&dependency.dependency) || self.run_one_blocking() {
        runnable_streak = 0;
        continue;
      }
      #[cfg(napi_runtime_os_threads)]
      {
        runnable_streak = 0;
      }
      // PARK DECISION: the future is Pending and the queue is empty. A token
      // stored during the poll (or by a racing thread) means a wake is
      // already pending: consume it and re-poll instead of parking.
      if parker.consume_permit() {
        continue;
      }
      // Threadless timer invariant: on a THREADLESS build even a pending
      // HOST timer is NOT a wake-token source -- the host event loop's
      // `setTimeout` relay can only run on the very thread that is about to
      // park, so it can never fire while `block_on` holds it. EVERY threadless
      // park at this decision is therefore provably dead; a pending timer only
      // selects the more precise diagnostic. Falling through instead would hit
      // `parker.park()`, which on the real target (wasm32-wasip1 no_threads
      // std) is an untyped "condvar wait not supported" abort -- a diagnostics
      // downgrade, never a rescue. (The deadline verdict's LIVE-wait veto
      // below stays: it serves the THREADED CT flavor, where the host loop
      // genuinely runs concurrently.)
      if self.threadless {
        if self.host_timers.has_pending() {
          std::panic::panic_any(BlockOnDeadlock::current_thread_certain_timer_backed());
        }
        std::panic::panic_any(BlockOnDeadlock::current_thread_certain());
      }
      match self.park_deadline {
        // A wake landing between `consume_permit` above and the park is
        // stored as the parker's permit, so `park` returns immediately --
        // never lost.
        None => parker.park(),
        Some(deadline) => match park_with_deadline(&parker, deadline, &self.metrics) {
          DeadlineParkOutcome::Woken => {}
          DeadlineParkOutcome::Expired(armed) => {
            // EXPIRY DECISION (CurrentThread has no parked-driver registry):
            // a wake can land in the instructions after the window
            // closed, and the fingerprint read inside `park_with_deadline`
            // is stale by now. Re-check both before declaring death; a hit
            // means the park was healthy -- continue the loop (re-poll,
            // drain, fresh full window on the next park). A LIVE host-timer
            // wait also vetoes, re-checked LAST -- arming a host timer bumps
            // no progress
            // counter, so it is invisible to the fingerprint read: waiting
            // out a host timer with zero progress is legitimate, its wake is
            // scheduled on the host loop. `deadline` doubles as the grace
            // for host firing lag; a timer past due by more than one full
            // window without firing is the frozen-JS-loop signature this
            // detection exists for, so it stops vetoing.
            if parker.consume_permit()
              || self.metrics.progress_fingerprint() != armed
              || self.host_timers.has_live_wait(deadline)
            {
              continue;
            }
            std::panic::panic_any(BlockOnDeadlock::current_thread_deadline(deadline));
          }
        },
      }
    }
  }

  fn begin_shutdown(&self) {
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    self.stop.begin_shutdown();
    self.close_blocking_admission();
    let (queued, rejected) = {
      let mut queue = self
        .queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      queue.closed = true;
      #[cfg(napi_runtime_os_threads)]
      let rejected_blocking = std::mem::take(&mut queue.rejected_blocking);
      let rejected = std::mem::take(&mut queue.rejected);
      #[cfg(napi_runtime_os_threads)]
      let rejected = (rejected, rejected_blocking);
      (std::mem::take(&mut queue.runnables), rejected)
    };
    self.dispatch_pending.store(0, Ordering::Release);
    self.recovery_dispatch.store(0, Ordering::Release);
    self.task_drivers.retire_for_shutdown();
    for runnable in queued {
      self
        .metrics
        .queued_runnables
        .fetch_sub(1, Ordering::Relaxed);
      // Dropping the last runnable cancels its detached async-task and retires
      // the generation guard. Isolate user future destructors from shutdown.
      let _ = catch_unwind_contained(|| drop(runnable));
    }
    // Rejected work (already unaccounted above) is cancelled by whichever
    // side takes it first: this one, or a host entry that got there earlier.
    #[cfg(napi_runtime_os_threads)]
    let (rejected, rejected_blocking) = rejected;
    for runnable in rejected {
      let _ = catch_unwind_contained(|| drop(runnable));
    }
    #[cfg(napi_runtime_os_threads)]
    for job in rejected_blocking {
      let _ = catch_unwind_contained(|| drop(job));
    }
    self.host_timers.shutdown();
  }

  fn wait_until_scheduler_idle(&self) {
    // Registered work has retired by now on the backend path; this catches
    // rejections from unregistered tasks (tests) before the executor goes.
    self.retire_rejected_work();
    let mut idle = self
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    while idle.active_host_turns != 0 || idle.active_dispatch_calls != 0 {
      idle = self
        .scheduler_idle
        .wait(idle)
        .unwrap_or_else(std::sync::PoisonError::into_inner);
    }
    debug_assert!(
      idle.dispatch_publications.is_empty(),
      "an idle CurrentThread scheduler must not retain dispatch publications"
    );
  }
}

// Identifies the executor whose Rayon pool owns THIS worker thread (or `None`
// when not on a pool worker). Used by `MultiThreadExecutor::block_on` to detect
// a re-entrant (on-pool) call OF THE SAME EXECUTOR and drive the queue
// cooperatively instead of parking the worker. Carrying the executor id (not a
// bare bool) keeps this marker scoped exactly like
// `BlockingOwnerToken.executor_id`: a worker of executor A that re-enters
// `block_on` on executor B must NOT be treated as B's on-pool driver -- it owns
// none of B's accounting, so it parks like any foreign-thread caller rather
// than driving B's queues as an unaccounted within-cap driver. Under the single
// global executor used in production these ids always match, so this is a
// defensive scoping gate (consistent with the blocking-owner machinery), not a
// reachable production change.
#[cfg(napi_runtime_os_threads)]
thread_local! {
  static ON_POOL_WORKER: std::cell::Cell<Option<u64>> = const { std::cell::Cell::new(None) };
  /// Identifies the dedicated timer thread for lifecycle self-wait
  /// prevention. It is deliberately separate from `ON_POOL_WORKER`: the
  /// timer thread must never become a cooperative Rayon scheduler driver.
  static ON_TIMER_THREAD: std::cell::Cell<Option<u64>> = const { std::cell::Cell::new(None) };
}

// Identifies scheduler-driver frames on a pool worker. Unlike
// `ON_POOL_WORKER`, this is not installed by Rayon's worker start hook:
// arbitrary nested Rayon jobs need cooperative `block_on` classification, but
// must not place work in the per-thread LIFO slot because no drain frame may
// remain to consume it after the Rayon job returns.
#[cfg(napi_runtime_os_threads)]
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
struct SchedulerDriverRole {
  executor_id: u64,
  can_run_blocking: bool,
}

#[cfg(napi_runtime_os_threads)]
thread_local! {
  static IN_SCHEDULER_DRIVER: std::cell::Cell<Option<SchedulerDriverRole>> =
    const { std::cell::Cell::new(None) };
}

// Per-worker LIFO slot (tokio-style): holds at most ONE
// runnable that was scheduled FROM this pool worker (typically a task the
// currently running runnable just woke). It is popped by this same thread's
// next drain/run_one iteration BEFORE the shared FIFO, so the hot
// wake-then-await ping-pong pattern stays on one core with no queue mutex, no
// wake and no drainer spawn. Tagged with the executor id -- the same scoping
// pattern as `ON_POOL_WORKER` and `BlockingOwnerToken.executor_id` -- so only
// drain/run_one/flush of the SAME executor may pop it.
//
// STRANDING INVARIANT: slot work is invisible to every other
// thread (`finish_draining`'s re-check and `wake_one` cannot see it), so the
// owning thread MUST either run its slot entry or flush it to the shared FIFO
// before it stops draining -- see the flush calls at `drain`'s returns, the
// pre-park flush in `cooperative_block_on`, and `LifoSlotFlushGuard` for
// unwinds. A runnable left here while the thread returns to rayon would be a
// silently lost task and a `queued_runnables` leak.
#[cfg(napi_runtime_os_threads)]
thread_local! {
  static LIFO_SLOT: std::cell::Cell<Option<(u64, Runnable)>> =
    const { std::cell::Cell::new(None) };
}

#[cfg(napi_runtime_os_threads)]
struct OnPoolWorkerGuard {
  previous_worker: Option<u64>,
  previous_driver: Option<SchedulerDriverRole>,
}

#[cfg(napi_runtime_os_threads)]
impl OnPoolWorkerGuard {
  // Save the previous marker and install `id`, so nested/re-entrant drains
  // (possibly from different executors on the same thread) restore the exact
  // prior executor id on drop instead of unconditionally clearing it.
  fn enter(id: u64) -> Self {
    Self::enter_with_role(id, true)
  }

  fn enter_with_role(id: u64, can_run_blocking: bool) -> Self {
    Self {
      previous_worker: ON_POOL_WORKER.with(|flag| flag.replace(Some(id))),
      previous_driver: IN_SCHEDULER_DRIVER.with(|flag| {
        flag.replace(Some(SchedulerDriverRole {
          executor_id: id,
          can_run_blocking,
        }))
      }),
    }
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for OnPoolWorkerGuard {
  fn drop(&mut self) {
    IN_SCHEDULER_DRIVER.with(|flag| flag.set(self.previous_driver));
    ON_POOL_WORKER.with(|flag| flag.set(self.previous_worker));
  }
}

// Identifies one specific counted-blocking owner frame on one specific executor.
//
// `executor_id` is assigned once per executor (so a stale token left on a
// thread by a shut-down executor can never authorize work on a replacement);
// `frame` is unique per blocking-lane entry. An owner frame is the eligibility
// half of dependency lending: the exact job half comes from the pending
// `JoinHandle` dependency recorded by the owning `block_on` frame. A plain
// runnable driver owns no frame, so it must respect normal blocking admission.
//
// CurrentThread uses the same identity to distinguish same-stack lane borrowing
// from cross-driver contention. MultiThread additionally reserves active owner
// frames while an otherwise-idle cooperative driver reuses their admitted lane.
#[derive(Clone, Copy, PartialEq, Eq, Debug, Hash)]
struct BlockingOwnerToken {
  executor_id: u64,
  frame: u64,
}

#[cfg(napi_runtime_os_threads)]
enum OwnedBlockingOutcome {
  Ineligible,
  OwnerBusy(BlockingOwnerToken),
  ReservationReleased {
    owner: BlockingOwnerToken,
    ran: bool,
  },
}

// Process-global owner-frame source for per-frame dependency-lending
// isolation. Executor ids use `NEXT_RUNTIME_EXECUTOR_ID` above on every target.
static NEXT_BLOCKING_FRAME: AtomicU64 = AtomicU64::new(1);
#[cfg(napi_runtime_os_threads)]
static NEXT_OWNER_RESERVATION: AtomicU64 = AtomicU64::new(1);

// The owner frame (if any) currently running a counted blocking closure on THIS
// thread. The exact frame identity scopes any over-cap dependency lending.
thread_local! {
  static BLOCKING_OWNER: std::cell::Cell<Option<BlockingOwnerToken>> =
    const { std::cell::Cell::new(None) };
}

// Save/replace/restore guard for `BLOCKING_OWNER`. Enter with `Some(token)` while
// running a counted blocking closure, or with `None` while a cooperative driver
// runs a plain queued runnable (ownership is LEXICAL to the blocking closure: a
// runnable an owner happens to drive via `run_one` is a logical non-owner and
// must not inherit the owner's over-cap privilege). Restored on drop, so the
// pattern is panic-safe even though `run_runnable` already catches panics.
#[cfg(napi_runtime_os_threads)]
struct BlockingOwnerGuard(Option<BlockingOwnerToken>);

#[cfg(napi_runtime_os_threads)]
impl BlockingOwnerGuard {
  fn enter(token: Option<BlockingOwnerToken>) -> Self {
    Self(BLOCKING_OWNER.with(|cell| cell.replace(token)))
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for BlockingOwnerGuard {
  fn drop(&mut self) {
    BLOCKING_OWNER.with(|cell| cell.set(self.0));
  }
}

#[cfg(napi_runtime_os_threads)]
#[derive(Default)]
struct ActiveBlockingOwners {
  // `None` is available; `Some(id)` is reserved by exactly that lending
  // transfer. The identity prevents a delayed stale drop from releasing a
  // newer reservation of the same owner frame.
  owners: Mutex<FxHashMap<BlockingOwnerToken, Option<u64>>>,
}

#[cfg(napi_runtime_os_threads)]
impl ActiveBlockingOwners {
  fn register(&self, owner: BlockingOwnerToken) {
    let previous = self
      .owners
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .insert(owner, None);
    debug_assert!(previous.is_none());
  }

  fn unregister(&self, owner: BlockingOwnerToken) {
    let removed = self
      .owners
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .remove(&owner);
    debug_assert!(removed.is_some());
  }

  fn reserve(&self, owner: BlockingOwnerToken) -> Option<u64> {
    let mut owners = self
      .owners
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let reservation = owners.get_mut(&owner)?;
    if reservation.is_some() {
      return None;
    }
    let id = next_unique_id(
      &NEXT_OWNER_RESERVATION,
      "blocking owner reservation id space exhausted",
    );
    *reservation = Some(id);
    Some(id)
  }

  fn release(&self, owner: BlockingOwnerToken, reservation: u64) {
    let mut owners = self
      .owners
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if let Some(current) = owners.get_mut(&owner)
      && *current == Some(reservation)
    {
      *current = None;
    }
  }

  fn is_available(&self, owner: BlockingOwnerToken) -> bool {
    self
      .owners
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .get(&owner)
      .is_some_and(Option::is_none)
  }
}

#[cfg(napi_runtime_os_threads)]
struct ActiveBlockingOwnerGuard<'a> {
  owners: &'a ActiveBlockingOwners,
  owner: BlockingOwnerToken,
}

#[cfg(napi_runtime_os_threads)]
impl<'a> ActiveBlockingOwnerGuard<'a> {
  fn enter(owners: &'a ActiveBlockingOwners, owner: BlockingOwnerToken) -> Self {
    owners.register(owner);
    Self { owners, owner }
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for ActiveBlockingOwnerGuard<'_> {
  fn drop(&mut self) {
    self.owners.unregister(self.owner);
  }
}

#[cfg(napi_runtime_os_threads)]
struct OwnerLaneReservation<'a> {
  owners: &'a ActiveBlockingOwners,
  owner: BlockingOwnerToken,
  reservation: u64,
}

#[cfg(napi_runtime_os_threads)]
impl<'a> OwnerLaneReservation<'a> {
  fn try_acquire(owners: &'a ActiveBlockingOwners, owner: BlockingOwnerToken) -> Option<Self> {
    let reservation = owners.reserve(owner)?;
    Some(Self {
      owners,
      owner,
      reservation,
    })
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for OwnerLaneReservation<'_> {
  fn drop(&mut self) {
    self.owners.release(self.owner, self.reservation);
  }
}

// A blocking job queued for the pool. Its stable id is copied into the returned
// JoinHandle and propagated through async JoinHandle dependencies, allowing a
// saturated owner to run exactly the job its nested block_on awaits.
#[cfg(napi_runtime_os_threads)]
type BlockingClosure = Box<dyn FnOnce() + Send + 'static>;

#[cfg(napi_runtime_os_threads)]
struct QueuedBlocking {
  id: BlockingJobId,
  run: BlockingClosure,
}

#[cfg(napi_runtime_os_threads)]
struct BlockingQueueNode {
  previous: Option<BlockingJobId>,
  next: Option<BlockingJobId>,
  run: Box<dyn FnOnce() + Send + 'static>,
}

#[cfg(napi_runtime_os_threads)]
struct BlockingQueue {
  closed: bool,
  head: Option<BlockingJobId>,
  tail: Option<BlockingJobId>,
  jobs: FxHashMap<BlockingJobId, BlockingQueueNode>,
}

#[cfg(napi_runtime_os_threads)]
impl BlockingQueue {
  fn push(&mut self, job: QueuedBlocking) {
    let previous = self.tail;
    let replaced = self.jobs.insert(
      job.id,
      BlockingQueueNode {
        previous,
        next: None,
        run: job.run,
      },
    );
    debug_assert!(replaced.is_none());
    if let Some(previous) = previous {
      self
        .jobs
        .get_mut(&previous)
        .expect("blocking queue tail must be indexed")
        .next = Some(job.id);
    } else {
      self.head = Some(job.id);
    }
    self.tail = Some(job.id);
  }

  fn pop_front(&mut self) -> Option<Box<dyn FnOnce() + Send + 'static>> {
    self.head.and_then(|id| self.remove(id))
  }

  fn remove(&mut self, id: BlockingJobId) -> Option<Box<dyn FnOnce() + Send + 'static>> {
    let node = self.jobs.remove(&id)?;
    if let Some(previous) = node.previous {
      self
        .jobs
        .get_mut(&previous)
        .expect("blocking queue predecessor must be indexed")
        .next = node.next;
    } else {
      self.head = node.next;
    }
    if let Some(next) = node.next {
      self
        .jobs
        .get_mut(&next)
        .expect("blocking queue successor must be indexed")
        .previous = node.previous;
    } else {
      self.tail = node.previous;
    }
    Some(node.run)
  }

  fn is_empty(&self) -> bool {
    debug_assert_eq!(self.head.is_none(), self.jobs.is_empty());
    debug_assert_eq!(self.tail.is_none(), self.jobs.is_empty());
    self.jobs.is_empty()
  }

  fn take_all(&mut self) -> Vec<Box<dyn FnOnce() + Send + 'static>> {
    self.head = None;
    self.tail = None;
    std::mem::take(&mut self.jobs)
      .into_values()
      .map(|node| node.run)
      .collect()
  }
}

#[cfg(napi_runtime_os_threads)]
struct WorkerLifecycle {
  remaining: Mutex<usize>,
  handles: Mutex<Option<Vec<std::thread::JoinHandle<()>>>>,
}

#[cfg(napi_runtime_os_threads)]
impl WorkerLifecycle {
  fn new(worker_threads: usize) -> Arc<Self> {
    Arc::new(Self {
      remaining: Mutex::new(worker_threads),
      handles: Mutex::new(Some(Vec::with_capacity(worker_threads))),
    })
  }

  fn retain(&self, handle: std::thread::JoinHandle<()>) {
    self
      .handles
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .as_mut()
      .expect("runtime worker handles already joined")
      .push(handle);
  }

  fn worker_exited(&self) {
    let mut remaining = self
      .remaining
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    *remaining = remaining
      .checked_sub(1)
      .expect("runtime worker exit count underflow");
  }

  fn wait_for_all_workers(&self) {
    let handles = self
      .handles
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .take()
      .expect("runtime worker handles already joined");
    for handle in handles {
      if let Err(payload) = crate::sync::join(handle) {
        discard_panic_payload(payload);
      }
    }
  }

  #[cfg(test)]
  fn remaining(&self) -> usize {
    *self
      .remaining
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
  }
}

#[cfg(napi_runtime_os_threads)]
struct MultiThreadExecutor {
  generation: u64,
  stop: Arc<GenerationStop>,
  // Stable per-executor id; tags owner tokens so a stale token from a shut-down
  // executor can never authorize an over-cap escape on a replacement.
  id: u64,
  pool: ThreadPool,
  // Lock-free MPMC injector replacing the former `Mutex<VecDeque<Runnable>>`.
  // Invariant: every push goes through `push_to_queue_and_wake` and every
  // emptiness check through `has_queued_runnable` -- their paired SeqCst fences
  // restore the removed mutex's synchronizes-with edge (full lost-wakeup proof
  // at `push_to_queue_and_wake`). A raw `injector.push`/`is_empty` at a new site
  // silently breaks the pairing.
  injector: Injector<Runnable>,
  blocking_queue: Mutex<BlockingQueue>,
  active_drainers: AtomicUsize,
  active_blocking: AtomicUsize,
  // Guards the idle-waiter count. `finish_draining` runs once per drain batch
  // -- i.e. per task whenever the drainer catches the producer -- and used to
  // call `notify_all` unconditionally. On Linux `Condvar::notify_all` issues a
  // `futex_wake_all` SYSCALL even with an empty waiter set, and the only waiter
  // site in this crate (`wait_until_scheduler_idle`) is reachable only from
  // shutdown/restart. Counting waiters under this same mutex lets the steady
  // state skip the syscall entirely.
  scheduler_idle_lock: Mutex<usize>,
  scheduler_idle: Condvar,
  worker_lifecycle: Arc<WorkerLifecycle>,
  // Registry of pool workers currently parked inside a re-entrant cooperative
  // `block_on`, woken ONE at a time when new queue work is scheduled. The pool
  // has a fixed number of OS threads, so a parked worker cannot rely on
  // `ensure_drainer` spawning a replacement (there is no free thread to run
  // it) -- it must wake and run the work itself. Future-wakes do NOT go
  // through this registry: each driver's own `DriverParker` is its awaited
  // future's waker (see the wake-domain note at `DriverParker`).
  parked_drivers: ParkedDrivers,
  active_blocking_owners: ActiveBlockingOwners,
  #[cfg(test)]
  owner_lending_attempts: AtomicUsize,
  // Linger-lifecycle observability for tests (see the idle-linger block in
  // `drain`): counts every linger-parker REGISTRATION into `parked_drivers`
  // and every idle-budget EXPIRY exit (the deadline-elapsed `break` paths,
  // counted AFTER the parker is deregistered, so `expiries` rising implies
  // the linger parker has permanently left the registry for that episode).
  // Tests that must observe a lingering drainer's full register->expire
  // lifecycle wait on these instead of sampling the non-monotonic registry
  // count, which is transiently at its settled value BEFORE the linger
  // parker registers.
  #[cfg(test)]
  drain_linger_registrations: AtomicUsize,
  #[cfg(test)]
  drain_linger_expiries: AtomicUsize,
  max_drainers: usize,
  max_blocking: usize,
  // Deadline-based deadlock detection for COOPERATIVE driver parks ONLY. The
  // foreign/napi whole-build park in `block_on`'s else-branch is exempt by
  // design because it parks for entire builds and a deadline there would
  // panic healthy production runs. Off unless
  // configured via `RuntimeOptions::park_deadline` (the embedder resolves
  // `PARK_DEADLINE_ENV` into it).
  park_deadline: Option<Duration>,
  // Idle-linger budget for pool drainers (`None` = disabled); resolved from
  // `RuntimeOptions::drain_linger` (`ZERO` = disabled, embedder-resolved from
  // `DRAIN_LINGER_ENV` at addon load) at construction and ceiling-clamped
  // there so even direct unvalidated test constructions stay bounded.
  drain_linger: Option<Duration>,
  // Shared with the timer heap because firing removes the timer before invoking
  // its waker. The admission remains active until that wake has published any
  // resulting runnable, so a final verdict cannot observe both sources empty.
  deadlock_state: Arc<MultiThreadDeadlockState>,
  // Runtime-owned timer heap plus its dedicated non-Rayon service thread.
  // Cooperative parks also fire due timers after timer-bounded waits.
  timers: TimerHeap,
  metrics: Arc<RuntimeMetrics>,
}

#[cfg(napi_runtime_os_threads)]
impl MultiThreadExecutor {
  /// Max work units before a drainer yields. Cooperative drivers use the same
  /// value as the LIFO streak cap.
  const RUNNABLE_BUDGET: usize = 64;
  /// Force one blocking admission after this many consecutive runnable polls
  /// when blocking capacity and queued work are both available.
  const RUNNABLE_FAIRNESS_QUANTUM: usize = 16;

  #[cfg(test)]
  fn new(
    options: &RuntimeOptions,
    metrics: Arc<RuntimeMetrics>,
  ) -> Result<Self, RuntimeConfigError> {
    Self::new_for_generation(
      options,
      metrics,
      u64::MAX,
      Arc::new(GenerationStop::default()),
    )
  }

  fn new_for_generation(
    options: &RuntimeOptions,
    metrics: Arc<RuntimeMetrics>,
    generation: u64,
    stop: Arc<GenerationStop>,
  ) -> Result<Self, RuntimeConfigError> {
    let id = next_unique_id(
      &NEXT_RUNTIME_EXECUTOR_ID,
      "async runtime executor id space exhausted",
    );
    let thread_name_prefix = options.thread_name_prefix.clone();
    let deadlock_state = Arc::new(MultiThreadDeadlockState::new(
      options.park_deadline.is_some(),
    ));
    let timers = TimerHeap::new(
      generation,
      id,
      format!("{thread_name_prefix}-timer"),
      Arc::clone(&deadlock_state),
    );
    // Production options are validated before construction, so this exact
    // physical count is also the configured/reported count. Direct executor
    // unit tests may still construct a one-thread topology intentionally.
    let pool_threads = options.worker_threads;
    let worker_lifecycle = WorkerLifecycle::new(pool_threads);
    let exit_lifecycle = Arc::clone(&worker_lifecycle);
    let spawn_lifecycle = Arc::clone(&worker_lifecycle);
    let pool = ThreadPoolBuilder::new()
      .num_threads(pool_threads)
      .thread_name(move |index| format!("{thread_name_prefix}-{index}"))
      .start_handler(move |_| {
        ON_POOL_WORKER.with(|worker| worker.set(Some(id)));
      })
      .exit_handler(move |_| {
        IN_SCHEDULER_DRIVER.with(|driver| {
          if driver.get().is_some_and(|role| role.executor_id == id) {
            driver.set(None);
          }
        });
        // Keep ON_POOL_WORKER set until the OS thread exits. TLS destructors
        // run after this Rayon hook and may re-enter lifecycle APIs while the
        // external shutdown caller is joining this worker; retaining the
        // executor identity makes that re-entry fail fast instead of waiting
        // in Stopping and deadlocking the join.
        exit_lifecycle.worker_exited();
      })
      .spawn_handler(move |thread| {
        let mut builder = std::thread::Builder::new();
        if let Some(name) = thread.name() {
          builder = builder.name(name.to_string());
        }
        if let Some(stack_size) = thread.stack_size() {
          builder = builder.stack_size(stack_size);
        }
        let handle = builder.spawn(move || thread.run())?;
        spawn_lifecycle.retain(handle);
        Ok(())
      })
      .build()
      .map_err(|error| {
        worker_lifecycle.wait_for_all_workers();
        RuntimeConfigError(format!("failed to create runtime workers: {error}"))
      })?;
    Ok(Self {
      generation,
      stop,
      id,
      pool,
      injector: Injector::new(),
      blocking_queue: Mutex::new(BlockingQueue {
        closed: false,
        head: None,
        tail: None,
        jobs: FxHashMap::default(),
      }),
      active_drainers: AtomicUsize::new(0),
      active_blocking: AtomicUsize::new(0),
      scheduler_idle_lock: Mutex::new(0),
      scheduler_idle: Condvar::new(),
      worker_lifecycle,
      parked_drivers: ParkedDrivers::default(),
      active_blocking_owners: ActiveBlockingOwners::default(),
      #[cfg(test)]
      owner_lending_attempts: AtomicUsize::new(0),
      #[cfg(test)]
      drain_linger_registrations: AtomicUsize::new(0),
      #[cfg(test)]
      drain_linger_expiries: AtomicUsize::new(0),
      max_drainers: pool_threads,
      max_blocking: options.max_blocking_tasks,
      park_deadline: options.park_deadline,
      drain_linger: {
        // Defensive re-clamp: production options were already clamped by
        // `RuntimeOptions::validate`, but direct executor unit tests construct
        // from unvalidated options.
        let budget = options.drain_linger.min(MAX_DRAIN_LINGER);
        (!budget.is_zero()).then_some(budget)
      },
      deadlock_state,
      timers,
      metrics,
    })
  }

  fn begin_deadlock_admission(&self) -> Option<MultiThreadDeadlockAdmissionGuard> {
    self.deadlock_state.begin_admission()
  }

  fn try_begin_deadlock_verdict(&self) -> Option<MultiThreadDeadlockVerdictGuard> {
    self.deadlock_state.try_begin_verdict()
  }

  fn wake_one_owner_dependency(&self, owner: BlockingOwnerToken) -> bool {
    // See the implementation notes in this crate's README.
    let _publication = self.deadlock_state.owner_handoff_publication_guard();
    self.parked_drivers.wake_one_owner_dependency(owner)
  }

  fn release_owner_lane_and_wake(&self, reservation: OwnerLaneReservation<'_>) -> bool {
    let owner = reservation.owner;
    // Keep release and its targeted handoff in one detector-visible critical
    // section. Unwind drops the mutex after the lane is already available, so
    // a later verdict rechecks that availability even if selection panicked.
    let _publication = self.deadlock_state.owner_handoff_publication_guard();
    drop(reservation);
    self.parked_drivers.wake_one_owner_dependency(owner)
  }

  fn schedule(self: &Arc<Self>, runnable: Runnable) {
    let mut admission = self.begin_deadlock_admission();
    // Fires for BOTH the slot and the FIFO path: a slot-resident runnable is
    // still "queued" until popped (`runnable_started` balances it either way).
    self.metrics.runnable_scheduled();
    // LIFO fast path: a runnable scheduled from a pool
    // worker OF THIS EXECUTOR goes into that worker's slot instead of the
    // shared FIFO -- this thread pops it before its next FIFO look, so no
    // queue mutex, no wake, no drainer spawn.
    //
    // "Pops it before its next FIFO look" is only true while RUNNABLE code is
    // on the stack (drain/run_one loop iterations, cooperative polls). It is
    // FALSE inside a blocking closure: `ON_POOL_WORKER` spans the whole drain
    // frame including `blocking()` calls, but the slot is only popped after
    // the closure returns -- so a closure that spawns and then synchronously
    // waits on the child would deadlock with the child slotted (no wake, no
    // drainer, even with idle workers). `BLOCKING_OWNER` is `Some` exactly
    // while straight-line blocking-closure code runs (drain/run_one blocking
    // branches, the over-cap escape) and `None` while runnables run (the
    // slot/FIFO owner-clear guards), so it is the discriminator: bypass the
    // slot and take the FIFO+wake path whenever an owner frame is ambient.
    // (A cooperative poll entered FROM a blocking closure also carries the
    // closure's token and loses the fast path -- a rare, conservative,
    // correctness-first trade.)
    if IN_SCHEDULER_DRIVER
      .with(std::cell::Cell::get)
      .is_some_and(|role| role.executor_id == self.id)
      && BLOCKING_OWNER.with(std::cell::Cell::get).is_none()
    {
      match LIFO_SLOT.with(std::cell::Cell::take) {
        None => {
          LIFO_SLOT.with(|slot| slot.set(Some((self.id, runnable))));
          if let Some(admission) = admission.as_mut() {
            admission.mark_published();
          }
          return;
        }
        // Same-executor occupant: the NEWEST runnable takes the slot (it is
        // the hottest); the displaced occupant falls back to the shared FIFO
        // with a normal wake so other workers can pick it up.
        Some((id, displaced)) if id == self.id => {
          LIFO_SLOT.with(|slot| slot.set(Some((self.id, runnable))));
          self.push_to_queue_and_wake(displaced);
          if let Some(admission) = admission.as_mut() {
            admission.mark_published();
          }
          return;
        }
        // Foreign-executor occupant (defensive: requires a thread acting as a
        // worker of two executors, e.g. under a test-installed marker; the
        // production process has one global executor). We must not flush
        // another executor's runnable onto OUR queue, so leave it in place --
        // its own executor's drain on this thread pops or flushes it -- and
        // route the new runnable to the FIFO.
        Some(foreign) => {
          LIFO_SLOT.with(|slot| slot.set(Some(foreign)));
        }
      }
    }
    self.push_to_queue_and_wake(runnable);
    if let Some(admission) = admission.as_mut() {
      admission.mark_published();
    }
  }

  /// Shared-FIFO tail of [`Self::schedule`]: push, then wake (also used for
  /// displaced/flushed slot runnables, whose `runnable_scheduled` accounting
  /// already happened at their original schedule).
  fn push_to_queue_and_wake(self: &Arc<Self>, runnable: Runnable) {
    self.injector.push(runnable);
    // The former queue mutex provided the synchronizes-with edge the
    // lost-wakeup proof depends on (see `wake_one`). With a lock-free injector
    // that edge is gone, so restore it explicitly: a SeqCst fence between the
    // push and BOTH wake mechanisms (`wake_one`'s SeqCst `count` load and
    // `ensure_drainer`'s `active_drainers` load), mirrored by the SeqCst fence
    // in `has_queued_runnable` before the waiter/drainer re-check. This is the
    // Dekker ordering rayon-core's injector+sleep protocol uses; without both
    // fences a worker can park next to stealable work.
    std::sync::atomic::fence(Ordering::SeqCst);
    self.wake_for_new_work();
  }

  /// Queue-wake tail shared by `schedule` and `schedule_blocking`: wake ONE
  /// parked cooperative driver; when none is parked, fall back to spawning a
  /// drainer. A single wake suffices because the woken driver re-checks
  /// every work source in its loop before re-parking, and a wake it absorbs
  /// without consuming is handed on at `cooperative_block_on` exit (miss
  /// compensation). MUST be called AFTER the work was pushed
  /// under its queue mutex -- see the lost-wakeup argument at
  /// [`ParkedDrivers::wake_one`].
  fn wake_for_new_work(self: &Arc<Self>) {
    if !self.parked_drivers.wake_one() {
      self.ensure_drainer();
    }
  }

  fn wake_for_blocking_work(self: &Arc<Self>) {
    // Prefer a cooperative driver that can consume the blocking FIFO;
    // otherwise arm a normal Rayon drainer.
    if !self.parked_drivers.wake_one_blocking() {
      self.ensure_drainer();
    }
  }

  #[cfg(test)]
  fn schedule_blocking<F, T>(self: &Arc<Self>, function: F) -> JoinHandle<T>
  where
    F: FnOnce() -> T + Send + 'static,
    T: Send + 'static,
  {
    self.schedule_blocking_result(move || catch_unwind_join_error(function))
  }

  fn schedule_blocking_result<F, T>(self: &Arc<Self>, function: F) -> JoinHandle<T>
  where
    F: FnOnce() -> Result<T, JoinError> + Send + 'static,
    T: Send + 'static,
  {
    let mut admission = self.begin_deadlock_admission();
    let (sender, receiver) = oneshot::channel();
    let generation = self.generation;
    let dependency = BlockingDependency {
      job: BlockingJobId(next_unique_id(
        &NEXT_BLOCKING_JOB_ID,
        "blocking job id space exhausted",
      )),
      owner: BLOCKING_OWNER
        .with(std::cell::Cell::get)
        .filter(|owner| owner.executor_id == self.id),
    };
    // Enqueue-time progress signal, BEFORE the queue push/wake: the deadlock
    // detector's fingerprint must be able to observe
    // this submission even while the job merely sits queued -- symmetric with
    // `runnable_scheduled` on the runnable path.
    self.metrics.blocking_scheduled();
    let queued = QueuedBlocking {
      id: dependency.job,
      run: Box::new(move || {
        let result = function().map(|output| ContainedTaskOutput::new(output, generation));
        let _ = sender.send(result);
      }),
    };
    let rejected = {
      let mut queue = self
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if queue.closed {
        Some(queued)
      } else {
        queue.push(queued);
        None
      }
    };
    if let Some(rejected) = rejected {
      // Shutdown may close the queue after the controller registered this
      // generation work but before it reaches the executor. Drop captured
      // user values outside the queue lock and contain hostile destructors,
      // matching the queued-job shutdown path.
      let _generation = RuntimeGenerationGuard::enter(self.generation);
      let _ = catch_unwind_contained(|| drop(rejected));
    } else {
      // Wake a blocking-capable cooperative driver, or arm a normal drainer.
      self.wake_for_blocking_work();
      if let Some(admission) = admission.as_mut() {
        admission.mark_published();
      }
    }
    JoinHandle(JoinHandleInner::Blocking {
      receiver,
      dependency,
      published: PublishedBlockingDependencies::default(),
    })
  }

  fn ensure_drainer(self: &Arc<Self>) {
    loop {
      let active = self.active_drainers.load(Ordering::Acquire);
      if active >= self.max_drainers {
        return;
      }
      if self
        .active_drainers
        .compare_exchange_weak(active, active + 1, Ordering::AcqRel, Ordering::Relaxed)
        .is_ok()
      {
        let executor = Arc::clone(self);
        self.pool.spawn_fifo(move || executor.drain());
        return;
      }
    }
  }

  fn drain(self: Arc<Self>) {
    // LINGER GATE: captured BEFORE the guard installs the marker below. In
    // production `drain` only ever runs via `pool.spawn_fifo`, i.e. on a pool
    // worker whose start handler already set `ON_POOL_WORKER`, so lingering is
    // active there; a direct test call from a foreign thread keeps the legacy
    // return-when-empty shape.
    let on_pool_worker = ON_POOL_WORKER.with(std::cell::Cell::get) == Some(self.id);
    // Mark this worker so a re-entrant `block_on` (reached from a polled task)
    // drives the queue cooperatively instead of parking the worker.
    let _on_pool = OnPoolWorkerGuard::enter(self.id);
    // Unwind backstop: never leave a runnable stranded in
    // the LIFO slot. Normal exits flush explicitly BEFORE `finish_draining`
    // below (so its re-check can see the flushed runnable); this guard only
    // covers unwinds, which should be impossible (runnables and blocking
    // wrappers are catch_unwind'd) but must not lose a task if they happen.
    let _slot_backstop = LifoSlotFlushGuard(&self);

    let linger_budget = self.drain_linger.filter(|_| on_pool_worker);
    // Linger state (parker + generation-stop registration), created lazily on
    // this frame's first idle episode and reused for the rest of the frame.
    let mut linger: Option<DrainLinger> = None;
    // Absolute exit deadline of the CURRENT idle episode, armed on the first
    // empty observation after work ran. Spurious wakes (timer churn, a stolen
    // queue wake) re-park with the REMAINING time rather than a fresh budget,
    // so a lingering drainer occupies its pool slot for at most
    // `linger_budget` past the last work unit it executed.
    let mut idle_deadline: Option<Instant> = None;
    // Absolute residence deadline of the WHOLE frame, armed on the frame's
    // FIRST idle observation and -- unlike `idle_deadline` -- never reset by
    // executed work. Without it, periodic sub-budget work re-arms the episode
    // deadline forever and this frame never returns its rayon worker; see
    // [`DRAIN_LINGER_FRAME_FACTOR`].
    let mut frame_deadline: Option<Instant> = None;

    'frame: loop {
      let mut runnable_streak = 0usize;
      for _ in 0..Self::RUNNABLE_BUDGET {
        if self.run_one_fair(&mut runnable_streak) {
          idle_deadline = None;
          continue;
        }
        // Queue observed empty. MANDATORY flush before the shared exit AND
        // before any park: slot work is invisible to other threads and to
        // `finish_draining`'s re-check, so no path may leave this loop (or
        // sleep) with an occupied slot. On this path the slot was observed
        // empty at the top of the iteration and no user code ran since, so
        // the flush is defensive -- kept unconditional so every exit upholds
        // the stranding invariant by construction.
        self.flush_lifo_slot();
        // IDLE LINGER: instead of exiting and paying a full
        // spawn_fifo/rayon-idle-protocol round trip on the NEXT wave, park on
        // our own parker, registered in `parked_drivers` so
        // `wake_for_new_work`/`wake_for_blocking_work` deliver ONE targeted
        // wake. `active_drainers` stays counted for the whole linger: this
        // frame is still a live drainer, so `ensure_drainer`'s cap and the
        // idle-wait predicate keep their meaning.
        //
        // LOST-WAKEUP ARGUMENT (identical protocol to a cooperative driver's
        // park): register FIRST (the registry `count` store), THEN re-check
        // the shared queues (`has_queued_work_for_role`'s SeqCst fence pairs
        // with `push_to_queue_and_wake`'s post-push fence), THEN park -- see
        // [`ParkedDrivers::wake_one`]. On the timeout path, `wake_one` may
        // have popped this parker (counting the wake as DELIVERED, so the
        // producer spawned no drainer) while its `unpark` is still in flight:
        // the pop precedes our `deregister` on the registry mutex, so the
        // producer's push (made BEFORE its wake) is visible to the
        // post-deregister permit/queue re-checks below, which then RESUME
        // draining instead of exiting. Only a truly empty re-check falls
        // through to `finish_draining`, whose own post-decrement re-check
        // remains the existing final net for pushes racing the exit.
        let Some(budget) = linger_budget else {
          break 'frame;
        };
        if self.stop.is_stopping() {
          break 'frame;
        }
        let now = Instant::now();
        // FRAME RESIDENCE BOUND: exiting here (or via the min-capped park
        // below) funnels through the UNCHANGED finish_draining path, whose
        // re-check re-arms a FIFO drain via ensure_drainer/spawn_fifo when
        // work remains -- that re-entry through rayon's queue is exactly the
        // interleaving point that lets pending raw rayon work run.
        let frame = *frame_deadline.get_or_insert_with(|| {
          now
            + budget
              .saturating_mul(DRAIN_LINGER_FRAME_FACTOR)
              .min(MAX_DRAIN_LINGER_FRAME_RESIDENCE)
        });
        let deadline = (*idle_deadline.get_or_insert_with(|| now + budget)).min(frame);
        if now >= deadline {
          // Deadline EXPIRY observed at the top: either a wake consumed the
          // rest of the episode's idle budget, or the frame residence bound
          // elapsed while work kept re-arming the episode deadline. Either
          // way this frame's lingering is over, and the linger parker of the
          // previous episode -- if one registered -- was already deregistered
          // after its park.
          #[cfg(test)]
          self.drain_linger_expiries.fetch_add(1, Ordering::SeqCst);
          break 'frame;
        }
        let state = match &linger {
          Some(state) => state,
          None => linger.insert(DrainLinger::new(&self)),
        };
        self
          .parked_drivers
          .register_with_role(&state.parker, true, None);
        #[cfg(test)]
        self
          .drain_linger_registrations
          .fetch_add(1, Ordering::SeqCst);
        if self.has_queued_work_for_role(true) {
          self.parked_drivers.deregister(&state.parker);
          continue 'frame;
        }
        // Stop re-check AFTER registering: `begin_shutdown` unparks every
        // generation-stop-registered parker (ours included, via
        // `DrainLinger`'s registration), so a stop publishing after this
        // check still cuts the park short instead of waiting out the budget.
        if self.stop.is_stopping() {
          self.parked_drivers.deregister(&state.parker);
          break 'frame;
        }
        let woken = state.parker.park_timeout(deadline - now);
        self.parked_drivers.deregister(&state.parker);
        if woken || state.parker.consume_permit() || self.has_queued_work_for_role(true) {
          continue 'frame;
        }
        // Idle-budget EXPIRY: the park timed out with no wake, no permit and
        // no queued work. Counted AFTER the deregister above, so a test
        // observing `drain_linger_expiries` rise knows the linger parker has
        // permanently left the registry for this idle episode.
        #[cfg(test)]
        self.drain_linger_expiries.fetch_add(1, Ordering::SeqCst);
        break 'frame;
      }
      // Budget exhausted: yield this worker back to rayon exactly as before
      // the linger existed -- `finish_draining` re-arms a FIFO drain job
      // BEHIND any pending rayon work (par_iter splits, nested jobs), which
      // is the pool-fairness property the budget exists for.
      break 'frame;
    }

    // MANDATORY flush before `finish_draining` so its
    // re-check sees a slot runnable on the shared FIFO and re-arms a drainer.
    self.flush_lifo_slot();
    self.finish_draining();
  }

  /// Pop this worker's LIFO slot if it holds a runnable of THIS executor.
  /// A foreign executor's entry is left untouched (see the scoping note at
  /// `LIFO_SLOT`).
  fn pop_lifo_slot(&self) -> Option<Runnable> {
    LIFO_SLOT.with(|slot| match slot.take() {
      Some((id, runnable)) if id == self.id => Some(runnable),
      other => {
        slot.set(other);
        None
      }
    })
  }

  /// Move this worker's slot entry (same-executor only) to the shared FIFO,
  /// with a wake so any worker can pick it up. MANDATORY on every path where
  /// this thread stops draining this executor: `drain`'s
  /// returns (BEFORE `finish_draining`), before a cooperative park, and on
  /// unwind via `LifoSlotFlushGuard` -- a runnable stranded in a thread-local
  /// slot while its thread leaves executor code is a silently lost task.
  fn flush_lifo_slot(self: &Arc<Self>) {
    let mut admission = self.begin_deadlock_admission();
    if let Some(runnable) = self.pop_lifo_slot() {
      self.push_to_queue_and_wake(runnable);
      if let Some(admission) = admission.as_mut() {
        admission.mark_published();
      }
    }
  }

  /// Mint a fresh owner token for a counted blocking closure entering on this
  /// executor. Each entry gets a unique `frame` so nested owners on the same
  /// thread can never run each other's queued jobs over the cap.
  fn fresh_owner_token(&self) -> BlockingOwnerToken {
    BlockingOwnerToken {
      executor_id: self.id,
      frame: next_unique_id(
        &NEXT_BLOCKING_FRAME,
        "blocking owner frame id space exhausted",
      ),
    }
  }

  fn finish_draining(self: &Arc<Self>) {
    // LIFO-slot invariant: this re-check reads only the
    // SHARED queues -- per-worker slots are invisible to it, and that is
    // sound because slot work never needs a foreign observer. A slot entry is
    // always either popped and run by its owning thread (drain / run_one) or
    // flushed to the shared FIFO by that same thread BEFORE it stops draining
    // (both `drain` returns flush ahead of this call; `LifoSlotFlushGuard`
    // covers unwinds; cooperative parks flush defensively). No thread leaves
    // executor code with its slot occupied, so the exit-then-respawn window
    // below cannot hide slot work from `ensure_drainer`.
    self.active_drainers.fetch_sub(1, Ordering::AcqRel);
    let has_runnable = self.has_queued_runnable();
    let has_blocking = self.active_blocking.load(Ordering::Acquire) < self.max_blocking
      && !self
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .is_empty();
    if has_runnable || has_blocking {
      self.ensure_drainer();
    }
    // The lock is still taken unconditionally: it is the release edge that
    // publishes the `active_drainers` decrement above to a waiter that is about
    // to evaluate the predicate. Only the wake is now conditional, and the
    // waiter count is read under the very mutex the waiter must hold to
    // register, so a waiter is never missed. See `wait_until_scheduler_idle`.
    let idle = self
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if *idle > 0 {
      self.scheduler_idle.notify_all();
    }
  }

  fn block_on(self: &Arc<Self>, future: Pin<&mut dyn Future<Output = ()>>) -> BlockOnOutcome {
    if ON_POOL_WORKER.with(std::cell::Cell::get) == Some(self.id) {
      // Re-entrant call from a pool worker OF THIS EXECUTOR: parking here would
      // freeze a worker that the awaited future may itself need to make
      // progress. Drive the queue cooperatively instead (mirrors the
      // CurrentThread drive loop). The id check mirrors the
      // `BlockingOwnerToken.executor_id` gate: a worker of a DIFFERENT executor
      // owns none of this executor's accounting, so it must take the parking
      // path below rather than drive these queues as an unaccounted driver.
      self.cooperative_block_on(future)
    } else {
      // Non-pool (e.g. napi caller) thread, or a pool worker of another
      // executor: park without driving queues. The runtime owns this park so
      // generation shutdown can wake and cancel it.
      self.parking_block_on(future)
    }
  }

  fn parking_block_on(
    self: &Arc<Self>,
    mut future: Pin<&mut dyn Future<Output = ()>>,
  ) -> BlockOnOutcome {
    let parker = Arc::new(DriverParker::default());
    let _stop_registration = self.stop.register(&parker);
    let waker = Waker::from(Arc::clone(&parker));
    let mut cx = Context::from_waker(&waker);
    loop {
      if self.stop.is_stopping() {
        return BlockOnOutcome::Stopped;
      }
      on_thread_handoff();
      if future.as_mut().poll(&mut cx).is_ready() {
        return BlockOnOutcome::Completed;
      }
      if self.stop.is_stopping() {
        return BlockOnOutcome::Stopped;
      }
      parker.park();
    }
  }

  fn run_runnable(
    self: &Arc<Self>,
    runnable: Runnable,
    admission: Option<MultiThreadDeadlockAdmissionGuard>,
  ) {
    on_thread_handoff();
    // Ownership is lexical to a blocking closure. A runnable driven from that
    // closure must not borrow its over-cap privilege.
    let _non_owner = BlockingOwnerGuard::enter(None);
    let _active = self.metrics.runnable_started();
    #[cfg(test)]
    run_multi_thread_work_started_test_hook();
    // The queue/slot removal is invisible to the deadline verdict until start
    // accounting advances. Keep the detector gate open across exactly that gap,
    // but never across a user poll.
    drop(admission);
    let _ = catch_unwind_contained(|| runnable.run());
  }

  fn cancel_runnable(
    &self,
    runnable: Runnable,
    admission: Option<MultiThreadDeadlockAdmissionGuard>,
  ) {
    self.metrics.runnable_cancelled();
    // Cancellation accounting closes the dequeue gap just as start accounting
    // does for a runnable that will be polled.
    drop(admission);
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    let _ = catch_unwind_contained(|| drop(runnable));
  }

  fn finish_runnable_claim(
    self: &Arc<Self>,
    claim: RunnableClaim,
    admission: Option<MultiThreadDeadlockAdmissionGuard>,
  ) -> bool {
    match claim {
      RunnableClaim::Empty => {
        drop(admission);
        false
      }
      RunnableClaim::Run(runnable) => {
        #[cfg(test)]
        run_multi_thread_work_claimed_test_hook();
        self.run_runnable(runnable, admission);
        true
      }
      RunnableClaim::Cancel(runnable) => {
        #[cfg(test)]
        run_multi_thread_work_claimed_test_hook();
        self.cancel_runnable(runnable, admission);
        true
      }
    }
  }

  fn runnable_claim(stopping: bool, runnable: Option<Runnable>) -> RunnableClaim {
    match runnable {
      Some(runnable) if stopping => RunnableClaim::Cancel(runnable),
      Some(runnable) => RunnableClaim::Run(runnable),
      None => RunnableClaim::Empty,
    }
  }

  /// Lock-free single-item steal from the shared injector, retrying the
  /// transient `Steal::Retry` contention state. Replaces the former
  /// `queue.lock().pop_front()`; `Injector` preserves FIFO order.
  fn steal_one(&self) -> Option<Runnable> {
    loop {
      match self.injector.steal() {
        Steal::Success(runnable) => return Some(runnable),
        Steal::Empty => return None,
        Steal::Retry => continue,
      }
    }
  }

  /// Test-only raw FIFO enqueue: the former `queue.lock().push_back()` staging
  /// that tests use to seed queued work WITHOUT the accompanying wake (so no
  /// drainer races the manual `run_one`/`drain` calls). Keeps the post-push
  /// SeqCst fence from `push_to_queue_and_wake` so any wake/park interaction a
  /// test performs afterwards still sees the Dekker pairing documented on
  /// `injector`.
  #[cfg(test)]
  fn push_fifo_raw(&self, runnable: Runnable) {
    self.injector.push(runnable);
    std::sync::atomic::fence(Ordering::SeqCst);
  }

  fn claim_fifo_runnable(&self) -> RunnableClaim {
    let stop_publication = self.stop.runnable_claim_guard();
    let runnable = self.steal_one();
    let stopping = stop_publication.is_stopping();
    drop(stop_publication);
    Self::runnable_claim(stopping, runnable)
  }

  fn claim_runnable(&self) -> RunnableClaim {
    let stop_publication = self.stop.runnable_claim_guard();
    let runnable = self.pop_lifo_slot().or_else(|| self.steal_one());
    let stopping = stop_publication.is_stopping();
    drop(stop_publication);
    Self::runnable_claim(stopping, runnable)
  }

  fn run_one_fifo_runnable(self: &Arc<Self>) -> bool {
    let admission = self.begin_deadlock_admission();
    let claim = self.claim_fifo_runnable();
    self.finish_runnable_claim(claim, admission)
  }

  /// Run one runnable, preferring this worker's LIFO slot over the shared FIFO.
  fn run_one_runnable(self: &Arc<Self>) -> bool {
    let admission = self.begin_deadlock_admission();
    // Same owner-clear as the FIFO-only path: a runnable from the slot must
    // not smuggle an owner frame's over-cap privilege.
    let claim = self.claim_runnable();
    self.finish_runnable_claim(claim, admission)
  }

  fn run_one_blocking(self: &Arc<Self>) -> bool {
    if let Some((blocking, admission)) = self.take_blocking() {
      let _generation = RuntimeGenerationGuard::enter(self.generation);
      {
        let _task = self.metrics.blocking_started(true);
        #[cfg(test)]
        run_multi_thread_work_started_test_hook();
        // Publish start before the dequeue admission retires. The detector can
        // then observe either the queued job, the active admission, or progress.
        drop(admission);
        let owner = self.fresh_owner_token();
        let _active_owner = ActiveBlockingOwnerGuard::enter(&self.active_blocking_owners, owner);
        let _owner = BlockingOwnerGuard::enter(Some(owner));
        // The queued wrapper contains panics from the user function, but
        // delivering its result can still drop user-owned state when the
        // receiver is gone. Contain that destructor boundary as well so an
        // unwind cannot bypass blocking-slot and drainer retirement.
        let _ = catch_unwind_contained(blocking);
      }
      self.active_blocking.fetch_sub(1, Ordering::Release);
      return true;
    }
    false
  }

  /// Run one fair scheduler unit. Runnable locality remains the normal
  /// priority, but a continuously hot runnable stream must yield one quantum
  /// to the blocking FIFO.
  fn run_one_fair(self: &Arc<Self>, runnable_streak: &mut usize) -> bool {
    self.run_one_fair_with_exact(runnable_streak, None)
  }

  /// Cooperative variant of [`Self::run_one_fair`]. Once runnable priority has
  /// been satisfied, a live exact dependency must claim its owner's lane before
  /// unrelated FIFO blocking work can consume the last ordinary slot.
  fn run_one_fair_with_exact(
    self: &Arc<Self>,
    runnable_streak: &mut usize,
    exact_dependency: Option<&TaskDependency>,
  ) -> bool {
    let mut exact_attempted = false;
    if *runnable_streak >= Self::RUNNABLE_FAIRNESS_QUANTUM {
      *runnable_streak = 0;
      if let Some(dependency) = exact_dependency {
        exact_attempted = true;
        if self.try_owned_blocking_over_cap(dependency) {
          return true;
        }
      }
      if self.run_one_blocking() {
        return true;
      }
    }
    if self.run_one_runnable() {
      *runnable_streak += 1;
      return true;
    }
    if !exact_attempted
      && exact_dependency.is_some_and(|dependency| self.try_owned_blocking_over_cap(dependency))
    {
      *runnable_streak = 0;
      return true;
    }
    if self.run_one_blocking() {
      *runnable_streak = 0;
      return true;
    }
    false
  }

  #[cfg(test)]
  fn run_one(self: &Arc<Self>) -> bool {
    let mut runnable_streak = 0;
    self.run_one_fair(&mut runnable_streak)
  }

  /// Exact-dependency fallback for a re-entrant `block_on` that would otherwise
  /// park while the blocking cap is saturated. The dependency carries its
  /// exact owner frame through JoinHandle lineage. Reserving that frame
  /// transfers its counted lane to this otherwise-idle cooperative driver.
  ///
  /// Owner lending is lexical: the cooperative driver must carry the exact
  /// blocking frame whose counted lane it reuses. Rayon does not propagate
  /// thread-local ancestry to stolen jobs, and registry cardinality cannot
  /// prove that an untagged worker belongs to the sole active owner.
  fn run_owned_blocking_over_cap(
    self: &Arc<Self>,
    dependency: &TaskDependency,
  ) -> OwnedBlockingOutcome {
    #[cfg(test)]
    self.owner_lending_attempts.fetch_add(1, Ordering::Relaxed);

    let Some(ambient_owner) = BLOCKING_OWNER
      .with(std::cell::Cell::get)
      .filter(|owner| owner.executor_id == self.id)
    else {
      return OwnedBlockingOutcome::Ineligible;
    };
    let Some(current) = dependency.select_for_owner(ambient_owner) else {
      return OwnedBlockingOutcome::Ineligible;
    };
    let admission = self.begin_deadlock_admission();
    let owner = current
      .publication
      .dependency
      .owner
      .expect("selected dependency must carry its owner");
    let Some(reservation) = OwnerLaneReservation::try_acquire(&self.active_blocking_owners, owner)
    else {
      return OwnedBlockingOutcome::OwnerBusy(owner);
    };
    #[cfg(test)]
    run_before_owned_blocking_queue_claim_test_hook();
    let job = {
      let mut queue = self
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      // Shutdown publishes stop before waiting on this queue mutex. Recheck both
      // admission states before consuming the dependency so a shutdown that
      // reached this claim first leaves the job queued for cancellation.
      if queue.closed || self.stop.is_stopping() {
        None
      // Claim while holding the queue lock. A concurrent clear/switch that
      // wins first makes this fail; once the claim succeeds, no stale snapshot
      // can authorize removal of the old job.
      } else if dependency.try_claim(&current) {
        queue.remove(current.publication.dependency.job)
      } else {
        None
      }
    };
    let ran = if let Some(job) = job {
      #[cfg(test)]
      run_multi_thread_work_claimed_test_hook();
      let _generation = RuntimeGenerationGuard::enter(self.generation);
      {
        let _task = self.metrics.blocking_started(false);
        #[cfg(test)]
        run_multi_thread_work_started_test_hook();
        // The exact job is no longer visible in the indexed FIFO. Publish its
        // start before allowing a deadline verdict to close the admission gate.
        drop(admission);
        let nested_owner = self.fresh_owner_token();
        let _active_owner =
          ActiveBlockingOwnerGuard::enter(&self.active_blocking_owners, nested_owner);
        let _owner = BlockingOwnerGuard::enter(Some(nested_owner));
        let _ = catch_unwind_contained(job);
      }
      true
    } else {
      drop(admission);
      false
    };
    // Every reservation release can make another exact dependency serviceable,
    // including failed-claim and already-removed-job exits.
    self.release_owner_lane_and_wake(reservation);
    OwnedBlockingOutcome::ReservationReleased { owner, ran }
  }

  fn try_owned_blocking_over_cap(self: &Arc<Self>, dependency: &TaskDependency) -> bool {
    matches!(
      self.run_owned_blocking_over_cap(dependency),
      OwnedBlockingOutcome::ReservationReleased { ran: true, .. }
    )
  }

  fn service_owner_handoff(
    self: &Arc<Self>,
    parker: &DriverParker,
    dependency: &TaskDependency,
    can_run_blocking: bool,
  ) -> Option<bool> {
    let handoff_owner = parker.take_owner_handoff()?;
    if !can_run_blocking {
      self.wake_one_owner_dependency(handoff_owner);
      return Some(false);
    }
    match self.run_owned_blocking_over_cap(dependency) {
      OwnedBlockingOutcome::Ineligible => {
        self.wake_one_owner_dependency(handoff_owner);
        Some(false)
      }
      OwnedBlockingOutcome::OwnerBusy(owner) => {
        if owner != handoff_owner {
          self.wake_one_owner_dependency(handoff_owner);
        }
        Some(false)
      }
      OwnedBlockingOutcome::ReservationReleased { owner, ran } => {
        if owner != handoff_owner {
          self.wake_one_owner_dependency(handoff_owner);
        }
        Some(ran)
      }
    }
  }

  fn forward_owner_handoff(&self, parker: &DriverParker) {
    if let Some(owner) = parker.take_owner_handoff() {
      self.wake_one_owner_dependency(owner);
    }
  }

  fn owner_dependency_lane_available(&self, dependency: &TaskDependency) -> bool {
    let Some(ambient_owner) = BLOCKING_OWNER
      .with(std::cell::Cell::get)
      .filter(|owner| owner.executor_id == self.id)
    else {
      return false;
    };
    self.active_blocking_owners.is_available(ambient_owner)
      && dependency.has_live_owner_dependency(ambient_owner, OwnerDependencyMode::Available)
  }

  fn has_exact_owner_work_for_role(
    &self,
    parker: &DriverParker,
    dependency: &TaskDependency,
    can_run_blocking: bool,
  ) -> bool {
    parker.has_owner_handoff()
      || (can_run_blocking && self.owner_dependency_lane_available(dependency))
  }

  /// Cooperative `block_on` for a re-entrant call from a pool worker. Instead
  /// of parking the worker (which would freeze one of the pool's fixed OS
  /// threads), it drives the awaited future while servicing queued work. When
  /// nothing is immediately runnable it parks on its own [`DriverParker`],
  /// which is woken directly by the awaited future's waker and through the
  /// `parked_drivers` registry by `schedule`/`schedule_blocking`, so a later
  /// wake reaches this worker even when every worker is parked and
  /// `ensure_drainer` has no free thread to spawn a replacement.
  fn cooperative_block_on(
    self: &Arc<Self>,
    mut future: Pin<&mut dyn Future<Output = ()>>,
  ) -> BlockOnOutcome {
    // One parker per `block_on` frame. Nested re-entrant frames each own one:
    // only the innermost frame runs or parks at any moment, and an outer
    // frame's future-wake is stored as its parker's permit, consumed when
    // control returns to that frame's loop.
    let parker = Arc::new(DriverParker::default());
    let _stop_registration = self.stop.register(&parker);
    let dependency = BlockOnDependencyGuard::enter(self.generation);
    let driver_role = IN_SCHEDULER_DRIVER.with(std::cell::Cell::get);
    let can_run_blocking =
      driver_role.is_none_or(|role| role.executor_id != self.id || role.can_run_blocking);
    let _exit = CooperativeDriverExitGuard {
      executor: self,
      parker: &parker,
      can_run_blocking,
    };
    // WAKE-DOMAIN SPLIT: the awaited future is polled with
    // THIS driver's own parker as its waker, so a future-wake targets exactly
    // the driver that awaits it -- delivered as a stored permit (skip next
    // park) when this driver is currently running, so it is never lost.
    let waker = std::task::Waker::from(Arc::clone(&parker));
    let mut cx = Context::from_waker(&waker);
    // Consecutive `run_one` successes since the last yield point: the
    // cooperative loop mirrors `drain`'s RUNNABLE_BUDGET streak cap. Without
    // it, a hot slot chain (each runnable schedules a successor into this
    // worker's slot, which `run_one` pops BEFORE the FIFO) would keep this
    // loop inside `run_one` forever and the shared FIFO would never be
    // reached from this thread -- a deadlock on a 1-worker pool when the
    // awaited future depends on a FIFO task.
    let mut runnable_streak = 0usize;
    let mut work_streak = 0usize;
    let mut force_fifo = false;
    loop {
      if self.stop.is_stopping() {
        return BlockOnOutcome::Stopped;
      }
      dependency.clear();
      on_thread_handoff();
      if future.as_mut().poll(&mut cx).is_ready() {
        return BlockOnOutcome::Completed;
      }
      if self.stop.is_stopping() {
        return BlockOnOutcome::Stopped;
      }
      if self
        .service_owner_handoff(&parker, &dependency.dependency, can_run_blocking)
        .is_some_and(|ran| ran)
      {
        continue;
      }
      if force_fifo {
        force_fifo = false;
        if self.run_one_fifo_runnable() {
          runnable_streak += 1;
          work_streak += 1;
          continue;
        }
      }
      let ran_work = if can_run_blocking {
        self.run_one_fair_with_exact(&mut runnable_streak, Some(&dependency.dependency))
      } else if self.run_one_runnable() {
        runnable_streak += 1;
        true
      } else {
        false
      };
      if ran_work {
        work_streak += 1;
        if work_streak >= Self::RUNNABLE_BUDGET {
          // Budget yield: move a hot slot occupant to the shared FIFO (with
          // a wake), so the next `run_one` pops the FIFO front (the oldest
          // work) and other workers can steal the chain. The awaited future
          // is polled every iteration regardless, so it is never starved.
          self.flush_lifo_slot();
          work_streak = 0;
          force_fifo = true;
        }
        continue;
      }
      runnable_streak = 0;
      work_streak = 0;
      // MANDATORY pre-park flush. Defensive on every
      // currently reachable path: `run_one` above popped the slot and no user
      // code ran since -- but parking with a stranded slot runnable would
      // silently lose that task, so the invariant is upheld unconditionally.
      self.flush_lifo_slot();
      // Park protocol: register FIRST, then re-check, then park -- the
      // waiter-side mirror of the push-then-wake schedule side. See the
      // lost-wakeup argument at [`ParkedDrivers::wake_one`].
      self.parked_drivers.register_with_role(
        &parker,
        can_run_blocking,
        Some(Arc::clone(&dependency.dependency)),
      );
      if self.has_queued_work_for_role(can_run_blocking)
        || (can_run_blocking && self.owner_dependency_lane_available(&dependency.dependency))
      {
        self.parked_drivers.deregister(&parker);
        continue;
      }
      if self.stop.is_stopping() {
        return BlockOnOutcome::Stopped;
      }
      // TIMER-BOUNDED PARK: while any heap
      // timer is pending, this park is a TIMER WAIT, not a deadlock
      // candidate -- the wall clock is a guaranteed wake source -- so it uses
      // its own bounded primitive instead of `park`/`park_with_deadline` and
      // fires whatever came due on the way out. An armed park deadline is
      // deliberately NOT evaluated during a timer wait: the fire schedules
      // the woken task (fingerprint progress), and the next timerless park
      // arms a fresh full window, so genuine-deadlock detection is delayed
      // past the timer, never lost. This is also load-bearing for liveness:
      // on a 1-worker pool whose only thread is parked HERE, the timekeeper
      // job has no free thread to run on, so this driver must fire due
      // timers itself. (A timer registered between the deadline read and the
      // park re-arms this parker through `note_earlier_timer`'s
      // `wake_one` -- we are registered -- or wakes the timekeeper.)
      if let Some(next) = self.next_timer_deadline() {
        let now = Instant::now();
        if next > now {
          parker.park_timeout(next - now);
        }
        self.parked_drivers.deregister(&parker);
        self.fire_due_timers();
        continue;
      }
      match self.park_deadline {
        None => parker.park(),
        Some(deadline) => {
          // Deadline-bounded cooperative park with PROGRESS-BASED reset: a
          // candidate deadlock only when a
          // FULL deadline window passes with zero executor progress. The
          // foreign-thread whole-build park in `block_on`'s else-branch is
          // exempt by design.
          let deadlock_publications = self.deadlock_state.publications();
          match park_with_deadline(&parker, deadline, &self.metrics) {
            DeadlineParkOutcome::Woken => {}
            DeadlineParkOutcome::Expired(armed) => {
              #[cfg(test)]
              run_deadline_expiry_test_hook();
              // EXPIRY DECISION. While this parker was
              // registered, a racing `wake_one` may have popped it, stored
              // its permit and reported the wake as DELIVERED (so the
              // scheduler spawned no drainer) -- panicking now would swallow
              // a healthy wake and kill a live build. Deregister FIRST so no
              // FURTHER wake can be counted against this parker, then
              // re-check every way a wake could have landed around the
              // expiry:
              //   * permit: a `wake_one` (or direct future-wake) that landed
              //     while still registered MUST be acted on;
              //   * queued work: the work behind such a wake was pushed
              //     under the queue mutex BEFORE `wake_one` popped us, so
              //     even if its `unpark` is still in flight the queue
              //     re-check observes it;
              //   * pending timers: arming a timer bumps NO progress counter
              //     by design, so a registration racing this already-
              //     committed park (it read an empty heap before parking) is
              //     invisible to every other re-check -- yet its wake (the
              //     fire) is wall-clock-guaranteed, so this park is healthy.
              //     The loop then re-parks TIMER-BOUNDED (see above) and
              //     fires the timer itself if needed;
              //   * fingerprint: the verdict requires ZERO progress, and the
              //     read inside `park_with_deadline` is stale by the time we
              //     get here -- re-read as the LAST step. Both ENQUEUE
              //     counters are in the fingerprint (`runnable_schedules`
              //     and `blocking_tasks_scheduled`, both bumped before the
              //     push), so a submission of EITHER kind
              //     landing after the queue re-check above is still caught
              //     here.
              // Any hit => not a deadlock: continue the cooperative loop
              // (fresh future poll, `run_one` picks up the work, and the
              // next park arms a fresh FULL deadline window). The residue is
              // exactly a BARE direct future-wake -- no queue push, no
              // counter movement -- landing in the few instructions after
              // these re-checks: the inherent, unclosable residue of any
              // timing-based detector, one reason the deadline is opt-in.
              self.parked_drivers.deregister(&parker);
              if parker.consume_permit() || self.has_queued_work_for_role(can_run_blocking) {
                continue;
              }
              // Test-only seam between the permit/queued-work re-checks and
              // the fingerprint verdict.
              #[cfg(test)]
              run_deadline_verdict_test_hook();
              if self.metrics.progress_fingerprint() != armed {
                continue;
              }
              // Pending-timer re-check LAST, after even the fingerprint:
              // arming a timer bumps no counter, so it is the one healthy
              // wake source that can land after every earlier re-check and
              // still be invisible to the fingerprint read above. (A
              // registration racing the instructions after this line is the
              // same inherent residue class as the bare future-wake -- and
              // its timer is still served: `note_earlier_timer` claims the
              // timekeeper independently of this driver.)
              if self.next_timer_deadline().is_some() {
                continue;
              }
              // Test-only seam for a cross-thread scheduler admission after
              // every legacy final check and before the synchronized verdict.
              #[cfg(test)]
              run_deadline_final_verdict_test_hook();
              let Some(verdict) = self.try_begin_deadlock_verdict() else {
                continue;
              };
              #[cfg(test)]
              run_deadline_gated_verdict_test_hook();
              // Lock order is verdict gate -> stop publication -> exact-owner
              // publication. The controller takes lifecycle -> stop
              // publication and never acquires the verdict gate or exact-owner
              // publication while retaining either lock.
              let stop_publication = self.stop.publication_guard();
              #[cfg(test)]
              run_deadline_synchronized_stop_test_hook();
              if stop_publication.is_stopping() {
                return BlockOnOutcome::Stopped;
              }
              let owner_handoff_publication = self
                .deadlock_state
                .owner_handoff_publication_guard()
                .expect("a deadline verdict requires exact-owner publication");
              #[cfg(test)]
              run_deadline_exact_owner_verdict_test_hook(&parker);
              // The closed gate excludes later publications. Any admission
              // that began earlier either remains counted (so gate acquisition
              // failed above) or completed before this recheck and advanced
              // the publication epoch. The stop-publication guard also keeps
              // the lifecycle in Running if this verdict linearized first. The
              // exact-owner publication guard similarly orders reservation
              // release and targeted handoff with the final predicates below.
              if self.has_exact_owner_work_for_role(
                &parker,
                &dependency.dependency,
                can_run_blocking,
              ) || parker.consume_permit()
                || self.has_queued_work_for_role(can_run_blocking)
                || self.deadlock_state.publications() != deadlock_publications
                || self.metrics.progress_fingerprint() != armed
                || self.next_timer_deadline().is_some()
              {
                continue;
              }
              let diagnostic = BlockOnDeadlock::multi_thread_cooperative(deadline);
              // Panic hooks run before unwind. Release every synchronization
              // guard first so a hook that submits work, releases an owner
              // lane, or starts shutdown cannot wait for the panic that invokes
              // it to unwind.
              drop(owner_handoff_publication);
              drop(stop_publication);
              drop(verdict);
              std::panic::panic_any(diagnostic);
            }
          }
        }
      }
      // `wake_one` removes the parkers it pops; a direct future-wake does
      // not. Deregister-if-present covers both.
      self.parked_drivers.deregister(&parker);
    }
  }

  /// Is there work a cooperative driver could pick up right now? Used by the
  /// pre-park re-check and the exit compensation in `cooperative_block_on`;
  /// mirrors `finish_draining`'s re-check (a queued runnable, or a queued
  /// blocking job within the cap). The exact over-cap dependency is handled
  /// separately before registration.
  fn has_queued_work_for_role(&self, can_run_blocking: bool) -> bool {
    if self.has_queued_runnable() {
      return true;
    }
    can_run_blocking
      && self.active_blocking.load(Ordering::Acquire) < self.max_blocking
      && !self
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .is_empty()
  }

  fn compensate_queued_work_wake(self: &Arc<Self>, can_run_blocking: bool) {
    if self.has_queued_runnable() {
      self.wake_for_new_work();
    }
    // Shutdown-aborted runnables still need a driver so their generators can
    // retire, but queued blocking closures are cancelled by begin_shutdown and
    // must never be admitted by exit compensation after stop is observable.
    if self.stop.is_stopping() {
      return;
    }
    if self.active_blocking.load(Ordering::Acquire) < self.max_blocking
      && !self
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .is_empty()
    {
      // This driver may have absorbed the queue wake that made its awaited
      // future ready. Runnable and blocking residue are independent. If no
      // other blocking-capable driver is available, merely spawning a Rayon
      // job is insufficient: this worker may return into arbitrary
      // synchronous user code while every other Rayon lane is busy.
      // Consume one admitted job before exit, then hand any residue to another
      // blocking-capable driver.
      let consumed = can_run_blocking && self.run_one_blocking();
      let has_residue = self.active_blocking.load(Ordering::Acquire) < self.max_blocking
        && !self
          .blocking_queue
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .is_empty();
      if !self.stop.is_stopping() && (!consumed || has_residue) {
        self.wake_for_blocking_work();
      }
    }
  }

  fn has_queued_runnable(&self) -> bool {
    // Waiter-side mirror of the `push_to_queue_and_wake` fence: a parking
    // driver (pre-park re-check) and the drainer-exit re-check in
    // `finish_draining` must not observe the injector empty when a racing push
    // is already visible to a wake. This SeqCst fence pairs with the post-push
    // fence so the Dekker ordering holds without the former queue mutex. Only
    // on park/quiesce decision paths, never the per-task hot path.
    std::sync::atomic::fence(Ordering::SeqCst);
    !self.injector.is_empty()
  }

  /// Pop the next queued blocking job FIFO within the cap. Any blocking-capable
  /// driver may run any job within `max_blocking`; only the over-cap escape is
  /// restricted to an exact dependency id.
  fn take_blocking(&self) -> Option<(BlockingClosure, Option<MultiThreadDeadlockAdmissionGuard>)> {
    let admission = self.begin_deadlock_admission();
    loop {
      let active = self.active_blocking.load(Ordering::Acquire);
      if active >= self.max_blocking {
        return None;
      }
      let mut queue = self
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if queue.closed || self.stop.is_stopping() || queue.is_empty() {
        return None;
      }
      if self
        .active_blocking
        .compare_exchange_weak(active, active + 1, Ordering::AcqRel, Ordering::Relaxed)
        .is_ok()
      {
        let blocking = queue
          .pop_front()
          .expect("a non-empty blocking queue must have a FIFO head");
        drop(queue);
        #[cfg(test)]
        run_multi_thread_work_claimed_test_hook();
        return Some((blocking, admission));
      }
    }
  }
}

#[cfg(napi_runtime_os_threads)]
struct MultiThreadDeadlockState {
  enabled: bool,
  verdict_closed: AtomicBool,
  admissions: AtomicUsize,
  publications: AtomicU64,
  owner_handoff_publication: Mutex<()>,
}

#[cfg(napi_runtime_os_threads)]
impl MultiThreadDeadlockState {
  fn new(enabled: bool) -> Self {
    Self {
      enabled,
      verdict_closed: AtomicBool::new(false),
      admissions: AtomicUsize::new(0),
      publications: AtomicU64::new(0),
      owner_handoff_publication: Mutex::new(()),
    }
  }

  fn begin_admission(self: &Arc<Self>) -> Option<MultiThreadDeadlockAdmissionGuard> {
    if !self.enabled {
      return None;
    }
    loop {
      while self.verdict_closed.load(Ordering::SeqCst) {
        #[cfg(test)]
        run_deadlock_closed_gate_admission_test_hook();
        std::hint::spin_loop();
      }
      self.admissions.fetch_add(1, Ordering::SeqCst);
      if !self.verdict_closed.load(Ordering::SeqCst) {
        return Some(MultiThreadDeadlockAdmissionGuard {
          state: Arc::clone(self),
          published: false,
        });
      }
      self.admissions.fetch_sub(1, Ordering::SeqCst);
    }
  }

  fn try_begin_verdict(self: &Arc<Self>) -> Option<MultiThreadDeadlockVerdictGuard> {
    debug_assert!(
      self.enabled,
      "a deadline verdict requires an enabled admission state"
    );
    if self
      .verdict_closed
      .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
      .is_err()
    {
      return None;
    }
    if self.admissions.load(Ordering::SeqCst) != 0 {
      self.verdict_closed.store(false, Ordering::SeqCst);
      return None;
    }
    Some(MultiThreadDeadlockVerdictGuard(Arc::clone(self)))
  }

  fn publications(&self) -> u64 {
    self.publications.load(Ordering::SeqCst)
  }

  fn owner_handoff_publication_guard(&self) -> Option<MutexGuard<'_, ()>> {
    self.enabled.then(|| {
      self
        .owner_handoff_publication
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
    })
  }
}

#[cfg(napi_runtime_os_threads)]
struct MultiThreadDeadlockAdmissionGuard {
  state: Arc<MultiThreadDeadlockState>,
  published: bool,
}

#[cfg(napi_runtime_os_threads)]
impl MultiThreadDeadlockAdmissionGuard {
  fn mark_published(&mut self) {
    self.published = true;
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for MultiThreadDeadlockAdmissionGuard {
  fn drop(&mut self) {
    if self.published {
      self.state.publications.fetch_add(1, Ordering::SeqCst);
    }
    // Publication and every scheduler-state write above must precede the final
    // admission decrement observed by a closed verdict gate.
    self.state.admissions.fetch_sub(1, Ordering::SeqCst);
  }
}

#[cfg(napi_runtime_os_threads)]
struct MultiThreadDeadlockVerdictGuard(Arc<MultiThreadDeadlockState>);

#[cfg(napi_runtime_os_threads)]
impl Drop for MultiThreadDeadlockVerdictGuard {
  fn drop(&mut self) {
    self.0.verdict_closed.store(false, Ordering::SeqCst);
  }
}

/// Cooperative-driver exit backstop. A user-future panic can unwind from any
/// poll, including after this driver absorbed a queue wake, received an exact
/// owner handoff, or filled its thread-local LIFO slot. Retire each obligation
/// independently so one cleanup failure cannot suppress the others or
/// double-panic the process.
#[cfg(napi_runtime_os_threads)]
struct CooperativeDriverExitGuard<'a> {
  executor: &'a Arc<MultiThreadExecutor>,
  parker: &'a Arc<DriverParker>,
  can_run_blocking: bool,
}

#[cfg(napi_runtime_os_threads)]
impl Drop for CooperativeDriverExitGuard<'_> {
  fn drop(&mut self) {
    let _ = catch_unwind_contained(|| self.executor.parked_drivers.deregister(self.parker));
    let _ = catch_unwind_contained(|| self.executor.forward_owner_handoff(self.parker));
    let _ = catch_unwind_contained(|| self.executor.flush_lifo_slot());
    let _ = catch_unwind_contained(|| {
      self
        .executor
        .compensate_queued_work_wake(self.can_run_blocking);
    });
  }
}

/// Unwind backstop for `drain`: flushes the worker's LIFO slot on drop so an
/// unwinding drain can never strand a runnable in the
/// thread-local slot of a thread that is about to return to rayon. Normal
/// drain exits flush explicitly BEFORE `finish_draining`; this drop is then a
/// no-op (the slot is already empty).
#[cfg(napi_runtime_os_threads)]
struct LifoSlotFlushGuard<'a>(&'a Arc<MultiThreadExecutor>);

#[cfg(napi_runtime_os_threads)]
impl Drop for LifoSlotFlushGuard<'_> {
  fn drop(&mut self) {
    self.0.flush_lifo_slot();
  }
}

/// Per-drain-frame idle-linger state, created lazily on the frame's first
/// idle episode (see the linger block in `MultiThreadExecutor::drain`): the
/// parker queue wakes are delivered to while this drainer lingers, plus its
/// generation-stop registration so `begin_shutdown` cuts a linger short
/// instead of `wait_until_scheduler_idle` waiting out the idle budget. The
/// registration guard deregisters on drop when the drain frame exits.
#[cfg(napi_runtime_os_threads)]
struct DrainLinger {
  parker: Arc<DriverParker>,
  _stop_registration: GenerationStopGuard,
}

#[cfg(napi_runtime_os_threads)]
impl DrainLinger {
  fn new(executor: &MultiThreadExecutor) -> Self {
    let parker = Arc::new(DriverParker::default());
    let stop_registration = executor.stop.register(&parker);
    Self {
      parker,
      _stop_registration: stop_registration,
    }
  }
}

// ---------------------------------------------------------------------------
// Targeted wake machinery for cooperative re-entrant `block_on` drivers.
//
// WAKE-DOMAIN SPLIT: future wakes and queue wakes have different targets:
//   * FUTURE-WAKES: `cooperative_block_on` polls its future with the driver's
//     OWN `DriverParker` as the waker, so a future-wake reaches exactly the
//     driver that awaits it. The permit bit makes a wake delivered while that
//     driver is RUNNING (mid-poll / mid-run_one) stick: the driver skips its
//     next park instead of losing the wake.
//   * QUEUE-WAKES (`schedule` / `schedule_blocking`): any parked driver can
//     serve queue work, so these go through the `ParkedDrivers` registry and
//     wake ONE parked driver; `ensure_drainer` remains the fallback when none
//     is parked, and an absorbed wake is handed on at `cooperative_block_on`
//     exit (miss compensation).
// Foreign-thread (napi caller) parks in `block_on` use
// `futures::executor::block_on`'s own parker and are OUTSIDE this mechanism.
// The CurrentThread flavor's `block_on` reuses `DriverParker` (one per
// frame, no registry) so it too OWNS its park site for deadlock detection
// while `ParkedDrivers` remains MultiThread-only.

/// No permit; the driver is running (or consumed its last permit).
const PARKER_EMPTY: usize = 0;
/// A wake permit is stored; the next `park` consumes it without sleeping.
const PARKER_NOTIFIED: usize = 1;
/// The driver is sleeping on the condvar (or committing to sleep under `lock`).
const PARKER_SLEEPING: usize = 2;

/// One driver's private parker: a saturating one-permit token plus a condvar
/// to sleep on when no permit is stored. Also the `Waker` for the future that
/// driver's `cooperative_block_on` / CurrentThread `block_on` frame awaits.
#[derive(Default)]
struct DriverParker {
  state: AtomicUsize,
  lock: Mutex<()>,
  condvar: UnboundedCondvar,
  #[cfg(napi_runtime_os_threads)]
  owner_handoff_pending: AtomicBool,
  #[cfg(napi_runtime_os_threads)]
  owner_handoff: Mutex<Option<BlockingOwnerToken>>,
}

impl DriverParker {
  #[cfg(napi_runtime_os_threads)]
  fn grant_owner_handoff(&self, owner: BlockingOwnerToken) {
    let mut pending = self
      .owner_handoff
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    debug_assert!(pending.is_none());
    *pending = Some(owner);
    self.owner_handoff_pending.store(true, Ordering::Release);
  }

  #[cfg(napi_runtime_os_threads)]
  fn take_owner_handoff(&self) -> Option<BlockingOwnerToken> {
    if !self.owner_handoff_pending.swap(false, Ordering::AcqRel) {
      return None;
    }
    self
      .owner_handoff
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .take()
  }

  #[cfg(napi_runtime_os_threads)]
  fn has_owner_handoff(&self) -> bool {
    self.owner_handoff_pending.load(Ordering::Acquire)
  }

  /// Grant the wake permit. Wakes the driver if it is sleeping; otherwise the
  /// permit is stored and the driver's next [`Self::park`] returns
  /// immediately -- a wake delivered while the driver is running is never
  /// lost. Multiple grants coalesce into one permit, which is safe because a
  /// woken driver re-checks every work source in its loop before it can park
  /// again.
  fn unpark(&self) {
    if self.state.swap(PARKER_NOTIFIED, Ordering::SeqCst) == PARKER_SLEEPING {
      // The sleeper publishes PARKER_SLEEPING while holding `lock` and
      // releases the lock only inside `condvar.wait`; the empty critical
      // section here fences the notify so it cannot fire in the window
      // between the sleeper's state store and its wait.
      drop(
        self
          .lock
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner),
      );
      self.condvar.notify_one();
    }
  }

  /// Consume a stored wake permit if one is present, without ever sleeping.
  /// This is the park DECISION's token check: a `true` return means a wake is
  /// already pending, so the caller must re-poll instead of parking (or
  /// panicking).
  fn consume_permit(&self) -> bool {
    self
      .state
      .compare_exchange(
        PARKER_NOTIFIED,
        PARKER_EMPTY,
        Ordering::SeqCst,
        Ordering::SeqCst,
      )
      .is_ok()
  }

  /// Block until the permit is granted, consuming it. Returns immediately if
  /// a permit is already stored. Only the owning driver calls `park`, so at
  /// most one thread ever sleeps here.
  fn park(&self) {
    // Fast path: consume a stored permit without touching the lock.
    if self.consume_permit() {
      return;
    }
    let mut guard = self
      .lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    match self.state.compare_exchange(
      PARKER_EMPTY,
      PARKER_SLEEPING,
      Ordering::SeqCst,
      Ordering::SeqCst,
    ) {
      Ok(_) => {}
      // The permit arrived between the fast path and here: consume it. (Only
      // this thread stores PARKER_SLEEPING, so the observed value can only be
      // PARKER_NOTIFIED.)
      Err(_) => {
        self.state.store(PARKER_EMPTY, Ordering::SeqCst);
        return;
      }
    }
    loop {
      guard = self
        .condvar
        .wait(guard)
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if self
        .state
        .compare_exchange(
          PARKER_NOTIFIED,
          PARKER_EMPTY,
          Ordering::SeqCst,
          Ordering::SeqCst,
        )
        .is_ok()
      {
        return;
      }
      // Spurious wakeup (state still PARKER_SLEEPING): keep waiting.
    }
  }

  /// Like [`Self::park`], but bounded: returns `true` when woken by a permit
  /// (consumed) and `false` when `timeout` elapsed with no permit granted.
  /// A `false` return has retracted the SLEEPING claim and left the parker
  /// EMPTY, so the caller may park again. Used by the deadline-based deadlock
  /// detection.
  fn park_timeout(&self, timeout: Duration) -> bool {
    if self.consume_permit() {
      return true;
    }
    let mut guard = self
      .lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    match self.state.compare_exchange(
      PARKER_EMPTY,
      PARKER_SLEEPING,
      Ordering::SeqCst,
      Ordering::SeqCst,
    ) {
      Ok(_) => {}
      // The permit arrived between the fast path and here: consume it. (Only
      // this thread stores PARKER_SLEEPING, so the observed value can only be
      // PARKER_NOTIFIED.)
      Err(_) => {
        self.state.store(PARKER_EMPTY, Ordering::SeqCst);
        return true;
      }
    }
    let Some(deadline) = Instant::now().checked_add(timeout) else {
      // An unrepresentable deadline is farther away than this platform can
      // observe. Treat it as an unbounded wait instead of panicking on a
      // user-provided deadlock-detection duration.
      loop {
        guard = self
          .condvar
          .wait(guard)
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        if self
          .state
          .compare_exchange(
            PARKER_NOTIFIED,
            PARKER_EMPTY,
            Ordering::SeqCst,
            Ordering::SeqCst,
          )
          .is_ok()
        {
          return true;
        }
      }
    };
    loop {
      if self
        .state
        .compare_exchange(
          PARKER_NOTIFIED,
          PARKER_EMPTY,
          Ordering::SeqCst,
          Ordering::SeqCst,
        )
        .is_ok()
      {
        return true;
      }
      let now = Instant::now();
      if now >= deadline {
        // Timed out: retract the SLEEPING claim -- unless a permit landed in
        // the meantime (an `unpark` that already saw SLEEPING may be waiting
        // on `lock` to notify; consuming its permit here IS the wake it
        // intended to deliver, so report "woken", not "timed out").
        return match self.state.compare_exchange(
          PARKER_SLEEPING,
          PARKER_EMPTY,
          Ordering::SeqCst,
          Ordering::SeqCst,
        ) {
          Ok(_) => false,
          Err(_) => {
            self.state.store(PARKER_EMPTY, Ordering::SeqCst);
            true
          }
        };
      }
      let (returned_guard, _timed_out) = self
        .condvar
        .wait_timeout(guard, deadline - now)
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      guard = returned_guard;
      // Loop re-checks the permit first, then the deadline (spurious wakeups
      // simply wait out the remaining time).
    }
  }
}

impl std::task::Wake for DriverParker {
  fn wake(self: Arc<Self>) {
    self.unpark();
  }

  fn wake_by_ref(self: &Arc<Self>) {
    self.unpark();
  }
}

/// Outcome of [`park_with_deadline`].
enum DeadlineParkOutcome {
  /// Woken by a permit (consumed); the park was healthy.
  Woken,
  /// A full deadline window elapsed with zero observed progress. Carries the
  /// fingerprint captured when that window was ARMED so the caller can make
  /// the final expiry DECISION against a fresh read -- expiry alone is NOT a
  /// verdict: a wake can land in the instructions after the window closes,
  /// and for MultiThread a `wake_one` can still pop the
  /// still-registered parker and count its wake as DELIVERED. Callers must
  /// deregister (MT), then re-check permit / queued work / fingerprint before
  /// panicking.
  Expired(ProgressFingerprint),
}

/// Deadline-bounded park with PROGRESS-BASED reset.
/// Every time `deadline` elapses without a wake, the runtime's progress
/// fingerprint is compared against the value captured when the deadline was
/// ARMED: any advance re-arms the deadline instead of firing, because a
/// legitimately long park -- e.g. awaiting a slow JS plugin while other work
/// proceeds -- must never be declared dead. `Expired` is a *candidate*
/// deadlock only; the panic decision lives with the caller (see
/// [`DeadlineParkOutcome`]).
fn park_with_deadline(
  parker: &DriverParker,
  deadline: Duration,
  metrics: &RuntimeMetrics,
) -> DeadlineParkOutcome {
  let mut armed = metrics.progress_fingerprint();
  loop {
    if parker.park_timeout(deadline) {
      return DeadlineParkOutcome::Woken;
    }
    let current = metrics.progress_fingerprint();
    if current != armed {
      armed = current;
      continue;
    }
    return DeadlineParkOutcome::Expired(armed);
  }
}

// Test-only injection seam for the deadline-expiry race: fired on the driver
// thread immediately after
// `park_with_deadline` reports `Expired`, while the parker is STILL
// REGISTERED in `parked_drivers` and before the expiry decision runs -- the
// exact window in which a racing `wake_one` can pop the parker, store its
// permit and report the wake as delivered. Lets a test interleave that race
// deterministically instead of wall-clock lottery.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEADLINE_EXPIRY_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_deadline_expiry_test_hook() {
  if let Some(hook) = DEADLINE_EXPIRY_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

// Second test-only injection seam for the enqueue/verdict race: fired AFTER
// the expiry decision's permit and queued-work re-checks both came up
// empty (parker already deregistered) and BEFORE the final fingerprint
// verdict -- the window in which an enqueue is invisible to every earlier
// re-check and only its ENQUEUE counter in the fingerprint can prevent a
// false BlockOnDeadlock.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEADLINE_VERDICT_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_deadline_verdict_test_hook() {
  if let Some(hook) = DEADLINE_VERDICT_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

// Final test-only injection seam: fired after every permit/queue/fingerprint/
// timer check from the legacy verdict and immediately before the synchronized
// admission gate closes. A separate OS thread can complete a publication here
// to prove the final verdict recheck has a real cross-thread ordering edge.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEADLINE_FINAL_VERDICT_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_deadline_final_verdict_test_hook() {
  if let Some(hook) = DEADLINE_FINAL_VERDICT_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

// Fired after the synchronized verdict gate has closed and before the verdict
// takes the stop-publication mutex for its final rechecks. A test can pause
// here while shutdown publishes generation stop and its abort wake reaches the
// closed admission gate.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEADLINE_GATED_VERDICT_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_deadline_gated_verdict_test_hook() {
  if let Some(hook) = DEADLINE_GATED_VERDICT_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

// Fired after the final verdict has acquired the stop-publication mutex. A
// shutdown test can retain that guard while another thread reaches the
// lifecycle -> stop-publication lock edge.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEADLINE_SYNCHRONIZED_STOP_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_deadline_synchronized_stop_test_hook() {
  if let Some(hook) = DEADLINE_SYNCHRONIZED_STOP_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

// Fired after the final verdict owns exact-owner publication and before it
// checks handoff/lane predicates. Tests can remove unrelated saving predicates
// while retaining the synchronized owner state under examination.
#[cfg(all(test, napi_runtime_os_threads))]
type DeadlineExactOwnerVerdictTestHook = Box<dyn FnOnce(&DriverParker)>;

#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEADLINE_EXACT_OWNER_VERDICT_TEST_HOOK:
    std::cell::RefCell<Option<DeadlineExactOwnerVerdictTestHook>> =
      const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_deadline_exact_owner_verdict_test_hook(parker: &DriverParker) {
  if let Some(hook) = DEADLINE_EXACT_OWNER_VERDICT_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook(parker);
  }
}

// Fired immediately before a test thread takes the stop-publication mutex.
// Installed only on the shutdown thread, this proves the controller still
// holds the lifecycle in Running while waiting for a verdict-owned guard.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static BEFORE_GENERATION_STOP_PUBLICATION_LOCK_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_before_generation_stop_publication_lock_test_hook() {
  if let Some(hook) =
    BEFORE_GENERATION_STOP_PUBLICATION_LOCK_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

// Fired on an admission thread after it observes a closed verdict gate. The
// hook is thread-local so a shutdown test can prove that an abort wake reached
// this exact wait without affecting unrelated scheduler threads.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static DEADLOCK_CLOSED_GATE_ADMISSION_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
      const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_deadlock_closed_gate_admission_test_hook() {
  if let Some(hook) = DEADLOCK_CLOSED_GATE_ADMISSION_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

// Timer registration enters the shared verdict admission before this seam.
// Tests can pause there to prove the timer remains an announced publication
// until its heap entry becomes visible.
#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static TIMER_REGISTRATION_ADMISSION_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_timer_registration_admission_test_hook() {
  if let Some(hook) = TIMER_REGISTRATION_ADMISSION_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

#[cfg(all(test, napi_runtime_os_threads))]
thread_local! {
  static OWNER_HANDOFF_SELECTED_TEST_HOOK: std::cell::RefCell<Option<Box<dyn FnOnce()>>> =
    const { std::cell::RefCell::new(None) };
}

#[cfg(all(test, napi_runtime_os_threads))]
fn run_owner_handoff_selected_test_hook() {
  if let Some(hook) = OWNER_HANDOFF_SELECTED_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

/// Registry of parked (or committed-to-parking) cooperative drivers, used by
/// queue-wakes to wake exactly one of them.
#[cfg(napi_runtime_os_threads)]
#[derive(Default)]
struct ParkedDrivers {
  parked: Mutex<Vec<ParkedDriver>>,
  // Mirror of `parked.len()`, maintained under the mutex and read lock-free
  // by `wake_one`'s no-waiter fast path.
  count: AtomicUsize,
}

#[cfg(napi_runtime_os_threads)]
struct ParkedDriver {
  parker: Arc<DriverParker>,
  can_run_blocking: bool,
  dependency: Option<Arc<TaskDependency>>,
}

#[cfg(napi_runtime_os_threads)]
impl ParkedDrivers {
  /// Register `parker` as parked-or-parking. MUST precede the caller's final
  /// work re-check -- see the lost-wakeup argument at [`Self::wake_one`].
  #[cfg(test)]
  fn register(&self, parker: &Arc<DriverParker>) {
    self.register_with_role(parker, true, None);
  }

  fn register_with_role(
    &self,
    parker: &Arc<DriverParker>,
    can_run_blocking: bool,
    dependency: Option<Arc<TaskDependency>>,
  ) {
    let mut parked = self
      .parked
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    parked.push(ParkedDriver {
      parker: Arc::clone(parker),
      can_run_blocking,
      dependency,
    });
    self.count.store(parked.len(), Ordering::SeqCst);
  }

  /// Remove `parker` if still registered. `wake_one` removes the parkers it
  /// pops, while a direct future-wake does not, so drivers call this after
  /// every park (and after a re-check aborts one).
  fn deregister(&self, parker: &Arc<DriverParker>) {
    let removed = {
      let mut parked = self
        .parked
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let removed = parked
        .iter()
        .position(|candidate| Arc::ptr_eq(&candidate.parker, parker))
        .map(|index| parked.swap_remove(index));
      self.count.store(parked.len(), Ordering::SeqCst);
      removed
    };
    drop(removed);
  }

  /// Wake one parked driver -- most recently parked first, its stack and
  /// caches are the warmest -- returning whether anyone was woken.
  ///
  /// LOST-WAKEUP ARGUMENT. A scheduler pushes
  /// work under a work-queue mutex Q, THEN calls `wake_one`; a parking driver
  /// registers itself (the `count` store above, under the registry mutex),
  /// THEN re-checks the work queues under Q, and only then parks. Order the
  /// two Q critical sections:
  ///   * If the driver's re-check locks Q after the scheduler's push unlocked
  ///     it, the re-check observes the work and the driver does not park --
  ///     skipping the wake (fast path below) is safe.
  ///   * Otherwise the driver's re-check unlocked Q before the scheduler's
  ///     push locked it. The driver's `count` store is sequenced before its
  ///     re-check, the re-check's unlock of Q synchronizes-with the push's
  ///     lock of Q, and the push is sequenced before the fast-path load
  ///     below; the load therefore happens-after the `count` store and must
  ///     observe `count >= 1`: the slow path pops a registered parker and
  ///     wakes it.
  ///
  /// A wake delivered to a driver that raced out of its park (or aborted it)
  /// is stored as that driver's permit; the driver re-checks every work
  /// source before it can sleep on the next park, so the wake still lands.
  fn wake_one(&self) -> bool {
    if self.count.load(Ordering::SeqCst) == 0 {
      // No-waiter fast path: nobody is parked or committed to parking (any
      // in-flight parker that missed this check re-checks the queues after
      // registering, per the argument above).
      return false;
    }
    let driver = {
      let mut parked = self
        .parked
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let driver = parked.pop();
      self.count.store(parked.len(), Ordering::SeqCst);
      driver
    };
    match driver {
      Some(driver) => {
        driver.parker.unpark();
        true
      }
      None => false,
    }
  }

  /// Wake the most recently parked cooperative driver that is eligible to
  /// consume blocking work.
  fn wake_one_blocking(&self) -> bool {
    if self.count.load(Ordering::SeqCst) == 0 {
      return false;
    }
    let driver = {
      let mut parked = self
        .parked
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let driver = parked
        .iter()
        .rposition(|driver| driver.can_run_blocking)
        .map(|index| parked.swap_remove(index));
      self.count.store(parked.len(), Ordering::SeqCst);
      driver
    };
    match driver {
      Some(driver) => {
        driver.parker.unpark();
        true
      }
      None => false,
    }
  }

  /// Wake one parked driver whose live dependency belongs to `owner`.
  ///
  /// The dependency is published with the parker, so an unrelated newer
  /// driver cannot consume the bounded owner-lane handoff.
  fn wake_one_owner_dependency(&self, owner: BlockingOwnerToken) -> bool {
    loop {
      if self.count.load(Ordering::SeqCst) == 0 {
        return false;
      }
      let candidates = {
        let parked = self
          .parked
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        parked
          .iter()
          .rev()
          .filter_map(|driver| {
            if !driver.can_run_blocking {
              return None;
            }
            driver
              .dependency
              .as_ref()
              .map(|dependency| (Arc::clone(&driver.parker), Arc::clone(dependency)))
          })
          .collect::<Vec<_>>()
      };
      let selected = candidates.into_iter().find(|(_, dependency)| {
        dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Exact)
      });
      let Some((selected_parker, selected_dependency)) = selected else {
        return false;
      };
      let driver = {
        let mut parked = self
          .parked
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        let driver = parked
          .iter()
          .rposition(|driver| {
            Arc::ptr_eq(&driver.parker, &selected_parker)
              && driver
                .dependency
                .as_ref()
                .is_some_and(|dependency| Arc::ptr_eq(dependency, &selected_dependency))
          })
          .map(|index| parked.swap_remove(index));
        // Publish the exact-owner token before releasing the registry lock. A
        // direct future wake can race this selection, but the driver must
        // deregister under this same lock before it can poll Ready and forward
        // an unconsumed handoff on exit.
        if let Some(driver) = &driver {
          driver.parker.grant_owner_handoff(owner);
        }
        self.count.store(parked.len(), Ordering::SeqCst);
        driver
      };
      if let Some(driver) = driver {
        #[cfg(test)]
        run_owner_handoff_selected_test_hook();
        driver.parker.unpark();
        return true;
      }
    }
  }

  /// Wake every timer-bounded driver so cancellation of the earliest timer
  /// cannot leave pool workers parked until a stale deadline.
  fn wake_all(&self) {
    if self.count.load(Ordering::SeqCst) == 0 {
      return;
    }
    let drivers = {
      let mut parked = self
        .parked
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let drivers = parked.drain(..).collect::<Vec<_>>();
      self.count.store(0, Ordering::SeqCst);
      drivers
    };
    for driver in drivers {
      driver.parker.unpark();
    }
  }
}

// ---------------------------------------------------------------------------
// Runtime timer facility: `sleep_until` without a tokio
// reactor. Two drivers, selected by runtime flavor:
//
//   * MultiThread: a runtime-owned binary heap plus one dedicated non-Rayon
//     timekeeper thread. Timer waits never consume the configured CPU workers.
//     Cooperative re-entrant `block_on` parks are ALSO bounded by the earliest
//     deadline, so the parked driver can fire due timers without depending on
//     any particular inter-thread wake ordering.
//   * CurrentThread: timers are DELEGATED TO THE HOST event loop through an
//     injected [`TimerDriver`] (the Node binding registers a setTimeout-based
//     driver at import; wasi-single uses the same path). A CT runtime without
//     a registered driver fails LOUD at `sleep_until` -- never a silent hang.
//
// DEADLOCK-DETECTION INTERACTIONS:
//   * MT: a wait on a pending timer is never a deadlock candidate -- the wall
//     clock is a guaranteed wake source. Timer waits therefore use their own
//     primitive (a plain `park_timeout` bounded by the earliest deadline),
//     NEVER `park_with_deadline`, so an armed park deadline
//     shorter than the next timer cannot fire on a legitimate timer wait; the
//     fire itself schedules the woken task, which IS fingerprint progress for
//     every other parked driver. The expiry VERDICT additionally re-checks
//     the heap (see `cooperative_block_on`): arming a timer bumps no progress
//     counter by design, so a registration racing an already-committed
//     deadline park must veto the panic there.
//   * CT certain check (threadless): a pending HOST timer is NOT a wake
//     token -- the JS setTimeout relay can only run on the very thread that
//     is parking, so it can never fire while `block_on` holds it. The check
//     panics unconditionally on a threadless build; a pending timer merely
//     selects the timer-backed variant of the typed diagnostic. The CT
//     deadline verdict (threaded flavor, where the host loop genuinely runs
//     concurrently) counts only LIVE waits (deadline still in the future): a
//     pending timer whose deadline passed without firing is the
//     frozen-JS-event-loop signature that the deadline-based detection
//     exists to catch, so it must NOT suppress the panic.

/// Host-turn dispatcher for the CurrentThread runnable queue.
///
/// The NAPI binding registers one weak native threadsafe-function driver per
/// importing environment. Its custom Node-API callback owns the fresh host turn
/// and keeps delivery capabilities out of JavaScript. Scheduling through a
/// fresh host turn is required for soundness: arbitrary futures may invoke
/// their waker while holding internal locks, so polling the runnable inline
/// from that wake can self-deadlock.
pub trait CurrentThreadTaskDriver: Send + Sync + 'static {
  /// Queue one host turn that will call [`drive_current_thread_tasks`] with
  /// [`CurrentThreadTaskDelivery::capability`].
  ///
  /// The delivery capability is scoped to this exact host registration and
  /// attempt. The registry maps it back to the executor's one internal
  /// dispatch capability only while this attempt remains current.
  /// `false` means this driver can no longer dispatch and must be swept. After
  /// returning `true`, the driver must eventually call either
  /// [`acknowledge_current_thread_task_delivery`] or
  /// [`fail_current_thread_task_delivery`] with this exact value. A successful
  /// acknowledgement is accepted only after
  /// [`drive_current_thread_tasks`] claimed this exact delivery.
  ///
  /// `dispatch` must return promptly and must not wait on another thread. In
  /// particular it must never block on the thread that will acknowledge or
  /// fail this delivery (for instance by spawning a helper that calls
  /// [`fail_current_thread_task_delivery`] and joining it). The executor
  /// calls `dispatch` from `schedule`, which may be a waker's stack: a waker
  /// can be invoked while its producer holds a mutex (`futures::Shared` wakes
  /// its awaiters under its `wakers` lock). When a delivery failure turns
  /// terminal, the rejected work is cancelled on the stack of the thread that
  /// failed it, and a rejected future's destructor may re-lock the very mutex
  /// the blocked waker still holds. A `dispatch` that waits on that thread
  /// therefore deadlocks with it.
  ///
  /// Failing the delivery synchronously from inside `dispatch`, on the
  /// calling thread, is handled: the executor recognises that stack as a
  /// possible waker's, moves the rejected work aside and cancels it on the
  /// next clean stack (see `CurrentThreadQueue::rejected`). Failing or
  /// acknowledging it later, from any thread, is handled too. The Node-API
  /// driver satisfies this contract: it makes one nonblocking
  /// threadsafe-function call and returns `false` at once when the
  /// environment is closing.
  fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool;

  fn is_live(&self) -> bool {
    true
  }

  /// Called after this driver has been removed from the registry, with no
  /// registry lock held. Must be idempotent with explicit host cleanup.
  fn on_swept(&self) {}
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct CurrentThreadTaskDriverId(u64);

type CurrentThreadTaskDriverSnapshot =
  ContainedArcSnapshot<CurrentThreadTaskDriverId, dyn CurrentThreadTaskDriver>;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct CurrentThreadTaskDelivery {
  driver: CurrentThreadTaskDriverId,
  capability: u64,
  dispatch: u64,
}

impl CurrentThreadTaskDelivery {
  /// Opaque driver capability for this exact registration attempt.
  pub fn capability(self) -> u64 {
    self.capability
  }
}

struct CurrentThreadTaskDeliveryState {
  delivery: CurrentThreadTaskDelivery,
  claimed: bool,
  accepted: bool,
}

struct CurrentThreadTaskDriverEntry {
  driver: Arc<dyn CurrentThreadTaskDriver>,
  delivery: Option<CurrentThreadTaskDeliveryState>,
  pending: Option<u64>,
  previous: Option<CurrentThreadTaskDriverId>,
  next: Option<CurrentThreadTaskDriverId>,
}

#[derive(Default, Clone, Copy, Debug, PartialEq, Eq)]
enum CurrentThreadDispatchPhase {
  #[default]
  Pending,
  Serviced,
  Cancelling,
}

#[derive(Default)]
struct CurrentThreadDispatchState {
  phase: CurrentThreadDispatchPhase,
  epoch: u64,
  publications: usize,
  references: usize,
  accepted: bool,
  accepted_failure: bool,
}

impl CurrentThreadDispatchState {
  fn is_serviced(&self) -> bool {
    self.phase == CurrentThreadDispatchPhase::Serviced
  }

  fn is_cancelling(&self) -> bool {
    self.phase == CurrentThreadDispatchPhase::Cancelling
  }

  fn failure(&self, dispatch: u64) -> CurrentThreadTaskDispatchFailure {
    CurrentThreadTaskDispatchFailure {
      dispatch,
      epoch: self.epoch,
    }
  }
}

#[derive(Default)]
struct CurrentThreadTaskDriverRegistryState {
  entries: FxHashMap<CurrentThreadTaskDriverId, CurrentThreadTaskDriverEntry>,
  oldest: Option<CurrentThreadTaskDriverId>,
  newest: Option<CurrentThreadTaskDriverId>,
  delivery_drivers: FxHashMap<u64, CurrentThreadTaskDriverId>,
  dispatches: FxHashMap<u64, CurrentThreadDispatchState>,
}

impl CurrentThreadTaskDriverRegistryState {
  fn insert_driver(
    &mut self,
    id: CurrentThreadTaskDriverId,
    driver: Arc<dyn CurrentThreadTaskDriver>,
  ) {
    let previous = self.newest;
    let replaced = self.entries.insert(
      id,
      CurrentThreadTaskDriverEntry {
        driver,
        delivery: None,
        pending: None,
        previous,
        next: None,
      },
    );
    assert!(
      replaced.is_none(),
      "CurrentThread task driver id must be unique"
    );
    if let Some(previous) = previous {
      self
        .entries
        .get_mut(&previous)
        .expect("the newest CurrentThread task driver must remain registered")
        .next = Some(id);
    } else {
      self.oldest = Some(id);
    }
    self.newest = Some(id);
  }

  fn remove_driver(
    &mut self,
    id: CurrentThreadTaskDriverId,
  ) -> Option<CurrentThreadTaskDriverEntry> {
    let entry = self.entries.remove(&id)?;
    if let Some(previous) = entry.previous {
      self
        .entries
        .get_mut(&previous)
        .expect("the previous CurrentThread task driver must remain registered")
        .next = entry.next;
    } else {
      self.oldest = entry.next;
    }
    if let Some(next) = entry.next {
      self
        .entries
        .get_mut(&next)
        .expect("the next CurrentThread task driver must remain registered")
        .previous = entry.previous;
    } else {
      self.newest = entry.previous;
    }
    if let Some(delivery) = &entry.delivery {
      let indexed = self.delivery_drivers.remove(&delivery.delivery.capability);
      debug_assert_eq!(
        indexed,
        Some(id),
        "delivery capability index must match its driver"
      );
    }
    Some(entry)
  }

  fn ordered_snapshot(&self) -> Vec<(CurrentThreadTaskDriverId, Arc<dyn CurrentThreadTaskDriver>)> {
    let mut snapshot = Vec::with_capacity(self.entries.len());
    let mut current = self.oldest;
    while let Some(id) = current {
      let entry = self
        .entries
        .get(&id)
        .expect("CurrentThread task driver order must reference a live entry");
      snapshot.push((id, Arc::clone(&entry.driver)));
      current = entry.next;
    }
    debug_assert_eq!(
      snapshot.len(),
      self.entries.len(),
      "CurrentThread task driver order must contain every entry exactly once"
    );
    snapshot
  }

  fn ordered_ids_match(&self, expected: &[CurrentThreadTaskDriverId]) -> bool {
    if self.entries.len() != expected.len() {
      return false;
    }
    let mut current = self.oldest;
    for expected in expected {
      if current != Some(*expected) {
        return false;
      }
      current = self
        .entries
        .get(expected)
        .expect("CurrentThread task driver order must reference a live entry")
        .next;
    }
    current.is_none()
  }
}

struct CurrentThreadTaskDriverSelection {
  live: CurrentThreadTaskDriverSnapshot,
  failed_dispatches: Vec<CurrentThreadTaskDispatchFailure>,
}

#[derive(Default)]
struct CurrentThreadTaskDeliveryCompletion {
  failed_dispatches: Vec<CurrentThreadTaskDispatchFailure>,
  redispatch: bool,
}

struct CurrentThreadTaskDispatchCompletion {
  result: CurrentThreadHostDispatchResult,
  failed_dispatches: Vec<CurrentThreadTaskDispatchFailure>,
}

struct CurrentThreadTaskDispatchPublicationGuard<'a> {
  registry: &'a CurrentThreadTaskDriverRegistry,
  dispatch: Option<u64>,
}

impl CurrentThreadTaskDispatchPublicationGuard<'_> {
  fn finish(mut self) -> CurrentThreadHostDispatchResult {
    let dispatch = self
      .dispatch
      .expect("the CurrentThread task dispatch publication must remain armed");
    let result = self.registry.finish_publication(dispatch);
    self.dispatch = None;
    result
  }
}

impl Drop for CurrentThreadTaskDispatchPublicationGuard<'_> {
  fn drop(&mut self) {
    if let Some(dispatch) = self.dispatch.take() {
      self.registry.abort_publication(dispatch);
    }
  }
}

#[derive(Default)]
struct CurrentThreadTaskDriverRegistry {
  state: Mutex<CurrentThreadTaskDriverRegistryState>,
  next_id: AtomicU64,
  next_delivery: AtomicU64,
}

impl CurrentThreadTaskDriverRegistry {
  fn register(&self, driver: Arc<dyn CurrentThreadTaskDriver>) -> CurrentThreadTaskDriverId {
    let id = next_unique_id(
      &self.next_id,
      "CurrentThread task driver id space exhausted",
    );
    let id = CurrentThreadTaskDriverId(id);
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .insert_driver(id, driver);
    id
  }

  fn unregister(&self, id: CurrentThreadTaskDriverId) -> CurrentThreadTaskDeliveryCompletion {
    let (removed, failed_dispatches) = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let removed = state.remove_driver(id);
      let mut failed_dispatches = Vec::new();
      if let Some(entry) = &removed {
        Self::finish_entry_references(&mut state, entry, &mut failed_dispatches);
      }
      (removed, failed_dispatches)
    };
    let _ = catch_unwind_contained(|| drop(removed));
    CurrentThreadTaskDeliveryCompletion {
      failed_dispatches,
      redispatch: false,
    }
  }

  fn live(&self) -> CurrentThreadTaskDriverSelection {
    let mut failed_dispatches = Vec::new();
    loop {
      let snapshot = CurrentThreadTaskDriverSnapshot::new({
        let state = self
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        state.ordered_snapshot()
      });
      let mut dead_ids = FxHashSet::default();
      let mut live_ids = Vec::new();
      for (id, driver) in snapshot.as_slice() {
        if catch_unwind_contained(|| driver.is_live()).unwrap_or(false) {
          live_ids.push(*id);
        } else {
          dead_ids.insert(*id);
        }
      }

      let (live, swept, retry) = {
        let mut state = self
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        let mut swept = Vec::new();
        let mut current = state.oldest;
        while let Some(id) = current {
          let next = state
            .entries
            .get(&id)
            .expect("CurrentThread task driver order must reference a live entry")
            .next;
          if dead_ids.contains(&id)
            && let Some(entry) = state.remove_driver(id)
          {
            swept.push(entry);
          }
          current = next;
        }
        for entry in &swept {
          Self::finish_entry_references(&mut state, entry, &mut failed_dispatches);
        }
        let retry = !state.ordered_ids_match(&live_ids);
        let live = if retry {
          Vec::new()
        } else {
          state.ordered_snapshot()
        };
        (CurrentThreadTaskDriverSnapshot::new(live), swept, retry)
      };

      // A reentrant probe can unregister multiple snapshot-only drivers.
      // See the implementation notes in this crate's README.
      drop(snapshot);
      for entry in swept {
        let _ = catch_unwind_contained(|| entry.driver.on_swept());
        let _ = catch_unwind_contained(|| drop(entry));
      }
      if !retry {
        return CurrentThreadTaskDriverSelection {
          live,
          failed_dispatches,
        };
      }
    }
  }

  #[cfg(test)]
  fn current(&self) -> Option<(CurrentThreadTaskDriverId, Arc<dyn CurrentThreadTaskDriver>)> {
    let mut live = self.live().live;
    live.pop().map(|(id, driver)| (id, driver.into_inner()))
  }

  fn next_delivery(
    &self,
    driver: CurrentThreadTaskDriverId,
    dispatch: u64,
  ) -> CurrentThreadTaskDelivery {
    let capability = next_unique_id(
      &self.next_delivery,
      "CurrentThread task delivery id space exhausted",
    )
    .checked_add(1)
    .expect("CurrentThread task delivery id space exhausted");
    CurrentThreadTaskDelivery {
      driver,
      capability,
      dispatch,
    }
  }

  fn add_dispatch_reference(state: &mut CurrentThreadTaskDriverRegistryState, dispatch: u64) {
    let dispatch_state = state
      .dispatches
      .get_mut(&dispatch)
      .expect("a referenced CurrentThread dispatch must remain registered");
    dispatch_state.references = dispatch_state
      .references
      .checked_add(1)
      .expect("CurrentThread dispatch reference count exhausted");
  }

  fn remove_dispatch_reference(state: &mut CurrentThreadTaskDriverRegistryState, dispatch: u64) {
    let Some(dispatch_state) = state.dispatches.get_mut(&dispatch) else {
      return;
    };
    dispatch_state.references = dispatch_state
      .references
      .checked_sub(1)
      .expect("CurrentThread dispatch reference count underflow");
  }

  fn dispatch_with_completion(&self, dispatch: u64) -> CurrentThreadTaskDispatchCompletion {
    let publication = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let dispatch_state = state.dispatches.entry(dispatch).or_default();
      if dispatch_state.is_serviced() {
        return CurrentThreadTaskDispatchCompletion {
          result: CurrentThreadHostDispatchResult::Accepted,
          failed_dispatches: Vec::new(),
        };
      }
      if dispatch_state.is_cancelling() {
        return CurrentThreadTaskDispatchCompletion {
          result: CurrentThreadHostDispatchResult::Failed(dispatch_state.failure(dispatch)),
          failed_dispatches: Vec::new(),
        };
      }
      dispatch_state.publications = dispatch_state
        .publications
        .checked_add(1)
        .expect("CurrentThread dispatch publication count exhausted");
      CurrentThreadTaskDispatchPublicationGuard {
        registry: self,
        dispatch: Some(dispatch),
      }
    };

    let CurrentThreadTaskDriverSelection {
      mut live,
      mut failed_dispatches,
    } = self.live();
    let planned_deliveries = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let Some(dispatch_state) = state.dispatches.get(&dispatch) else {
        return CurrentThreadTaskDispatchCompletion {
          result: CurrentThreadHostDispatchResult::Unavailable,
          failed_dispatches,
        };
      };
      if dispatch_state.is_serviced() || dispatch_state.is_cancelling() {
        Vec::new()
      } else {
        // Reserve every capability and all output storage before mutating an
        // entry. If ID allocation unwinds, the publication guard can retire
        // the barrier without leaving an undispatched physical slot occupied.
        let mut reserved_deliveries = Vec::with_capacity(live.len());
        for (id, _) in live.as_slice().iter().rev() {
          let Some(entry) = state.entries.get(id) else {
            continue;
          };
          if entry.delivery.is_none() {
            reserved_deliveries.push(self.next_delivery(*id, dispatch));
          }
        }
        state.delivery_drivers.reserve(reserved_deliveries.len());
        let mut reserved_deliveries = reserved_deliveries.into_iter();
        let mut planned_deliveries = Vec::with_capacity(live.len());
        let mut retired = Vec::with_capacity(live.len());
        let mut accepted_reservation = false;
        for (id, _) in live.as_slice().iter().rev() {
          let Some(entry) = state.entries.get(id) else {
            continue;
          };
          if let Some(delivery) = &entry.delivery
            && delivery.delivery.dispatch == dispatch
          {
            accepted_reservation |= delivery.accepted;
            continue;
          }
          if entry.delivery.is_some() {
            let previous = state
              .entries
              .get_mut(id)
              .expect("the CurrentThread task driver must remain registered")
              .pending
              .replace(dispatch);
            if previous != Some(dispatch) {
              if let Some(previous) = previous {
                Self::remove_dispatch_reference(&mut state, previous);
              }
              Self::add_dispatch_reference(&mut state, dispatch);
            }
            retired.push(previous);
            accepted_reservation = true;
            continue;
          }
          let delivery = reserved_deliveries
            .next()
            .expect("every available CurrentThread host must have a reserved delivery");
          let pending = state
            .entries
            .get_mut(id)
            .expect("the CurrentThread task driver must remain registered")
            .pending
            .take();
          let accepted = pending == Some(dispatch);
          if !accepted && pending.is_some() {
            retired.push(pending);
          }
          match pending {
            Some(pending) if pending == dispatch => {}
            Some(pending) => {
              Self::remove_dispatch_reference(&mut state, pending);
              Self::add_dispatch_reference(&mut state, dispatch);
            }
            None => Self::add_dispatch_reference(&mut state, dispatch),
          }
          let indexed = state.delivery_drivers.insert(delivery.capability, *id);
          assert!(
            indexed.is_none(),
            "CurrentThread delivery capability must be unique"
          );
          state
            .entries
            .get_mut(id)
            .expect("the CurrentThread task driver must remain registered")
            .delivery = Some(CurrentThreadTaskDeliveryState {
            delivery,
            claimed: false,
            accepted,
          });
          accepted_reservation |= accepted;
          planned_deliveries.push((*id, delivery));
        }
        let all_reserved_deliveries_installed = reserved_deliveries.next().is_none();
        debug_assert!(
          all_reserved_deliveries_installed,
          "every reserved CurrentThread delivery must be installed"
        );
        if accepted_reservation {
          state
            .dispatches
            .get_mut(&dispatch)
            .expect("the publishing dispatch state must remain registered")
            .accepted = true;
        }
        for dispatch in retired.into_iter().flatten() {
          Self::retire_unreferenced_dispatch(&mut state, Some(dispatch));
        }
        planned_deliveries
      }
    };

    // Pair newest-first delivery plans with contained driver owners after
    // releasing the registry lock. Normal, rejection, and unwind cleanup can
    // then destroy every selected driver independently without re-entering the
    // registry under its mutex.
    let mut deliveries = Vec::with_capacity(planned_deliveries.len());
    let mut planned_deliveries = planned_deliveries.into_iter();
    let mut next_delivery = planned_deliveries.next();
    while let Some((id, driver)) = live.pop() {
      let Some((planned_id, delivery)) = next_delivery else {
        break;
      };
      if planned_id == id {
        deliveries.push((id, driver, delivery));
        next_delivery = planned_deliveries.next();
      } else {
        next_delivery = Some((planned_id, delivery));
      }
    }
    debug_assert!(
      next_delivery.is_none() && planned_deliveries.len() == 0,
      "every planned CurrentThread delivery must retain its selected driver"
    );

    for (id, driver, delivery) in deliveries {
      if catch_unwind_contained(|| driver.get().dispatch(delivery)).unwrap_or(false) {
        self.accept_delivery(id, delivery);
      } else {
        let (entry, failures) = self.reject_delivery(id, delivery);
        failed_dispatches.extend(failures);
        if let Some(entry) = entry {
          let _ = catch_unwind_contained(|| entry.driver.on_swept());
          let _ = catch_unwind_contained(|| drop(entry));
        }
      }
    }

    let result = publication.finish();
    debug_assert!(
      !failed_dispatches
        .iter()
        .any(|failure| failure.dispatch == dispatch),
      "the active publication must report its own terminal outcome directly"
    );
    CurrentThreadTaskDispatchCompletion {
      result,
      failed_dispatches,
    }
  }

  #[cfg(test)]
  fn dispatch(&self, dispatch: u64) -> CurrentThreadHostDispatchResult {
    self.dispatch_with_completion(dispatch).result
  }

  fn accept_delivery(&self, id: CurrentThreadTaskDriverId, delivery: CurrentThreadTaskDelivery) {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let delivery_remains = if state.entries.get(&id).is_some_and(|entry| {
      entry
        .delivery
        .as_ref()
        .is_some_and(|current| current.delivery == delivery)
    }) {
      state
        .entries
        .get_mut(&id)
        .expect("the matching CurrentThread task driver must remain registered")
        .delivery
        .as_mut()
        .expect("the matching delivery must remain installed")
        .accepted = true;
      true
    } else {
      // A callback may complete or unregister synchronously before
      // `CurrentThreadTaskDriver::dispatch` returns. The true return still
      // proves acceptance; if no host serviced it, losing the reference is an
      // accepted delivery failure retained behind this publication barrier.
      false
    };
    if let Some(dispatch_state) = state.dispatches.get_mut(&delivery.dispatch) {
      dispatch_state.accepted = true;
      dispatch_state.accepted_failure |= !delivery_remains && !dispatch_state.is_serviced();
    }
  }

  fn reject_delivery(
    &self,
    id: CurrentThreadTaskDriverId,
    delivery: CurrentThreadTaskDelivery,
  ) -> (
    Option<CurrentThreadTaskDriverEntry>,
    Vec<CurrentThreadTaskDispatchFailure>,
  ) {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if !state.entries.get(&id).is_some_and(|entry| {
      entry
        .delivery
        .as_ref()
        .is_some_and(|current| current.delivery == delivery)
    }) {
      return (None, Vec::new());
    }
    let entry = state
      .remove_driver(id)
      .expect("the matching CurrentThread task driver must remain registered");
    let mut failures = Vec::new();
    Self::finish_entry_references(&mut state, &entry, &mut failures);
    (Some(entry), failures)
  }

  fn finish_delivery(
    &self,
    delivery: CurrentThreadTaskDelivery,
    failed: bool,
  ) -> CurrentThreadTaskDeliveryCompletion {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if !state.entries.get(&delivery.driver).is_some_and(|entry| {
      entry
        .delivery
        .as_ref()
        .is_some_and(|current| current.delivery == delivery)
    }) {
      return CurrentThreadTaskDeliveryCompletion::default();
    }
    let current = state
      .entries
      .get_mut(&delivery.driver)
      .expect("the matching CurrentThread task driver must remain registered")
      .delivery
      .take()
      .expect("the matching delivery must remain installed");
    let indexed = state.delivery_drivers.remove(&delivery.capability);
    debug_assert_eq!(
      indexed,
      Some(delivery.driver),
      "delivery capability index must match its driver"
    );
    let redispatch = state
      .entries
      .get(&delivery.driver)
      .expect("the matching CurrentThread task driver must remain registered")
      .pending
      .is_some_and(|dispatch| {
        state
          .dispatches
          .get(&dispatch)
          .is_some_and(|state| !state.is_serviced() && !state.is_cancelling())
      });
    let mut failed_dispatches = Vec::new();
    // Callback completion proves only that JavaScript ran. A success return is
    // authoritative only after `drive_current_thread_tasks` claimed this exact
    // host attempt; otherwise a no-op or malicious callback could retire the
    // registry reference while leaving the executor dispatch pending forever.
    Self::finish_dispatch_reference(
      &mut state,
      delivery.dispatch,
      true,
      failed || !current.claimed,
      &mut failed_dispatches,
    );
    CurrentThreadTaskDeliveryCompletion {
      failed_dispatches,
      redispatch,
    }
  }

  fn claim_delivery(&self, capability: u64) -> Option<u64> {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let driver = *state.delivery_drivers.get(&capability)?;
    let delivery = state.entries.get(&driver)?.delivery.as_ref()?.delivery;
    if delivery.capability != capability {
      return None;
    }
    let dispatch_state = state.dispatches.get(&delivery.dispatch)?;
    if dispatch_state.is_serviced()
      || dispatch_state.is_cancelling()
      || state.entries.get(&driver)?.delivery.as_ref()?.claimed
    {
      return None;
    }
    let current = state.entries.get_mut(&driver)?.delivery.as_mut()?;
    current.claimed = true;
    current.accepted = true;
    state.dispatches.get_mut(&delivery.dispatch)?.accepted = true;
    Some(delivery.dispatch)
  }

  fn mark_serviced(&self, dispatch: u64) {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let Some(dispatch_state) = state.dispatches.get_mut(&dispatch) else {
      return;
    };
    dispatch_state.phase = CurrentThreadDispatchPhase::Serviced;
    let mut removed_references = 0usize;
    for entry in state.entries.values_mut() {
      if entry.pending == Some(dispatch) {
        entry.pending = None;
        removed_references = removed_references
          .checked_add(1)
          .expect("CurrentThread dispatch reference count exhausted");
      }
    }
    let dispatch_state = state
      .dispatches
      .get_mut(&dispatch)
      .expect("the serviced CurrentThread dispatch must remain registered");
    dispatch_state.references = dispatch_state
      .references
      .checked_sub(removed_references)
      .expect("CurrentThread dispatch reference count underflow");
    Self::retire_unreferenced_dispatch(&mut state, Some(dispatch));
  }

  fn fail_delivery(&self, capability: u64) -> CurrentThreadTaskDeliveryCompletion {
    let delivery = {
      let state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state
        .delivery_drivers
        .get(&capability)
        .and_then(|driver| state.entries.get(driver))
        .and_then(|entry| entry.delivery.as_ref())
        .map(|delivery| delivery.delivery)
        .filter(|delivery| delivery.capability == capability)
    };
    delivery.map_or_else(CurrentThreadTaskDeliveryCompletion::default, |delivery| {
      self.finish_delivery(delivery, true)
    })
  }

  fn finish_dispatch_reference(
    state: &mut CurrentThreadTaskDriverRegistryState,
    dispatch: u64,
    accepted: bool,
    failed: bool,
    failures: &mut Vec<CurrentThreadTaskDispatchFailure>,
  ) {
    let (publications, references) = {
      let Some(dispatch_state) = state.dispatches.get_mut(&dispatch) else {
        return;
      };
      dispatch_state.references = dispatch_state
        .references
        .checked_sub(1)
        .expect("CurrentThread dispatch reference count underflow");
      dispatch_state.accepted |= accepted;
      dispatch_state.accepted_failure |= accepted && failed;
      (dispatch_state.publications, dispatch_state.references)
    };
    if references != 0 || publications != 0 {
      return;
    }
    let Some(dispatch_state) = state.dispatches.get_mut(&dispatch) else {
      return;
    };
    if dispatch_state.accepted_failure
      && !dispatch_state.is_serviced()
      && !dispatch_state.is_cancelling()
    {
      dispatch_state.phase = CurrentThreadDispatchPhase::Cancelling;
      failures.push(dispatch_state.failure(dispatch));
    } else if !dispatch_state.is_cancelling() {
      state.dispatches.remove(&dispatch);
    }
  }

  fn finish_entry_references(
    state: &mut CurrentThreadTaskDriverRegistryState,
    entry: &CurrentThreadTaskDriverEntry,
    failures: &mut Vec<CurrentThreadTaskDispatchFailure>,
  ) {
    if let Some(delivery) = &entry.delivery {
      Self::finish_dispatch_reference(
        state,
        delivery.delivery.dispatch,
        delivery.accepted,
        delivery.accepted,
        failures,
      );
    }
    if let Some(pending) = entry.pending {
      Self::finish_dispatch_reference(state, pending, true, true, failures);
    }
  }

  fn finish_publication(&self, dispatch: u64) -> CurrentThreadHostDispatchResult {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let publications = {
      let Some(dispatch_state) = state.dispatches.get_mut(&dispatch) else {
        return CurrentThreadHostDispatchResult::Unavailable;
      };
      dispatch_state.publications = dispatch_state
        .publications
        .checked_sub(1)
        .expect("CurrentThread dispatch publication count underflow");
      dispatch_state.publications
    };
    if Self::has_dispatch_reference(&state, dispatch) || publications != 0 {
      return CurrentThreadHostDispatchResult::Accepted;
    }
    let Some(dispatch_state) = state.dispatches.get_mut(&dispatch) else {
      return CurrentThreadHostDispatchResult::Unavailable;
    };
    if dispatch_state.is_cancelling() {
      return CurrentThreadHostDispatchResult::Failed(dispatch_state.failure(dispatch));
    }
    if dispatch_state.accepted_failure && !dispatch_state.is_serviced() {
      dispatch_state.phase = CurrentThreadDispatchPhase::Cancelling;
      return CurrentThreadHostDispatchResult::Failed(dispatch_state.failure(dispatch));
    }
    let accepted = dispatch_state.accepted || dispatch_state.is_serviced();
    state.dispatches.remove(&dispatch);
    if accepted {
      CurrentThreadHostDispatchResult::Accepted
    } else {
      CurrentThreadHostDispatchResult::Unavailable
    }
  }

  fn abort_publication(&self, dispatch: u64) {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let Some(dispatch_state) = state.dispatches.get_mut(&dispatch) else {
      return;
    };
    let Some(publications) = dispatch_state.publications.checked_sub(1) else {
      return;
    };
    dispatch_state.publications = publications;
    Self::retire_unreferenced_dispatch(&mut state, Some(dispatch));
  }

  fn rearm_failed_publication(&self, failure: CurrentThreadTaskDispatchFailure) -> bool {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let can_rearm = state
      .dispatches
      .get(&failure.dispatch)
      .is_some_and(|dispatch_state| {
        dispatch_state.is_cancelling()
          && dispatch_state.epoch == failure.epoch
          && dispatch_state.publications == 0
      })
      && !Self::has_dispatch_reference(&state, failure.dispatch);
    if !can_rearm {
      return false;
    }
    let dispatch_state = state
      .dispatches
      .get_mut(&failure.dispatch)
      .expect("the exact failed CurrentThread dispatch must remain registered");
    let epoch = dispatch_state
      .epoch
      .checked_add(1)
      .expect("CurrentThread dispatch failure epoch space exhausted");
    *dispatch_state = CurrentThreadDispatchState {
      epoch,
      ..CurrentThreadDispatchState::default()
    };
    true
  }

  fn is_current_failure(&self, failure: CurrentThreadTaskDispatchFailure) -> bool {
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .dispatches
      .get(&failure.dispatch)
      .is_some_and(|dispatch_state| {
        dispatch_state.is_cancelling() && dispatch_state.epoch == failure.epoch
      })
  }

  fn retire_unreferenced_dispatch(
    state: &mut CurrentThreadTaskDriverRegistryState,
    dispatch: Option<u64>,
  ) {
    let Some(dispatch) = dispatch else {
      return;
    };
    if Self::has_dispatch_reference(state, dispatch) {
      return;
    }
    let Some(dispatch_state) = state.dispatches.get(&dispatch) else {
      return;
    };
    if dispatch_state.publications == 0
      && !dispatch_state.is_cancelling()
      && (dispatch_state.is_serviced() || !dispatch_state.accepted_failure)
    {
      state.dispatches.remove(&dispatch);
    }
  }

  fn has_dispatch_reference(state: &CurrentThreadTaskDriverRegistryState, dispatch: u64) -> bool {
    state
      .dispatches
      .get(&dispatch)
      .is_some_and(|dispatch_state| dispatch_state.references != 0)
  }

  fn finish_cancellation(&self, failure: CurrentThreadTaskDispatchFailure) {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    if state
      .dispatches
      .get(&failure.dispatch)
      .is_some_and(|dispatch_state| {
        dispatch_state.is_cancelling() && dispatch_state.epoch == failure.epoch
      })
    {
      state.dispatches.remove(&failure.dispatch);
    }
  }

  fn retire_for_shutdown(&self) {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    state.dispatches.clear();
    for entry in state.entries.values_mut() {
      entry.pending = None;
    }
  }
}

static CURRENT_THREAD_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
  LazyLock::new(CurrentThreadTaskDriverRegistry::default);

pub fn register_current_thread_task_driver(
  driver: Arc<dyn CurrentThreadTaskDriver>,
) -> CurrentThreadTaskDriverId {
  CURRENT_THREAD_TASK_DRIVERS.register(driver)
}

/// Request service for work that may have accumulated while no live host
/// dispatcher was registered. A new host receives the existing internal
/// dispatch capability through a fresh registration-scoped delivery token;
/// already accepting hosts keep their attempts.
pub fn request_current_thread_task_drain() {
  RUNTIME.request_current_thread_drain();
}

pub fn unregister_current_thread_task_driver(id: CurrentThreadTaskDriverId) {
  complete_current_thread_task_delivery(CURRENT_THREAD_TASK_DRIVERS.unregister(id));
}

fn dispatch_current_thread_tasks(dispatch: u64) -> CurrentThreadHostDispatchResult {
  let CurrentThreadTaskDispatchCompletion {
    result,
    failed_dispatches,
  } = CURRENT_THREAD_TASK_DRIVERS.dispatch_with_completion(dispatch);
  complete_current_thread_task_delivery(CurrentThreadTaskDeliveryCompletion {
    failed_dispatches,
    redispatch: false,
  });
  result
}

pub type TimerId = u64;

/// Process-global id source for [`Sleep`] futures (both drivers).
static NEXT_TIMER_ID: AtomicU64 = AtomicU64::new(0);

/// Seam for host-delegated timers: the CurrentThread flavor cannot park a
/// helper thread on a threadless build, so it delegates
/// `sleep_until` to the host event loop through this trait. The Node binding
/// installs a `setTimeout`-based implementation via [`register_timer_driver`]
/// at import -- one per importing napi env (main thread AND workers).
pub trait TimerDriver: Send + Sync + 'static {
  /// Arm (or re-arm on re-poll) `waker` to fire at/after `deadline`. Called
  /// once per [`Sleep`] poll: implementations must treat a repeated `id` as a
  /// waker refresh, not a second timer.
  fn register(&self, id: TimerId, deadline: Instant, waker: Waker);
  /// Best-effort cancel (Drop of the [`Sleep`] future). A fire that already
  /// raced ahead is acceptable (the woken task observes the sleep completed).
  fn cancel(&self, id: TimerId);
  /// Whether this driver can still deliver wakes. `false` once the driver's
  /// host is gone (the Node binding's driver dies with its owning napi env:
  /// worker exit aborts the weak threadsafe function). Selection skips and
  /// evicts dead drivers -- a timer armed on one would only ever busy-fail.
  fn is_live(&self) -> bool {
    true
  }
  /// Called by [`TimerDriverRegistry`] AFTER it swept this driver out of the
  /// entries (its `is_live` turned false), with NO registry lock held.
  /// Implementations with pending-waker bookkeeping must wake everything
  /// armed on them here, so those sleeps re-poll onto the next live
  /// registrant: the `is_live` probe can be the FIRST layer to notice a dying
  /// host (before its env-cleanup hook or any call failure runs), and a
  /// silent `retain` would strand sleeps whose only wake source was the swept
  /// driver. Idempotent with the owner's other eviction paths. Default no-op
  /// for drivers without waker state.
  fn on_swept(&self) {}
}

/// Handle to one registration in a [`TimerDriverRegistry`], returned by
/// [`TimerDriverRegistry::register`] and consumed by
/// [`TimerDriverRegistry::unregister`].
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct TimerDriverId(u64);

type HostTimerDriverSnapshot = ContainedArcSnapshot<TimerDriverId, dyn TimerDriver>;

struct TimerDriverEntry {
  driver: Arc<dyn TimerDriver>,
  previous: Option<TimerDriverId>,
  next: Option<TimerDriverId>,
}

#[derive(Default)]
struct TimerDriverRegistryState {
  entries: FxHashMap<TimerDriverId, TimerDriverEntry>,
  oldest: Option<TimerDriverId>,
  newest: Option<TimerDriverId>,
}

impl TimerDriverRegistryState {
  fn insert_driver(&mut self, id: TimerDriverId, driver: Arc<dyn TimerDriver>) {
    let previous = self.newest;
    let replaced = self.entries.insert(
      id,
      TimerDriverEntry {
        driver,
        previous,
        next: None,
      },
    );
    assert!(replaced.is_none(), "timer driver id must be unique");
    if let Some(previous) = previous {
      self
        .entries
        .get_mut(&previous)
        .expect("the newest timer driver must remain registered")
        .next = Some(id);
    } else {
      self.oldest = Some(id);
    }
    self.newest = Some(id);
  }

  fn remove_driver(&mut self, id: TimerDriverId) -> Option<TimerDriverEntry> {
    let entry = self.entries.remove(&id)?;
    if let Some(previous) = entry.previous {
      self
        .entries
        .get_mut(&previous)
        .expect("the previous timer driver must remain registered")
        .next = entry.next;
    } else {
      self.oldest = entry.next;
    }
    if let Some(next) = entry.next {
      self
        .entries
        .get_mut(&next)
        .expect("the next timer driver must remain registered")
        .previous = entry.previous;
    } else {
      self.newest = entry.previous;
    }
    Some(entry)
  }

  fn ordered_snapshot(&self) -> Vec<(TimerDriverId, Arc<dyn TimerDriver>)> {
    let mut snapshot = Vec::with_capacity(self.entries.len());
    let mut current = self.oldest;
    while let Some(id) = current {
      let entry = self
        .entries
        .get(&id)
        .expect("timer driver order must reference a live entry");
      snapshot.push((id, Arc::clone(&entry.driver)));
      current = entry.next;
    }
    debug_assert_eq!(
      snapshot.len(),
      self.entries.len(),
      "timer driver order must contain every entry exactly once"
    );
    snapshot
  }

  fn ordered_ids_match(&self, expected: &[TimerDriverId]) -> bool {
    if self.entries.len() != expected.len() {
      return false;
    }
    let mut current = self.oldest;
    for expected in expected {
      if current != Some(*expected) {
        return false;
      }
      current = self
        .entries
        .get(expected)
        .expect("timer driver order must reference a live entry")
        .next;
    }
    current.is_none()
  }
}

/// Host timer drivers keyed by registration order. A driver is owned by a host
/// context that can die independently
/// of the process -- the Node binding registers one driver per importing napi
/// env, and a worker's env teardown kills its driver's threadsafe function. A
/// single first-wins slot is therefore unsound: a worker that imports the
/// binding first and then exits would permanently shadow the slot with a dead
/// driver, and every CT timer armed afterwards would busy-fail against it.
/// Selecting only the newest live driver is also
/// insufficient: a live worker can be CPU-blocked indefinitely while another
/// environment remains responsive. The registry therefore keeps all
/// registrants and returns a stable snapshot of every live driver at each
/// [`Sleep`] poll, sweeping dead entries out as it goes.
///
/// Instance-based (not a hidden global) so tests exercise
/// registration/eviction/selection against local registries; production uses
/// the process-global one behind
/// [`register_timer_driver`]/[`unregister_timer_driver`]/[`has_live_timer_driver`].
#[derive(Default)]
pub struct TimerDriverRegistry {
  /// Keyed lookup with a linked registration order. Exact unregister and a
  /// swept binding host's idempotent unregister are expected O(1), while
  /// snapshots keep deterministic oldest-to-newest fallback order.
  state: Mutex<TimerDriverRegistryState>,
  /// Stable repoll signals for every currently polled host sleep. A newly
  /// registered driver snapshots these after publishing itself, then wakes
  /// them outside both registry locks so each sleep re-arms the same timer id
  /// on the expanded all-live driver set.
  pending: Mutex<FxHashMap<TimerId, Weak<HostTimerRepoll>>>,
  next_id: AtomicU64,
}

impl Drop for TimerDriverRegistry {
  fn drop(&mut self) {
    let state = self
      .state
      .get_mut()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    state.oldest = None;
    state.newest = None;
    let entries = std::mem::take(&mut state.entries);
    for (_, entry) in entries {
      let _ = catch_unwind_contained(|| drop(entry));
    }
  }
}

impl TimerDriverRegistry {
  /// Add `driver` as the newest registrant and return its handle.
  pub fn register(&self, driver: Arc<dyn TimerDriver>) -> TimerDriverId {
    let id = next_unique_id(&self.next_id, "timer driver id space exhausted");
    let id = TimerDriverId(id);
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .insert_driver(id, driver);
    // Publish the driver before snapshotting pending sleeps. A sleep publishes
    // its repoll signal before selecting live drivers. Therefore either this
    // snapshot sees the sleep, or that sleep's subsequent selection sees this
    // driver; no registration/insertion interleaving can miss both sides.
    let pending = {
      let mut entries = self
        .pending
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let mut pending = Vec::with_capacity(entries.len());
      entries.retain(|_, repoll| {
        if let Some(repoll) = repoll.upgrade() {
          pending.push(repoll);
          true
        } else {
          false
        }
      });
      pending
    };
    for repoll in pending {
      repoll.wake();
    }
    id
  }

  /// Drop the registration behind `id` (no-op when already swept/removed).
  pub fn unregister(&self, id: TimerDriverId) {
    let removed = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .remove_driver(id);
    // A driver's destructor may re-enter this registry. Keep it outside the
    // entries lock just like is_live/on_swept callbacks.
    let _ = catch_unwind_contained(|| drop(removed));
  }

  /// Every LIVE driver in registration order, sweeping dead entries out as a
  /// side effect.
  ///
  /// LOCK DISCIPLINE: no driver callback or destructor runs with the entries
  /// lock held. `is_live` is externally implemented and may re-enter this
  /// registry; `on_swept` does so in the binding by calling `unregister` and
  /// waking pending sleeps whose re-polls call `current()` again. Selection
  /// therefore probes a snapshot, removes dead entries under the lock, then
  /// runs hooks after release. A concurrent registration/unregistration can
  /// stale the snapshot, in which case selection retries.
  fn live(&self) -> HostTimerDriverSnapshot {
    loop {
      let snapshot = HostTimerDriverSnapshot::new({
        let state = self
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        state.ordered_snapshot()
      });
      let mut dead_ids = FxHashSet::default();
      let mut live_ids = Vec::new();
      for (id, driver) in snapshot.as_slice() {
        if catch_unwind_contained(|| driver.is_live()).unwrap_or(false) {
          live_ids.push(*id);
        } else {
          dead_ids.insert(*id);
        }
      }

      let (live, swept, retry) = {
        let mut state = self
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        let mut swept = Vec::new();
        let mut current = state.oldest;
        while let Some(id) = current {
          let next = state
            .entries
            .get(&id)
            .expect("timer driver order must reference a live entry")
            .next;
          if dead_ids.contains(&id)
            && let Some(entry) = state.remove_driver(id)
          {
            swept.push(entry);
          }
          current = next;
        }
        let retry = !state.ordered_ids_match(&live_ids);
        let live = if retry {
          Vec::new()
        } else {
          state.ordered_snapshot()
        };
        (HostTimerDriverSnapshot::new(live), swept, retry)
      };

      // A reentrant probe can unregister multiple snapshot-only drivers.
      // See the implementation notes in this crate's README.
      drop(snapshot);
      for entry in swept {
        let _ = catch_unwind_contained(|| entry.driver.on_swept());
        let _ = catch_unwind_contained(|| drop(entry));
      }
      if !retry {
        return live;
      }
    }
  }

  #[cfg(test)]
  fn current(&self) -> Option<(TimerDriverId, Arc<dyn TimerDriver>)> {
    let mut live = self.live();
    live.pop().map(|(id, driver)| (id, driver.into_inner()))
  }

  /// Whether a LIVE driver is currently registered (dead-only counts as no).
  pub fn has_live_driver(&self) -> bool {
    !self.live().is_empty()
  }

  fn register_pending(&self, id: TimerId, repoll: &Arc<HostTimerRepoll>) {
    let replaced = self
      .pending
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .insert(id, Arc::downgrade(repoll));
    assert!(
      replaced.is_none(),
      "host timer {id} registered its repoll signal twice"
    );
    // Shutdown can close and try to remove the signal immediately before this
    // insertion. The post-insert check is the other side of that race.
    if repoll.is_closed() {
      self.remove_pending(id);
    }
  }

  fn remove_pending(&self, id: TimerId) {
    let removed = self
      .pending
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .remove(&id);
    let _ = catch_unwind_contained(|| drop(removed));
  }

  #[cfg(test)]
  fn pending_len(&self) -> usize {
    self
      .pending
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .len()
  }
}

/// The process-global registry behind [`sleep_until`] (see
/// [`TimerDriverRegistry`] for the lifetime story).
static TIMER_DRIVERS: LazyLock<Arc<TimerDriverRegistry>> =
  LazyLock::new(|| Arc::new(TimerDriverRegistry::default()));

/// Register a host timer driver for the CurrentThread flavor's `sleep_until`.
/// Every host context that can serve timers registers its own driver (the
/// Node binding: one per importing napi env); every LIVE registrant receives
/// each timer so a starved environment cannot own its only wake source.
/// Returns the handle for [`unregister_timer_driver`].
pub fn register_timer_driver(driver: Arc<dyn TimerDriver>) -> TimerDriverId {
  TIMER_DRIVERS.register(driver)
}

/// Remove a driver registered via [`register_timer_driver`] -- called when
/// its host context dies (the Node binding evicts on env teardown and on
/// callback failure). Idempotent.
pub fn unregister_timer_driver(id: TimerDriverId) {
  TIMER_DRIVERS.unregister(id);
}

/// Whether a LIVE host timer driver is currently registered. Lets the
/// embedder report CurrentThread timer availability honestly (e.g. through a
/// capabilities export) instead of guessing: with no
/// live driver a CurrentThread `sleep_until` would panic, so the capability
/// must read `false` -- including when the only registrants are DEAD (their
/// owning envs torn down), not merely when none ever registered.
pub fn has_live_timer_driver() -> bool {
  TIMER_DRIVERS.has_live_driver()
}

/// Coalescing wake signal used only to make an already-pending [`Sleep`]
/// re-select host drivers after a new registration. The task's arbitrary
/// waker is never cloned, invoked, or dropped while this mutex is held.
#[derive(Default)]
struct HostTimerRepoll {
  state: Mutex<HostTimerRepollState>,
}

#[derive(Default)]
struct HostTimerRepollState {
  closed: bool,
  notified: bool,
  waker: Option<Waker>,
}

impl HostTimerRepoll {
  fn register(&self, waker: Waker) {
    let (replaced, wake) = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if state.closed {
        (Some(waker), None)
      } else if state.notified {
        state.notified = false;
        (state.waker.take(), Some(waker))
      } else {
        (state.waker.replace(waker), None)
      }
    };
    let _ = catch_unwind_contained(|| drop(replaced));
    if let Some(waker) = wake {
      wake_waker_contained(waker);
    }
  }

  fn wake(&self) {
    let waker = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if state.closed {
        return;
      }
      if let Some(waker) = state.waker.take() {
        Some(waker)
      } else {
        state.notified = true;
        None
      }
    };
    if let Some(waker) = waker {
      wake_waker_contained(waker);
    }
  }

  fn close(&self) {
    let waker = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.closed = true;
      state.notified = false;
      state.waker.take()
    };
    let _ = catch_unwind_contained(|| drop(waker));
  }

  fn is_closed(&self) -> bool {
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .closed
  }
}

/// Pending HOST-driver timers armed on one CurrentThread executor, keyed by
/// timer id with the armed deadline as the value. Maintained by the [`Sleep`]
/// futures themselves (insert at FIRST POLL, exactly when `driver.register`
/// arms the host timer -- an unpolled Sleep holds no wake-token; remove on
/// completion/drop via [`HostTimerPendingGuard`]) and read by the CT deadlock
/// detection -- see the interaction notes at the top of this section.
#[derive(Default)]
struct HostTimerRegistry {
  state: Mutex<HostTimerRegistryState>,
}

#[derive(Default)]
struct HostTimerRegistryState {
  closed: bool,
  timers: FxHashMap<TimerId, HostTimerEntry>,
}

struct HostTimerEntry {
  deadline: Instant,
  waker: Waker,
  fired: Arc<AtomicBool>,
  drivers: Weak<TimerDriverRegistry>,
  repoll: Arc<HostTimerRepoll>,
}

impl HostTimerRegistry {
  fn register(
    &self,
    id: TimerId,
    deadline: Instant,
    waker: Waker,
    fired: &Arc<AtomicBool>,
    drivers: &Arc<TimerDriverRegistry>,
    repoll: &Arc<HostTimerRepoll>,
  ) -> bool {
    let replaced = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if state.closed || fired.load(Ordering::SeqCst) {
        fired.store(true, Ordering::SeqCst);
        Err(waker)
      } else {
        Ok(state.timers.insert(
          id,
          HostTimerEntry {
            deadline,
            waker,
            fired: Arc::clone(fired),
            drivers: Arc::downgrade(drivers),
            repoll: Arc::clone(repoll),
          },
        ))
      }
    };
    match replaced {
      Ok(Some(entry)) => {
        let _ = catch_unwind_contained(|| drop(entry));
        true
      }
      Ok(None) => true,
      Err(waker) => {
        let _ = catch_unwind_contained(|| drop(waker));
        false
      }
    }
  }

  fn remove(&self, id: TimerId) {
    let removed = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .timers
      .remove(&id);
    if let Some(entry) = removed {
      let _ = catch_unwind_contained(|| drop(entry));
    }
  }

  fn shutdown(&self) {
    let timers = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.closed = true;
      state
        .timers
        .drain()
        .map(|(id, entry)| {
          entry.fired.store(true, Ordering::SeqCst);
          (id, entry)
        })
        .collect::<Vec<_>>()
    };
    for (id, entry) in timers {
      entry.repoll.close();
      if let Some(drivers) = entry.drivers.upgrade() {
        drivers.remove_pending(id);
      }
      wake_waker_contained(entry.waker);
    }
  }

  /// Any host timer armed at all? Consulted by the threadless CERTAIN check
  /// only to pick the diagnostic variant: on a threadless build the park is
  /// provably dead either way (the host relay shares the parked thread), but
  /// a pending timer means the timer-backed message applies.
  fn has_pending(&self) -> bool {
    !self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .timers
      .is_empty()
  }

  /// Any host timer whose deadline (plus `grace` for host firing lag) is
  /// still in the future? Used by the CT deadline VERDICT: waiting out such a
  /// timer with zero progress is legitimate. A timer past due by more than
  /// `grace` that never fired is not -- that is the frozen-JS-event-loop
  /// signature the deadline detection exists to catch, so it must not keep
  /// suppressing the panic. Callers pass the armed park deadline as `grace`
  /// (the detector's own granularity: firing lag within one window is
  /// indistinguishable from an expiry racing the fire).
  fn has_live_wait(&self, grace: Duration) -> bool {
    let now = Instant::now();
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .timers
      .values()
      .any(|entry| {
        entry
          .deadline
          .checked_add(grace)
          .is_none_or(|deadline| deadline > now)
      })
  }
}

/// Removes this sleep's entry from its executor's [`HostTimerRegistry`] on
/// drop, so completion AND cancellation (Sleep dropped by a `select!` losing
/// arm) both retire the wake-token exactly once.
struct HostTimerPendingGuard {
  registry: Arc<HostTimerRegistry>,
  drivers: Arc<TimerDriverRegistry>,
  repoll: Arc<HostTimerRepoll>,
  id: TimerId,
}

impl Drop for HostTimerPendingGuard {
  fn drop(&mut self) {
    self.repoll.close();
    self.registry.remove(self.id);
    self.drivers.remove_pending(self.id);
  }
}

/// Runtime-owned timer heap for the MultiThread executor.
///
/// The timekeeper is a dedicated lifecycle-managed OS thread. It never enters
/// Rayon and therefore cannot consume one of the configured CPU workers while
/// a long timer is armed.
#[cfg(napi_runtime_os_threads)]
struct TimerHeap {
  inner: Arc<Mutex<TimerHeapInner>>,
  parker: Arc<DriverParker>,
  thread: Mutex<Option<std::thread::JoinHandle<()>>>,
  deadlock_state: Arc<MultiThreadDeadlockState>,
  #[cfg(test)]
  fail_next_start: AtomicBool,
  generation: u64,
  executor_id: u64,
  thread_name: String,
}

#[cfg(napi_runtime_os_threads)]
#[derive(Default)]
struct TimerHeapInner {
  /// Indexed min-heap of `(deadline, id)`. Cancellation removes its node in
  /// `O(log n)`, so non-earliest timer churn cannot accumulate tombstones for
  /// one later unbounded cleanup pass.
  queue: TimerDeadlineQueue,
  entries: FxHashMap<TimerId, HeapTimerEntry>,
  /// The parker of the dedicated timekeeper while it is waiting on a timer.
  /// `register_timer` unparks it when the earliest deadline moves up, so the
  /// timekeeper re-arms (task requirement: re-arm-to-earlier re-wakes).
  timekeeper_parker: Option<Arc<DriverParker>>,
  /// Set by `shutdown_timers`: every pending entry has been drain-fired and
  /// later registrations must fire immediately (a `Sleep` polled after
  /// shutdown resolves early instead of parking a closing runtime forever).
  closed: bool,
}

#[cfg(napi_runtime_os_threads)]
struct HeapTimerEntry {
  waker: Waker,
  /// Shared with the owning [`Sleep`]: set (under the heap lock) when this
  /// timer fires or the heap shuts down, so the woken poll returns `Ready`
  /// even when the wall clock has not reached `deadline` (shutdown
  /// drain-fire).
  fired: Arc<AtomicBool>,
}

#[cfg(napi_runtime_os_threads)]
#[derive(Default)]
struct TimerDeadlineQueue {
  nodes: Vec<(Instant, TimerId)>,
  positions: FxHashMap<TimerId, usize>,
}

#[cfg(napi_runtime_os_threads)]
impl TimerDeadlineQueue {
  #[cfg(test)]
  fn len(&self) -> usize {
    self.nodes.len()
  }

  #[cfg(test)]
  fn is_empty(&self) -> bool {
    self.nodes.is_empty()
  }

  fn clear(&mut self) {
    self.nodes.clear();
    self.positions.clear();
  }

  fn peek(&self) -> Option<(Instant, TimerId)> {
    self.nodes.first().copied()
  }

  fn push(&mut self, deadline: Instant, id: TimerId) {
    let index = self.nodes.len();
    assert!(
      self.positions.insert(id, index).is_none(),
      "timer deadline queue received duplicate id {id}"
    );
    self.nodes.push((deadline, id));
    self.sift_up(index);
  }

  fn pop(&mut self) -> Option<(Instant, TimerId)> {
    let first = self.nodes.first().copied()?;
    self.positions.remove(&first.1);
    let last = self
      .nodes
      .pop()
      .expect("the non-empty timer heap must have a final node");
    if !self.nodes.is_empty() {
      self.nodes[0] = last;
      self.positions.insert(last.1, 0);
      self.sift_down(0);
    }
    Some(first)
  }

  fn remove(&mut self, id: TimerId) -> Option<(Instant, TimerId)> {
    let index = self.positions.remove(&id)?;
    let removed = self.nodes[index];
    let last = self.nodes.pop().expect("an indexed timer node must exist");
    if index < self.nodes.len() {
      self.nodes[index] = last;
      self.positions.insert(last.1, index);
      if index > 0 && self.nodes[index] < self.nodes[(index - 1) / 2] {
        self.sift_up(index);
      } else {
        self.sift_down(index);
      }
    }
    Some(removed)
  }

  fn sift_up(&mut self, mut index: usize) {
    while index > 0 {
      let parent = (index - 1) / 2;
      if self.nodes[parent] <= self.nodes[index] {
        break;
      }
      self.swap(parent, index);
      index = parent;
    }
  }

  fn sift_down(&mut self, mut index: usize) {
    loop {
      let left = index * 2 + 1;
      if left >= self.nodes.len() {
        return;
      }
      let right = left + 1;
      let child = if right < self.nodes.len() && self.nodes[right] < self.nodes[left] {
        right
      } else {
        left
      };
      if self.nodes[index] <= self.nodes[child] {
        return;
      }
      self.swap(index, child);
      index = child;
    }
  }

  fn swap(&mut self, left: usize, right: usize) {
    self.nodes.swap(left, right);
    self.positions.insert(self.nodes[left].1, left);
    self.positions.insert(self.nodes[right].1, right);
  }
}

#[cfg(napi_runtime_os_threads)]
impl TimerHeapInner {
  fn next_deadline(&self) -> Option<Instant> {
    self.queue.peek().map(|(deadline, _)| deadline)
  }
}

#[cfg(napi_runtime_os_threads)]
impl TimerHeap {
  fn new(
    generation: u64,
    executor_id: u64,
    thread_name: String,
    deadlock_state: Arc<MultiThreadDeadlockState>,
  ) -> Self {
    Self {
      inner: Arc::new(Mutex::new(TimerHeapInner::default())),
      parker: Arc::new(DriverParker::default()),
      thread: Mutex::new(None),
      deadlock_state,
      #[cfg(test)]
      fail_next_start: AtomicBool::new(false),
      generation,
      executor_id,
      thread_name,
    }
  }

  fn ensure_started(&self) -> Result<(), RuntimeConfigError> {
    if self
      .inner
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .closed
    {
      return Ok(());
    }
    let current_thread = std::thread::current().id();
    loop {
      let finished = {
        let mut thread = self
          .thread
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        match thread.as_ref() {
          Some(handle) if handle.thread().id() == current_thread => return Ok(()),
          Some(handle) if !handle.is_finished() => return Ok(()),
          Some(_) => thread.take(),
          None => {
            // Shutdown can close the heap after the optimistic check above.
            // Recheck before publishing another service thread.
            if self
              .inner
              .lock()
              .unwrap_or_else(std::sync::PoisonError::into_inner)
              .closed
            {
              return Ok(());
            }
            #[cfg(test)]
            if self.fail_next_start.swap(false, Ordering::SeqCst) {
              return Err(RuntimeConfigError(
                "injected runtime timer thread creation failure".to_string(),
              ));
            }

            let inner = Arc::clone(&self.inner);
            let parker = Arc::clone(&self.parker);
            let deadlock_state = Arc::clone(&self.deadlock_state);
            let generation = self.generation;
            let executor_id = self.executor_id;
            let handle = std::thread::Builder::new()
              .name(self.thread_name.clone())
              .spawn(move || {
                // Keep the identity through OS-thread TLS teardown. Unlike
                // `ON_POOL_WORKER`, this marker never authorizes scheduler driving.
                ON_TIMER_THREAD.with(|current| current.set(Some(executor_id)));
                let _generation = RuntimeGenerationGuard::enter(generation);
                timer_timekeeper_main(&inner, &parker, &deadlock_state);
              })
              .map_err(|error| {
                RuntimeConfigError(format!("failed to create runtime timer thread: {error}"))
              })?;
            *thread = Some(handle);
            return Ok(());
          }
        }
      };

      // A finished timer thread may still be running TLS destructors that
      // re-enter timer code. Never hold the handle mutex while waiting for
      // those destructors, and never attempt to join this thread from itself.
      if let Some(finished) = finished
        && finished.thread().id() != current_thread
        && let Err(payload) = finished.join()
      {
        discard_panic_payload(payload);
      }
      if self
        .inner
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .closed
      {
        return Ok(());
      }
    }
  }

  fn close(&self) -> Vec<Waker> {
    let mut inner = self
      .inner
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    inner.closed = true;
    inner.queue.clear();
    inner.timekeeper_parker = None;
    inner
      .entries
      .drain()
      .map(|(_, entry)| {
        entry.fired.store(true, Ordering::SeqCst);
        entry.waker
      })
      .collect()
  }

  fn join(&self) {
    let handle = self
      .thread
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .take();
    if let Some(handle) = handle {
      if handle.thread().id() == std::thread::current().id() {
        // A custom RawWaker may own the final direct executor Arc and release
        // it from this thread. Closing the heap makes the loop exit after the
        // callback returns; joining self would deadlock that exit.
        drop(handle);
        return;
      }
      if let Err(payload) = crate::sync::join(handle) {
        discard_panic_payload(payload);
      }
    }
  }
}

#[cfg(napi_runtime_os_threads)]
impl Drop for TimerHeap {
  fn drop(&mut self) {
    let mut admission = self.deadlock_state.begin_admission();
    let wakers = self.close();
    if !wakers.is_empty()
      && let Some(admission) = admission.as_mut()
    {
      admission.mark_published();
    }
    self.parker.unpark();
    for waker in wakers {
      wake_waker_contained(waker);
    }
    drop(admission);
    self.join();
  }
}

#[cfg(napi_runtime_os_threads)]
fn timer_timekeeper_main(
  inner: &Mutex<TimerHeapInner>,
  parker: &Arc<DriverParker>,
  deadlock_state: &Arc<MultiThreadDeadlockState>,
) {
  loop {
    // Acquire before touching the heap. If a verdict has already closed the
    // gate, a due timer remains visible until the verdict's final timer recheck
    // causes that guard to reopen.
    let mut admission = deadlock_state.begin_admission();
    let (due, deadline) = {
      let mut inner = inner
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if inner.closed {
        inner.timekeeper_parker = None;
        return;
      }
      let now = Instant::now();
      let mut due = Vec::new();
      while let Some((deadline, id)) = inner.queue.peek() {
        if deadline > now {
          break;
        }
        inner.queue.pop();
        if let Some(entry) = inner.entries.remove(&id) {
          entry.fired.store(true, Ordering::SeqCst);
          due.push(entry.waker);
        }
      }
      let deadline = inner.next_deadline();
      inner.timekeeper_parker = deadline.map(|_| Arc::clone(parker));
      (due, deadline)
    };

    if !due.is_empty() {
      if let Some(admission) = admission.as_mut() {
        admission.mark_published();
      }
      for waker in due {
        wake_waker_contained(waker);
      }
      continue;
    }
    // Never retain an admission while sleeping: it protects only the
    // remove-then-wake publication window.
    drop(admission);

    match deadline {
      Some(deadline) => {
        let now = Instant::now();
        if deadline > now {
          parker.park_timeout(deadline - now);
        }
      }
      None => parker.park(),
    }
  }
}

#[cfg(napi_runtime_os_threads)]
impl MultiThreadExecutor {
  /// Arm (or waker-refresh) heap timer `id` at `deadline`. `fired` is the
  /// owning `Sleep`'s completion flag: set under the heap lock on fire and on
  /// shutdown, and set here immediately when the heap is already closed (the
  /// caller re-checks it after registering, so a post-shutdown poll resolves
  /// instead of parking forever).
  fn register_timer(
    self: &Arc<Self>,
    id: TimerId,
    deadline: Instant,
    waker: Waker,
    fired: &Arc<AtomicBool>,
  ) {
    let mut admission = self.begin_deadlock_admission();
    #[cfg(test)]
    run_timer_registration_admission_test_hook();
    // Establish the service thread before publishing the entry. If thread
    // creation fails, `Sleep::poll` unwinds with `registered == false` and no
    // heap state exists for Drop to miss.
    if let Err(error) = self.timers.ensure_started() {
      let _ = catch_unwind_contained(|| drop(waker));
      panic!("{error}");
    }
    let (became_earliest, published, discarded_waker) = {
      let mut inner = self
        .timers
        .inner
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      if inner.closed || fired.load(Ordering::SeqCst) {
        fired.store(true, Ordering::SeqCst);
        (false, false, Some(waker))
      } else if let Some(entry) = inner.entries.get_mut(&id) {
        // Re-poll of a still-armed sleep: refresh the waker, nothing else.
        (
          false,
          false,
          Some(std::mem::replace(&mut entry.waker, waker)),
        )
      } else {
        let previous = inner.next_deadline();
        inner.entries.insert(
          id,
          HeapTimerEntry {
            waker,
            fired: Arc::clone(fired),
          },
        );
        inner.queue.push(deadline, id);
        (
          previous.is_none_or(|previous| deadline < previous),
          true,
          None,
        )
      }
    };
    if published && let Some(admission) = admission.as_mut() {
      admission.mark_published();
    }
    if let Some(waker) = discarded_waker {
      // RawWaker destruction is user code and may re-enter timer cancellation.
      // Keep it outside the heap mutex and contain hostile destructors.
      let _ = catch_unwind_contained(|| drop(waker));
    }
    if became_earliest {
      // Re-arm the lazy service thread and any cooperative timer wait.
      self.note_earlier_timer();
    }
  }

  /// Best-effort cancel: remove the entry and its indexed heap node.
  /// If cancellation changes the earliest deadline, wake every timer-bounded
  /// driver so no pool worker remains parked on the stale deadline.
  fn cancel_timer(&self, id: TimerId) {
    let (removed, earliest_changed) = {
      let mut inner = self
        .timers
        .inner
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let previous = inner.next_deadline();
      let removed = inner.entries.remove(&id);
      if removed.is_some() {
        let queued = inner.queue.remove(id);
        debug_assert!(
          queued.is_some(),
          "a live timer entry must have one indexed deadline node"
        );
      }
      let current = inner.next_deadline();
      (removed, previous != current)
    };
    if let Some(entry) = removed {
      // A RawWaker destructor may cancel another timer. Never run it while
      // holding the heap lock.
      let _ = catch_unwind_contained(|| drop(entry));
    }
    if earliest_changed {
      self.timers.parker.unpark();
      self.parked_drivers.wake_all();
    }
  }

  /// Earliest pending deadline (None when the heap is empty or closed).
  fn next_timer_deadline(&self) -> Option<Instant> {
    self
      .timers
      .inner
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .next_deadline()
  }

  /// Pop and wake everything due at/before now. Wakers are collected under
  /// the lock but woken OUTSIDE it (a wake runs `schedule`, which must not
  /// nest inside the heap lock). Firing sets each sleep's `fired` flag under
  /// the lock, before the wake, so the woken poll observes it.
  fn fire_due_timers(&self) {
    let mut admission = self.begin_deadlock_admission();
    let due: Vec<Waker> = {
      let mut inner = self
        .timers
        .inner
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let now = Instant::now();
      let mut due = Vec::new();
      while let Some((deadline, id)) = inner.queue.peek() {
        if deadline > now {
          break;
        }
        inner.queue.pop();
        if let Some(entry) = inner.entries.remove(&id) {
          entry.fired.store(true, Ordering::SeqCst);
          due.push(entry.waker);
        }
      }
      due
    };
    if !due.is_empty()
      && let Some(admission) = admission.as_mut()
    {
      admission.mark_published();
    }
    for waker in due {
      // Wakers may originate outside this executor. Isolate user RawWaker
      // implementations so a panic cannot unwind the dedicated timekeeper.
      wake_waker_contained(waker);
    }
  }

  /// The earliest pending deadline moved up (or the heap went non-empty).
  /// Re-arm the dedicated timekeeper and one timer-bounded cooperative driver
  /// whose current park may still reflect the previous deadline.
  fn note_earlier_timer(self: &Arc<Self>) {
    self.timers.parker.unpark();
    self.parked_drivers.wake_one();
  }

  /// Drain-fire every pending heap timer and poison later registrations.
  /// `shutdown()` with armed timers must not hang a pending `close()`. Fired
  /// sleeps resolve on their next poll; the woken tasks are
  /// scheduled through the normal path, so a coordinator awaiting a debounce
  /// completes its close sequence instead of parking forever.
  fn shutdown_timers(&self) {
    let mut admission = self.begin_deadlock_admission();
    let wakers = self.timers.close();
    if !wakers.is_empty()
      && let Some(admission) = admission.as_mut()
    {
      admission.mark_published();
    }
    for waker in wakers {
      // A user-provided RawWaker may panic. Shutdown is a lifecycle
      // transition, so one hostile wake must not leave the controller stuck
      // in `Stopping` and prevent every later restart.
      wake_waker_contained(waker);
    }
    self.timers.parker.unpark();
  }

  fn begin_shutdown(&self) {
    let _generation = RuntimeGenerationGuard::enter(self.generation);
    // Publish stop before taking the blocking queue. The final deadlock verdict
    // holds stop publication while rechecking that queue, so queue -> stop
    // would invert its lock order. A concurrent taker either claims while stop
    // is still false or observes stop after this publication.
    self.stop.begin_shutdown();
    let queued = {
      let mut queue = self
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      // The blocking FIFO mutex closes queue admission. `take_blocking` either
      // claimed a job before stop publication or observes stop/closure.
      queue.closed = true;
      queue.take_all()
    };
    // Captured values belong to user code and may panic in Drop. Retire each
    // rejected closure independently so one destructor cannot strand the
    // runtime in `Stopping` or prevent the remaining queued jobs from being
    // cancelled.
    for queued in queued {
      let _ = catch_unwind_contained(|| drop(queued));
    }
    self.shutdown_timers();
  }

  /// Non-blocking read of the predicate `wait_until_scheduler_idle` sleeps on.
  /// The timer join is deliberately excluded: it is a thread lifetime, not
  /// work a host can let finish by yielding.
  fn scheduler_work_pending(&self) -> bool {
    self.active_drainers.load(Ordering::Acquire) != 0
  }

  fn wait_until_scheduler_idle(&self) {
    self.timers.join();
    let mut idle = self
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    // Register BEFORE the first predicate evaluation and stay registered for
    // the whole wait. `finish_draining` reads this count under the same mutex,
    // so any drainer that retires after this increment is published either
    // sees `> 0` and wakes us, or had already decremented `active_drainers`
    // before we read the predicate -- in which case we never sleep.
    *idle += 1;
    while self.active_drainers.load(Ordering::Acquire) != 0 {
      idle = self
        .scheduler_idle
        .wait(idle)
        .unwrap_or_else(std::sync::PoisonError::into_inner);
    }
    *idle -= 1;
  }
}

/// Timer future returned by [`sleep_until`]. Resolves at/after its deadline
/// (or early on runtime shutdown drain-fire). Dropping it cancels the
/// underlying registration -- the `tokio::select!` losing-arm semantics the
/// watch coordinator's debounce loop relies on.
pub struct Sleep {
  deadline: Instant,
  inner: SleepInner,
}

enum SleepInner {
  #[cfg(napi_runtime_os_threads)]
  Heap(HeapSleep),
  Host(HostSleep),
}

#[cfg(napi_runtime_os_threads)]
struct HeapSleep {
  id: TimerId,
  executor: Weak<MultiThreadExecutor>,
  fired: Arc<AtomicBool>,
  registered: bool,
}

struct HostSleep {
  id: TimerId,
  /// Selection source, NOT a pinned driver: each poll snapshots every LIVE
  /// registrant. Arming redundant host timers prevents a live but starved
  /// environment from owning the sleep's only wake source.
  drivers: Arc<TimerDriverRegistry>,
  /// Drivers this sleep last armed on. The first responsive fire wakes the
  /// sleep; completion cancels every losing arm, including pre-delivery arms
  /// whose binding relay retains a cancellation tombstone.
  armed: FxHashMap<TimerDriverId, Arc<dyn TimerDriver>>,
  /// The executor's registry, held so the FIRST poll can arm the wake-token
  /// at the same moment `driver.register` arms the host timer.
  registry: Arc<HostTimerRegistry>,
  fired: Arc<AtomicBool>,
  /// Stable, coalescing signal used by [`TimerDriverRegistry::register`] to
  /// request a re-poll without retaining or invoking a task waker under the
  /// driver-registry locks.
  repoll: Arc<HostTimerRepoll>,
  /// Retires this sleep's wake-token in the executor's registry exactly once
  /// (created at first poll alongside the host registration, taken on
  /// completion, dropped with the Sleep on cancellation). `None` before the
  /// first poll: an unpolled Sleep holds no wake-token.
  pending: Option<HostTimerPendingGuard>,
}

fn cancel_host_timer_driver(id: TimerId, driver: Arc<dyn TimerDriver>) {
  let _ = catch_unwind_contained(|| driver.cancel(id));
  let _ = catch_unwind_contained(|| drop(driver));
}

fn cancel_host_timer_drivers(
  id: TimerId,
  armed: &mut FxHashMap<TimerDriverId, Arc<dyn TimerDriver>>,
) {
  for (_, driver) in armed.drain() {
    cancel_host_timer_driver(id, driver);
  }
}

impl Future for Sleep {
  type Output = ();

  fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
    let deadline = self.deadline;
    let this = self.get_mut();
    match &mut this.inner {
      #[cfg(napi_runtime_os_threads)]
      SleepInner::Heap(heap) => {
        if heap.fired.load(Ordering::SeqCst) || Instant::now() >= deadline {
          if heap.registered {
            // Wall-clock completion may beat the (busy) timekeeper's fire:
            // retire the registration so it cannot wake spuriously later.
            if let Some(executor) = heap.executor.upgrade() {
              executor.cancel_timer(heap.id);
            }
            heap.registered = false;
          }
          return Poll::Ready(());
        }
        let Some(executor) = heap.executor.upgrade() else {
          heap.fired.store(true, Ordering::SeqCst);
          heap.registered = false;
          return Poll::Ready(());
        };
        executor.register_timer(heap.id, deadline, cx.waker().clone(), &heap.fired);
        heap.registered = true;
        // Registration on a closed (shut-down) heap stores nothing and sets
        // `fired` instead: re-check so this poll resolves rather than parking
        // a closing runtime forever.
        if heap.fired.load(Ordering::SeqCst) {
          heap.registered = false;
          return Poll::Ready(());
        }
        Poll::Pending
      }
      SleepInner::Host(host) => {
        if host.fired.load(Ordering::SeqCst) || Instant::now() >= deadline {
          cancel_host_timer_drivers(host.id, &mut host.armed);
          host.pending.take();
          return Poll::Ready(());
        }
        // Clone both wakers before publishing either one. If the second clone
        // unwinds, destroy the first clone behind its own panic boundary before
        // resuming the original panic, so a hostile RawWaker destructor cannot
        // turn clone failure into a process-aborting double panic.
        let repoll_waker = cx.waker().clone();
        let registry_waker = match catch_unwind(AssertUnwindSafe(|| cx.waker().clone())) {
          Ok(waker) => waker,
          Err(payload) => {
            let _ = catch_unwind_contained(|| drop(repoll_waker));
            resume_unwind(payload);
          }
        };
        host.repoll.register(repoll_waker);
        if !host.registry.register(
          host.id,
          deadline,
          registry_waker,
          &host.fired,
          &host.drivers,
          &host.repoll,
        ) {
          cancel_host_timer_drivers(host.id, &mut host.armed);
          if host.pending.take().is_none() {
            host.repoll.close();
          }
          return Poll::Ready(());
        }
        if host.pending.is_none() {
          // FIRST poll: the registry entry appears at the same moment the
          // host timer is armed below -- and only then. An unpolled Sleep has
          // no host callback behind it, so counting it at creation would
          // wrongly veto the threaded deadline verdict (`has_live_wait`) and
          // mislabel the threadless certain diagnostic as timer-backed. The
          // certain panic itself no longer consults pending timers for its
          // verdict.
          host.drivers.register_pending(host.id, &host.repoll);
          host.pending = Some(HostTimerPendingGuard {
            registry: Arc::clone(&host.registry),
            drivers: Arc::clone(&host.drivers),
            repoll: Arc::clone(&host.repoll),
            id: host.id,
          });
        }
        // Re-select every LIVE driver on every poll. A live but starved
        // environment may accept a TSFN call and then stop servicing its
        // event loop, so no single host may own the only timer arm.
        let current = host.drivers.live();
        assert!(
          !current.as_slice().is_empty(),
          "CurrentThread runtime lost every live timer driver mid-sleep: the host contexts \
           that registered timer drivers (via \
           `napi_async_runtime::register_timer_driver`; the napi adapter registers \
           one per importing env through `registerTimerHost`) have all been torn down, so this \
           `sleep_until` can never be woken."
        );
        // Publish cancellation ownership for the complete live snapshot before
        // invoking any arbitrary callback. An earlier driver may unregister a
        // later one and then unwind; both the Sleep and the contained snapshot
        // must still own that later driver while the original panic propagates.
        // See the implementation notes in this crate's README.
        let missing = current
          .as_slice()
          .iter()
          .filter(|(current_id, _)| !host.armed.contains_key(current_id))
          .count();
        host.armed.reserve(missing);
        for (current_id, current_driver) in current.as_slice() {
          host
            .armed
            .entry(*current_id)
            .or_insert_with(|| Arc::clone(current_driver));
        }
        for (current_id, _) in current.as_slice() {
          let armed_driver = host
            .armed
            .get(current_id)
            .expect("every live timer driver must have cancellation ownership before callbacks");
          armed_driver.register(host.id, deadline, panic_contained_waker(cx.waker().clone()));
        }
        let current_ids = current
          .as_slice()
          .iter()
          .map(|(current_id, _)| *current_id)
          .collect::<FxHashSet<_>>();
        let retired = host
          .armed
          .keys()
          .filter(|armed_id| !current_ids.contains(armed_id))
          .copied()
          .collect::<Vec<_>>();
        for retired in retired {
          let old_driver = host
            .armed
            .remove(&retired)
            .expect("the retired timer driver must remain armed");
          cancel_host_timer_driver(host.id, old_driver);
        }
        Poll::Pending
      }
    }
  }
}

impl Drop for Sleep {
  fn drop(&mut self) {
    match &mut self.inner {
      #[cfg(napi_runtime_os_threads)]
      SleepInner::Heap(heap) => {
        if heap.registered
          && let Some(executor) = heap.executor.upgrade()
        {
          executor.cancel_timer(heap.id);
        }
      }
      SleepInner::Host(host) => {
        // Close directly as an unwind backstop even when first-poll setup
        // failed before `pending` could install its normal cleanup guard.
        host.repoll.close();
        cancel_host_timer_drivers(host.id, &mut host.armed);
        // `pending` (if still held) drops here and retires the wake-token.
      }
    }
  }
}

/// Sleep until `deadline` on the runtime's timer facility. MultiThread uses
/// the executor-owned heap; CurrentThread requires a LIVE host driver
/// registered via [`register_timer_driver`] and otherwise fails LOUD (a
/// missing driver must never become a silent never-firing debounce).
pub fn sleep_until(deadline: Instant) -> Sleep {
  make_sleep(&RUNTIME.backend(), &TIMER_DRIVERS, deadline)
}

/// Flavor dispatch behind [`sleep_until`], parameterized for tests (which
/// build executors and driver registries locally and must not touch the
/// process-global ones).
fn make_sleep(
  backend: &RuntimeBackend,
  host_drivers: &Arc<TimerDriverRegistry>,
  deadline: Instant,
) -> Sleep {
  let id = next_unique_id(&NEXT_TIMER_ID, "timer id space exhausted");
  match &backend.executor {
    #[cfg(napi_runtime_os_threads)]
    RuntimeExecutor::MultiThread(executor) => Sleep {
      deadline,
      inner: SleepInner::Heap(HeapSleep {
        id,
        executor: Arc::downgrade(executor),
        fired: Arc::new(AtomicBool::new(false)),
        registered: false,
      }),
    },
    RuntimeExecutor::CurrentThread(executor) => {
      // Fail loud at CREATION when no live driver exists (the
      // never-registered case gets its diagnostic at the sleep_until call
      // site, not on some later poll). The driver is NOT pinned here: each
      // poll re-selects every live registrant, so a driver dying while this
      // sleep is in flight is cancelled while the remaining hosts stay armed
      // -- and if every driver dies mid-flight, the poll path has its own loud
      // panic.
      assert!(
        host_drivers.has_live_driver(),
        "CurrentThread runtime has no live timer driver registered: `sleep_until` on the \
         single-thread flavor delegates timers to the host event loop. Install one via \
         `napi_async_runtime::register_timer_driver` (the napi adapter registers \
         a setTimeout-based driver per importing env through `registerTimerHost` at import)."
      );
      // The registry entry is created at FIRST POLL (when `driver.register`
      // arms the host timer), not here: an unpolled Sleep cannot wake anyone
      // -- nothing was handed to the host loop -- so counting it at creation
      // would wrongly veto the threaded deadline verdict and mislabel the
      // threadless certain diagnostic as timer-backed. First-poll accounting
      // has no false-panic side.
      Sleep {
        deadline,
        inner: SleepInner::Host(HostSleep {
          id,
          drivers: Arc::clone(host_drivers),
          armed: FxHashMap::default(),
          registry: Arc::clone(&executor.host_timers),
          fired: Arc::new(AtomicBool::new(false)),
          repoll: Arc::new(HostTimerRepoll::default()),
          pending: None,
        }),
      }
    }
  }
}

#[derive(Clone)]
enum RuntimeExecutor {
  CurrentThread(Arc<CurrentThreadExecutor>),
  #[cfg(napi_runtime_os_threads)]
  MultiThread(Arc<MultiThreadExecutor>),
}

enum WeakRuntimeExecutor {
  CurrentThread(Weak<CurrentThreadExecutor>),
  #[cfg(napi_runtime_os_threads)]
  MultiThread(Weak<MultiThreadExecutor>),
}

impl WeakRuntimeExecutor {
  fn schedule(&self, runnable: Runnable) {
    match self {
      Self::CurrentThread(executor) => {
        if let Some(executor) = executor.upgrade() {
          executor.schedule(runnable);
        }
      }
      #[cfg(napi_runtime_os_threads)]
      Self::MultiThread(executor) => {
        if let Some(executor) = executor.upgrade() {
          executor.schedule(runnable);
        }
      }
    }
  }
}

#[derive(Clone)]
struct RuntimeBackend {
  work: Arc<GenerationWork>,
  executor: RuntimeExecutor,
}

impl RuntimeBackend {
  fn new(
    options: &RuntimeOptions,
    metrics: Arc<RuntimeMetrics>,
  ) -> Result<Self, RuntimeConfigError> {
    #[cfg(test)]
    if FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.replace(false)) {
      return Err(RuntimeConfigError(
        "injected async runtime backend creation failure".to_string(),
      ));
    }

    let work = GenerationWork::new();
    let stop = Arc::new(GenerationStop::default());
    let executor = match options.flavor {
      RuntimeFlavor::CurrentThread => {
        let executor = CurrentThreadExecutor::with_generation(
          metrics,
          THREADLESS_BUILD,
          options.park_deadline,
          work.id,
          Arc::clone(&stop),
        );
        executor.attach_generation_work(&work);
        RuntimeExecutor::CurrentThread(Arc::new(executor))
      }
      RuntimeFlavor::MultiThread => {
        #[cfg(napi_runtime_os_threads)]
        {
          RuntimeExecutor::MultiThread(Arc::new(MultiThreadExecutor::new_for_generation(
            options, metrics, work.id, stop,
          )?))
        }
        #[cfg(not(napi_runtime_os_threads))]
        {
          let _ = metrics;
          return Err(RuntimeConfigError(
            "the multi-thread runtime is unavailable in this threadless WebAssembly build \
             (wasm32-wasip1 / wasm32-unknown-unknown); build for wasm32-wasip1-threads to use it"
              .to_string(),
          ));
        }
      }
    };
    Ok(Self { work, executor })
  }

  #[cfg(test)]
  fn from_executor(executor: RuntimeExecutor) -> Self {
    let work = GenerationWork::new();
    if let RuntimeExecutor::CurrentThread(executor) = &executor {
      executor.attach_generation_work(&work);
    }
    Self { work, executor }
  }

  fn generation(&self) -> u64 {
    self.work.id
  }

  fn downgrade_executor(&self) -> WeakRuntimeExecutor {
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => {
        WeakRuntimeExecutor::CurrentThread(Arc::downgrade(executor))
      }
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => {
        WeakRuntimeExecutor::MultiThread(Arc::downgrade(executor))
      }
    }
  }

  /// First schedule of a freshly submitted task. This runs on the stack of the
  /// caller of `spawn`, never on a waker's; see
  /// `CurrentThreadExecutor::schedule_submission`.
  fn schedule_submission(&self, runnable: Runnable) {
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => executor.schedule_submission(runnable),
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => executor.schedule(runnable),
    }
  }

  fn spawn_registered_blocking<F, T>(
    &self,
    function: F,
    registration: GenerationWorkGuard,
    metrics: &Arc<RuntimeMetrics>,
  ) -> JoinHandle<T>
  where
    F: FnOnce() -> T + Send + 'static,
    T: Send + 'static,
  {
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => {
        let _ = metrics;
        executor.schedule_blocking(function, registration)
      }
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => {
        let generation = self.generation();
        let _ = metrics;
        let function = RegisteredBlockingFunction::new(function, registration, generation);
        executor.schedule_blocking_result(move || function.run())
      }
    }
  }

  fn block_on(&self, future: Pin<&mut dyn Future<Output = ()>>) -> BlockOnOutcome {
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => executor.block_on(future),
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => executor.block_on(future),
    }
  }

  fn generation_stop(&self) -> Arc<GenerationStop> {
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => Arc::clone(&executor.stop),
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => Arc::clone(&executor.stop),
    }
  }

  fn begin_shutdown(&self) {
    let _generation = RuntimeGenerationGuard::enter(self.generation());
    self.work.close_and_abort();
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => executor.begin_shutdown(),
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => executor.begin_shutdown(),
    }
  }

  fn wait_until_idle(&self) {
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => {
        // A wake in flight across `begin_shutdown` is rejected by the closed
        // queue and parked in `queue.rejected` with its guard still held, and
        // a failure transition racing `begin_shutdown` from a waker's stack
        // moves the queued guards there too; retire them here, on this stack,
        // until the generation is idle.
        self.work.wait_until_idle_retiring(
          || executor.has_rejected_work(),
          || executor.retire_rejected_work(),
        );
        executor.wait_until_scheduler_idle();
      }
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => {
        self.work.wait_until_idle();
        executor.wait_until_scheduler_idle();
      }
    }
  }

  /// Non-blocking counterpart of `wait_until_idle`: whether that call would
  /// have to wait for anything. Same sources, read without sleeping --
  /// registered async/blocking work, work the executor still owes a
  /// cancellation, and an in-flight drain or host turn.
  ///
  /// Joining the worker threads (phase 2's `wait_for_all_workers`) is NOT a
  /// source here: a Rayon worker exits when the last backend handle is
  /// dropped, which only phase 2 does, so `WorkerLifecycle::remaining` is
  /// non-zero for the whole window between the phases by construction and
  /// would make this poll never answer `false`. That join waits on thread
  /// teardown, never on user work, so yielding to the host cannot help it.
  ///
  /// `read` decides whether the sources that live under a lock may wait for
  /// it; the MultiThread scheduler source is an atomic either way.
  fn work_pending(&self, read: PendingRead) -> bool {
    if self.work.has_active_work(read) {
      return true;
    }
    match &self.executor {
      RuntimeExecutor::CurrentThread(executor) => {
        executor.rejected_work_pending(read) || executor.scheduler_work_pending(read)
      }
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(executor) => executor.scheduler_work_pending(),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  fn worker_lifecycle(&self) -> Option<Arc<WorkerLifecycle>> {
    match &self.executor {
      RuntimeExecutor::CurrentThread(_) => None,
      RuntimeExecutor::MultiThread(executor) => Some(Arc::clone(&executor.worker_lifecycle)),
    }
  }

  fn stop_identity(&self) -> RuntimeStopIdentity {
    RuntimeStopIdentity {
      generation: self.generation(),
      #[cfg(napi_runtime_os_threads)]
      executor_id: match &self.executor {
        RuntimeExecutor::CurrentThread(_) => None,
        RuntimeExecutor::MultiThread(executor) => Some(executor.id),
      },
    }
  }

  fn is_current(&self) -> bool {
    self.stop_identity().is_current()
  }
}

#[derive(Clone, Copy)]
struct RuntimeStopIdentity {
  generation: u64,
  #[cfg(napi_runtime_os_threads)]
  executor_id: Option<u64>,
}

impl RuntimeStopIdentity {
  fn is_current(self) -> bool {
    if ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get) == Some(self.generation) {
      return true;
    }
    #[cfg(napi_runtime_os_threads)]
    if let Some(executor_id) = self.executor_id
      && (ON_POOL_WORKER.with(std::cell::Cell::get) == Some(executor_id)
        || ON_TIMER_THREAD.with(std::cell::Cell::get) == Some(executor_id))
    {
      return true;
    }
    false
  }
}

enum RuntimeLifecycle {
  Initial,
  StoppedBeforeFirstUse,
  Running(RuntimeBackend),
  Stopping(RuntimeStopIdentity),
  StoppingWithoutBackend(ZeroBackendShutdownTarget),
  Stopped,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
enum ZeroBackendShutdownTarget {
  StoppedBeforeFirstUse,
  Stopped,
}

impl ZeroBackendShutdownTarget {
  fn into_lifecycle(self) -> RuntimeLifecycle {
    match self {
      Self::StoppedBeforeFirstUse => RuntimeLifecycle::StoppedBeforeFirstUse,
      Self::Stopped => RuntimeLifecycle::Stopped,
    }
  }
}

struct RuntimeState {
  options: RuntimeOptions,
  lifecycle: RuntimeLifecycle,
  rejected_drops: usize,
  /// Handoff between the two shutdown phases, `None` unless a
  /// `begin_shutdown` is outstanding. `RuntimeLifecycle::Stopping` carries no
  /// backend, so the single-call `shutdown` keeps it on its own stack; the
  /// split needs somewhere to park it across the host's yield window.
  ///
  /// Scoped to the generation the phase 1 was opened against: a successful
  /// `start` publishes a fresh one and drops it
  /// (`forget_shutdown_handoff`).
  ///
  /// A `ShutdownDrain::Backend` handoff is taken: whoever finds it takes it,
  /// drains it and publishes the stop; everybody else answers off the
  /// lifecycle. A `ShutdownDrain::ZeroBackend` handoff is not -- there is no
  /// backend to own. Nobody takes it. Every `finish_shutdown` that finds it
  /// waits on `rejected_drops`, and the one that observes zero clears the
  /// slot together with the publication, under one lock hold. Either way the
  /// handoff carries no owner and no credit -- see `phase_ever_opened`.
  ///
  /// The slot never goes empty while a stop is still owed. For `Backend` the
  /// taker swaps the handoff for `ShutdownDrain::Joining`, which stays until
  /// `Stopped` is published under this same lock. For `ZeroBackend` the
  /// handoff itself stays, untouched, until the target lifecycle is published
  /// under that lock. That keeps the non-blocking surfaces
  /// (`begin_shutdown`'s re-entry arm, `runtime_work_pending`) truthful for
  /// the whole wait instead of reading like a runtime with nothing pending.
  draining: Option<ShutdownDrain>,
  /// Sticky: `true` once any `begin_shutdown` has OPENED a phase (any arm that
  /// parks a handoff, `Backend` or `Settled`). Never cleared -- not by a
  /// finish, not by a `start`, not by a restart.
  ///
  /// It answers the one question `finish_shutdown` cannot answer from
  /// `draining` and the lifecycle alone. An empty handoff slot on a runtime
  /// that has never announced a stop is a host bug (phase 2 called on its
  /// own); an empty slot on a runtime that has announced one only means
  /// somebody else already completed, dropped or superseded it, which phase 2
  /// reports as `Ok(())`.
  ///
  /// A counter was tried here and is wrong by construction: the credit is
  /// spent by whichever thread performs the join, NOT by the thread that
  /// opened the phase. A concurrent in-protocol `finish_shutdown` therefore
  /// pairs off a single-call `shutdown`'s own phase, and that `shutdown` is
  /// then told its stop was never started -- 8.2% of the time on
  /// CurrentThread, after it had already published the stop. `(begin, start)`
  /// pairs leak credits on top of that, turning later orphan finishes into
  /// `Ok`. A bool can neither race nor leak.
  phase_ever_opened: bool,
}

impl RuntimeState {
  /// Park an accepted phase 1's handoff and record that a stop has been
  /// announced. Both halves are set under the one lock every opening arm
  /// already holds, so no phase can be open without the flag.
  fn open_phase_one(&mut self, drain: ShutdownDrain) {
    self.phase_ever_opened = true;
    self.draining = Some(drain);
  }

  /// Drop any parked handoff. Called by every path that publishes a
  /// generation (`start`, and `backend_locked`'s lazy first backend): a fresh
  /// generation owes nothing to a handoff opened against an earlier one.
  ///
  /// Dropping `draining` here is what keeps a stale handoff from answering
  /// for the new generation -- a surviving `Settled` would make the next
  /// `begin_shutdown` return from its outstanding-handoff arm without
  /// stopping anything, let `finish_shutdown` consume it and report `Ok(())`,
  /// and pin `runtime_work_pending` to `false`, so a `shutdown` would claim
  /// success while this generation kept running, kept accepting work and kept
  /// its MultiThread workers unjoined.
  ///
  /// It does NOT clear `phase_ever_opened`. Dropping the handoff answers the
  /// stale-handoff question completely; whether phase 2 may be called at all
  /// is a different question, and a `start` does not turn an outstanding phase
  /// 2 into a host bug -- it turns it into a no-op.
  fn forget_shutdown_handoff(&mut self) {
    // Only a settled handoff can ever reach here: `ShutdownDrain::Backend` is
    // parked together with the published `Stopping` and `Joining` replaces it
    // until `Stopped` is published, and every `start` arm waits out
    // `Stopping` instead of publishing over it. `ZeroBackend` is the same
    // argument one lifecycle over: it is parked together with the published
    // `StoppingWithoutBackend`, every `start` arm waits that out, and
    // `backend_locked` refuses to build a backend under it.
    debug_assert!(
      !matches!(
        self.draining,
        Some(ShutdownDrain::Backend(_) | ShutdownDrain::Joining(_) | ShutdownDrain::ZeroBackend(_))
      ),
      "a start must never publish over an outstanding backend drain"
    );
    self.draining = None;
  }
}

/// What `RuntimeController::finish_shutdown` still owes an outstanding
/// `begin_shutdown`.
enum ShutdownDrain {
  /// `Stopping(identity)` is published and this backend is waiting to be
  /// drained and joined. Nobody owns it yet, so it is still up for grabs.
  Backend(RuntimeBackend),
  /// A `finish_shutdown` has TAKEN the handoff above and is inside the join.
  /// The marker stays until that thread publishes `Stopped`: the lifecycle
  /// reads `Stopping` for the whole window, so an empty slot would make a
  /// re-entering phase 1 park on `lifecycle_changed` and
  /// `runtime_work_pending` answer `false` about work the finisher is
  /// demonstrably still waiting for.
  ///
  /// The backend rides along only for the FIRST half of that window
  /// (`wait_until_idle`), which is the half that can still report work. The
  /// drainer clears it to `None` before releasing its own last reference,
  /// because that release is what drops the executor and lets the workers
  /// exit -- a marker that kept a clone alive would wedge the worker join
  /// forever (observed: `wait_for_all_workers` never returning). By then
  /// `wait_until_idle` has returned, so `None` is the truthful verdict for
  /// the remaining half.
  ///
  /// It is NOT up for grabs -- a second `finish_shutdown` that finds it waits
  /// for the publication and reports it, exactly as it does for an empty slot
  /// on a runtime that has announced a stop.
  Joining(Option<RuntimeBackend>),
  /// Phase 1 completed a zero-backend transition (`Initial`, or an already
  /// stopped runtime): phase 2 has nothing left to drain.
  Settled,
  /// Phase 1 announced a zero-backend stop (`Initial`, or an already stopped
  /// runtime) that still owes the retirement of one or more
  /// rejected-submission destructors before `target` may be published.
  ///
  /// Those destructors are arbitrary user `Drop` code running on the
  /// REJECTING thread, so waiting for them is exactly what phase 1 must not
  /// do: on the threaded WASI artifact that thread can be waiting for a
  /// JavaScript turn the phase-1 caller can only give by returning. The
  /// lifecycle reads `StoppingWithoutBackend(target)` for the whole window,
  /// exactly as `Stopping` + `Backend` do for a generation with a backend, and
  /// phase 2 does the wait and publishes the target.
  ///
  /// It is NOT taken out of the slot the way `Backend` is -- there is nothing
  /// to own -- so every `finish_shutdown` that finds it re-reads the slot
  /// after each wake and only the one that observes `rejected_drops == 0`
  /// under the published target publishes it.
  ZeroBackend(ZeroBackendShutdownTarget),
}

#[cfg(test)]
thread_local! {
  static BEFORE_RUNTIME_SUBMISSION_LOCK_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static AFTER_ASYNC_WORK_REGISTRATION_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static AFTER_BLOCKING_WORK_REGISTRATION_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static AFTER_CURRENT_THREAD_HOST_ADMISSION_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static BEFORE_INITIAL_START_WAIT_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static AFTER_GENERATION_STOP_PUBLICATION_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static AFTER_SHUTDOWN_DRAIN_TAKEN_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static BETWEEN_SHUTDOWN_PHASES_TEST_HOOK:
    std::cell::RefCell<Option<Box<dyn FnOnce()>>> = const { std::cell::RefCell::new(None) };
  static FAIL_NEXT_RUNTIME_BACKEND_CREATION:
    std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
}

#[cfg(test)]
fn run_before_runtime_submission_lock_test_hook() {
  if let Some(hook) = BEFORE_RUNTIME_SUBMISSION_LOCK_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(test)]
fn run_after_async_work_registration_test_hook() {
  if let Some(hook) = AFTER_ASYNC_WORK_REGISTRATION_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(test)]
fn run_after_blocking_work_registration_test_hook() {
  if let Some(hook) =
    AFTER_BLOCKING_WORK_REGISTRATION_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(test)]
fn run_after_current_thread_host_admission_test_hook() {
  if let Some(hook) =
    AFTER_CURRENT_THREAD_HOST_ADMISSION_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

#[cfg(test)]
fn run_before_initial_start_wait_test_hook() {
  if let Some(hook) = BEFORE_INITIAL_START_WAIT_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

#[cfg(test)]
fn run_after_generation_stop_publication_test_hook() {
  if let Some(hook) =
    AFTER_GENERATION_STOP_PUBLICATION_TEST_HOOK.with(|slot| slot.borrow_mut().take())
  {
    hook();
  }
}

/// Runs on the thread that TOOK the outstanding phase 1, after the handoff is
/// out of the state and before it waits: anything a test starts from here
/// provably arrives at the handshake second.
#[cfg(test)]
fn run_after_shutdown_drain_taken_test_hook() {
  if let Some(hook) = AFTER_SHUTDOWN_DRAIN_TAKEN_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

/// Runs inside the single-call `shutdown`, in the window between its two
/// halves where it holds no lock: this is exactly where a racing `start` can
/// land and drop the handoff phase 1 parked.
#[cfg(test)]
fn run_between_shutdown_phases_test_hook() {
  if let Some(hook) = BETWEEN_SHUTDOWN_PHASES_TEST_HOOK.with(|slot| slot.borrow_mut().take()) {
    hook();
  }
}

thread_local! {
  static IN_REJECTED_SUBMISSION_DROP: std::cell::Cell<usize> =
    const { std::cell::Cell::new(0) };
}

struct RejectedSubmissionDropContext;

impl RejectedSubmissionDropContext {
  fn enter() -> Self {
    IN_REJECTED_SUBMISSION_DROP.with(|depth| depth.set(depth.get() + 1));
    Self
  }

  fn is_current() -> bool {
    IN_REJECTED_SUBMISSION_DROP.with(|depth| depth.get() != 0)
  }
}

impl Drop for RejectedSubmissionDropContext {
  fn drop(&mut self) {
    IN_REJECTED_SUBMISSION_DROP.with(|depth| {
      depth.set(
        depth
          .get()
          .checked_sub(1)
          .expect("rejected submission drop depth underflow"),
      );
    });
  }
}

struct RuntimeController {
  state: Mutex<RuntimeState>,
  lifecycle_changed: Condvar,
  metrics: Arc<RuntimeMetrics>,
  // Lock-free mirror of `state.lifecycle`'s backend, read by `fast_register`
  // without the `state` lock. Invariant: store `Some(b)` on every transition
  // INTO `Running(b)` and `None` on every transition OUT -- exactly 3 sites
  // today (lazy-create, start, shutdown). Any new Running-boundary write MUST
  // mirror here, or `fast_register` routes work onto a superseded backend.
  current_backend: ArcSwapOption<RuntimeBackend>,
}

struct RejectedSubmissionGuard<'a> {
  controller: &'a RuntimeController,
}

impl Drop for RejectedSubmissionGuard<'_> {
  fn drop(&mut self) {
    let mut state = self
      .controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    state.rejected_drops = state
      .rejected_drops
      .checked_sub(1)
      .expect("rejected submission drop count underflow");
    self.controller.lifecycle_changed.notify_all();
  }
}

impl RuntimeController {
  fn new() -> Self {
    let options = RuntimeOptions::default()
      .validate()
      .expect("default async runtime options must be valid");
    Self {
      state: Mutex::new(RuntimeState {
        options,
        lifecycle: RuntimeLifecycle::Initial,
        rejected_drops: 0,
        draining: None,
        phase_ever_opened: false,
      }),
      lifecycle_changed: Condvar::new(),
      metrics: Arc::new(RuntimeMetrics::default()),
      current_backend: ArcSwapOption::empty(),
    }
  }

  fn configure(&self, options: RuntimeOptions) -> Result<(), RuntimeConfigError> {
    let options = options.validate()?;
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    Self::ensure_configuration_mutable(&state)?;
    state.options = options;
    Ok(())
  }

  fn configure_partial(&self, patch: RuntimeOptionsPatch) -> Result<(), RuntimeConfigError> {
    self.configure_partial_inner(patch, |_| {})
  }

  fn configure_partial_inner(
    &self,
    patch: RuntimeOptionsPatch,
    after_merge: impl FnOnce(&RuntimeOptions),
  ) -> Result<(), RuntimeConfigError> {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    Self::ensure_configuration_mutable(&state)?;

    let mut options = state.options.clone();
    patch.apply_to(&mut options);
    after_merge(&options);
    let options = options.validate()?;
    state.options = options;
    Ok(())
  }

  fn ensure_configuration_mutable(state: &RuntimeState) -> Result<(), RuntimeConfigError> {
    if matches!(
      &state.lifecycle,
      RuntimeLifecycle::Initial | RuntimeLifecycle::StoppedBeforeFirstUse
    ) {
      return Ok(());
    }
    Err(RuntimeConfigError(
      "the async runtime configuration is frozen; configure it before the first async call"
        .to_string(),
    ))
  }

  fn ensure_active_generation_current(state: &RuntimeState) -> Result<(), RuntimeConfigError> {
    let Some(active_generation) = active_runtime_generation() else {
      return Ok(());
    };
    let lifecycle_generation = match &state.lifecycle {
      RuntimeLifecycle::Running(backend) => Some(backend.generation()),
      RuntimeLifecycle::Stopping(identity) => Some(identity.generation),
      RuntimeLifecycle::Initial
      | RuntimeLifecycle::StoppedBeforeFirstUse
      | RuntimeLifecycle::StoppingWithoutBackend(_)
      | RuntimeLifecycle::Stopped => None,
    };
    if lifecycle_generation == Some(active_generation) {
      return Ok(());
    }
    Err(RuntimeConfigError(
      "cannot access or control the async runtime from work owned by a retired generation"
        .to_string(),
    ))
  }

  fn backend_locked(&self, state: &mut RuntimeState) -> Result<RuntimeBackend, RuntimeConfigError> {
    Self::ensure_active_generation_current(state)?;
    match &state.lifecycle {
      RuntimeLifecycle::Running(backend) => return Ok(backend.clone()),
      RuntimeLifecycle::StoppedBeforeFirstUse
      | RuntimeLifecycle::Stopping(_)
      | RuntimeLifecycle::StoppingWithoutBackend(_)
      | RuntimeLifecycle::Stopped => {
        return Err(RuntimeConfigError(
          "the async runtime is stopped; call start before submitting work".to_string(),
        ));
      }
      RuntimeLifecycle::Initial => {}
    }
    if state.rejected_drops != 0 {
      return Err(RuntimeConfigError(
        "the async runtime cannot start while a rejected submission is being destroyed".to_string(),
      ));
    }
    let backend = RuntimeBackend::new(&state.options, Arc::clone(&self.metrics))?;
    state.lifecycle = RuntimeLifecycle::Running(backend.clone());
    state.forget_shutdown_handoff();
    self.current_backend.store(Some(Arc::new(backend.clone())));
    Ok(backend)
  }

  fn try_backend(&self) -> Result<RuntimeBackend, RuntimeConfigError> {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    self.backend_locked(&mut state)
  }

  fn backend(&self) -> RuntimeBackend {
    self.try_backend().unwrap_or_else(|error| panic!("{error}"))
  }

  fn begin_rejected_drop(state: &mut RuntimeState) -> Option<u64> {
    let generation = active_runtime_generation().or_else(|| match &state.lifecycle {
      RuntimeLifecycle::Running(backend) => Some(backend.generation()),
      RuntimeLifecycle::Stopping(identity) => Some(identity.generation),
      RuntimeLifecycle::Initial
      | RuntimeLifecycle::StoppedBeforeFirstUse
      | RuntimeLifecycle::StoppingWithoutBackend(_)
      | RuntimeLifecycle::Stopped => None,
    });
    state.rejected_drops += 1;
    generation
  }

  /// Lock-free spawn fast path. Returns Some((backend, registration)) when the
  /// runtime is Running, the caller's generation is current, and registration
  /// succeeds -- all without taking the outer `state` lock. Returns None (fall
  /// to the locked slow path) for any miss: no current backend, retired
  /// generation, or a closed generation. Staleness is safe: see the safety
  /// invariant -- try_register_* re-checks `closed`, and wait_until_idle already
  /// gates on any registration that slips in during shutdown.
  #[inline]
  fn fast_register<R>(
    &self,
    register: impl FnOnce(&Arc<GenerationWork>) -> Option<R>,
  ) -> Option<(Arc<RuntimeBackend>, R)> {
    let guard = self.current_backend.load();
    let backend = guard.as_ref()?; // None => Initial/Stopping/Stopped => slow path
    if let Some(active) = active_runtime_generation()
      && active != backend.generation()
    {
      return None; // retired generation => slow path yields exact error
    }
    let registration = register(&backend.work)?; // closed => None => slow path rejects
    // Hand back the already-loaded Arc (one refcount bump) rather than deep-
    // cloning `RuntimeBackend`'s two inner Arcs; both callers only borrow it.
    Some((Arc::clone(backend), registration))
  }

  fn try_spawn_tracked<F, T>(
    &self,
    future: F,
  ) -> Result<JoinHandle<T>, (RuntimeConfigError, F, Option<u64>)>
  where
    F: Future<Output = T> + Send + 'static,
    T: Send + 'static,
  {
    #[cfg(test)]
    run_before_runtime_submission_lock_test_hook();

    if let Some((backend, registration)) = self.fast_register(|w| w.try_register_async()) {
      #[cfg(test)]
      run_after_async_work_registration_test_hook();
      return Ok(spawn_registered(
        &backend,
        Arc::clone(&self.metrics),
        future,
        registration,
      ));
    }

    let (backend, registration) = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let backend = match self.backend_locked(&mut state) {
        Ok(backend) => backend,
        Err(error) => {
          let generation = Self::begin_rejected_drop(&mut state);
          return Err((error, future, generation));
        }
      };
      let Some(registration) = backend.work.try_register_async() else {
        let generation = Self::begin_rejected_drop(&mut state);
        return Err((
          RuntimeConfigError(
            "the async runtime is stopped; call start before submitting work".to_string(),
          ),
          future,
          generation,
        ));
      };
      (backend, registration)
    };
    #[cfg(test)]
    run_after_async_work_registration_test_hook();
    Ok(spawn_registered(
      &backend,
      Arc::clone(&self.metrics),
      future,
      registration,
    ))
  }

  fn try_spawn<F, T>(&self, future: F) -> Result<JoinHandle<T>, (RuntimeConfigError, F)>
  where
    F: Future<Output = T> + Send + 'static,
    T: Send + 'static,
  {
    match self.try_spawn_tracked(future) {
      Ok(handle) => Ok(handle),
      Err((error, future, _generation)) => {
        drop(RejectedSubmissionGuard { controller: self });
        Err((error, future))
      }
    }
  }

  fn spawn<F, T>(&self, future: F) -> JoinHandle<T>
  where
    F: Future<Output = T> + Send + 'static,
    T: Send + 'static,
  {
    match self.try_spawn_tracked(future) {
      Ok(handle) => handle,
      Err((error, future, generation)) => {
        let _rejection = RejectedSubmissionGuard { controller: self };
        let _drop_context = RejectedSubmissionDropContext::enter();
        let _generation = generation.map(RuntimeGenerationGuard::enter);
        let _ = catch_unwind_contained(|| drop(future));
        JoinHandle(JoinHandleInner::Ready(Some(Err(JoinError {
          message: error.to_string(),
        }))))
      }
    }
  }

  fn try_spawn_detached<F>(&self, future: F) -> Result<(), F>
  where
    F: Future<Output = ()> + Send + 'static,
  {
    match self.try_spawn(future) {
      Ok(handle) => {
        handle.detach();
        Ok(())
      }
      Err((_, future)) => Err(future),
    }
  }

  fn try_spawn_blocking_tracked<F, T>(
    &self,
    function: F,
  ) -> Result<JoinHandle<T>, (RuntimeConfigError, F, Option<u64>)>
  where
    F: FnOnce() -> T + Send + 'static,
    T: Send + 'static,
  {
    #[cfg(test)]
    run_before_runtime_submission_lock_test_hook();

    if let Some((backend, registration)) = self.fast_register(|w| w.try_register_work()) {
      #[cfg(test)]
      run_after_blocking_work_registration_test_hook();
      return Ok(backend.spawn_registered_blocking(function, registration, &self.metrics));
    }

    let (backend, registration) = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let backend = match self.backend_locked(&mut state) {
        Ok(backend) => backend,
        Err(error) => {
          let generation = Self::begin_rejected_drop(&mut state);
          return Err((error, function, generation));
        }
      };
      let Some(registration) = backend.work.try_register_work() else {
        let generation = Self::begin_rejected_drop(&mut state);
        return Err((
          RuntimeConfigError(
            "the async runtime is stopped; call start before submitting work".to_string(),
          ),
          function,
          generation,
        ));
      };
      (backend, registration)
    };
    #[cfg(test)]
    run_after_blocking_work_registration_test_hook();
    Ok(backend.spawn_registered_blocking(function, registration, &self.metrics))
  }

  fn try_spawn_blocking<F, T>(&self, function: F) -> Result<JoinHandle<T>, (RuntimeConfigError, F)>
  where
    F: FnOnce() -> T + Send + 'static,
    T: Send + 'static,
  {
    match self.try_spawn_blocking_tracked(function) {
      Ok(handle) => Ok(handle),
      Err((error, function, _generation)) => {
        drop(RejectedSubmissionGuard { controller: self });
        Err((error, function))
      }
    }
  }

  fn spawn_blocking<F, T>(&self, function: F) -> JoinHandle<T>
  where
    F: FnOnce() -> T + Send + 'static,
    T: Send + 'static,
  {
    match self.try_spawn_blocking_tracked(function) {
      Ok(handle) => handle,
      Err((error, function, generation)) => {
        let _rejection = RejectedSubmissionGuard { controller: self };
        let _drop_context = RejectedSubmissionDropContext::enter();
        let _generation = generation.map(RuntimeGenerationGuard::enter);
        let _ = catch_unwind_contained(|| drop(function));
        JoinHandle(JoinHandleInner::Ready(Some(Err(JoinError {
          message: error.to_string(),
        }))))
      }
    }
  }

  #[cfg(test)]
  fn block_on(&self, future: Pin<&mut dyn Future<Output = ()>>) -> BlockOnOutcome {
    self
      .try_block_on(future)
      .unwrap_or_else(|error| panic!("{error}"))
  }

  fn try_block_on_scope(
    &self,
  ) -> Result<(RuntimeBackend, GenerationWorkGuard), (RuntimeConfigError, Option<u64>)> {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let backend = match self.backend_locked(&mut state) {
      Ok(backend) => backend,
      Err(error) => {
        let generation = Self::begin_rejected_drop(&mut state);
        return Err((error, generation));
      }
    };
    let Some(registration) = backend.work.try_register_work() else {
      let generation = Self::begin_rejected_drop(&mut state);
      return Err((
        RuntimeConfigError(
          "the async runtime is stopped; call start before submitting work".to_string(),
        ),
        generation,
      ));
    };
    Ok((backend, registration))
  }

  fn try_block_on(
    &self,
    future: Pin<&mut dyn Future<Output = ()>>,
  ) -> Result<BlockOnOutcome, RuntimeConfigError> {
    let (backend, registration) = match self.try_block_on_scope() {
      Ok(scope) => scope,
      Err((error, _generation)) => {
        drop(RejectedSubmissionGuard { controller: self });
        return Err(error);
      }
    };
    let _registration = registration;
    let _generation = RuntimeGenerationGuard::enter(backend.generation());
    Ok(backend.block_on(future))
  }

  fn start(&self) -> Result<(), RuntimeConfigError> {
    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    loop {
      Self::ensure_active_generation_current(&state)?;
      match &state.lifecycle {
        // napi starts the runtime while the addon is still being registered.
        // Keep the first backend lazy so configureAsyncRuntime remains usable
        // until the first async binding call.
        RuntimeLifecycle::Initial => {
          if state.rejected_drops == 0 {
            // A started runtime owes nothing to a handoff parked against an
            // earlier generation. The stop that handoff announced still
            // happened, so `phase_ever_opened` stays set and a phase 2 that
            // arrives afterwards is a no-op instead of an error.
            state.forget_shutdown_handoff();
            return Ok(());
          }
          if RejectedSubmissionDropContext::is_current() {
            return Err(RuntimeConfigError(
              "cannot start the async runtime while a rejected submission is being destroyed"
                .to_string(),
            ));
          }
          #[cfg(test)]
          run_before_initial_start_wait_test_hook();
          state = self
            .lifecycle_changed
            .wait(state)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
        RuntimeLifecycle::Running(_) => {
          state.forget_shutdown_handoff();
          return Ok(());
        }
        RuntimeLifecycle::Stopping(identity) => {
          if identity.is_current() {
            return Err(RuntimeConfigError(
              "cannot restart the async runtime from work in the generation being stopped"
                .to_string(),
            ));
          }
          state = self
            .lifecycle_changed
            .wait(state)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
        RuntimeLifecycle::StoppingWithoutBackend(_) => {
          if RejectedSubmissionDropContext::is_current() {
            return Err(RuntimeConfigError(
              "cannot restart the async runtime while a rejected submission is being destroyed"
                .to_string(),
            ));
          }
          state = self
            .lifecycle_changed
            .wait(state)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
        RuntimeLifecycle::StoppedBeforeFirstUse | RuntimeLifecycle::Stopped => {
          if state.rejected_drops == 0 {
            if matches!(&state.lifecycle, RuntimeLifecycle::StoppedBeforeFirstUse) {
              state.lifecycle = RuntimeLifecycle::Initial;
              state.forget_shutdown_handoff();
              return Ok(());
            }
            break;
          }
          if RejectedSubmissionDropContext::is_current() {
            return Err(RuntimeConfigError(
              "cannot restart the async runtime while a rejected submission is being destroyed"
                .to_string(),
            ));
          }
          state = self
            .lifecycle_changed
            .wait(state)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
      }
    }
    let backend = RuntimeBackend::new(&state.options, Arc::clone(&self.metrics))?;
    self.current_backend.store(Some(Arc::new(backend.clone())));
    state.lifecycle = RuntimeLifecycle::Running(backend);
    state.forget_shutdown_handoff();
    Ok(())
  }

  fn options(&self) -> RuntimeOptions {
    self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .options
      .clone()
  }

  fn running_current_thread_executor(&self) -> Option<Arc<CurrentThreadExecutor>> {
    let state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let RuntimeLifecycle::Running(backend) = &state.lifecycle else {
      return None;
    };
    match &backend.executor {
      RuntimeExecutor::CurrentThread(executor) => Some(Arc::clone(executor)),
      #[cfg(napi_runtime_os_threads)]
      RuntimeExecutor::MultiThread(_) => None,
    }
  }

  fn request_current_thread_drain(&self) {
    if let Some(executor) = self.running_current_thread_executor() {
      executor.request_drain_if_queued();
    }
  }

  fn retire_rejected_current_thread_work(&self) {
    if let Some(executor) = self.running_current_thread_executor() {
      executor.retire_rejected_work_off_waker_stack();
    }
  }

  fn cancel_current_thread_dispatch(&self, failure: CurrentThreadTaskDispatchFailure) {
    let executor = {
      let state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let RuntimeLifecycle::Running(backend) = &state.lifecycle else {
        return;
      };
      match &backend.executor {
        RuntimeExecutor::CurrentThread(executor) => Arc::clone(executor),
        #[cfg(napi_runtime_os_threads)]
        RuntimeExecutor::MultiThread(_) => return,
      }
    };
    executor.cancel_host_dispatch(failure);
  }

  #[cfg(test)]
  fn cancel_current_thread_dispatch_for_test(&self, dispatch: u64) {
    let executor = {
      let state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let RuntimeLifecycle::Running(backend) = &state.lifecycle else {
        return;
      };
      match &backend.executor {
        RuntimeExecutor::CurrentThread(executor) => Arc::clone(executor),
        #[cfg(napi_runtime_os_threads)]
        RuntimeExecutor::MultiThread(_) => return,
      }
    };
    executor.cancel_host_dispatch_for_test(dispatch);
  }

  fn drive_current_thread_tasks(&self, delivery: u64) -> Option<CurrentThreadTaskCallbackLease> {
    let dispatch = CURRENT_THREAD_TASK_DRIVERS.claim_delivery(delivery)?;
    self.drive_current_thread_dispatch_with_lease(dispatch, true)
  }

  fn drive_current_thread_dispatch_with_lease(
    &self,
    dispatch: u64,
    mark_serviced: bool,
  ) -> Option<CurrentThreadTaskCallbackLease> {
    let mut host_turn = {
      let state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let RuntimeLifecycle::Running(backend) = &state.lifecycle else {
        return None;
      };
      let executor = match &backend.executor {
        RuntimeExecutor::CurrentThread(executor) => executor,
        #[cfg(napi_runtime_os_threads)]
        RuntimeExecutor::MultiThread(_) => return None,
      };
      let host_turn = executor.try_admit_host_turn(dispatch)?;
      if mark_serviced {
        CURRENT_THREAD_TASK_DRIVERS.mark_serviced(dispatch);
      }
      host_turn
    };
    #[cfg(test)]
    run_after_current_thread_host_admission_test_hook();
    host_turn.drive();
    Some(CurrentThreadTaskCallbackLease::new(host_turn))
  }

  #[cfg(test)]
  fn drive_current_thread_dispatch(&self, dispatch: u64, mark_serviced: bool) -> bool {
    self
      .drive_current_thread_dispatch_with_lease(dispatch, mark_serviced)
      .is_some()
  }

  /// Phase 1 of the two-phase shutdown: publish `Stopping`, close admission,
  /// abort registered tasks, drop queued work, drain-fire timers and wake
  /// parkers -- then return WITHOUT waiting for work that is already running.
  ///
  /// `Ok(true)` = the announced stop still owes a wait, so the caller should
  /// let its host loop turn and poll [`Self::runtime_work_pending`] before
  /// phase 2. That is registered work of a generation with a backend, and --
  /// on a zero-backend stop -- a rejected submission still being destroyed on
  /// another thread, which phase 1 parks as `ShutdownDrain::ZeroBackend`
  /// rather than wait out. `Ok(false)` = there is nothing left and
  /// `finish_shutdown` will not block.
  ///
  /// This exists for a host that cannot yield inside a single-call
  /// `shutdown`: the threaded WASI artifact enters shutdown from the JS
  /// thread, so a blocking closure that still needs a JS turn could never get
  /// one while that thread sat in `wait_until_idle`.
  ///
  /// A `begin_shutdown` while one is outstanding opens no second phase and
  /// never waits: it answers with the current work-pending verdict, so the
  /// thread that owns the shutdown may re-enter it from a host turn. That
  /// holds for the whole of an outstanding stop, including the window in
  /// which another thread is already inside the join -- the handoff slot
  /// carries `ShutdownDrain::Joining` there rather than going empty, so this
  /// call answers from it instead of parking on the published `Stopping`.
  /// Phase 1s and phase 2s do not have to balance -- `finish_shutdown`
  /// completes the most recently announced stop and is idempotent.
  ///
  /// `start()` between the phases is NOT allowed -- it waits in `Stopping`
  /// until phase 2 publishes `Stopped`, and is rejected outright when it comes
  /// from work in the generation being stopped. Admission needs no guard of
  /// its own: `backend_locked` already rejects every submission under
  /// `Stopping`. The same holds for a zero-backend stop that still owes a
  /// rejected destruction: it publishes `StoppingWithoutBackend` for the whole
  /// window, and `start` waits there until phase 2 publishes the target. Only
  /// a zero-backend phase 1 that settled outright (`ShutdownDrain::Settled`,
  /// nothing published to wait in) lets a `start` through -- it drops the
  /// handoff, and the `finish_shutdown` that follows finds the fresh
  /// generation running and is a no-op `Ok(())`.
  fn begin_shutdown(&self) -> Result<bool, RuntimeConfigError> {
    // See `finish_shutdown`: the same waits, the same reason.
    let _bounded_waits = BoundedWaits::enter();
    let backend = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      // Before the outstanding-handoff arm, not only inside the loop below:
      // that arm returns early, and work of a RETIRED generation must be told
      // so rather than be handed the current stop's verdict. The window it
      // covers is the whole of an outstanding stop, join included, so the
      // guard cannot sit behind it.
      Self::ensure_active_generation_current(&state)?;
      if let Some(drain) = &state.draining {
        let outstanding = match drain {
          // `Joining` answers exactly like `Backend`: the stop it carries has
          // been announced and is being completed right now, so this call has
          // nothing to open and nothing to wait for -- only a verdict to give.
          ShutdownDrain::Backend(backend) => Some(backend.clone()),
          ShutdownDrain::Joining(backend) => backend.clone(),
          // A zero-backend stop that still owes a rejected destruction. The
          // verdict lives in `state`, not in a backend, so it is answered
          // here -- under this lock, before the `drop(state)` below -- and,
          // like every other arm of this re-entry, it never waits. The
          // drop-context error keeps the surface identical to the
          // `StoppingWithoutBackend` and `Stopped` arms below: a destructor
          // can never drive the shutdown of the state it is blocking.
          ShutdownDrain::ZeroBackend(_) => {
            if RejectedSubmissionDropContext::is_current() {
              return Err(RuntimeConfigError(
                "cannot shut down the async runtime while a rejected submission is being destroyed"
                  .to_string(),
              ));
            }
            return Ok(state.rejected_drops != 0);
          }
          ShutdownDrain::Settled => None,
        };
        // A second phase 1 opens nothing: the stop this handoff carries has
        // already been announced, and one `finish_shutdown` completes it for
        // every caller. Answering from the handoff can never skip stopping a
        // live generation: the handoff belongs to the generation it was opened
        // against, and `forget_shutdown_handoff` drops it at every `start`.
        //
        // Answer off the lifecycle lock: probing a backend takes the
        // generation and executor locks, and the same re-entry must not
        // nest them under this one.
        drop(state);
        return Ok(outstanding.is_some_and(|backend| backend.work_pending(PendingRead::Locked)));
      }
      loop {
        Self::ensure_active_generation_current(&state)?;
        match &state.lifecycle {
          RuntimeLifecycle::Initial => {
            if state.rejected_drops != 0 && RejectedSubmissionDropContext::is_current() {
              return Err(RuntimeConfigError(
                "cannot shut down the async runtime while a rejected submission is being destroyed"
                  .to_string(),
              ));
            }
            let target = ZeroBackendShutdownTarget::StoppedBeforeFirstUse;
            state.lifecycle = RuntimeLifecycle::StoppingWithoutBackend(target);
            if state.rejected_drops != 0 {
              // Phase 1 NEVER waits. The outstanding retirement is another
              // thread's user `Drop`, and that thread may be waiting for a
              // host turn this one can only give by returning. Park the
              // announced stop for phase 2 and report it as pending work, so
              // the host keeps turning its loop -- the turn that destructor
              // may be waiting for.
              state.open_phase_one(ShutdownDrain::ZeroBackend(target));
              self.lifecycle_changed.notify_all();
              return Ok(true);
            }
            state.lifecycle = target.into_lifecycle();
            state.open_phase_one(ShutdownDrain::Settled);
            self.lifecycle_changed.notify_all();
            return Ok(false);
          }
          RuntimeLifecycle::Running(backend) => {
            if backend.is_current() {
              return Err(RuntimeConfigError(
                "cannot shut down the async runtime from work running on that runtime".to_string(),
              ));
            }
            let identity = backend.stop_identity();
            let stop = backend.generation_stop();
            // Lock order is lifecycle -> stop publication. Publish before
            // mutating the lifecycle so a gated verdict that acquired the
            // publication mutex first wins while this state remains Running;
            // otherwise the verdict must observe the published stop.
            let stop_publication = stop.publication_guard();
            stop_publication.publish_stopping();
            let RuntimeLifecycle::Running(backend) =
              std::mem::replace(&mut state.lifecycle, RuntimeLifecycle::Stopping(identity))
            else {
              unreachable!();
            };
            self.current_backend.store(None);
            // Park the backend for phase 2. `Stopping` carries only an
            // identity, so without this slot the backend would live on this
            // stack and phase 1 could not return.
            state.open_phase_one(ShutdownDrain::Backend(backend.clone()));
            // Release before aborting tasks or running any user destruction.
            // Neither path may retain the publication mutex across scheduler
            // admission, lifecycle reentry, or a panic boundary.
            drop(stop_publication);
            break backend;
          }
          RuntimeLifecycle::Stopping(identity) => {
            if identity.is_current() {
              return Err(RuntimeConfigError(
                "cannot wait for async runtime shutdown from work in the generation being stopped"
                  .to_string(),
              ));
            }
            state = self
              .lifecycle_changed
              .wait(state)
              .unwrap_or_else(std::sync::PoisonError::into_inner);
          }
          RuntimeLifecycle::StoppingWithoutBackend(_) => {
            if RejectedSubmissionDropContext::is_current() {
              return Err(RuntimeConfigError(
                "cannot shut down the async runtime while a rejected submission is being destroyed"
                  .to_string(),
              ));
            }
            state = self
              .lifecycle_changed
              .wait(state)
              .unwrap_or_else(std::sync::PoisonError::into_inner);
          }
          RuntimeLifecycle::StoppedBeforeFirstUse | RuntimeLifecycle::Stopped => {
            if state.rejected_drops == 0 {
              state.open_phase_one(ShutdownDrain::Settled);
              return Ok(false);
            }
            if RejectedSubmissionDropContext::is_current() {
              return Err(RuntimeConfigError(
                "cannot shut down the async runtime while a rejected submission is being destroyed"
                  .to_string(),
              ));
            }
            let target = if matches!(&state.lifecycle, RuntimeLifecycle::StoppedBeforeFirstUse) {
              ZeroBackendShutdownTarget::StoppedBeforeFirstUse
            } else {
              ZeroBackendShutdownTarget::Stopped
            };
            // Same rule as the `Initial` arm: announce the stop, hand the
            // wait to phase 2, and return without waiting on another thread's
            // destructor.
            state.lifecycle = RuntimeLifecycle::StoppingWithoutBackend(target);
            state.open_phase_one(ShutdownDrain::ZeroBackend(target));
            self.lifecycle_changed.notify_all();
            return Ok(true);
          }
        }
      }
    };

    #[cfg(test)]
    run_after_generation_stop_publication_test_hook();
    backend.begin_shutdown();
    Ok(backend.work_pending(PendingRead::Locked))
  }

  /// Non-blocking poll for the window between the phases: `false` means
  /// `finish_shutdown` will not have to wait for user work. Reads the running
  /// generation when no phase 1 is outstanding, so a host may also use it to
  /// decide whether a shutdown would block at all.
  ///
  /// It stays truthful while a `finish_shutdown` is inside the join: that
  /// thread leaves `ShutdownDrain::Joining` in the slot, so this poll reports
  /// the very work the join is waiting for instead of `false`.
  ///
  /// Never blocks, not even on a lock: every lock it reads under is only
  /// tried ([`PendingRead::NonBlocking`]), and one held by another thread
  /// answers `true`, so the host takes one more turn and asks again. A held
  /// lock is not always about to come back: on `wasm32-wasip1-threads` a pool
  /// thread that traps while holding one unwinds nothing, and waiting for it
  /// here would park the JavaScript thread in `memory.atomic.wait32` for good
  /// -- before the loader can see that thread's crash.
  fn runtime_work_pending(&self) -> bool {
    let backend = {
      let state = match self.state.try_lock() {
        Ok(state) => state,
        Err(std::sync::TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
        Err(std::sync::TryLockError::WouldBlock) => return true,
      };
      match (&state.draining, &state.lifecycle) {
        // `Joining` is the in-flight drain: while it still carries the
        // backend, report the work the finisher is waiting for, not `false`.
        (Some(ShutdownDrain::Backend(backend) | ShutdownDrain::Joining(Some(backend))), _) => {
          backend.clone()
        }
        // A zero-backend stop that still owes a rejected destruction: that
        // destruction IS the pending work, and reporting it is what makes the
        // host keep turning its event loop -- the turn the destructor may be
        // waiting for. `false` here would send the loader straight into the
        // phase-2 join in the same synchronous turn.
        (Some(ShutdownDrain::ZeroBackend(_)), _) => return state.rejected_drops != 0,
        (None, RuntimeLifecycle::Running(backend)) => backend.clone(),
        // `Settled` is a handoff for a generation that had no backend, and
        // `forget_shutdown_handoff` drops it at every `start`, so it never
        // shadows a running generation. A backend-less `Joining` is a drain
        // past `wait_until_idle`: no user work can be left to report.
        (Some(ShutdownDrain::Joining(None) | ShutdownDrain::Settled), _) | (None, _) => {
          return false;
        }
      }
    };
    backend.work_pending(PendingRead::NonBlocking)
  }

  /// Phase 2 of the two-phase shutdown: wait for the generation to go idle,
  /// join the workers and publish `Stopped`. Everything after
  /// `begin_shutdown`, in the same order the single call runs it.
  ///
  /// It completes the most recently announced stop, and it is IDEMPOTENT. It
  /// owns no phase and counts none: whoever finds a `ShutdownDrain::Backend`
  /// handoff takes it, swaps it for `ShutdownDrain::Joining`, drains it and
  /// publishes the stop while retiring that marker, and every other caller
  /// answers off the lifecycle -- waiting out a join that is still in flight,
  /// then reporting `Ok(())` for the stop that was delivered. A
  /// `ShutdownDrain::ZeroBackend` handoff is never taken and never swapped:
  /// every caller that finds it waits on the outstanding rejected
  /// destruction, the one that observes it retired publishes the target and
  /// clears the slot, and the rest wake to that published stop and report it
  /// the same way. Phase 1s and phase 2s therefore do not have to balance,
  /// and two threads completing the same shutdown both get `Ok(())` instead
  /// of one of them being told its own stop never happened.
  ///
  /// It never stops a generation it did not begin. A `start` between the
  /// phases -- or any later restart -- drops a handoff that published nothing
  /// to wait in (`ShutdownDrain::Settled`) and publishes a fresh generation; a
  /// `finish_shutdown` that arrives afterwards with nothing outstanding is a
  /// no-op `Ok(())` and does NOT adopt that generation. A `ZeroBackend`
  /// handoff is never dropped that way: it publishes `StoppingWithoutBackend`
  /// for its whole window, so a `start` waits there until phase 2 publishes
  /// the target.
  ///
  /// The only missing-phase error left is phase 2 on a runtime that has never
  /// begun a shutdown at all (`phase_ever_opened == false`): the host called
  /// the second half without ever calling the first. Like `shutdown`, it also
  /// rejects a caller that is work of the generation being stopped, which could
  /// only wait for itself.
  ///
  /// On `wasm32-wasip1-threads` every lock, condvar wait and join this thread
  /// makes in here (and in `begin_shutdown`) stops once the host reports a
  /// crashed thread, with a trap: a pool thread that trapped holds its locks
  /// and its work for good, and waiting for either would park the host's
  /// JavaScript thread before the loader could see the crash. See
  /// `crate::sync`.
  fn finish_shutdown(&self) -> Result<(), RuntimeConfigError> {
    let _bounded_waits = BoundedWaits::enter();
    const STOPPING_WAIT_ERROR: &str =
      "cannot wait for async runtime shutdown from work in the generation being stopped";
    const REJECTED_DROP_ERROR: &str =
      "cannot shut down the async runtime while a rejected submission is being destroyed";
    const NO_PHASE_ERROR: &str =
      "the async runtime shutdown was not started; call begin_shutdown before finish_shutdown";

    let backend = {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      // Every arm but `Backend` leaves this function; only that one falls
      // through to the take below.
      match &state.draining {
        Some(ShutdownDrain::Settled) => {
          // Phase 1 completed a zero-backend transition; nothing to drain.
          state.draining = None;
          return Ok(());
        }
        Some(ShutdownDrain::Backend(backend)) => {
          if backend.is_current() {
            return Err(RuntimeConfigError(STOPPING_WAIT_ERROR.to_string()));
          }
        }
        // Phase 1 announced a zero-backend stop that still owed the
        // retirement of a rejected submission's destructor. This is the wait
        // phase 1 refused to do. The marker is NOT taken -- there is nothing
        // to own -- so the slot is re-read after every wake: only the caller
        // that observes `rejected_drops == 0` while the slot still carries
        // this target publishes it, and a second finisher that wakes to an
        // already-published stop reports it like any other completed phase 2.
        Some(ShutdownDrain::ZeroBackend(_)) => loop {
          let target = match (&state.draining, &state.lifecycle) {
            (
              Some(ShutdownDrain::ZeroBackend(parked)),
              RuntimeLifecycle::StoppingWithoutBackend(published),
            ) if published == parked => *parked,
            // Another finisher published it, or a `start` superseded it.
            // Either way the stop this call was asked to complete has been
            // delivered.
            _ => return Ok(()),
          };
          if state.rejected_drops == 0 {
            // Retire the marker and publish the stop under the ONE lock
            // acquisition, exactly as the backend path does below: no
            // observer may ever see `StoppingWithoutBackend` without a drain,
            // or the terminal lifecycle with one.
            state.draining = None;
            state.lifecycle = target.into_lifecycle();
            self.lifecycle_changed.notify_all();
            return Ok(());
          }
          if RejectedSubmissionDropContext::is_current() {
            return Err(RuntimeConfigError(REJECTED_DROP_ERROR.to_string()));
          }
          // `rejected_drops` can flicker 1 -> 0 -> 1 across the host's turns:
          // a fresh submission under `StoppingWithoutBackend` is rejected and
          // increments it again. Re-observe, exactly as the backend path's
          // tail wait does.
          state = self
            .lifecycle_changed
            .wait(state)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        },
        // `Joining`: another caller took the handoff and is inside the join.
        // Same answer as an empty slot on a runtime that announced a stop --
        // wait out the publication and report it. `phase_ever_opened` is
        // necessarily set here, so the orphan check below never fires.
        Some(ShutdownDrain::Joining(_)) | None => {
          if !state.phase_ever_opened {
            // No shutdown has ever been announced on this runtime, so there is
            // nothing for this call to complete: the host called the second
            // half without the first.
            return Err(RuntimeConfigError(NO_PHASE_ERROR.to_string()));
          }
          // A stop WAS announced. The slot holds an in-flight drain, or is
          // empty because a `start` dropped the handoff or the joining thread
          // has already published and retired its marker. Wait out a
          // join still in flight and report its publication -- a concurrent
          // `shutdown` waits in exactly this place today. Waiting inside this
          // arm, instead of re-entering the match, also keeps this caller from
          // adopting a phase 1 that was opened after it woke.
          loop {
            match &state.lifecycle {
              RuntimeLifecycle::Stopping(identity) => {
                if identity.is_current() {
                  return Err(RuntimeConfigError(STOPPING_WAIT_ERROR.to_string()));
                }
              }
              RuntimeLifecycle::StoppingWithoutBackend(_) => {
                if RejectedSubmissionDropContext::is_current() {
                  return Err(RuntimeConfigError(REJECTED_DROP_ERROR.to_string()));
                }
              }
              // Stopped/StoppedBeforeFirstUse: the publication an announced
              // stop was owed has happened, whichever thread performed the
              // join. Initial/Running: a `start` superseded that generation --
              // this call must report the stop, not stop the new generation.
              RuntimeLifecycle::StoppedBeforeFirstUse
              | RuntimeLifecycle::Stopped
              | RuntimeLifecycle::Initial
              | RuntimeLifecycle::Running(_) => return Ok(()),
            }
            state = self
              .lifecycle_changed
              .wait(state)
              .unwrap_or_else(std::sync::PoisonError::into_inner);
          }
        }
      }
      // Take the backend so this thread owns the drain and the slot can
      // never be taken twice -- but leave an explicit in-flight marker behind
      // instead of emptying the slot, so the non-blocking surfaces keep
      // telling the truth until `Stopped` is published below. Nothing can
      // overwrite it in between: `open_phase_one` is only reached with an
      // empty slot, and every `start` arm waits out the `Stopping` this
      // marker is published alongside.
      let Some(ShutdownDrain::Backend(backend)) = state.draining.take() else {
        unreachable!();
      };
      state.draining = Some(ShutdownDrain::Joining(Some(backend.clone())));
      backend
    };

    #[cfg(test)]
    run_after_shutdown_drain_taken_test_hook();
    backend.wait_until_idle();

    #[cfg(napi_runtime_os_threads)]
    let worker_lifecycle = backend.worker_lifecycle();
    // Hand the backend back out of the marker BEFORE dropping this thread's
    // own reference: `drop(backend)` below has to be the LAST one, because
    // releasing the executor is what lets the workers exit and what
    // `wait_for_all_workers` then joins. The marker itself stays -- phase 1
    // and the poll must keep answering without waiting for the rest of the
    // join -- it just stops carrying a backend, which `wait_until_idle`
    // having returned already makes the truthful answer.
    {
      let mut state = self
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      debug_assert!(
        matches!(state.draining, Some(ShutdownDrain::Joining(Some(_)))),
        "nothing may disturb an in-flight drain marker before its publication"
      );
      state.draining = Some(ShutdownDrain::Joining(None));
    }
    drop(backend);

    #[cfg(napi_runtime_os_threads)]
    if let Some(worker_lifecycle) = worker_lifecycle {
      worker_lifecycle.wait_for_all_workers();
    }

    let mut state = self
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    while state.rejected_drops != 0 {
      state = self
        .lifecycle_changed
        .wait(state)
        .unwrap_or_else(std::sync::PoisonError::into_inner);
    }
    debug_assert!(matches!(state.lifecycle, RuntimeLifecycle::Stopping(_)));
    debug_assert!(
      matches!(state.draining, Some(ShutdownDrain::Joining(None))),
      "nothing may retire an in-flight drain marker but its own publication"
    );
    // Retire the marker and publish the stop under the ONE lock acquisition:
    // no observer may ever see `Stopping` without a drain, or `Stopped` with
    // one.
    state.draining = None;
    state.lifecycle = RuntimeLifecycle::Stopped;
    self.lifecycle_changed.notify_all();
    Ok(())
  }

  /// Single-call shutdown: the two phases back to back. Ordering and
  /// semantics are exactly what this function has always done -- phase 1 ends
  /// at `RuntimeBackend::begin_shutdown` and phase 2 resumes at
  /// `wait_until_idle`, with nothing in between.
  ///
  /// It takes the lifecycle lock twice, so a `start` (or another shutdown) can
  /// land between the halves. Phase 2 being idempotent is what makes that
  /// window free: whether the stop this call announced is published by this
  /// thread, by a concurrent `finish_shutdown` that took the handoff first, or
  /// superseded by a racing `start`, this call reports `Ok(())` for the stop it
  /// performed -- it never has to be told that its own shutdown was never
  /// started.
  fn shutdown(&self) -> Result<(), RuntimeConfigError> {
    self.begin_shutdown()?;
    #[cfg(test)]
    run_between_shutdown_phases_test_hook();
    self.finish_shutdown()
  }
}

static RUNTIME: LazyLock<RuntimeController> = LazyLock::new(RuntimeController::new);

pub fn configure(options: RuntimeOptions) -> Result<(), RuntimeConfigError> {
  RUNTIME.configure(options)
}

pub fn configure_partial(patch: RuntimeOptionsPatch) -> Result<(), RuntimeConfigError> {
  RUNTIME.configure_partial(patch)
}

pub fn configured_options() -> RuntimeOptions {
  RUNTIME.options()
}

pub fn is_multi_threaded() -> bool {
  RUNTIME.options().flavor == RuntimeFlavor::MultiThread
}

fn spawn_registered<F, T>(
  backend: &RuntimeBackend,
  metrics: Arc<RuntimeMetrics>,
  future: F,
  registration: (AbortRegistration, GenerationWorkGuard),
) -> JoinHandle<T>
where
  F: Future<Output = T> + Send + 'static,
  T: Send + 'static,
{
  metrics.tasks_spawned.fetch_add(1, Ordering::Relaxed);
  let generation = backend.generation();
  let (abort_registration, work_registration) = registration;
  #[cfg(napi_runtime_os_threads)]
  let dependency = Arc::new(TaskDependency::new_task(generation));
  #[cfg(napi_runtime_os_threads)]
  let task_dependency = Arc::clone(&dependency);
  let wrapped = async move {
    let abortable = Abortable::new(ContainedFuture::new(future, generation), abort_registration);
    let mut abortable = std::pin::pin!(abortable);
    let polled = futures::future::poll_fn(|cx| {
      #[cfg(napi_runtime_os_threads)]
      task_dependency.begin_poll();
      #[cfg(napi_runtime_os_threads)]
      let _dependency = TaskDependencyGuard::enter(&task_dependency);
      abortable.as_mut().poll(cx)
    });
    match AssertUnwindSafe(polled).catch_unwind().await {
      Ok(Ok(output)) => {
        metrics.tasks_completed.fetch_add(1, Ordering::Relaxed);
        Ok(ContainedTaskOutput::new(output, generation))
      }
      Ok(Err(_)) => Err(JoinError {
        message: "async runtime stopped before the task completed".to_string(),
      }),
      Err(panic) => {
        metrics.tasks_panicked.fetch_add(1, Ordering::Relaxed);
        Err(panic_payload_to_join_error(panic))
      }
    }
  };
  let scheduler = backend.downgrade_executor();
  // `async-task` aborts the process if its future's destructor unwinds. Keep
  // the entire task generator behind our manually-dropped containment wrapper,
  // including the never-polled case where `future` is still a generator field.
  let (runnable, task) = async_task::spawn(
    RegisteredTaskFuture::new(wrapped, work_registration, generation),
    move |runnable| {
      scheduler.schedule(runnable);
    },
  );
  backend.schedule_submission(runnable);
  JoinHandle(JoinHandleInner::Task {
    task: task.fallible(),
    awaiter: None,
    #[cfg(napi_runtime_os_threads)]
    dependency,
  })
}

pub fn spawn<F, T>(future: F) -> JoinHandle<T>
where
  F: Future<Output = T> + Send + 'static,
  T: Send + 'static,
{
  RUNTIME.spawn(future)
}

/// Submit a future without consuming it when the runtime is not accepting work.
///
/// Lifecycle owners can retain the returned future and retry it after
/// [`start`] completes a runtime restart.
///
/// **On a wasm target, prefer this over [`spawn`].** Building the MultiThread
/// pool is lazy and fail-loud: the first async call is what calls
/// `wasi.thread-spawn`, and whether that works is a JavaScript fact the crate
/// cannot observe up front. Here the failure is an `Err` you can act on; the
/// infallible helpers turn it into a panic, which `panic = "abort"` then turns
/// into a dead instance.
pub fn try_spawn<F, T>(future: F) -> Result<JoinHandle<T>, (RuntimeConfigError, F)>
where
  F: Future<Output = T> + Send + 'static,
  T: Send + 'static,
{
  RUNTIME.try_spawn(future)
}

pub fn try_spawn_detached<F>(future: F) -> Result<(), F>
where
  F: Future<Output = ()> + Send + 'static,
{
  RUNTIME.try_spawn_detached(future)
}

pub fn spawn_detached<F>(future: F)
where
  F: Future<Output = ()> + Send + 'static,
{
  spawn(future).detach();
}

pub fn spawn_blocking<F, T>(function: F) -> JoinHandle<T>
where
  F: FnOnce() -> T + Send + 'static,
  T: Send + 'static,
{
  RUNTIME.spawn_blocking(function)
}

/// Submit blocking work without consuming it when the runtime is not accepting work.
///
/// Lifecycle owners can retain the returned closure and retry it after [`start`]
/// completes a runtime restart.
///
/// **On a wasm target, prefer this over [`spawn_blocking`]** -- see
/// [`try_spawn`] for why.
pub fn try_spawn_blocking<F, T>(function: F) -> Result<JoinHandle<T>, (RuntimeConfigError, F)>
where
  F: FnOnce() -> T + Send + 'static,
  T: Send + 'static,
{
  RUNTIME.try_spawn_blocking(function)
}

fn block_on_with_controller<F: Future>(controller: &RuntimeController, future: F) -> F::Output {
  let (backend, registration) = match controller.try_block_on_scope() {
    Ok(scope) => scope,
    Err((error, generation)) => {
      let _rejection = RejectedSubmissionGuard { controller };
      let _drop_context = RejectedSubmissionDropContext::enter();
      let _generation = generation.map(RuntimeGenerationGuard::enter);
      let _ = catch_unwind_contained(|| drop(future));
      panic!("{error}");
    }
  };
  let generation = backend.generation();
  let _registration = registration;
  let _generation = RuntimeGenerationGuard::enter(generation);
  let mut output = None;
  {
    let future = ContainedFuture::new(future, generation);
    let mut erased = std::pin::pin!(async {
      output = Some(future.await);
    });
    let _ = backend.block_on(erased.as_mut());
    // `erased` is destroyed before this scope exits, while the controller's
    // generation work and identity guards are live. `ContainedFuture` keeps a
    // poll panic from becoming a process-aborting double panic if the owned
    // future's destructor also unwinds.
  }
  output.expect("async runtime returned before the future completed")
}

pub fn block_on<F: Future>(future: F) -> F::Output {
  block_on_with_controller(&RUNTIME, future)
}

pub fn block_on_dyn(future: Pin<&mut dyn Future<Output = ()>>) {
  try_block_on_dyn(future).unwrap_or_else(|error| panic!("{error}"));
}

/// Drive a borrowed future without consuming it when admission or shutdown fails.
///
/// **On a wasm target, prefer this over [`block_on`] / [`block_on_dyn`]** --
/// see [`try_spawn`] for why.
///
/// Under [`RuntimeFlavor::MultiThread`] this parks the CALLING thread on
/// `memory.atomic.wait32`, which a browser main thread is forbidden to do
/// (emnapi answers `napi_would_deadlock` there). The threaded wasm artifact is
/// a Node / WebContainer target today; inside a Worker it is fine.
pub fn try_block_on_dyn(
  future: Pin<&mut dyn Future<Output = ()>>,
) -> Result<(), RuntimeConfigError> {
  match RUNTIME.try_block_on(future)? {
    BlockOnOutcome::Completed => Ok(()),
    BlockOnOutcome::Stopped => Err(RuntimeConfigError(
      "the async runtime stopped before block_on completed its future".to_string(),
    )),
  }
}

pub fn start() -> Result<(), RuntimeConfigError> {
  RUNTIME.start()
}

/// Shut the async runtime down: stop accepting work, cancel what is queued,
/// wait for what is running, join the workers.
///
/// Equivalent to [`begin_shutdown`] followed by [`finish_shutdown`], and
/// unchanged in ordering and semantics. It reports the shutdown it performed
/// even when another thread completes that shutdown, or restarts the runtime,
/// between the two halves.
pub fn shutdown() -> Result<(), RuntimeConfigError> {
  RUNTIME.shutdown()
}

/// Phase 1 of a two-phase shutdown. Publishes the stop, closes admission,
/// aborts registered tasks, drops queued work, drain-fires timers and wakes
/// parkers -- and never waits. Never, including for a rejected submission
/// whose destructor is still running on another thread: that wait belongs to
/// [`finish_shutdown`] too.
///
/// `Ok(true)` means the announced stop still owes a wait -- registered work
/// that is still live, or a rejected submission still being destroyed: let
/// the host loop turn, poll [`runtime_work_pending`] until it answers `false`
/// (or a bound expires), then call [`finish_shutdown`]. `Ok(false)` means
/// [`finish_shutdown`] has nothing to wait for.
///
/// For a host that cannot yield inside [`shutdown`] -- on the threaded WASI
/// artifact the call comes from the JS thread, which is also the only thread
/// that can give a running blocking closure the turn it is waiting for.
///
/// Submissions are rejected between the phases, and [`start`] must not be
/// called there: it waits for phase 2 to publish the stop. A second
/// `begin_shutdown` before [`finish_shutdown`] neither waits nor starts a
/// second shutdown; it just re-reports [`runtime_work_pending`]. Calls of the
/// two phases do not have to balance: [`finish_shutdown`] completes the most
/// recently announced stop and is idempotent.
pub fn begin_shutdown() -> Result<bool, RuntimeConfigError> {
  RUNTIME.begin_shutdown()
}

/// Non-blocking poll for the window between [`begin_shutdown`] and
/// [`finish_shutdown`]: `false` means phase 2 will not wait for user work.
///
/// Answers for the running generation when no shutdown is outstanding.
///
/// It never waits for a lock either: when another thread holds one it reads
/// under, it answers `true` and the host polls again on its next turn. That
/// keeps a pool thread that died holding such a lock (a trap on
/// `wasm32-wasip1-threads` unwinds nothing) from parking the polling thread
/// for good.
pub fn runtime_work_pending() -> bool {
  RUNTIME.runtime_work_pending()
}

/// Phase 2 of a two-phase shutdown: wait for the generation to go idle, join
/// the workers and publish the stop.
///
/// Completes the most recently announced stop, whichever thread performs the
/// join, and is idempotent: extra calls, and calls that race another thread
/// completing the same shutdown, answer `Ok(())`. A call that arrives after a
/// [`start`] finds nothing outstanding and is a no-op -- it never stops the
/// generation that restart published. It errors only when no [`begin_shutdown`]
/// has EVER been called on this runtime, and when called from work of the
/// generation being stopped. Calling it while [`runtime_work_pending`] still
/// answers `true` is allowed -- it then blocks, which is what [`shutdown`]
/// does.
pub fn finish_shutdown() -> Result<(), RuntimeConfigError> {
  RUNTIME.finish_shutdown()
}

fn complete_current_thread_task_delivery(completion: CurrentThreadTaskDeliveryCompletion) {
  for failure in completion.failed_dispatches {
    RUNTIME.cancel_current_thread_dispatch(failure);
  }
  if completion.redispatch {
    RUNTIME.request_current_thread_drain();
  }
  // Every host entry point lands here (delivery acknowledgement or failure,
  // driver unregistration, explicit dispatch cancellation). Work a
  // waker-stack failure transition moved aside is cancelled on this clean
  // stack even when the completion itself carried nothing, e.g. an env
  // cleanup hook unregistering a driver whose deliveries all failed already.
  RUNTIME.retire_rejected_current_thread_work();
}

/// Acknowledge that one exact host delivery callback returned the successful
/// claim result from [`drive_current_thread_tasks`].
///
/// This releases the host's single-flight slot and submits at most its latest
/// still-needed pending delivery. The registry verifies that this exact
/// delivery was claimed; a forged success for an unclaimed delivery is treated
/// as failure. A stale acknowledgement from an unregistered host or retired
/// attempt is a no-op.
pub fn acknowledge_current_thread_task_delivery(delivery: CurrentThreadTaskDelivery) {
  complete_current_thread_task_delivery(
    CURRENT_THREAD_TASK_DRIVERS.finish_delivery(delivery, false),
  );
}

/// Report that one exact host delivery callback failed.
///
/// Recovery begins only after no other live host attempt can still service the
/// same executor dispatch. The registration and delivery identities prevent a
/// stale failure from affecting another host or a re-registered generation.
pub fn fail_current_thread_task_delivery(delivery: CurrentThreadTaskDelivery) {
  complete_current_thread_task_delivery(
    CURRENT_THREAD_TASK_DRIVERS.finish_delivery(delivery, true),
  );
}

/// Cancel an accepted CurrentThread host delivery that failed before it could
/// schedule a fresh turn.
///
/// `delivery` is the opaque registration-scoped driver capability,
/// not the executor's shared dispatch capability. Repeated or stale failures
/// are no-ops.
pub fn cancel_current_thread_task_dispatch(delivery: u64) {
  complete_current_thread_task_delivery(CURRENT_THREAD_TASK_DRIVERS.fail_delivery(delivery));
}

/// Poll the shared runtime's CurrentThread queue from a host-dispatched turn.
///
/// Embedders normally call this from their [`CurrentThreadTaskDriver`]
/// implementation with the opaque [`CurrentThreadTaskDelivery::capability`].
/// Returns a callback lease only when this exact delivery was claimed, admitted,
/// and driven. It returns `None` for stale/unregistered deliveries, before
/// backend creation, and on MultiThread. The host must retain the lease through
/// delivery acknowledgement/failure and callback payload destruction.
pub fn drive_current_thread_tasks(delivery: u64) -> Option<CurrentThreadTaskCallbackLease> {
  RUNTIME.drive_current_thread_tasks(delivery)
}

pub fn reset_metrics() {
  RUNTIME.metrics.reset();
}

pub fn metrics() -> RuntimeMetricsSnapshot {
  let options = RUNTIME.options();
  RUNTIME.metrics.snapshot(&options)
}

#[cfg(test)]
// The wasm lanes gate out whole classes of tests (see the three rules below),
// which strands their helper fns, statics and driver registries. That is the
// point of the gates, not a defect, and 100+ dead-code warnings would bury a
// real one in the `cargo check --tests` guard CI runs on both WASI triples.
#[cfg_attr(target_family = "wasm", allow(dead_code))]
mod tests {
  use super::*;

  // Three gates in here do NOT mean "can this build create OS threads?", so
  // the `napi_runtime_os_threads` rewrite deliberately does not reach them.
  // Each was verified by running the suite on `wasm32-wasip1-threads`:
  //
  // * `#[cfg(not(target_family = "wasm"))]` on a test that re-execs itself
  //   through `std::process::Command`: `std::env::current_exe()` is
  //   `Unsupported` on WASI (22 tests).
  // * `#[cfg(not(target_family = "wasm"))]` on a test that asserts the
  //   DEFAULT flavor is MultiThread: every wasm target keeps CurrentThread by
  //   default, which `RuntimeOptions::default` still decides with
  //   `cfg!(target_family = "wasm")` (2 tests).
  // * `panic = "unwind"` on a test that drives a panic through
  //   `catch_unwind`: both WASI targets are `panic = "abort"`, so every
  //   containment path this crate has is inert there and the panic takes the
  //   process down instead of becoming a `JoinError` (43 tests). The
  //   containment code itself still compiles and runs; only the tests that
  //   PROVE containment need an unwinding target.
  //
  // `napi_runtime_os_threads` itself is also the right gate for a test whose
  // HARNESS spawns a `std::thread` even though the code under test does not:
  // threadless WASI answers `thread_spawn` with `Os { code: 58, Unsupported }`
  // (13 tests).

  static CURRENT_THREAD_ADMISSION_HOST_DISPATCHES: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_ARMED_PANIC_PUBLICATION_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_ARMED_PANIC_PUBLICATION_ONCE: AtomicBool = AtomicBool::new(false);
  static CURRENT_THREAD_BLOCKING_BUDGET_HOST_DISPATCHES: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_BUDGET_HOST_DISPATCHES: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_INITIAL_PUBLICATION_RACE_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_INTERLEAVED_RECOVERY_HOST_DISPATCHES: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCH_CALLS: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS: LazyLock<
    CurrentThreadTaskDriverRegistry,
  > = LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_FIRST_HOSTILE_PANIC_DROPS: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_LATER_HOSTILE_PANIC_DROPS: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_NESTED_UNWIND_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_PANICKING_PUBLICATION_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_PANICKING_PUBLICATION_ONCE: AtomicBool = AtomicBool::new(false);
  static CURRENT_THREAD_REPUBLISH_REARM_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS: LazyLock<
    CurrentThreadTaskDriverRegistry,
  > = LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_REPLACEMENT_PUBLICATION_RACE_DISPATCHES: LazyLock<Mutex<Vec<u64>>> =
    LazyLock::new(Mutex::default);
  static CURRENT_THREAD_SHUTDOWN_REPUBLISH_HOST_DISPATCHES: AtomicUsize = AtomicUsize::new(0);
  static CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS: LazyLock<
    CurrentThreadTaskDriverRegistry,
  > = LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_HEALTHY_AFTER_WAKER_STACK_FAILURE_TASK_DRIVERS: LazyLock<
    CurrentThreadTaskDriverRegistry,
  > = LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_SUBMISSION_FAILURE_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_RETIREMENT_TURN_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_NESTED_RETIREMENT_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_SUSTAINED_PRODUCER_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_RETIREMENT_RETRY_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_FINAL_RETIREMENT_OFFER_TASK_DRIVERS: LazyLock<
    CurrentThreadTaskDriverRegistry,
  > = LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_INLINE_FINAL_OFFER_TASK_DRIVERS: LazyLock<CurrentThreadTaskDriverRegistry> =
    LazyLock::new(CurrentThreadTaskDriverRegistry::default);
  static CURRENT_THREAD_STOPPED_HOST_DISPATCHES: AtomicUsize = AtomicUsize::new(0);

  thread_local! {
    static CURRENT_THREAD_RECOVERY_HOST_DISPATCHES: std::cell::Cell<usize> =
      const { std::cell::Cell::new(0) };
    static CURRENT_THREAD_ONE_SHOT_HOST_DISPATCHES: std::cell::Cell<usize> =
      const { std::cell::Cell::new(0) };
  }

  #[cfg(napi_runtime_os_threads)]
  struct StopPollProbe {
    polls: Arc<AtomicUsize>,
    first_poll: Option<std::sync::mpsc::Sender<()>>,
  }

  #[cfg(napi_runtime_os_threads)]
  impl Future for StopPollProbe {
    type Output = ();

    fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
      self.polls.fetch_add(1, Ordering::SeqCst);
      if let Some(first_poll) = self.first_poll.take() {
        first_poll.send(()).unwrap();
      }
      Poll::Pending
    }
  }

  #[cfg(napi_runtime_os_threads)]
  struct PanickingJoinAwaiter {
    wakes: Arc<AtomicUsize>,
    drops: Arc<AtomicUsize>,
  }

  #[cfg(napi_runtime_os_threads)]
  impl std::task::Wake for PanickingJoinAwaiter {
    fn wake(self: Arc<Self>) {
      self.wakes.fetch_add(1, Ordering::SeqCst);
      panic!("intentional JoinHandle awaiter wake panic");
    }

    fn wake_by_ref(self: &Arc<Self>) {
      self.wakes.fetch_add(1, Ordering::SeqCst);
      panic!("intentional JoinHandle awaiter wake-by-ref panic");
    }
  }

  #[cfg(napi_runtime_os_threads)]
  impl Drop for PanickingJoinAwaiter {
    fn drop(&mut self) {
      self.drops.fetch_add(1, Ordering::SeqCst);
      panic!("intentional JoinHandle awaiter destructor panic");
    }
  }

  #[cfg(napi_runtime_os_threads)]
  fn panicking_join_awaiter_waker(wakes: Arc<AtomicUsize>, drops: Arc<AtomicUsize>) -> Waker {
    Waker::from(Arc::new(PanickingJoinAwaiter { wakes, drops }))
  }

  #[cfg(napi_runtime_os_threads)]
  #[derive(Clone, Copy, Debug, PartialEq, Eq)]
  enum JoinAwaiterWakerEventKind {
    Clone,
    Wake,
    WakeByRef,
    Drop,
  }

  #[cfg(napi_runtime_os_threads)]
  struct JoinAwaiterWakerState {
    events: Mutex<Vec<(JoinAwaiterWakerEventKind, Option<u64>)>>,
  }

  #[cfg(napi_runtime_os_threads)]
  impl JoinAwaiterWakerState {
    fn record(&self, kind: JoinAwaiterWakerEventKind) {
      self
        .events
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .push((kind, active_runtime_generation()));
    }

    fn clear(&self) {
      self
        .events
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .clear();
    }

    fn snapshot(&self) -> Vec<(JoinAwaiterWakerEventKind, Option<u64>)> {
      self
        .events
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .clone()
    }
  }

  #[cfg(napi_runtime_os_threads)]
  struct JoinAwaiterWakerToken {
    state: Arc<JoinAwaiterWakerState>,
  }

  #[cfg(napi_runtime_os_threads)]
  unsafe fn clone_join_awaiter_waker(data: *const ()) -> std::task::RawWaker {
    let token = unsafe { &*data.cast::<JoinAwaiterWakerToken>() };
    token.state.record(JoinAwaiterWakerEventKind::Clone);
    let clone = Box::new(JoinAwaiterWakerToken {
      state: Arc::clone(&token.state),
    });
    std::task::RawWaker::new(Box::into_raw(clone).cast(), &JOIN_AWAITER_WAKER_VTABLE)
  }

  #[cfg(napi_runtime_os_threads)]
  unsafe fn wake_join_awaiter_waker(data: *const ()) {
    let token = unsafe { Box::from_raw(data.cast_mut().cast::<JoinAwaiterWakerToken>()) };
    token.state.record(JoinAwaiterWakerEventKind::Wake);
  }

  #[cfg(napi_runtime_os_threads)]
  unsafe fn wake_join_awaiter_waker_by_ref(data: *const ()) {
    let token = unsafe { &*data.cast::<JoinAwaiterWakerToken>() };
    token.state.record(JoinAwaiterWakerEventKind::WakeByRef);
  }

  #[cfg(napi_runtime_os_threads)]
  unsafe fn drop_join_awaiter_waker(data: *const ()) {
    let token = unsafe { Box::from_raw(data.cast_mut().cast::<JoinAwaiterWakerToken>()) };
    token.state.record(JoinAwaiterWakerEventKind::Drop);
  }

  #[cfg(napi_runtime_os_threads)]
  static JOIN_AWAITER_WAKER_VTABLE: std::task::RawWakerVTable = std::task::RawWakerVTable::new(
    clone_join_awaiter_waker,
    wake_join_awaiter_waker,
    wake_join_awaiter_waker_by_ref,
    drop_join_awaiter_waker,
  );

  #[cfg(napi_runtime_os_threads)]
  fn join_awaiter_waker(state: Arc<JoinAwaiterWakerState>) -> Waker {
    let token = Box::new(JoinAwaiterWakerToken { state });
    let raw = std::task::RawWaker::new(Box::into_raw(token).cast(), &JOIN_AWAITER_WAKER_VTABLE);
    unsafe { Waker::from_raw(raw) }
  }

  #[cfg(napi_runtime_os_threads)]
  fn wait_for_generation_parker_to_sleep(stop: &GenerationStop) {
    wait_until("the block_on driver to sleep", || {
      stop
        .parkers
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .iter()
        .filter_map(Weak::upgrade)
        .any(|parker| parker.state.load(Ordering::SeqCst) == PARKER_SLEEPING)
    });
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn unique_ids_fail_before_wraparound() {
    let counter = AtomicU64::new(u64::MAX - 1);
    assert_eq!(
      next_unique_id(&counter, "test id space exhausted"),
      u64::MAX - 1
    );

    let exhausted = catch_unwind(AssertUnwindSafe(|| {
      next_unique_id(&counter, "test id space exhausted");
    }));
    assert!(exhausted.is_err());
    assert_eq!(counter.load(Ordering::Relaxed), u64::MAX);
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn generation_task_ids_fail_before_reusing_an_abort_handle_key() {
    let work = GenerationWork::new();
    {
      let mut state = work.state.lock().unwrap();
      state.next_task_id = u64::MAX;
    }

    let exhausted = catch_unwind(AssertUnwindSafe(|| work.try_register_async()));
    assert!(exhausted.is_err());

    let state = work.state.lock().unwrap();
    assert_eq!(state.next_task_id, u64::MAX);
    assert_eq!(state.active, 0);
    assert!(state.abort_handles.is_empty());
  }

  /// A waker that records, when its last reference drops, whether `work`'s
  /// state lock was free at that moment. `Abortable` parks the waker it is
  /// polled with in the abort state its handles share, so the waker drops
  /// exactly where the last `AbortHandle` of that task does.
  struct GenerationStateLockProbe {
    work: Weak<GenerationWork>,
    dropped_with_lock_free: Arc<Mutex<Option<bool>>>,
  }

  #[expect(
    clippy::manual_noop_waker,
    reason = "the test observes the waker payload's Drop"
  )]
  impl std::task::Wake for GenerationStateLockProbe {
    fn wake(self: Arc<Self>) {}
  }

  impl Drop for GenerationStateLockProbe {
    fn drop(&mut self) {
      let lock_free = self
        .work
        .upgrade()
        .is_some_and(|work| work.state.try_lock().is_ok());
      *self.dropped_with_lock_free.lock().unwrap() = Some(lock_free);
    }
  }

  /// Register one async task on `work` and leave the handle `work` keeps as
  /// the only owner of its abort state, with a [`GenerationStateLockProbe`]
  /// parked in it.
  fn register_task_with_state_lock_probe(
    work: &Arc<GenerationWork>,
  ) -> (GenerationWorkGuard, Arc<Mutex<Option<bool>>>) {
    let (registration, guard) = work
      .try_register_async()
      .expect("an open generation must accept the task");
    let dropped_with_lock_free = Arc::new(Mutex::new(None));
    let waker = Waker::from(Arc::new(GenerationStateLockProbe {
      work: Arc::downgrade(work),
      dropped_with_lock_free: Arc::clone(&dropped_with_lock_free),
    }));
    let mut task = std::pin::pin!(Abortable::new(std::future::pending::<()>(), registration));
    assert!(
      task
        .as_mut()
        .poll(&mut Context::from_waker(&waker))
        .is_pending()
    );
    (guard, dropped_with_lock_free)
  }

  #[test]
  fn generation_work_guard_drops_its_abort_handle_outside_the_state_lock() {
    // The last `AbortHandle` of a task frees its abort state and the waker
    // parked there, and a waker's drop is foreign code. Under the state lock,
    // anything that goes wrong in there -- on `wasm32-wasip1-threads`, a trap
    // in the allocator unwinds nothing -- leaves the lock held for good.
    let work = GenerationWork::new();
    let (guard, dropped_with_lock_free) = register_task_with_state_lock_probe(&work);
    assert_eq!(
      *dropped_with_lock_free.lock().unwrap(),
      None,
      "the handle the generation keeps must still own the abort state"
    );

    drop(guard);
    assert_eq!(
      *dropped_with_lock_free.lock().unwrap(),
      Some(true),
      "the guard must drop the handle it removed after releasing the state lock"
    );
  }

  #[test]
  fn close_and_abort_takes_the_abort_handles_out_of_the_state() {
    // `abort` consumes the parked waker, so what is left to free is the abort
    // state itself. Taking the handles out at close frees it after the lock
    // is released, and a guard retiring later finds nothing to free under it.
    let work = GenerationWork::new();
    let (registration, guard) = work
      .try_register_async()
      .expect("an open generation must accept the task");
    let task = Abortable::new(std::future::pending::<()>(), registration);

    work.close_and_abort();
    assert!(task.is_aborted(), "close must abort the registered task");
    assert!(
      work.state.lock().unwrap().abort_handles.is_empty(),
      "close must take the handles out of the state, not leave them for the guards"
    );
    drop(task);
    drop(guard);
    assert_eq!(work.state.lock().unwrap().active, 0);
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn caught_panic_payload_destructor_runs() {
    struct DropSignal(Arc<AtomicBool>);

    impl Drop for DropSignal {
      fn drop(&mut self) {
        self.0.store(true, Ordering::SeqCst);
      }
    }

    let dropped = Arc::new(AtomicBool::new(false));
    let payload = DropSignal(Arc::clone(&dropped));

    assert!(
      catch_unwind_contained(|| -> () { std::panic::panic_any(payload) }).is_none(),
      "the original panic must remain contained"
    );
    assert!(
      dropped.load(Ordering::SeqCst),
      "an ordinary caught panic payload must be destroyed"
    );
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn hostile_caught_panic_payload_destructor_remains_contained() {
    struct PanicOnDrop(Arc<AtomicBool>);

    impl Drop for PanicOnDrop {
      fn drop(&mut self) {
        self.0.store(true, Ordering::SeqCst);
        panic!("caught panic payload destructor escaped");
      }
    }

    let dropped = Arc::new(AtomicBool::new(false));
    let payload = PanicOnDrop(Arc::clone(&dropped));
    let result = catch_unwind(AssertUnwindSafe(|| {
      catch_unwind_contained(|| -> () { std::panic::panic_any(payload) })
    }));

    assert!(
      result.is_ok(),
      "the payload destructor's nested panic must remain contained"
    );
    assert!(
      result.unwrap().is_none(),
      "the original panic must remain contained"
    );
    assert!(
      dropped.load(Ordering::SeqCst),
      "the hostile payload destructor must be attempted"
    );
  }

  fn accept_current_thread_host_dispatch(_dispatch: u64) -> CurrentThreadHostDispatchResult {
    CurrentThreadHostDispatchResult::Accepted
  }

  fn reject_current_thread_host_dispatch(_dispatch: u64) -> CurrentThreadHostDispatchResult {
    CurrentThreadHostDispatchResult::Unavailable
  }

  fn count_current_thread_recovery_host_dispatch(
    _dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_RECOVERY_HOST_DISPATCHES.with(|dispatches| dispatches.set(dispatches.get() + 1));
    CurrentThreadHostDispatchResult::Accepted
  }

  fn reset_current_thread_recovery_host_dispatches() {
    CURRENT_THREAD_RECOVERY_HOST_DISPATCHES.with(|dispatches| dispatches.set(0));
  }

  fn current_thread_recovery_host_dispatches() -> usize {
    CURRENT_THREAD_RECOVERY_HOST_DISPATCHES.with(std::cell::Cell::get)
  }

  fn accept_only_first_current_thread_host_dispatch(
    _dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    if CURRENT_THREAD_ONE_SHOT_HOST_DISPATCHES.with(|dispatches| {
      let previous = dispatches.get();
      dispatches.set(previous + 1);
      previous == 0
    }) {
      CurrentThreadHostDispatchResult::Accepted
    } else {
      CurrentThreadHostDispatchResult::Unavailable
    }
  }

  fn reset_current_thread_one_shot_host_dispatches() {
    CURRENT_THREAD_ONE_SHOT_HOST_DISPATCHES.with(|dispatches| dispatches.set(0));
  }

  fn current_thread_one_shot_host_dispatches() -> usize {
    CURRENT_THREAD_ONE_SHOT_HOST_DISPATCHES.with(std::cell::Cell::get)
  }

  fn count_current_thread_budget_host_dispatch(_dispatch: u64) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_BUDGET_HOST_DISPATCHES.fetch_add(1, Ordering::SeqCst);
    CurrentThreadHostDispatchResult::Accepted
  }

  fn count_current_thread_blocking_budget_host_dispatch(
    _dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_BLOCKING_BUDGET_HOST_DISPATCHES.fetch_add(1, Ordering::SeqCst);
    CurrentThreadHostDispatchResult::Accepted
  }

  fn count_current_thread_admission_host_dispatch(
    _dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_ADMISSION_HOST_DISPATCHES.fetch_add(1, Ordering::SeqCst);
    CurrentThreadHostDispatchResult::Accepted
  }

  fn count_current_thread_interleaved_recovery_host_dispatch(
    _dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_INTERLEAVED_RECOVERY_HOST_DISPATCHES.fetch_add(1, Ordering::SeqCst);
    CurrentThreadHostDispatchResult::Accepted
  }

  fn dispatch_late_registration_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_nested_unwind_current_thread_tasks(dispatch: u64) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_NESTED_UNWIND_DISPATCHES
      .lock()
      .unwrap()
      .push(dispatch);
    CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_authoritative_panic_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCHES
      .lock()
      .unwrap()
      .push(dispatch);
    match CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCH_CALLS.fetch_add(1, Ordering::SeqCst) {
      0 => std::panic::panic_any(FirstHostileCurrentThreadPanic),
      2 => std::panic::panic_any(LaterHostileCurrentThreadPanic),
      _ => CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS.dispatch(dispatch),
    }
  }

  fn dispatch_stale_failure_current_thread_tasks(dispatch: u64) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_waker_stack_failure_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_healthy_after_waker_stack_failure_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_HEALTHY_AFTER_WAKER_STACK_FAILURE_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_submission_failure_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_SUBMISSION_FAILURE_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_retirement_turn_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_RETIREMENT_TURN_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_nested_retirement_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_NESTED_RETIREMENT_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_sustained_producer_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_SUSTAINED_PRODUCER_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_retirement_retry_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_RETIREMENT_RETRY_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_final_retirement_offer_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_FINAL_RETIREMENT_OFFER_TASK_DRIVERS.dispatch(dispatch)
  }

  fn dispatch_inline_final_offer_current_thread_tasks(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_INLINE_FINAL_OFFER_TASK_DRIVERS.dispatch(dispatch)
  }

  fn panic_once_current_thread_host_dispatch(dispatch: u64) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_PANICKING_PUBLICATION_DISPATCHES
      .lock()
      .unwrap()
      .push(dispatch);
    assert!(
      !CURRENT_THREAD_PANICKING_PUBLICATION_ONCE.swap(false, Ordering::SeqCst),
      "injected CurrentThread host dispatch panic"
    );
    CurrentThreadHostDispatchResult::Accepted
  }

  fn panic_once_current_thread_armed_republish_host_dispatch(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_ARMED_PANIC_PUBLICATION_DISPATCHES
      .lock()
      .unwrap()
      .push(dispatch);
    assert!(
      !CURRENT_THREAD_ARMED_PANIC_PUBLICATION_ONCE.swap(false, Ordering::SeqCst),
      "injected armed CurrentThread host dispatch panic"
    );
    CurrentThreadHostDispatchResult::Accepted
  }

  fn record_current_thread_republish_rearm_dispatch(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_REPUBLISH_REARM_DISPATCHES
      .lock()
      .unwrap()
      .push(dispatch);
    CurrentThreadHostDispatchResult::Accepted
  }

  fn reject_initial_current_thread_publication_once(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    let mut dispatches = CURRENT_THREAD_INITIAL_PUBLICATION_RACE_DISPATCHES
      .lock()
      .unwrap();
    dispatches.push(dispatch);
    if dispatches.len() == 1 {
      CurrentThreadHostDispatchResult::Unavailable
    } else {
      CurrentThreadHostDispatchResult::Accepted
    }
  }

  fn reject_current_thread_replacement_publication_once(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    let mut dispatches = CURRENT_THREAD_REPLACEMENT_PUBLICATION_RACE_DISPATCHES
      .lock()
      .unwrap();
    dispatches.push(dispatch);
    if dispatches.len() == 2 {
      CurrentThreadHostDispatchResult::Unavailable
    } else {
      CurrentThreadHostDispatchResult::Accepted
    }
  }

  fn fail_current_thread_replacement_publication_once(
    dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_DISPATCHES
      .lock()
      .unwrap()
      .push(dispatch);
    CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS.dispatch(dispatch)
  }

  fn count_current_thread_shutdown_republish_host_dispatch(
    _dispatch: u64,
  ) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_SHUTDOWN_REPUBLISH_HOST_DISPATCHES.fetch_add(1, Ordering::SeqCst);
    CurrentThreadHostDispatchResult::Accepted
  }

  fn count_current_thread_stopped_host_dispatch(_dispatch: u64) -> CurrentThreadHostDispatchResult {
    CURRENT_THREAD_STOPPED_HOST_DISPATCHES.fetch_add(1, Ordering::SeqCst);
    CurrentThreadHostDispatchResult::Accepted
  }

  fn current_thread_dispatch(executor: &CurrentThreadExecutor) -> u64 {
    let pending = executor.dispatch_pending.load(Ordering::Acquire);
    if pending != 0 {
      return pending;
    }
    let dispatch = next_current_thread_dispatch_id();
    match executor.dispatch_pending.compare_exchange(
      0,
      dispatch,
      Ordering::AcqRel,
      Ordering::Acquire,
    ) {
      Ok(_) => dispatch,
      Err(pending) => pending,
    }
  }

  fn current_thread_dispatch_failure(
    dispatch: u64,
    epoch: u64,
  ) -> CurrentThreadTaskDispatchFailure {
    CurrentThreadTaskDispatchFailure { dispatch, epoch }
  }

  fn controller_current_thread_dispatch(controller: &RuntimeController) -> u64 {
    let executor = controller
      .running_current_thread_executor()
      .expect("the test controller must have a running CurrentThread executor");
    current_thread_dispatch(&executor)
  }

  #[test]
  fn current_thread_executor_drives_spawned_tasks() {
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::new(Arc::clone(&metrics)));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 42 }, move |runnable| {
      scheduler.schedule(runnable);
    });

    executor.schedule(runnable);

    let mut output = None;
    {
      let mut future = std::pin::pin!(async {
        output = Some(task.await);
      });
      executor.block_on(future.as_mut());
    }
    assert_eq!(output, Some(42));
    assert_eq!(metrics.runnable_polls.load(Ordering::Relaxed), 1);
    assert_eq!(metrics.active_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_wake_does_not_repoll_user_future() {
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::with_detection(
      Arc::new(RuntimeMetrics::default()),
      false,
      None,
    ));
    let polls = Arc::new(AtomicUsize::new(0));
    let (first_poll_tx, first_poll_rx) = mpsc::channel();
    let (outcome_tx, outcome_rx) = mpsc::channel();
    let driver_executor = Arc::clone(&executor);
    let driver_polls = Arc::clone(&polls);
    let driver = std::thread::spawn(move || {
      let mut future = std::pin::pin!(StopPollProbe {
        polls: driver_polls,
        first_poll: Some(first_poll_tx)
      });
      outcome_tx
        .send(driver_executor.block_on(future.as_mut()))
        .unwrap();
    });

    first_poll_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    wait_for_generation_parker_to_sleep(&executor.stop);
    executor.stop.begin_shutdown();

    assert_eq!(
      outcome_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      BlockOnOutcome::Stopped
    );
    driver.join().unwrap();
    assert_eq!(
      polls.load(Ordering::SeqCst),
      1,
      "a shutdown wake must be checked before the next CurrentThread user poll"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_admitted_host_turn_does_not_poll_after_stop_publication() {
    use std::sync::mpsc;

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      accept_current_thread_host_dispatch,
    ));
    let polls = Arc::new(AtomicUsize::new(0));
    let task_polls = Arc::clone(&polls);
    let (runnable, task) = async_task::spawn(
      async move {
        task_polls.fetch_add(1, Ordering::SeqCst);
      },
      |_| {},
    );
    executor.schedule(runnable);
    let dispatch = current_thread_dispatch(&executor);

    let (claim_locked_tx, claim_locked_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let driver_executor = Arc::clone(&executor);
    let driver = std::thread::spawn(move || {
      CURRENT_THREAD_RUNNABLE_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claim_locked_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      driver_executor.drive_host_turn_for_dispatch(dispatch);
    });
    claim_locked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the admitted host turn must pause before its runnable claim");

    executor.stop.publish_stopping();
    release_claim_tx.send(()).unwrap();
    driver.join().unwrap();

    assert_eq!(
      polls.load(Ordering::SeqCst),
      0,
      "stop publication must outrank a later runnable claim by an already-admitted host turn"
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 1);

    executor.begin_shutdown();
    assert!(
      futures::executor::block_on(task.fallible()).is_none(),
      "shutdown must cancel the runnable rejected by the stopped claim"
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_terminal_dispatch_cancellation_outranks_runnable_claim() {
    use std::sync::mpsc;

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      accept_current_thread_host_dispatch,
    ));
    let polls = Arc::new(AtomicUsize::new(0));
    let task_polls = Arc::clone(&polls);
    let (runnable, task) = async_task::spawn(
      async move {
        task_polls.fetch_add(1, Ordering::SeqCst);
      },
      |_| {},
    );
    executor.schedule(runnable);

    let queue = executor
      .queue
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let (cancellation_published_tx, cancellation_published_rx) = mpsc::channel();
    let (cancellation_done_tx, cancellation_done_rx) = mpsc::channel();
    let cancelling_executor = Arc::clone(&executor);
    let cancellation = std::thread::spawn(move || {
      let scheduler = cancelling_executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let cancelling = cancelling_executor
        .begin_failed_dispatch_cancellation()
        .expect("the test must publish terminal dispatch cancellation");
      drop(scheduler);
      cancellation_published_tx.send(()).unwrap();
      cancelling_executor.cancel_work_after_host_dispatch_failure(cancelling);
      cancellation_done_tx.send(()).unwrap();
    });
    cancellation_published_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("terminal dispatch cancellation must publish before queue draining");

    let claimant_executor = Arc::clone(&executor);
    let claimant = std::thread::spawn(move || claimant_executor.drain_one());
    assert!(
      !claimant.join().unwrap(),
      "a runnable claim after terminal cancellation publication must be rejected"
    );
    assert_eq!(polls.load(Ordering::SeqCst), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 1);
    assert!(
      matches!(
        cancellation_done_rx.try_recv(),
        Err(mpsc::TryRecvError::Empty)
      ),
      "terminal cancellation must still be waiting to drain the queued runnable"
    );

    drop(queue);
    cancellation_done_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("terminal cancellation must drain the rejected runnable");
    cancellation.join().unwrap();
    assert!(
      futures::executor::block_on(task.fallible()).is_none(),
      "terminal cancellation must cancel the runnable it prevented from starting"
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_parking_shutdown_wake_does_not_repoll_user_future() {
    use std::sync::mpsc;

    let executor = multi_thread_executor(2, None, "parking-stop-before-poll");
    let polls = Arc::new(AtomicUsize::new(0));
    let (first_poll_tx, first_poll_rx) = mpsc::channel();
    let (outcome_tx, outcome_rx) = mpsc::channel();
    let driver_executor = Arc::clone(&executor);
    let driver_polls = Arc::clone(&polls);
    let driver = std::thread::spawn(move || {
      let mut future = std::pin::pin!(StopPollProbe {
        polls: driver_polls,
        first_poll: Some(first_poll_tx)
      });
      outcome_tx
        .send(driver_executor.block_on(future.as_mut()))
        .unwrap();
    });

    first_poll_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    wait_for_generation_parker_to_sleep(&executor.stop);
    executor.stop.begin_shutdown();

    assert_eq!(
      outcome_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      BlockOnOutcome::Stopped
    );
    driver.join().unwrap();
    assert_eq!(
      polls.load(Ordering::SeqCst),
      1,
      "a shutdown wake must be checked before the next parking block_on user poll"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_cooperative_shutdown_wake_does_not_repoll_user_future() {
    use std::sync::mpsc;

    let executor = multi_thread_executor(2, None, "cooperative-stop-before-poll");
    let polls = Arc::new(AtomicUsize::new(0));
    let (first_poll_tx, first_poll_rx) = mpsc::channel();
    let (outcome_tx, outcome_rx) = mpsc::channel();
    let driver_executor = Arc::clone(&executor);
    let driver_polls = Arc::clone(&polls);
    let driver = std::thread::spawn(move || {
      let _on_pool = OnPoolWorkerGuard::enter(driver_executor.id);
      let mut future = std::pin::pin!(StopPollProbe {
        polls: driver_polls,
        first_poll: Some(first_poll_tx)
      });
      outcome_tx
        .send(driver_executor.block_on(future.as_mut()))
        .unwrap();
    });

    first_poll_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    wait_for_generation_parker_to_sleep(&executor.stop);
    executor.stop.begin_shutdown();

    assert_eq!(
      outcome_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      BlockOnOutcome::Stopped
    );
    driver.join().unwrap();
    assert_eq!(
      polls.load(Ordering::SeqCst),
      1,
      "a shutdown wake must be checked before the next cooperative user poll"
    );
  }

  #[test]
  fn current_thread_pending_dispatch_does_not_allocate_another_capability() {
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::new(RuntimeMetrics::default()),
      accept_current_thread_host_dispatch,
    ));
    let pending = u64::MAX - 1;
    executor.dispatch_pending.store(pending, Ordering::Release);
    let mut allocations = 0;

    executor.request_drain_with(|| {
      allocations += 1;
      u64::MAX
    });

    assert_eq!(allocations, 0);
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), pending);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_stopped_dispatch_claim_is_rejected_under_scheduler_lock() {
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::new(RuntimeMetrics::default()),
      accept_current_thread_host_dispatch,
    ));
    let dispatch = current_thread_dispatch(&executor);
    let scheduler = executor
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let (claiming_tx, claiming_rx) = mpsc::channel();
    let (claimed_tx, claimed_rx) = mpsc::channel();
    let claiming_executor = Arc::clone(&executor);
    let claimant = std::thread::spawn(move || {
      claiming_tx.send(()).unwrap();
      claimed_tx
        .send(claiming_executor.try_admit_host_turn(dispatch).is_some())
        .unwrap();
    });
    claiming_rx.recv_timeout(Duration::from_secs(2)).unwrap();

    executor.stop.begin_shutdown();
    drop(scheduler);

    assert!(
      !claimed_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      "an old-generation dispatch must not claim a host turn after stop becomes visible"
    );
    claimant.join().unwrap();
    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      dispatch,
      "rejecting the stopped claim must not consume its stale capability"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_stopped_dispatch_publication_is_rejected_under_scheduler_lock() {
    use std::sync::mpsc;

    CURRENT_THREAD_STOPPED_HOST_DISPATCHES.store(0, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_stopped_host_dispatch,
    ));
    let scheduler = executor
      .scheduler_idle_lock
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    let (publication_blocked_tx, publication_blocked_rx) = mpsc::channel();
    let scheduling_executor = Arc::clone(&executor);
    let scheduling = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_PUBLICATION_BLOCKED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          publication_blocked_tx.send(()).unwrap();
        }));
      });
      let scheduler = Arc::clone(&scheduling_executor);
      let (runnable, task) = async_task::spawn(std::future::pending::<()>(), move |runnable| {
        scheduler.schedule(runnable);
      });
      task.detach();
      scheduling_executor.schedule(runnable);
    });

    publication_blocked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("dispatch publication must block behind the scheduler-idle mutex");
    executor.begin_shutdown();
    drop(scheduler);
    scheduling.join().unwrap();
    executor.wait_until_scheduler_idle();

    assert_eq!(
      CURRENT_THREAD_STOPPED_HOST_DISPATCHES.load(Ordering::SeqCst),
      0,
      "a publication that reaches the scheduler-idle barrier after stop must not call the host"
    );
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_host_dispatch_does_not_poll_inline_from_shared_wake() {
    use std::{sync::mpsc, time::Duration};

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      accept_current_thread_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let completed = Arc::new(AtomicBool::new(false));
    let completed_task = Arc::clone(&completed);
    let (wake_tx, wake_rx) = futures::channel::oneshot::channel::<()>();
    let shared = async move {
      wake_rx.await.expect("wake sender dropped");
    }
    .boxed()
    .shared();
    let (runnable, task) = async_task::spawn(
      async move {
        shared.await;
        completed_task.store(true, Ordering::SeqCst);
      },
      move |runnable| scheduler.schedule(runnable),
    );

    executor.schedule(runnable);
    assert!(
      !completed.load(Ordering::SeqCst),
      "accepted host dispatch must defer the first poll"
    );
    executor.drive_host_turn();

    let (send_returned_tx, send_returned_rx) = mpsc::sync_channel(1);
    std::thread::spawn(move || {
      wake_tx.send(()).expect("shared wake receiver dropped");
      send_returned_tx.send(()).unwrap();
    });
    send_returned_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("Shared wake re-entered its own waker mutex through inline polling");
    assert!(
      !completed.load(Ordering::SeqCst),
      "the wake must remain queued until a fresh host turn"
    );

    executor.drive_host_turn();
    futures::executor::block_on(task);
    assert!(completed.load(Ordering::SeqCst));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_hostless_wake_is_enqueue_only() {
    use std::{sync::mpsc, time::Duration};

    struct LockOnSecondPoll {
      gate: Arc<Mutex<()>>,
      first: bool,
      waker: Option<mpsc::Sender<Waker>>,
      completed: Arc<AtomicBool>,
    }

    impl Future for LockOnSecondPoll {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        if self.first {
          self.first = false;
          self.waker.take().unwrap().send(cx.waker().clone()).unwrap();
          return Poll::Pending;
        }
        drop(self.gate.lock().unwrap());
        self.completed.store(true, Ordering::SeqCst);
        Poll::Ready(())
      }
    }

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::new(metrics));
    let gate = Arc::new(Mutex::new(()));
    let completed = Arc::new(AtomicBool::new(false));
    let (waker_tx, waker_rx) = mpsc::channel();
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      LockOnSecondPoll {
        gate: Arc::clone(&gate),
        first: true,
        waker: Some(waker_tx),
        completed: Arc::clone(&completed),
      },
      move |runnable| scheduler.schedule(runnable),
    );
    executor.schedule(runnable);
    executor.drive_host_turn();
    let waker = waker_rx.recv_timeout(Duration::from_secs(1)).unwrap();

    let (returned_tx, returned_rx) = mpsc::channel();
    let wake_gate = Arc::clone(&gate);
    let waking = std::thread::spawn(move || {
      let _held = wake_gate.lock().unwrap();
      waker.wake();
      returned_tx.send(()).unwrap();
    });
    returned_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("hostless wake must enqueue without polling under the caller's lock");
    waking.join().unwrap();
    assert!(!completed.load(Ordering::SeqCst));

    executor.drive_host_turn();
    futures::executor::block_on(task);
    assert!(completed.load(Ordering::SeqCst));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_hostless_submission_wakes_sleeping_block_on_driver() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller(
      "current-thread-hostless-late-work",
    ));
    let backend = controller.backend();
    let RuntimeExecutor::CurrentThread(executor) = &backend.executor else {
      panic!("configured CurrentThread backend must create a CurrentThread executor");
    };
    let executor = Arc::clone(executor);
    drop(backend);

    let (value_tx, value_rx) = oneshot::channel();
    let (done_tx, done_rx) = mpsc::channel();
    let block_on_controller = Arc::clone(&controller);
    let runner = std::thread::spawn(move || {
      let mut output = None;
      let outcome = {
        let mut future = std::pin::pin!(async {
          output = Some(value_rx.await.expect("scheduled sender must deliver"));
        });
        block_on_controller.block_on(future.as_mut())
      };
      done_tx.send((outcome, output)).unwrap();
    });

    wait_until(
      "the hostless CurrentThread block_on driver to sleep",
      || {
        executor
          .stop
          .parkers
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .iter()
          .filter_map(Weak::upgrade)
          .any(|parker| parker.state.load(Ordering::SeqCst) == PARKER_SLEEPING)
      },
    );

    controller
      .try_spawn_detached(async move {
        value_tx
          .send(37usize)
          .expect("block_on receiver must remain alive");
      })
      .unwrap_or_else(|_| panic!("the running CurrentThread runtime must accept late work"));

    let (outcome, output) = done_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("queue publication must wake the sleeping explicit driver");
    assert_eq!(outcome, BlockOnOutcome::Completed);
    assert_eq!(output, Some(37));
    runner.join().unwrap();
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_submission_wakes_older_driver_when_newer_is_blocked_in_poll() {
    use std::sync::mpsc;

    struct BlockingPoll {
      entered: Option<mpsc::Sender<()>>,
      release: mpsc::Receiver<()>,
    }

    impl Future for BlockingPoll {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        self.entered.take().unwrap().send(()).unwrap();
        self.release.recv().unwrap();
        Poll::Ready(())
      }
    }

    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::new(RuntimeMetrics::default()),
      reject_current_thread_host_dispatch,
    ));
    let (value_tx, value_rx) = oneshot::channel();
    let (older_done_tx, older_done_rx) = mpsc::channel();
    let older_executor = Arc::clone(&executor);
    let older = std::thread::spawn(move || {
      let mut value = None;
      {
        let mut future = std::pin::pin!(async {
          value = Some(value_rx.await.unwrap());
        });
        assert_eq!(
          older_executor.block_on(future.as_mut()),
          BlockOnOutcome::Completed
        );
      }
      older_done_tx.send(value.unwrap()).unwrap();
    });
    wait_until("the older CurrentThread driver to sleep", || {
      executor
        .stop
        .parkers
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .iter()
        .filter_map(Weak::upgrade)
        .any(|parker| parker.state.load(Ordering::SeqCst) == PARKER_SLEEPING)
    });

    let (newer_entered_tx, newer_entered_rx) = mpsc::channel();
    let (release_newer_tx, release_newer_rx) = mpsc::channel();
    let newer_executor = Arc::clone(&executor);
    let newer = std::thread::spawn(move || {
      let mut future = std::pin::pin!(BlockingPoll {
        entered: Some(newer_entered_tx),
        release: release_newer_rx
      });
      assert_eq!(
        newer_executor.block_on(future.as_mut()),
        BlockOnOutcome::Completed
      );
    });
    newer_entered_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("the newer driver must be blocked inside its poll");

    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        value_tx.send(41usize).unwrap();
      },
      move |runnable| scheduler.schedule(runnable),
    );
    task.detach();
    executor.schedule(runnable);

    assert_eq!(
      older_done_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("queue publication must also wake the older sleeping driver"),
      41
    );
    release_newer_tx.send(()).unwrap();
    older.join().unwrap();
    newer.join().unwrap();
  }

  #[test]
  fn current_thread_shutdown_cancels_host_queued_task() {
    use std::sync::mpsc;

    struct DropSignal(mpsc::Sender<()>);

    impl Drop for DropSignal {
      fn drop(&mut self) {
        self.0.send(()).unwrap();
      }
    }

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      accept_current_thread_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let (dropped_tx, dropped_rx) = mpsc::channel();
    let signal = DropSignal(dropped_tx);
    let (runnable, task) = async_task::spawn(
      async move {
        let _signal = signal;
        futures::future::pending::<()>().await;
      },
      move |runnable| scheduler.schedule(runnable),
    );

    executor.schedule(runnable);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 1);
    executor.begin_shutdown();

    dropped_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("shutdown must drop a task queued behind a host turn");
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert!(
      futures::executor::block_on(task.fallible()).is_none(),
      "the queued task handle must resolve as cancelled"
    );
  }

  #[test]
  fn current_thread_new_host_republishes_the_existing_dispatch_capability() {
    reset_current_thread_recovery_host_dispatches();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_recovery_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let completed = Arc::new(AtomicBool::new(false));
    let completed_task = Arc::clone(&completed);
    let (runnable, task) = async_task::spawn(
      async move {
        completed_task.store(true, Ordering::SeqCst);
      },
      move |runnable| scheduler.schedule(runnable),
    );

    executor.schedule(runnable);
    assert_eq!(current_thread_recovery_host_dispatches(), 1);
    let lost_dispatch = current_thread_dispatch(&executor);

    // Model another host registering while the first host still owns an
    // accepted delivery. The executor capability stays stable; the host
    // registry gives the new registration a distinct delivery token.
    executor.request_drain_if_queued();
    assert_eq!(
      current_thread_recovery_host_dispatches(),
      2,
      "the newly registered host must receive the pending executor dispatch"
    );
    assert_eq!(current_thread_dispatch(&executor), lost_dispatch);
    executor.drive_host_turn_for_dispatch(lost_dispatch);
    futures::executor::block_on(task);
    assert!(completed.load(Ordering::SeqCst));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);

    let second_completed = Arc::new(AtomicBool::new(false));
    let second_completed_task = Arc::clone(&second_completed);
    let second_scheduler = Arc::clone(&executor);
    let (second_runnable, second_task) = async_task::spawn(
      async move {
        second_completed_task.store(true, Ordering::SeqCst);
      },
      move |runnable| second_scheduler.schedule(runnable),
    );
    executor.schedule(second_runnable);
    assert_eq!(
      current_thread_recovery_host_dispatches(),
      3,
      "work queued after the stale callback must receive a new dispatch"
    );
    let third_dispatch = current_thread_dispatch(&executor);

    // The already-consumed capability remains stale relative to dispatch 2 and
    // cannot service its work.
    executor.drive_host_turn_for_dispatch(lost_dispatch);
    assert!(!second_completed.load(Ordering::SeqCst));
    executor.drive_host_turn_for_dispatch(third_dispatch);
    futures::executor::block_on(second_task);
    assert!(second_completed.load(Ordering::SeqCst));

    let third_scheduler = Arc::clone(&executor);
    let (third_runnable, third_task) =
      async_task::spawn(async {}, move |runnable| third_scheduler.schedule(runnable));
    executor.schedule(third_runnable);
    assert_eq!(
      current_thread_recovery_host_dispatches(),
      4,
      "a stale callback must not leave the dispatch latch stuck"
    );
    executor.drive_host_turn();
    futures::executor::block_on(third_task);
  }

  #[test]
  fn current_thread_new_host_joins_an_existing_recovery_dispatch() {
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      accept_current_thread_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 17usize }, move |runnable| {
      scheduler.schedule(runnable)
    });

    executor.schedule(runnable);
    let failed_dispatch = current_thread_dispatch(&executor);
    executor.cancel_host_dispatch_for_test(failed_dispatch);
    let recovery_dispatch = current_thread_dispatch(&executor);
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      recovery_dispatch
    );

    executor.request_drain_if_queued();
    let new_host_dispatch = current_thread_dispatch(&executor);
    assert_eq!(new_host_dispatch, recovery_dispatch);
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      recovery_dispatch
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 1);

    executor.drive_host_turn_for_dispatch(new_host_dispatch);
    assert_eq!(futures::executor::block_on(task), 17);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_host_admission_serializes_dispatch_publication() {
    use std::sync::mpsc;

    CURRENT_THREAD_ADMISSION_HOST_DISPATCHES.store(0, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_admission_host_dispatch,
    ));
    let first_scheduler = Arc::clone(&executor);
    let (first_runnable, first_task) =
      async_task::spawn(async {}, move |runnable| first_scheduler.schedule(runnable));
    first_task.detach();
    executor.schedule(first_runnable);
    let dispatch = current_thread_dispatch(&executor);
    assert_eq!(
      CURRENT_THREAD_ADMISSION_HOST_DISPATCHES.load(Ordering::SeqCst),
      1
    );

    let (claimed_tx, claimed_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let driver_executor = Arc::clone(&executor);
    let driver = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claimed_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      driver_executor.drive_host_turn_for_dispatch(dispatch);
    });
    claimed_rx.recv_timeout(Duration::from_secs(2)).unwrap();

    let second_ran = Arc::new(AtomicBool::new(false));
    let second_ran_task = Arc::clone(&second_ran);
    let scheduling_executor = Arc::clone(&executor);
    let (publication_blocked_tx, publication_blocked_rx) = mpsc::channel();
    let (scheduled_tx, scheduled_rx) = mpsc::channel();
    let scheduling = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_PUBLICATION_BLOCKED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          publication_blocked_tx.send(()).unwrap();
        }));
      });
      let scheduler = Arc::clone(&scheduling_executor);
      let (runnable, task) = async_task::spawn(
        async move {
          second_ran_task.store(true, Ordering::SeqCst);
        },
        move |runnable| scheduler.schedule(runnable),
      );
      task.detach();
      scheduling_executor.schedule(runnable);
      scheduled_tx.send(()).unwrap();
    });

    publication_blocked_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap();
    assert!(
      matches!(scheduled_rx.try_recv(), Err(mpsc::TryRecvError::Empty)),
      "dispatch publication must wait until host admission publishes its draining role"
    );
    assert_eq!(
      CURRENT_THREAD_ADMISSION_HOST_DISPATCHES.load(Ordering::SeqCst),
      1,
      "the admission gap must not publish a duplicate host dispatch"
    );

    release_tx.send(()).unwrap();
    scheduled_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    scheduling.join().unwrap();
    driver.join().unwrap();
    if !second_ran.load(Ordering::SeqCst) {
      executor.drive_host_turn();
    }
    assert!(second_ran.load(Ordering::SeqCst));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[test]
  fn current_thread_host_turn_yields_after_runnable_budget() {
    struct SelfWakingFuture {
      remaining: usize,
    }

    impl Future for SelfWakingFuture {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
        if self.remaining == 0 {
          return Poll::Ready(());
        }
        self.remaining -= 1;
        cx.waker().wake_by_ref();
        Poll::Pending
      }
    }

    CURRENT_THREAD_BUDGET_HOST_DISPATCHES.store(0, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_budget_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      SelfWakingFuture {
        remaining: CurrentThreadExecutor::HOST_TURN_RUNNABLE_BUDGET + 1,
      },
      move |runnable| scheduler.schedule(runnable),
    );

    executor.schedule(runnable);
    executor.drive_host_turn();

    assert_eq!(
      metrics.runnable_polls.load(Ordering::Relaxed),
      CurrentThreadExecutor::HOST_TURN_RUNNABLE_BUDGET as u64
    );
    assert_eq!(
      CURRENT_THREAD_BUDGET_HOST_DISPATCHES.load(Ordering::SeqCst),
      2,
      "remaining hot work must continue through a fresh host turn"
    );

    executor.drive_host_turn();
    futures::executor::block_on(task);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_host_turn_yields_after_inline_blocking_releases_queued_fifo() {
    const QUEUED_BLOCKING_JOBS: usize = CurrentThreadExecutor::HOST_TURN_RUNNABLE_BUDGET + 1;

    CURRENT_THREAD_BLOCKING_BUDGET_HOST_DISPATCHES.store(0, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_blocking_budget_host_dispatch,
    ));
    let work = GenerationWork::new();
    let observed = Arc::new(Mutex::new(Vec::new()));

    let task_executor = Arc::clone(&executor);
    let wake_executor = Arc::clone(&executor);
    let producer_executor = Arc::clone(&executor);
    let producer_work = Arc::clone(&work);
    let producer_observed = Arc::clone(&observed);
    let outer_registration = work
      .try_register_work()
      .expect("the outer blocking job must be accepted");
    let (runnable, task) = async_task::spawn(
      async move {
        let queued = task_executor
          .schedule_blocking(
            move || {
              std::thread::spawn(move || {
                (0..QUEUED_BLOCKING_JOBS)
                  .map(|index| {
                    let registration = producer_work
                      .try_register_work()
                      .expect("queued blocking work must be accepted");
                    let observed = Arc::clone(&producer_observed);
                    producer_executor.schedule_blocking(
                      move || {
                        observed
                          .lock()
                          .unwrap_or_else(std::sync::PoisonError::into_inner)
                          .push(index);
                      },
                      registration,
                    )
                  })
                  .collect::<Vec<_>>()
              })
              .join()
              .expect("the blocking producer must finish")
            },
            outer_registration,
          )
          .await
          .expect("the inline blocking job must finish");
        for handle in queued {
          handle.await.expect("queued blocking work must finish");
        }
      },
      move |runnable| wake_executor.schedule(runnable),
    );

    executor.schedule(runnable);
    executor.drive_host_turn();

    let first_turn = observed
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .clone();
    assert!(
      !first_turn.is_empty(),
      "the first host turn must service queued blocking work"
    );
    assert!(
      first_turn.len() < QUEUED_BLOCKING_JOBS,
      "inline lane release must not drain the entire blocking FIFO in one host turn"
    );
    assert_eq!(first_turn, (0..first_turn.len()).collect::<Vec<_>>());
    assert_eq!(
      CURRENT_THREAD_BLOCKING_BUDGET_HOST_DISPATCHES.load(Ordering::SeqCst),
      2,
      "remaining blocking work must continue through a fresh host turn"
    );

    let mut continuation_turns = 0;
    while observed
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .len()
      < QUEUED_BLOCKING_JOBS
    {
      continuation_turns += 1;
      assert!(
        continuation_turns <= QUEUED_BLOCKING_JOBS,
        "queued blocking work failed to make bounded host-turn progress"
      );
      executor.drive_host_turn();
    }
    executor.drive_host_turn();
    futures::executor::block_on(task);

    assert_eq!(
      *observed
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner),
      (0..QUEUED_BLOCKING_JOBS).collect::<Vec<_>>(),
      "blocking jobs must preserve FIFO order across host turns"
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_waits_for_continuation_dispatch_publication() {
    use std::sync::mpsc;

    struct SelfWakingFuture {
      remaining: usize,
    }

    impl Future for SelfWakingFuture {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
        if self.remaining == 0 {
          return Poll::Ready(());
        }
        self.remaining -= 1;
        cx.waker().wake_by_ref();
        Poll::Pending
      }
    }

    let controller = Arc::new(current_thread_controller("host-continuation-shutdown"));
    let old_generation = controller.backend().generation();
    controller
      .try_spawn_detached(SelfWakingFuture {
        remaining: CurrentThreadExecutor::HOST_TURN_RUNNABLE_BUDGET + 1,
      })
      .unwrap_or_else(|_| panic!("the CurrentThread runtime must accept the self-waking task"));
    let dispatch = controller_current_thread_dispatch(&controller);

    let (dispatch_entered_tx, dispatch_entered_rx) = mpsc::channel();
    let (release_dispatch_tx, release_dispatch_rx) = mpsc::channel();
    let driver_controller = Arc::clone(&controller);
    let driver = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_CALL_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          dispatch_entered_tx.send(()).unwrap();
          release_dispatch_rx.recv().unwrap();
        }));
      });
      driver_controller.drive_current_thread_dispatch(dispatch, false);
    });
    dispatch_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the bounded host turn must begin publishing its continuation");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until("CurrentThread shutdown to leave Running", || {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      !matches!(
        &state.lifecycle,
        RuntimeLifecycle::Running(backend) if backend.generation() == old_generation
      )
    });

    let (restart_tx, restart_rx) = mpsc::channel();
    let restart_controller = Arc::clone(&controller);
    let restart = std::thread::spawn(move || {
      let result = restart_controller
        .start()
        .map(|()| restart_controller.backend().generation());
      restart_tx.send(result).unwrap();
    });

    let early_shutdown = shutdown_rx.recv_timeout(Duration::from_millis(200)).ok();
    let early_restart = restart_rx.recv_timeout(Duration::from_millis(200)).ok();
    let shutdown_overlapped = early_shutdown.is_some();
    let restart_overlapped = early_restart.is_some();
    release_dispatch_tx.send(()).unwrap();
    driver.join().unwrap();

    let shutdown_result = early_shutdown.unwrap_or_else(|| {
      shutdown_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("shutdown must finish after continuation publication retires")
    });
    shutdown_result.unwrap();
    let new_generation = early_restart.unwrap_or_else(|| {
      restart_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("restart must follow continuation publication and shutdown")
    });
    let new_generation = new_generation.unwrap();
    shutdown.join().unwrap();
    restart.join().unwrap();

    assert!(
      !shutdown_overlapped,
      "shutdown must not publish Stopped while an old-generation continuation dispatch is executing"
    );
    assert!(
      !restart_overlapped,
      "restart must not overlap an old-generation continuation dispatch"
    );
    assert_ne!(new_generation, old_generation);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_waits_for_initial_dispatch_publication() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("host-initial-dispatch-shutdown"));
    let old_generation = controller.backend().generation();
    let (reentrant_shutdown_tx, reentrant_shutdown_rx) = mpsc::channel();
    let (dispatch_entered_tx, dispatch_entered_rx) = mpsc::channel();
    let (release_dispatch_tx, release_dispatch_rx) = mpsc::channel();
    let submit_controller = Arc::clone(&controller);
    let reentrant_controller = Arc::clone(&controller);
    let submitter = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_CALL_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          reentrant_shutdown_tx
            .send(reentrant_controller.shutdown())
            .unwrap();
          dispatch_entered_tx.send(()).unwrap();
          release_dispatch_rx.recv().unwrap();
        }));
      });
      submit_controller
        .try_spawn_detached(std::future::pending::<()>())
        .unwrap_or_else(|_| panic!("the CurrentThread runtime must accept the pending task"));
    });

    let reentrant_shutdown = reentrant_shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("dispatch publication must not self-deadlock on reentrant shutdown");
    dispatch_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the initial host dispatch publication must reach the injected pause");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until("CurrentThread shutdown to leave Running", || {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      !matches!(
        &state.lifecycle,
        RuntimeLifecycle::Running(backend) if backend.generation() == old_generation
      )
    });

    let (restart_tx, restart_rx) = mpsc::channel();
    let restart_controller = Arc::clone(&controller);
    let restart = std::thread::spawn(move || {
      let result = restart_controller
        .start()
        .map(|()| restart_controller.backend().generation());
      restart_tx.send(result).unwrap();
    });

    let early_shutdown = shutdown_rx.recv_timeout(Duration::from_millis(200)).ok();
    let early_restart = restart_rx.recv_timeout(Duration::from_millis(200)).ok();
    let shutdown_overlapped = early_shutdown.is_some();
    let restart_overlapped = early_restart.is_some();
    release_dispatch_tx.send(()).unwrap();
    submitter.join().unwrap();

    let shutdown_result = early_shutdown.unwrap_or_else(|| {
      shutdown_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("shutdown must finish after initial dispatch publication retires")
    });
    shutdown_result.unwrap();
    let new_generation = early_restart.unwrap_or_else(|| {
      restart_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("restart must follow initial dispatch publication and shutdown")
    });
    let new_generation = new_generation.unwrap();
    shutdown.join().unwrap();
    restart.join().unwrap();

    let reentrant_error = reentrant_shutdown
      .expect_err("dispatch publication must be generation-scoped scheduler work");
    assert!(
      reentrant_error
        .to_string()
        .contains("work running on that runtime")
    );
    assert!(
      !shutdown_overlapped,
      "shutdown must not publish Stopped while an old-generation host dispatch call is executing"
    );
    assert!(
      !restart_overlapped,
      "restart must not overlap an old-generation host dispatch call"
    );
    assert_ne!(new_generation, old_generation);
    controller.shutdown().unwrap();
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_dispatch_publication_unwind_releases_owner_and_can_republish() {
    CURRENT_THREAD_PANICKING_PUBLICATION_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    CURRENT_THREAD_PANICKING_PUBLICATION_ONCE.store(true, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      panic_once_current_thread_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 17usize }, move |runnable| {
      scheduler.schedule(runnable)
    });

    let publication = catch_unwind(AssertUnwindSafe(|| executor.schedule(runnable)));
    assert!(
      publication.is_err(),
      "the injected host dispatch panic must unwind"
    );
    let dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(scheduler.active_dispatch_calls, 0);
      assert!(scheduler.dispatch_publications.is_empty());
    }

    executor.request_drain_if_queued();

    assert_ne!(dispatch, 0);
    assert_eq!(
      *CURRENT_THREAD_PANICKING_PUBLICATION_DISPATCHES
        .lock()
        .unwrap(),
      vec![dispatch, dispatch],
      "a later host registration must retry the same pending capability"
    );
    {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(scheduler.active_dispatch_calls, 0);
      assert!(scheduler.dispatch_publications.is_empty());
    }
    executor.drive_host_turn_for_dispatch(dispatch);
    assert_eq!(futures::executor::block_on(task.fallible()), Some(17));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn current_thread_publication_unwind_services_armed_republish_before_resuming_panic() {
    use std::sync::mpsc;

    CURRENT_THREAD_ARMED_PANIC_PUBLICATION_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    CURRENT_THREAD_ARMED_PANIC_PUBLICATION_ONCE.store(true, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      panic_once_current_thread_armed_republish_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 23usize }, move |runnable| {
      scheduler.schedule(runnable)
    });

    let (called_tx, called_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_CALL_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          called_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      catch_unwind(AssertUnwindSafe(|| publishing_executor.schedule(runnable)))
    });
    called_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the first publication must pause before calling the host dispatcher");

    let dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    executor.request_drain_if_queued();
    let publication_state = {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      (
        scheduler.active_dispatch_calls,
        scheduler.dispatch_publications.len(),
        scheduler.dispatch_publications[0].dispatch,
        scheduler.dispatch_publications[0].republish_requested,
      )
    };
    release_tx.send(()).unwrap();

    let publication = publication.join().unwrap();
    assert!(
      publication.is_err(),
      "the original host-dispatch panic must resume"
    );
    assert_ne!(dispatch, 0);
    assert_eq!(publication_state, (1, 1, dispatch, true));
    assert_eq!(
      *CURRENT_THREAD_ARMED_PANIC_PUBLICATION_DISPATCHES
        .lock()
        .unwrap(),
      vec![dispatch, dispatch],
      "the armed request must retry automatically before the original panic resumes"
    );
    {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(scheduler.active_dispatch_calls, 0);
      assert!(scheduler.dispatch_publications.is_empty());
    }
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), dispatch);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 1);

    executor.drive_host_turn_for_dispatch(dispatch);
    assert_eq!(futures::executor::block_on(task.fallible()), Some(23));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn current_thread_first_panic_survives_failed_republish_and_nested_recovery_panic() {
    use std::sync::mpsc;

    CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCH_CALLS.store(0, Ordering::SeqCst);
    CURRENT_THREAD_FIRST_HOSTILE_PANIC_DROPS.store(0, Ordering::SeqCst);
    CURRENT_THREAD_LATER_HOSTILE_PANIC_DROPS.store(0, Ordering::SeqCst);
    {
      let state = CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
    }
    let failed_registration = CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS
      .register(Arc::new(FailDuringAuthoritativePanicPublication));
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
      Arc::clone(&metrics),
      dispatch_authoritative_panic_current_thread_tasks,
      &CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 41usize }, move |runnable| {
      scheduler.schedule(runnable)
    });

    let (called_tx, called_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_CALL_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          called_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      catch_unwind(AssertUnwindSafe(|| publishing_executor.schedule(runnable)))
    });
    called_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the first publication must pause before raising its panic");

    let failed_dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    executor.request_drain_if_queued();
    release_tx.send(()).unwrap();

    let payload = publication
      .join()
      .unwrap()
      .expect_err("the first host-dispatch panic must resume");
    assert!(
      payload.is::<FirstHostileCurrentThreadPanic>(),
      "the first panic must remain authoritative over nested recovery"
    );
    assert_eq!(
      CURRENT_THREAD_LATER_HOSTILE_PANIC_DROPS.load(Ordering::SeqCst),
      1,
      "the later hostile payload must be discarded under containment"
    );
    assert_eq!(
      CURRENT_THREAD_FIRST_HOSTILE_PANIC_DROPS.load(Ordering::SeqCst),
      0,
      "the authoritative payload must remain owned by the resumed unwind"
    );
    discard_panic_payload(payload);
    assert_eq!(
      CURRENT_THREAD_FIRST_HOSTILE_PANIC_DROPS.load(Ordering::SeqCst),
      1
    );

    let dispatches = CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCHES
      .lock()
      .unwrap()
      .clone();
    assert_eq!(dispatches.len(), 3);
    let replacement_dispatch = dispatches[2];
    assert_eq!(dispatches[0], failed_dispatch);
    assert_eq!(dispatches[1], failed_dispatch);
    assert_ne!(replacement_dispatch, failed_dispatch);
    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      replacement_dispatch
    );
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      replacement_dispatch
    );
    {
      let state = CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        !state.dispatches.contains_key(&failed_dispatch),
        "nested recovery unwind must retire the exact failed epoch"
      );
      assert!(!state.dispatches.contains_key(&replacement_dispatch));
    }

    CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS.unregister(failed_registration);
    let healthy = Arc::new(ManualCurrentThreadTaskDriver::default());
    let healthy_registration = CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS
      .register(Arc::clone(&healthy) as Arc<dyn CurrentThreadTaskDriver>);
    executor.request_drain_if_queued();

    assert_eq!(
      *CURRENT_THREAD_AUTHORITATIVE_PANIC_DISPATCHES
        .lock()
        .unwrap(),
      vec![
        failed_dispatch,
        failed_dispatch,
        replacement_dispatch,
        replacement_dispatch
      ],
      "retry must retain the replacement reserved before the nested panic"
    );
    let delivery = healthy.deliveries()[0];
    assert_eq!(
      CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS.claim_delivery(delivery.capability()),
      Some(replacement_dispatch)
    );
    let mut host_turn = executor
      .try_admit_host_turn(replacement_dispatch)
      .expect("the retried replacement delivery must be admitted");
    CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS.mark_serviced(replacement_dispatch);
    host_turn.drive();
    assert!(
      CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS
        .finish_delivery(delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert_eq!(futures::executor::block_on(task.fallible()), Some(41));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);

    CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS.unregister(healthy_registration);
    let state = CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(state.entries.is_empty());
    assert!(state.dispatches.is_empty());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_suppresses_queued_republish() {
    use std::sync::mpsc;

    CURRENT_THREAD_SHUTDOWN_REPUBLISH_HOST_DISPATCHES.store(0, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_shutdown_republish_host_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(std::future::pending::<()>(), move |runnable| {
      scheduler.schedule(runnable)
    });

    let (returned_tx, returned_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          returned_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      publishing_executor.schedule(runnable);
    });
    returned_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the initial publication must reach its completion barrier");

    let dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    executor.request_drain_if_queued();
    let publication_state = {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      (
        scheduler.active_dispatch_calls,
        scheduler.dispatch_publications.len(),
        scheduler.dispatch_publications[0].dispatch,
        scheduler.dispatch_publications[0].republish_requested,
      )
    };
    executor.begin_shutdown();
    release_tx.send(()).unwrap();
    publication.join().unwrap();
    executor.wait_until_scheduler_idle();

    assert_ne!(dispatch, 0);
    assert_eq!(publication_state, (1, 1, dispatch, true));
    assert_eq!(
      CURRENT_THREAD_SHUTDOWN_REPUBLISH_HOST_DISPATCHES.load(Ordering::SeqCst),
      1
    );
    {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(scheduler.active_dispatch_calls, 0);
      assert!(scheduler.dispatch_publications.is_empty());
    }
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), 0);
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(futures::executor::block_on(task.fallible()), None);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_republish_bit_rearms_across_successive_broadcasts() {
    use std::sync::mpsc;

    CURRENT_THREAD_REPUBLISH_REARM_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      record_current_thread_republish_rearm_dispatch,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 19usize }, move |runnable| {
      scheduler.schedule(runnable)
    });

    let (first_returned_tx, first_returned_rx) = mpsc::channel();
    let (release_first_tx, release_first_rx) = mpsc::channel();
    let (second_returned_tx, second_returned_rx) = mpsc::channel();
    let (release_second_tx, release_second_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          first_returned_tx.send(()).unwrap();
          release_first_rx.recv().unwrap();
          CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| {
            *slot.borrow_mut() = Some(Box::new(move || {
              second_returned_tx.send(()).unwrap();
              release_second_rx.recv().unwrap();
            }));
          });
        }));
      });
      publishing_executor.schedule(runnable);
    });
    first_returned_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the first publication must reach its completion barrier");

    let dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    executor.request_drain_if_queued();
    executor.request_drain_if_queued();
    let first_publication_state = {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      (
        scheduler.active_dispatch_calls,
        scheduler.dispatch_publications.len(),
        scheduler.dispatch_publications[0].dispatch,
        scheduler.dispatch_publications[0].republish_requested,
      )
    };
    release_first_tx.send(()).unwrap();
    second_returned_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the second publication must reach its completion barrier");

    executor.request_drain_if_queued();
    executor.request_drain_if_queued();
    let second_publication_state = {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      (
        scheduler.active_dispatch_calls,
        scheduler.dispatch_publications.len(),
        scheduler.dispatch_publications[0].dispatch,
        scheduler.dispatch_publications[0].republish_requested,
      )
    };
    release_second_tx.send(()).unwrap();
    publication.join().unwrap();

    assert_ne!(dispatch, 0);
    assert_eq!(first_publication_state, (1, 1, dispatch, true));
    assert_eq!(second_publication_state, (1, 1, dispatch, true));
    assert_eq!(
      *CURRENT_THREAD_REPUBLISH_REARM_DISPATCHES.lock().unwrap(),
      vec![dispatch, dispatch, dispatch],
      "each newly armed republish bit must add one broadcast while duplicate requests coalesce"
    );
    {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(scheduler.active_dispatch_calls, 0);
      assert!(scheduler.dispatch_publications.is_empty());
    }
    executor.drive_host_turn_for_dispatch(dispatch);
    assert_eq!(futures::executor::block_on(task.fallible()), Some(19));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_initial_unavailable_cannot_retire_later_accepted_publication() {
    use std::sync::mpsc;

    CURRENT_THREAD_INITIAL_PUBLICATION_RACE_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      reject_initial_current_thread_publication_once,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 11usize }, move |runnable| {
      scheduler.schedule(runnable)
    });

    let (returned_tx, returned_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          returned_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      publishing_executor.schedule(runnable);
    });
    returned_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the unavailable initial publication must reach its completion barrier");

    let dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    executor.request_drain_if_queued();
    let attempts_while_unavailable_is_paused = CURRENT_THREAD_INITIAL_PUBLICATION_RACE_DISPATCHES
      .lock()
      .unwrap()
      .len();

    release_tx.send(()).unwrap();
    publication.join().unwrap();

    let dispatches = CURRENT_THREAD_INITIAL_PUBLICATION_RACE_DISPATCHES
      .lock()
      .unwrap()
      .clone();
    assert_ne!(dispatch, 0);
    assert_eq!(
      attempts_while_unavailable_is_paused, 1,
      "a racing host request must join the in-flight publication instead of retiring it independently"
    );
    assert_eq!(
      dispatches,
      vec![dispatch, dispatch],
      "the publication owner must retry the same internal capability after the new host joins"
    );
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), dispatch);
    executor.drive_host_turn_for_dispatch(dispatch);
    assert_eq!(futures::executor::block_on(task.fallible()), Some(11));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_replacement_unavailable_cannot_cancel_later_accepted_publication() {
    use std::sync::mpsc;

    CURRENT_THREAD_REPLACEMENT_PUBLICATION_RACE_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      reject_current_thread_replacement_publication_once,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 13usize }, move |runnable| {
      scheduler.schedule(runnable)
    });
    executor.schedule(runnable);
    let failed_dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    assert_ne!(failed_dispatch, 0);

    let (returned_tx, returned_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let cancelling_executor = Arc::clone(&executor);
    let cancellation = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          returned_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      cancelling_executor.cancel_host_dispatch_for_test(failed_dispatch);
    });
    returned_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the unavailable replacement publication must reach its completion barrier");

    let replacement_dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    executor.request_drain_if_queued();
    let attempts_while_unavailable_is_paused =
      CURRENT_THREAD_REPLACEMENT_PUBLICATION_RACE_DISPATCHES
        .lock()
        .unwrap()
        .len();

    release_tx.send(()).unwrap();
    cancellation.join().unwrap();

    let dispatches = CURRENT_THREAD_REPLACEMENT_PUBLICATION_RACE_DISPATCHES
      .lock()
      .unwrap()
      .clone();
    assert_ne!(replacement_dispatch, 0);
    assert_ne!(replacement_dispatch, failed_dispatch);
    assert_eq!(
      attempts_while_unavailable_is_paused, 2,
      "a racing host request must join the in-flight replacement publication"
    );
    assert_eq!(
      dispatches,
      vec![failed_dispatch, replacement_dispatch, replacement_dispatch],
      "republication must reuse the sole replacement capability instead of allocating another"
    );
    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      replacement_dispatch
    );
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      replacement_dispatch
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 1);

    executor.drive_host_turn_for_dispatch(replacement_dispatch);
    assert_eq!(futures::executor::block_on(task.fallible()), Some(13));
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_replacement_failed_retries_armed_republish_before_cancellation() {
    use std::sync::mpsc;

    CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    {
      let state = CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
    }
    let initial = Arc::new(ManualCurrentThreadTaskDriver::default());
    let initial_registration = CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
      .register(Arc::clone(&initial) as Arc<dyn CurrentThreadTaskDriver>);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
      Arc::clone(&metrics),
      fail_current_thread_replacement_publication_once,
      &CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 29usize }, move |runnable| {
      scheduler.schedule(runnable)
    });
    executor.schedule(runnable);
    let failed_dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    assert_ne!(failed_dispatch, 0);
    let initial_delivery = initial.deliveries()[0];
    let failed_completion = CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
      .finish_delivery(initial_delivery, true);
    let [failed_dispatch_failure] = failed_completion.failed_dispatches.as_slice() else {
      panic!("the initial accepted delivery must report one exact failure");
    };
    assert_eq!(failed_dispatch_failure.dispatch, failed_dispatch);
    let failed_dispatch_failure = *failed_dispatch_failure;
    CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS.unregister(initial_registration);
    let failed_registration = CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
      .register(Arc::new(FailDuringReplacementRepublishPublication));

    let (returned_tx, returned_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let cancelling_executor = Arc::clone(&executor);
    let cancellation = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          returned_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      cancelling_executor.cancel_host_dispatch(failed_dispatch_failure);
    });
    returned_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the failed replacement publication must reach its completion barrier");

    let replacement_dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    let healthy = Arc::new(ManualCurrentThreadTaskDriver::default());
    let healthy_registration = CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
      .register(Arc::clone(&healthy) as Arc<dyn CurrentThreadTaskDriver>);
    executor.request_drain_if_queued();
    let publication_state = {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      (
        scheduler.active_dispatch_calls,
        scheduler.dispatch_publications.len(),
        scheduler.dispatch_publications[0].dispatch,
        scheduler.dispatch_publications[0].republish_requested,
      )
    };
    release_tx.send(()).unwrap();
    cancellation.join().unwrap();

    assert_ne!(replacement_dispatch, 0);
    assert_ne!(replacement_dispatch, failed_dispatch);
    assert_eq!(publication_state, (1, 1, replacement_dispatch, true));
    assert_eq!(
      *CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_DISPATCHES
        .lock()
        .unwrap(),
      vec![failed_dispatch, replacement_dispatch, replacement_dispatch],
      "the newly armed host request must receive the exact replacement before cancellation"
    );
    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      replacement_dispatch
    );
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      replacement_dispatch
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 1);

    let delivery = healthy.deliveries()[0];
    assert_eq!(delivery.dispatch, replacement_dispatch);
    assert_eq!(
      CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
        .claim_delivery(delivery.capability()),
      Some(replacement_dispatch)
    );
    let mut host_turn = executor
      .try_admit_host_turn(replacement_dispatch)
      .expect("the rearmed replacement delivery must be admitted");
    CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS.mark_serviced(replacement_dispatch);
    host_turn.drive();
    assert!(
      CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
        .finish_delivery(delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert_eq!(futures::executor::block_on(task.fallible()), Some(29));
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);

    CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS.unregister(failed_registration);
    CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS.unregister(healthy_registration);
    let state = CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(state.entries.is_empty());
    assert!(state.dispatches.is_empty());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_delayed_failure_cannot_cancel_successfully_rearmed_epoch() {
    use std::sync::mpsc;

    {
      let state = CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
    }
    let initial = Arc::new(ManualCurrentThreadTaskDriver::default());
    let initial_registration = CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
      .register(Arc::clone(&initial) as Arc<dyn CurrentThreadTaskDriver>);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
      Arc::clone(&metrics),
      dispatch_stale_failure_current_thread_tasks,
      &CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 43usize }, move |runnable| {
      scheduler.schedule(runnable)
    });
    executor.schedule(runnable);

    let dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    let initial_delivery = initial.deliveries()[0];
    let delayed_completion =
      CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS.finish_delivery(initial_delivery, true);
    let [delayed_failure] = delayed_completion.failed_dispatches.as_slice() else {
      panic!("the initial accepted delivery must report one exact failure");
    };
    assert_eq!(
      *delayed_failure,
      current_thread_dispatch_failure(dispatch, 0)
    );
    let delayed_failure = *delayed_failure;

    let (returned_tx, returned_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_RETURNED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          returned_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      publishing_executor.request_drain_if_queued();
    });
    returned_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the old failed epoch must pause before executor recovery");

    let healthy = Arc::new(ManualCurrentThreadTaskDriver::default());
    let healthy_registration = CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
      .register(Arc::clone(&healthy) as Arc<dyn CurrentThreadTaskDriver>);
    executor.request_drain_if_queued();
    release_tx.send(()).unwrap();
    publication.join().unwrap();

    let healthy_delivery = healthy.deliveries()[0];
    let delayed_initial_delivery = initial.deliveries()[1];
    {
      let state = CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let dispatch_state = state
        .dispatches
        .get(&dispatch)
        .expect("the rearmed dispatch must remain registered");
      assert_eq!(dispatch_state.epoch, 1);
      assert!(!dispatch_state.is_cancelling());
    }

    executor.cancel_host_dispatch(delayed_failure);

    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      dispatch,
      "the delayed old-epoch failure must not consume the rearmed executor capability"
    );
    assert_eq!(
      CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .dispatches
        .get(&dispatch)
        .map(|state| (state.epoch, state.phase)),
      Some((1, CurrentThreadDispatchPhase::Pending)),
      "the delayed old-epoch cancellation must not remove the accepted rearm"
    );

    assert_eq!(
      CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS.claim_delivery(healthy_delivery.capability()),
      Some(dispatch)
    );
    let mut host_turn = executor
      .try_admit_host_turn(dispatch)
      .expect("the current-epoch delivery must be admitted");
    CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS.mark_serviced(dispatch);
    host_turn.drive();
    assert!(
      CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
        .finish_delivery(healthy_delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert!(
      CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
        .finish_delivery(delayed_initial_delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert_eq!(futures::executor::block_on(task.fallible()), Some(43));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);

    CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS.unregister(initial_registration);
    CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS.unregister(healthy_registration);
    let state = CURRENT_THREAD_STALE_FAILURE_TASK_DRIVERS
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(state.entries.is_empty());
    assert!(state.dispatches.is_empty());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_failed_replacement_closes_ownerless_registration_gap() {
    use std::sync::mpsc;

    {
      let state = CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
    }
    let failed_registration = CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS
      .register(Arc::new(FailDuringLateRegistrationPublication));

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
      Arc::clone(&metrics),
      dispatch_late_registration_current_thread_tasks,
      &CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(std::future::pending::<()>(), move |runnable| {
      scheduler.schedule(runnable)
    });
    metrics.runnable_scheduled();
    executor
      .queue
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .runnables
      .push_back(runnable);
    let replacement_dispatch = next_current_thread_dispatch_id();
    executor
      .recovery_dispatch
      .store(replacement_dispatch, Ordering::Release);
    executor
      .dispatch_pending
      .store(replacement_dispatch, Ordering::Release);

    let (owner_retired_tx, owner_retired_rx) = mpsc::channel();
    let (request_blocked_tx, request_blocked_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_FAILED_PUBLICATION_RETIRED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          owner_retired_tx.send(()).unwrap();
          request_blocked_rx
            .recv_timeout(Duration::from_secs(2))
            .expect("the binding-like drain request must wait for the failure transition");
        }));
      });
      publishing_executor.request_drain_if_queued();
    });
    owner_retired_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the failed replacement publication must retire its owner");

    // Match the binding sequence: publish the host registration first, then
    // request service for work that may have accumulated before registration.
    let healthy = Arc::new(ManualCurrentThreadTaskDriver::default());
    let healthy_registration = CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS
      .register(Arc::clone(&healthy) as Arc<dyn CurrentThreadTaskDriver>);
    let requesting_executor = Arc::clone(&executor);
    let request = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_PUBLICATION_BLOCKED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          request_blocked_tx.send(()).unwrap();
        }));
      });
      requesting_executor.request_drain_if_queued();
    });

    publication.join().unwrap();
    request.join().unwrap();

    assert!(
      healthy.deliveries().is_empty(),
      "publication admission must not recreate the closed replacement between owner retirement and terminal cancellation"
    );
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), 0);
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(futures::executor::block_on(task.fallible()), None);
    {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(scheduler.active_dispatch_calls, 0);
      assert!(scheduler.dispatch_publications.is_empty());
    }

    CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS.unregister(failed_registration);

    let scheduler = Arc::clone(&executor);
    let (later_runnable, later_task) = async_task::spawn(async { 31usize }, move |runnable| {
      scheduler.schedule(runnable)
    });
    executor.schedule(later_runnable);
    let later_dispatch = executor.dispatch_pending.load(Ordering::Acquire);
    let later_delivery = healthy.deliveries()[0];
    assert_eq!(
      CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS.claim_delivery(later_delivery.capability()),
      Some(later_dispatch)
    );
    let mut host_turn = executor
      .try_admit_host_turn(later_dispatch)
      .expect("the later exact delivery must be admitted");
    CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS.mark_serviced(later_dispatch);
    host_turn.drive();
    assert!(
      CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS
        .finish_delivery(later_delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert_eq!(futures::executor::block_on(later_task.fallible()), Some(31));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);

    CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS.unregister(healthy_registration);
    let state = CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(state.entries.is_empty());
    assert!(state.dispatches.is_empty());
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn current_thread_nested_replacement_unwind_finalizes_old_dispatch_and_retries_same_replacement()
  {
    CURRENT_THREAD_NESTED_UNWIND_DISPATCHES
      .lock()
      .unwrap()
      .clear();
    {
      let state = CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
    }
    CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
      .next_delivery
      .store(0, Ordering::Relaxed);
    let failed_registration = CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
      .register(Arc::new(FailDuringNestedUnwindPublication));

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
      Arc::clone(&metrics),
      dispatch_nested_unwind_current_thread_tasks,
      &CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS,
    ));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 37usize }, move |runnable| {
      scheduler.schedule(runnable)
    });

    CURRENT_THREAD_FAILED_PUBLICATION_RETIRED_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(|| {
        CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
          .next_delivery
          .store(u64::MAX, Ordering::Relaxed);
      }));
    });
    let publication = catch_unwind(AssertUnwindSafe(|| executor.schedule(runnable)));
    assert!(
      publication.is_err(),
      "replacement delivery-id exhaustion must unwind through the outer failed publication"
    );

    let dispatches = CURRENT_THREAD_NESTED_UNWIND_DISPATCHES
      .lock()
      .unwrap()
      .clone();
    assert_eq!(dispatches.len(), 2);
    let failed_dispatch = dispatches[0];
    let replacement_dispatch = dispatches[1];
    assert_ne!(failed_dispatch, replacement_dispatch);
    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      replacement_dispatch
    );
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      replacement_dispatch
    );
    {
      let scheduler = executor
        .scheduler_idle_lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(scheduler.active_dispatch_calls, 0);
      assert!(scheduler.dispatch_publications.is_empty());
    }
    {
      let state = CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        !state.dispatches.contains_key(&failed_dispatch),
        "outer unwind cleanup must retire the exact old cancelling dispatch"
      );
      assert!(
        !state.dispatches.contains_key(&replacement_dispatch),
        "the replacement publication guard must release its aborted registry state"
      );
    }

    CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
      .next_delivery
      .store(1, Ordering::Relaxed);
    CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS.unregister(failed_registration);
    let healthy = Arc::new(ManualCurrentThreadTaskDriver::default());
    let healthy_registration = CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
      .register(Arc::clone(&healthy) as Arc<dyn CurrentThreadTaskDriver>);

    executor.request_drain_if_queued();

    assert_eq!(
      *CURRENT_THREAD_NESTED_UNWIND_DISPATCHES.lock().unwrap(),
      vec![failed_dispatch, replacement_dispatch, replacement_dispatch],
      "retry must reuse the replacement reserved before the nested unwind"
    );
    let delivery = healthy.deliveries()[0];
    assert_eq!(delivery.dispatch, replacement_dispatch);
    assert_eq!(
      CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS.claim_delivery(delivery.capability()),
      Some(replacement_dispatch)
    );
    let mut host_turn = executor
      .try_admit_host_turn(replacement_dispatch)
      .expect("the retried replacement delivery must be admitted");
    CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS.mark_serviced(replacement_dispatch);
    host_turn.drive();
    assert!(
      CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
        .finish_delivery(delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert_eq!(futures::executor::block_on(task.fallible()), Some(37));
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);

    CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS.unregister(healthy_registration);
    let state = CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(state.entries.is_empty());
    assert!(state.dispatches.is_empty());
  }

  #[test]
  fn current_thread_cancelled_host_dispatch_recovers_without_a_later_wake() {
    reset_current_thread_recovery_host_dispatches();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_recovery_host_dispatch,
    ));

    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(async { 1usize }, move |runnable| {
      scheduler.schedule(runnable)
    });
    executor.schedule(runnable);
    assert_eq!(current_thread_recovery_host_dispatches(), 1);
    let failed_dispatch = current_thread_dispatch(&executor);

    // Model the host scheduler throwing after Rust accepted the callback but
    // before JavaScript could queue a fresh turn.
    executor.cancel_host_dispatch_for_test(failed_dispatch);
    assert_eq!(
      current_thread_recovery_host_dispatches(),
      2,
      "cancellation must request one replacement without another submission"
    );
    let replacement_dispatch = current_thread_dispatch(&executor);
    assert_ne!(replacement_dispatch, failed_dispatch);
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      replacement_dispatch
    );

    executor.drive_host_turn_for_dispatch(replacement_dispatch);
    assert_eq!(futures::executor::block_on(task), 1);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
  }

  #[test]
  fn current_thread_second_host_dispatch_failure_cancels_work_and_reopens() {
    reset_current_thread_recovery_host_dispatches();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_recovery_host_dispatch,
    ));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

    let registration = backend
      .work
      .try_register_async()
      .expect("the backend must accept work");
    let task = spawn_registered(
      &backend,
      Arc::clone(&metrics),
      std::future::pending::<()>(),
      registration,
    );
    let failed_dispatch = current_thread_dispatch(&executor);
    executor.cancel_host_dispatch_for_test(failed_dispatch);
    let replacement_dispatch = current_thread_dispatch(&executor);

    executor.cancel_host_dispatch_for_test(replacement_dispatch);

    assert_eq!(
      current_thread_recovery_host_dispatches(),
      2,
      "a second scheduler failure must not create an unbounded retry loop"
    );
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), 0);
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(
      futures::executor::block_on(task).unwrap_err().to_string(),
      "async runtime stopped before the task completed",
      "terminal host failure must settle the original operation as cancelled"
    );
    assert_eq!(backend.work.state.lock().unwrap().active, 0);

    let later_registration = backend
      .work
      .try_register_async()
      .expect("terminal cancellation must reopen acceptance");
    let later_task = spawn_registered(
      &backend,
      Arc::clone(&metrics),
      async { 2usize },
      later_registration,
    );
    assert_eq!(
      current_thread_recovery_host_dispatches(),
      3,
      "terminal cancellation must not permanently close the executor"
    );
    executor.drive_host_turn();
    assert_eq!(futures::executor::block_on(later_task).unwrap(), 2);
  }

  /// Regression test for the hazard shape rolldown hit when a `worker_threads`
  /// Worker running watch mode is torn down on the CurrentThread flavor: the
  /// cleanup-hook dispatch failure cancels the queued coordinator runnable,
  /// whose JoinHandle is wrapped in `futures::Shared`. `Shared`'s notifier
  /// wakes its awaiters while holding its `wakers` mutex; the parked awaiter's
  /// schedule is rejected by the cancellation sweep, and dropping that
  /// runnable inline destroys the awaiter's `Shared` clone, whose destructor
  /// re-locks `wakers` on the same thread.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_failed_dispatch_cancellation_does_not_drop_rejected_runnable_inline() {
    use std::{sync::mpsc, time::Duration};

    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
        Arc::clone(&metrics),
        accept_current_thread_host_dispatch,
      ));

      // Task A: its JoinHandle is shared, exactly like a watcher close handle.
      let scheduler_a = Arc::clone(&executor);
      let (runnable_a, task_a) = async_task::spawn(std::future::pending::<()>(), move |runnable| {
        scheduler_a.schedule(runnable)
      });
      let shared = async move { task_a.fallible().await }.boxed().shared();
      let shared_for_b = shared.clone();

      // Task B: awaits a clone of that Shared and parks after one poll.
      let scheduler_b = Arc::clone(&executor);
      let (runnable_b, task_b) = async_task::spawn(
        async move {
          shared_for_b.await;
        },
        move |runnable| scheduler_b.schedule(runnable),
      );
      executor.schedule(runnable_b);
      executor.drive_host_turn();
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "B must be parked and unscheduled after its first poll"
      );

      // A's runnable is queued (woken, not yet polled) when the host dispatch
      // fails twice, so the terminal cancellation sweep drops it.
      executor.schedule(runnable_a);
      let failed_dispatch = current_thread_dispatch(&executor);
      executor.cancel_host_dispatch_for_test(failed_dispatch);
      let replacement_dispatch = current_thread_dispatch(&executor);
      executor.cancel_host_dispatch_for_test(replacement_dispatch);

      assert!(
        !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
        "the cancellation sweep must reopen the executor"
      );
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert!(
        futures::executor::block_on(task_b.fallible()).is_none(),
        "B's rejected wake must still cancel B"
      );
      drop(shared);
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("teardown deadlocked: inline runnable drop re-entered a waker lock");
  }

  /// Regression test for the closed-queue sibling of the hazard above. A wake
  /// can be in flight on any thread when shutdown starts: `async-task` marks
  /// the task `SCHEDULED` before it invokes the schedule closure, so the abort
  /// that `close_and_abort` issues for that task coalesces with the in-flight
  /// wake and returns, `begin_shutdown` closes the queue without waiting for
  /// the closure to land, and the resumed closure is rejected by the closed
  /// queue. That rejection must not drop the runnable inline either: the
  /// waker here is still inside `futures::Shared`'s notifier, holding its
  /// `wakers` mutex, and the rejected future owns a clone of the same `Shared`.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_does_not_drop_in_flight_rejected_runnable_inline() {
    use std::{
      sync::{Barrier, mpsc},
      time::Duration,
    };

    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
        Arc::clone(&metrics),
        accept_current_thread_host_dispatch,
      ));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let generation = backend.generation();

      // Task A: registered like production work; its JoinHandle is shared.
      let (abort_a, guard_a) = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let scheduler_a = Arc::clone(&executor);
      let (runnable_a, task_a) = async_task::spawn(
        RegisteredTaskFuture::new(
          Abortable::new(std::future::pending::<()>(), abort_a),
          guard_a,
          generation,
        ),
        move |runnable| scheduler_a.schedule(runnable),
      );
      let shared = async move { task_a.fallible().await.is_some() }
        .boxed()
        .shared();
      let shared_for_b = shared.clone();

      // Task B: registered and abortable too, awaiting a clone of that Shared.
      // Its schedule closure pauses before it reaches the executor, exactly
      // where a waker thread may be descheduled while shutdown runs.
      let (abort_b, guard_b) = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let wake_in_flight = Arc::new(Barrier::new(2));
      let wake_release = Arc::new(Barrier::new(2));
      let scheduler_b = Arc::clone(&executor);
      let (runnable_b, task_b) = async_task::spawn(
        RegisteredTaskFuture::new(
          Abortable::new(
            async move {
              shared_for_b.await;
            },
            abort_b,
          ),
          guard_b,
          generation,
        ),
        {
          let wake_in_flight = Arc::clone(&wake_in_flight);
          let wake_release = Arc::clone(&wake_release);
          move |runnable| {
            wake_in_flight.wait();
            wake_release.wait();
            scheduler_b.schedule(runnable);
          }
        },
      );
      executor.schedule(runnable_b);
      executor.drive_host_turn();
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "B must be parked and unscheduled after its first poll"
      );

      // Cancel A on another thread: closing A notifies its awaiter, and the
      // Shared notifier wakes B while holding `wakers`. B's schedule closure
      // then parks at the barrier with that lock still held.
      let waker_thread = std::thread::spawn(move || drop(runnable_a));
      wake_in_flight.wait();

      // Shutdown: `close_and_abort` aborts B, which is already SCHEDULED, so
      // the abort wake is a no-op; the queue then closes.
      backend.begin_shutdown();
      wake_release.wait();
      backend.wait_until_idle();

      waker_thread
        .join()
        .expect("the waker thread must not panic");
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert!(
        futures::executor::block_on(task_b.fallible()).is_none(),
        "B's rejected wake must still cancel B"
      );
      assert_eq!(backend.work.state.lock().unwrap().active, 0);
      drop(shared);
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("shutdown deadlocked: inline runnable drop re-entered a waker lock");
  }

  /// Regression test for the terminal-failure sibling of the two hazards
  /// above. Task B awaits a `futures::Shared` and parks. Completing the Shared
  /// wakes B from inside its notifier, which holds `wakers`, and `schedule`
  /// publishes a host dispatch on that same stack. The host fails the
  /// delivery before `dispatch` returns, and fails the one replacement the
  /// same way, so the terminal failure transition runs while the waker's
  /// stack is still under `wakers`. Nothing may be dropped there: B's future
  /// owns a clone of the same `Shared`, whose destructor re-locks `wakers`.
  /// The transition moves B aside and reopens; the next host turn cancels B.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_synchronous_dispatch_failure_does_not_sweep_on_the_waker_stack() {
    use std::{sync::mpsc, time::Duration};

    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      {
        let state = CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(SynchronouslyFailingCurrentThreadTaskDriver::new(
        &CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS,
      ));
      let registration = CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS
        .register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_waker_stack_failure_current_thread_tasks,
        &CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS,
      ));

      // Task B awaits a clone of a Shared and parks after its first poll.
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let scheduler_b = Arc::clone(&executor);
      let (runnable_b, task_b) = async_task::spawn(
        async move {
          shared_for_b.await;
        },
        move |runnable| scheduler_b.schedule(runnable),
      );
      executor.schedule(runnable_b);

      // Service the accepted delivery the way `drive_current_thread_tasks`
      // and `acknowledge_current_thread_task_delivery` do.
      let delivery = driver.deliveries()[0];
      let dispatch = CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS
        .claim_delivery(delivery.capability())
        .expect("the accepted delivery must be claimable");
      let mut host_turn = executor
        .try_admit_host_turn(dispatch)
        .expect("the claimed delivery must be admitted");
      CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS.mark_serviced(dispatch);
      host_turn.drive();
      drop(host_turn);
      let completion =
        CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS.finish_delivery(delivery, false);
      assert!(completion.failed_dispatches.is_empty());
      assert!(!completion.redispatch);
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "B must be parked and unscheduled after its first poll"
      );

      // From now on every accepted delivery fails before `dispatch` returns.
      driver.fail.store(true, Ordering::SeqCst);
      // Completing the Shared wakes B from inside its notifier, under
      // `wakers`; B's schedule publishes the dispatch and its replacement on
      // this stack, both fail, and the terminal transition runs here.
      tx.send(()).expect("B must still hold its Shared clone");
      assert_eq!(
        driver.deliveries().len(),
        // The initial service, the wake's dispatch and its one replacement,
        // then the retirement turns and the final offer -- this host refuses
        // every one of them.
        1 + 2 + CurrentThreadExecutor::REJECTED_WORK_RETIREMENT_ATTEMPTS + 1,
        "the wake must publish the dispatch, its one replacement, and the \
         retirement turns the terminal transition owes itself"
      );
      assert!(
        !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
        "the terminal failure must reopen the executor before the waker returns"
      );
      assert!(
        executor.has_rejected_work(),
        "B must be moved aside, not dropped on the waker's stack"
      );
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "the moved runnable carries its queued debit"
      );
      let mut task_b = task_b.fallible();
      assert!(
        poll_ready_within(&mut task_b, Duration::ZERO).is_none(),
        "B must still be pending: nothing may be dropped on the waker's stack"
      );

      // The next host turn (what `drive_current_thread_tasks` runs for the
      // delivery a later submission publishes) cancels B on its own stack.
      executor.drive_host_turn();
      assert!(!executor.has_rejected_work());
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert!(
        poll_ready_within(&mut task_b, Duration::from_secs(5))
          .expect("the host turn must cancel B")
          .is_none(),
        "the terminal failure must still cancel B"
      );
      drop(shared);

      CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS.unregister(registration);
      let state = CURRENT_THREAD_WAKER_STACK_FAILURE_TASK_DRIVERS
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("terminal cancellation deadlocked: the sweep ran on the waker's stack");
  }

  /// Poll `future` with a no-op waker until it is ready or `timeout` passes.
  /// The tests below drive the executor by hand, so readiness is produced on
  /// this thread and a wait can only fail by design, never by scheduling.
  #[cfg(napi_runtime_os_threads)]
  fn poll_ready_within<F: Future + Unpin>(
    future: &mut F,
    timeout: std::time::Duration,
  ) -> Option<F::Output> {
    let deadline = std::time::Instant::now() + timeout;
    let mut cx = Context::from_waker(futures::task::noop_waker_ref());
    loop {
      if let Poll::Ready(output) = Pin::new(&mut *future).poll(&mut cx) {
        return Some(output);
      }
      if std::time::Instant::now() >= deadline {
        return None;
      }
      std::thread::sleep(std::time::Duration::from_millis(1));
    }
  }

  /// Liveness regression test for the transition above. After the waker-stack
  /// terminal failure the driver stays registered and becomes healthy again.
  /// Work submitted from then on is new work: its schedule must publish a
  /// fresh delivery, and the host turn that services it cancels the work that
  /// was queued when the failure happened (B) before it runs the new task.
  /// Nothing else prompts the executor: no drain request, no re-registration,
  /// no shutdown.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_submission_after_waker_stack_failure_is_delivered_to_a_healthy_host() {
    use std::{sync::mpsc, time::Duration};

    const WAIT: Duration = Duration::from_secs(5);
    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      let registry = &*CURRENT_THREAD_HEALTHY_AFTER_WAKER_STACK_FAILURE_TASK_DRIVERS;
      {
        let state = registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(SynchronouslyFailingCurrentThreadTaskDriver::new(registry));
      let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_healthy_after_waker_stack_failure_current_thread_tasks,
        registry,
      ));

      // Service one accepted delivery the way the host does.
      let service = |index: usize| {
        let delivery = driver.deliveries()[index];
        let dispatch = registry
          .claim_delivery(delivery.capability())
          .expect("the accepted delivery must be claimable");
        let mut host_turn = executor
          .try_admit_host_turn(dispatch)
          .expect("the claimed delivery must be admitted");
        registry.mark_serviced(dispatch);
        host_turn.drive();
        drop(host_turn);
        let completion = registry.finish_delivery(delivery, false);
        assert!(completion.failed_dispatches.is_empty());
        assert!(!completion.redispatch);
      };

      // Task B awaits a clone of a Shared and parks after its first poll.
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let scheduler_b = Arc::clone(&executor);
      let (runnable_b, task_b) = async_task::spawn(
        async move {
          shared_for_b.await;
        },
        move |runnable| scheduler_b.schedule(runnable),
      );
      executor.schedule(runnable_b);
      service(0);
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);

      // The waker-stack terminal failure: the wake's dispatch and its one
      // replacement both fail before `dispatch` returns.
      driver.fail.store(true, Ordering::SeqCst);
      tx.send(()).expect("B must still hold its Shared clone");
      // The dispatch, its one replacement, and the retirement turns the
      // transition publishes for itself -- which this still-failing host
      // loses too, down to the final offer.
      const AFTER_WAKE: usize =
        1 + 2 + CurrentThreadExecutor::REJECTED_WORK_RETIREMENT_ATTEMPTS + 1;
      assert_eq!(driver.deliveries().len(), AFTER_WAKE);
      let mut task_b = task_b.fallible();
      assert!(
        poll_ready_within(&mut task_b, Duration::ZERO).is_none(),
        "B must still be pending: nothing may be dropped on the waker's stack"
      );

      // The host is healthy again and still registered. A later submission
      // must publish a delivery on its own.
      driver.fail.store(false, Ordering::SeqCst);
      let scheduler_later = Arc::clone(&executor);
      let (runnable_later, task_later) = async_task::spawn(async { 42usize }, move |runnable| {
        scheduler_later.schedule(runnable)
      });
      executor.schedule(runnable_later);
      assert_eq!(
        driver.deliveries().len(),
        AFTER_WAKE + 1,
        "a submission after the terminal failure must publish a fresh delivery"
      );
      assert!(
        !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
        "the executor must be open for the healthy host"
      );

      // The host services that delivery: the pre-failure work is cancelled
      // and the new task runs.
      service(AFTER_WAKE);
      let mut task_later = task_later.fallible();
      assert_eq!(
        poll_ready_within(&mut task_later, WAIT).expect("the later task must have run"),
        Some(42),
        "the later task must complete on the delivered host turn"
      );
      assert!(
        poll_ready_within(&mut task_b, WAIT)
          .expect("B must have been cancelled by the host turn")
          .is_none(),
        "the terminal failure must still cancel the work queued when it happened"
      );
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      drop(shared);

      registry.unregister(registration);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(WAIT)
      .expect("the healthy host never got a delivery for the later submission");
  }

  /// Regression test for the continuation a WAKE owes itself.
  ///
  /// `6d452174` gave an ordinary submission its own continuation, but a
  /// genuine wake still had none. B parks on a `futures::Shared`; completing
  /// the Shared wakes B from inside its notifier, which holds `wakers`, so
  /// `schedule` publishes on a stack where nothing may be destroyed. The host
  /// loses that publication and the one replacement before `dispatch`
  /// returns, and the terminal transition moves B into `queue.rejected` and
  /// reopens -- correctly dropping nothing.
  ///
  /// What was missing is what happens next. The transition consumed the
  /// executor's one outstanding host request and left the queue empty, so
  /// `has_serviceable_work` is false and nothing published again: during
  /// normal operation there is no generation idle waiter, no host turn
  /// follows the failed publications, and B's `JoinHandle` and
  /// `GenerationWorkGuard` stayed live forever. Nothing in this test supplies
  /// an unrelated entry -- no later submission, no drain request, no
  /// unregistration, no shutdown. The host only services the delivery the
  /// transition published for ITSELF.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_waker_stack_failure_publishes_its_own_retirement_turn() {
    use std::{sync::mpsc, time::Duration};

    const WAIT: Duration = Duration::from_secs(5);
    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      let registry = &*CURRENT_THREAD_RETIREMENT_TURN_TASK_DRIVERS;
      {
        let state = registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(BoundedFailureCurrentThreadTaskDriver::new(registry));
      let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_retirement_turn_current_thread_tasks,
        registry,
      ));

      // Service one accepted delivery the way the host does.
      let service = |index: usize| {
        let delivery = driver.deliveries()[index];
        let dispatch = registry
          .claim_delivery(delivery.capability())
          .expect("the accepted delivery must be claimable");
        let mut host_turn = executor
          .try_admit_host_turn(dispatch)
          .expect("the claimed delivery must be admitted");
        registry.mark_serviced(dispatch);
        host_turn.drive();
        drop(host_turn);
        let completion = registry.finish_delivery(delivery, false);
        assert!(completion.failed_dispatches.is_empty());
        assert!(!completion.redispatch);
      };

      // Task B awaits a clone of a Shared and parks after its first poll.
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let scheduler_b = Arc::clone(&executor);
      let (runnable_b, task_b) = async_task::spawn(
        async move {
          shared_for_b.await;
        },
        move |runnable| scheduler_b.schedule(runnable),
      );
      executor.schedule(runnable_b);
      service(0);
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "B must be parked and unscheduled after its first poll"
      );

      // Exactly the wake's publication and its one replacement are lost; the
      // host is healthy again from the third delivery on.
      driver.fail_budget.store(2, Ordering::SeqCst);
      tx.send(()).expect("B must still hold its Shared clone");

      assert_eq!(
        driver.deliveries().len(),
        4,
        "the wake must publish the dispatch, its one replacement, and the \
         retirement turn the terminal transition owes itself; without that \
         third publication no host turn ever follows and B stays pending \
         forever"
      );
      assert!(
        !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
        "the terminal failure must reopen the executor before the waker returns"
      );
      assert!(
        executor.has_rejected_work(),
        "B must be moved aside, not dropped on the waker's stack"
      );
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "the moved runnable carries its queued debit"
      );
      let mut task_b = task_b.fallible();
      assert!(
        poll_ready_within(&mut task_b, Duration::ZERO).is_none(),
        "B must still be pending: nothing may be dropped on the waker's stack"
      );

      // The ONLY continuation: the host serves the turn the transition asked
      // for. No submission, no drain request, no unregistration, no shutdown.
      service(3);
      assert!(
        !executor.has_rejected_work(),
        "the retirement turn must cancel the moved work on its own stack"
      );
      assert!(
        poll_ready_within(&mut task_b, WAIT)
          .expect("the retirement turn must cancel B")
          .is_none(),
        "the terminal failure must still cancel the work queued when it happened"
      );
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      drop(shared);

      registry.unregister(registration);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx.recv_timeout(WAIT).expect(
      "a waker-stack terminal failure published no retirement turn: B's runnable stayed in \
       `queue.rejected` and its JoinHandle never settled",
    );
  }

  /// Regression test for the continuation a NESTED terminal failure owes.
  ///
  /// `fc4d8e3b` gave a waker-stack terminal failure a continuation of its own:
  /// it publishes one fresh host dispatch, and the host turn that services it
  /// is the clean stack that retires the moved work. That publication calls
  /// the host driver again, so a one-shot bounds it -- and the one-shot used
  /// to DISCARD the nested request instead of handing it back:
  ///
  ///   thread W (waker)                     | thread T (producer)
  ///   -------------------------------------+---------------------------
  ///   Shared notifier wakes B -> schedule  |
  ///   publish D1 .. host fails             |
  ///   publish D2 (replacement) .. fails    |
  ///   terminal: B -> queue.rejected, reopen|
  ///   retirement scope ENTER, publish D3 --+--> schedule(C) -> queue.runnables
  ///                                        |    request_drain -> Coalesced
  ///   host fails D3, sees C serviceable    |
  ///   publish D4 (replacement) .. fails    |
  ///   terminal: C -> queue.rejected, reopen|
  ///   retirement scope already ACTIVE      |
  ///     -> returned, publishing NOTHING    |
  ///
  /// Four deliveries during the wake, every one of them lost, no host turn at
  /// all, and both B and C sat in `queue.rejected` with their `JoinHandle`s
  /// pending and their `GenerationWorkGuard`s live -- even though the host is
  /// healthy for its very next delivery. The nested request now goes back to
  /// the frame that owns the publication, which publishes a fifth delivery for
  /// it once D3 has unwound. Nothing in this test supplies an unrelated entry:
  /// no later submission, no drain request, no unregistration, no shutdown.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_nested_retirement_failure_keeps_its_continuation() {
    use std::{sync::mpsc, time::Duration};

    const WAIT: Duration = Duration::from_secs(5);
    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      let registry = &*CURRENT_THREAD_NESTED_RETIREMENT_TASK_DRIVERS;
      {
        let state = registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(BoundedFailureCurrentThreadTaskDriver::new(registry));
      let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_nested_retirement_current_thread_tasks,
        registry,
      ));

      // Service one accepted delivery the way the host does.
      let service = |index: usize| {
        let delivery = driver.deliveries()[index];
        let dispatch = registry
          .claim_delivery(delivery.capability())
          .expect("the accepted delivery must be claimable");
        let mut host_turn = executor
          .try_admit_host_turn(dispatch)
          .expect("the claimed delivery must be admitted");
        registry.mark_serviced(dispatch);
        host_turn.drive();
        drop(host_turn);
        let completion = registry.finish_delivery(delivery, false);
        assert!(completion.failed_dispatches.is_empty());
        assert!(!completion.redispatch);
      };

      // Task B awaits a clone of a Shared and parks after its first poll, so
      // its wake arrives from inside the notifier's `wakers` lock.
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let scheduler_b = Arc::clone(&executor);
      let (runnable_b, task_b) = async_task::spawn(
        async move {
          shared_for_b.await;
        },
        move |runnable| scheduler_b.schedule(runnable),
      );
      executor.schedule(runnable_b);
      service(0);
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "B must be parked and unscheduled after its first poll"
      );

      // Task C is queued by ANOTHER thread, from inside the retirement turn's
      // publication. The executor is reopened by then, so C lands in
      // `queue.runnables`; the publication already owns `dispatch_pending`, so
      // C's own drain request coalesces and adds no delivery of its own.
      let scheduler_c = Arc::clone(&executor);
      let (runnable_c, task_c) = async_task::spawn(async {}, move |runnable| {
        scheduler_c.schedule(runnable);
      });
      let (gate_tx, gate_rx) = mpsc::channel::<Runnable>();
      let (queued_tx, queued_rx) = mpsc::channel::<()>();
      let producer_executor = Arc::clone(&executor);
      let producer = std::thread::spawn(move || {
        let runnable = gate_rx
          .recv()
          .expect("the retirement turn must open the window");
        producer_executor.schedule(runnable);
        queued_tx.send(()).expect("W must still be waiting");
      });
      driver.during_delivery(3, move || {
        gate_tx.send(runnable_c).expect("the producer must be live");
        queued_rx
          .recv_timeout(WAIT)
          .expect("the producer must queue C before the retirement turn fails");
      });

      // Every delivery of the interleaving is lost: the wake's publication,
      // its one replacement, the retirement turn the terminal transition
      // publishes for itself, and the replacement that turn's failure reserves
      // once it sees C queued. The host is healthy again from the sixth.
      driver.fail_budget.store(4, Ordering::SeqCst);
      tx.send(()).expect("B must still hold its Shared clone");
      producer.join().expect("the producer must not panic");

      assert_eq!(
        driver.deliveries().len(),
        6,
        "the nested terminal transition may not publish on this stack, but the \
         retirement request it hands back must be serviced after the outer \
         publication unwinds; without that sixth delivery no host turn ever \
         follows and both B and C stay pending forever"
      );
      assert!(
        !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
        "both terminal failures must reopen the executor before the waker returns"
      );
      assert!(
        executor.has_rejected_work(),
        "B and C must be moved aside, not dropped on the waker's stack"
      );
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "the moved runnables carry their queued debit"
      );
      let mut task_b = task_b.fallible();
      let mut task_c = task_c.fallible();
      assert!(
        poll_ready_within(&mut task_b, Duration::ZERO).is_none(),
        "B must still be pending: nothing may be dropped on the waker's stack"
      );
      assert!(
        poll_ready_within(&mut task_c, Duration::ZERO).is_none(),
        "C must still be pending: nothing may be dropped on the waker's stack"
      );

      // The ONLY continuation: the host serves the delivery the retirement
      // request produced. No submission, no drain request, no unregistration,
      // no shutdown.
      service(5);
      assert!(
        !executor.has_rejected_work(),
        "the retirement turn must cancel both moved runnables on its own stack"
      );
      assert!(
        poll_ready_within(&mut task_b, WAIT)
          .expect("the retirement turn must cancel B")
          .is_none(),
        "the terminal failure must still cancel the work queued when it happened"
      );
      assert!(
        poll_ready_within(&mut task_c, WAIT)
          .expect("the retirement turn must cancel C")
          .is_none(),
        "the nested terminal failure must cancel the work it moved aside too"
      );
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      drop(shared);

      registry.unregister(registration);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx.recv_timeout(WAIT).expect(
      "a nested waker-stack terminal failure discarded its retirement request: B's and C's \
       runnables stayed in `queue.rejected` and neither JoinHandle ever settled",
    );
  }

  /// Regression test for the BOUND on the retirement turns `e2a8ed9c` opened.
  ///
  /// That commit made the frame owning a waker-stack retirement publication
  /// loop while nested terminal transitions kept handing work back. Its
  /// termination argument -- every turn consumes one distinct live task --
  /// bounds the turns by the live tasks, which is no bound at all in wall
  /// clock: a producer that keeps submitting keeps supplying the runnable each
  /// nested transition needs.
  ///
  ///   thread W (waker)                     | thread T (producer)
  ///   -------------------------------------+---------------------------
  ///   Shared notifier wakes B -> schedule  |
  ///   publish D1 --------------------------+--> schedule(C1) -> runnables
  ///   host fails D1 synchronously          |    request_drain -> Coalesced
  ///   publish D2 (replacement) ------------+--> schedule(C2)
  ///   host fails D2 synchronously          |
  ///   terminal: C1,C2 -> rejected, reopen  |
  ///   retirement turn 1: publish D3 -------+--> schedule(C3)   ... and so on
  ///
  /// Every turn is two more host callbacks and two more producer submissions,
  /// so the turns ran for exactly as long as the producer did: measured on
  /// `e2a8ed9c`, 32768 submissions produced 32769 deliveries inside one wake,
  /// and a producer left running for 400ms held this single `schedule`
  /// callback -- and `futures::Shared`'s `wakers` mutex under it -- for 432ms.
  ///
  /// The owner frame now takes at most `REJECTED_WORK_RETIREMENT_ATTEMPTS`
  /// turns a producer can interleave with, and then makes the one offer a
  /// producer cannot inflate (`publish_final_rejected_work_retirement`). This
  /// host refuses that one too, so what is left is the honest end state for a
  /// host that never accepts: the work waits, undropped, for a depth-0 entry.
  /// Nothing here supplies one until `wait_until_idle` -- no submission, no
  /// drain request, no unregistration -- and that is what
  /// `current_thread_final_retirement_offer_outlives_a_producer_that_spends_the_budget`
  /// pins from the other side, where the host accepts the final offer.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_rejected_work_retirement_is_bounded_under_a_sustained_producer() {
    use std::{sync::mpsc, time::Duration};

    const WAIT: Duration = Duration::from_secs(5);
    /// Far more submissions than the turns may ever spend, so what stops them
    /// is the executor's budget and not the producer running dry.
    const PRODUCER_BUDGET: usize = 4096;
    /// One publication and its one replacement for the wake itself, two more
    /// for each retirement turn, and the single final offer.
    const BOUNDED_DELIVERIES: usize =
      2 + 2 * CurrentThreadExecutor::REJECTED_WORK_RETIREMENT_ATTEMPTS + 1;

    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      let registry = &*CURRENT_THREAD_SUSTAINED_PRODUCER_TASK_DRIVERS;
      {
        let state = registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(SustainedProducerCurrentThreadTaskDriver::new(registry));
      let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_sustained_producer_current_thread_tasks,
        registry,
      ));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

      // Service one accepted delivery the way the host does.
      let service = |index: usize| {
        let delivery = driver.deliveries()[index];
        let dispatch = registry
          .claim_delivery(delivery.capability())
          .expect("the accepted delivery must be claimable");
        let mut host_turn = executor
          .try_admit_host_turn(dispatch)
          .expect("the claimed delivery must be admitted");
        registry.mark_serviced(dispatch);
        host_turn.drive();
        drop(host_turn);
        let completion = registry.finish_delivery(delivery, false);
        assert!(completion.failed_dispatches.is_empty());
        assert!(!completion.redispatch);
      };

      // B awaits a clone of a Shared and parks after its first poll, so its
      // wake arrives from inside the notifier's `wakers` lock. It is a
      // registered task, so its `GenerationWorkGuard` is observable.
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let work_registration = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let task_b = spawn_registered(
        &backend,
        Arc::clone(&metrics),
        async move {
          shared_for_b.await;
        },
        work_registration,
      );
      service(0);
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "B must be parked and unscheduled after its first poll"
      );
      assert_eq!(backend.work.state.lock().unwrap().active, 1);

      // The producer queues one runnable from inside every publication. The
      // publication already owns `dispatch_pending`, so each of those drain
      // requests coalesces and adds no delivery of its own -- every delivery
      // below is one the waker's stack published.
      let (queue_one_tx, queue_one_rx) = mpsc::channel::<()>();
      let (queued_tx, queued_rx) = mpsc::channel::<()>();
      let producer_executor = Arc::clone(&executor);
      let producer = std::thread::spawn(move || {
        let mut submissions = 0usize;
        while queue_one_rx.recv().is_ok() {
          let scheduler = Arc::clone(&producer_executor);
          let (runnable, task) = async_task::spawn(std::future::pending::<()>(), move |runnable| {
            scheduler.schedule(runnable);
          });
          task.detach();
          producer_executor.schedule(runnable);
          submissions += 1;
          if queued_tx.send(()).is_err() {
            break;
          }
        }
        submissions
      });
      driver.arm_producer(PRODUCER_BUDGET, queue_one_tx, queued_rx);

      // From here the host fails every delivery synchronously, on the calling
      // thread, and never recovers.
      driver.fail_budget.store(usize::MAX, Ordering::SeqCst);
      let before = driver.deliveries().len();
      tx.send(()).expect("B must still hold its Shared clone");
      let during_wake = driver.deliveries().len() - before;
      let unspent = driver.disarm_producer();
      let submissions = producer.join().expect("the producer must not panic");

      assert_eq!(
        during_wake, BOUNDED_DELIVERIES,
        "the retirement must take at most REJECTED_WORK_RETIREMENT_ATTEMPTS turns \
         on the waker's stack plus its one final offer; without a budget it \
         services the producer's stream instead and this wake never returns"
      );
      assert_eq!(
        submissions, during_wake,
        "the producer must have queued a runnable during every publication"
      );
      assert!(
        unspent > 0,
        "the producer must still have been willing to submit when the turns stopped"
      );
      assert!(
        !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
        "every terminal failure, and the final offer, must reopen the executor \
         before the waker returns"
      );
      assert!(
        executor.has_rejected_work(),
        "the moved work must be parked, not dropped on the waker's stack"
      );
      assert_eq!(
        executor.dispatch_pending.load(Ordering::Acquire),
        0,
        "a host that refused every offer including the final one leaves none \
         outstanding: this is the documented end state for a host that never accepts"
      );
      assert_eq!(
        metrics.queued_runnables.load(Ordering::Relaxed),
        0,
        "the moved runnables carry their queued debit"
      );
      let mut task_b = Box::pin(task_b);
      assert!(
        poll_ready_within(&mut task_b, Duration::ZERO).is_none(),
        "B must still be pending: nothing may be dropped on the waker's stack"
      );
      assert_eq!(
        backend.work.state.lock().unwrap().active,
        1,
        "B's generation guard rides with its parked runnable"
      );

      // The first depth-0 entry retires it, and no `GenerationWorkGuard`
      // outlives that wait. Nothing above supplied this entry: no submission,
      // no drain request, no unregistration.
      backend.wait_until_idle();
      assert!(!executor.has_rejected_work());
      assert_eq!(backend.work.state.lock().unwrap().active, 0);
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert!(
        poll_ready_within(&mut task_b, WAIT)
          .expect("the idle wait must cancel B")
          .is_err(),
        "the terminal failure must still cancel the work queued when it happened"
      );
      drop(shared);

      registry.unregister(registration);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx.recv_timeout(WAIT).expect(
      "an unbounded retirement loop serviced the producer's stream on the waker's stack: \
       the wake never returned",
    );
  }

  /// Regression test for the offer the attempt budget may not swallow -- the
  /// reviewer's interleaving, with a FINITE producer.
  ///
  /// `fd471429` capped the retirement turns at
  /// `REJECTED_WORK_RETIREMENT_ATTEMPTS` and argued that exhausting the budget
  /// strands nothing, because the producer that drove it to exhaustion
  /// supplies the next continuation itself with its next ordinary submission.
  /// It does not, if it has just made its last one:
  ///
  ///   thread W (waker)                     | thread T (producer, budget 18)
  ///   -------------------------------------+---------------------------
  ///   ... turns 1..7 ...                   | ... C3..C16 ...
  ///   turn 8: publish D17 -----------------+--> schedule(C17)
  ///   host fails D17, sees C17 serviceable |
  ///   publish D18 (replacement) -----------+--> schedule(C18)  <- last one
  ///   host fails D18                       |    (producer now quiescent)
  ///   terminal #9: C18 -> rejected, reopen |
  ///   budget spent -> turns stop           |
  ///
  /// The host is healthy from its next delivery and stays registered, but no
  /// dispatch is outstanding, `queue.rejected` holds B and every C, and
  /// nothing publishes again. Measured on `fd471429`: 18 deliveries during the
  /// wake, `dispatch_pending` 0, `queued_runnables` 0, B's `JoinHandle`
  /// pending, its future never dropped, its `GenerationWorkGuard` still
  /// active, and no delivery afterwards.
  ///
  /// The budget bounds what a producer can inflate; it may not swallow the
  /// continuation itself. After it, one final offer is made with the
  /// terminal-cancellation claim held, so nothing can interleave with it and
  /// it needs no budget of its own -- and this host accepts it. That host turn
  /// is the depth-0 stack that retires everything the wake moved aside.
  /// Nothing here supplies any other entry: no submission after the wake, no
  /// drain request, no unregistration, no shutdown.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_final_retirement_offer_outlives_a_producer_that_spends_the_budget() {
    use std::{sync::mpsc, time::Duration};

    const WAIT: Duration = Duration::from_secs(5);
    /// Every delivery the budget can pay for, and not one more: the producer's
    /// last runnable is queued inside the last of them and it then goes
    /// quiescent.
    const BUDGETED_DELIVERIES: usize =
      2 + 2 * CurrentThreadExecutor::REJECTED_WORK_RETIREMENT_ATTEMPTS;

    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      struct DropFlag(Arc<AtomicBool>);
      impl Drop for DropFlag {
        fn drop(&mut self) {
          self.0.store(true, Ordering::SeqCst);
        }
      }

      let registry = &*CURRENT_THREAD_FINAL_RETIREMENT_OFFER_TASK_DRIVERS;
      {
        let state = registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(SustainedProducerCurrentThreadTaskDriver::new(registry));
      let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_final_retirement_offer_current_thread_tasks,
        registry,
      ));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

      let service = |index: usize| {
        let delivery = driver.deliveries()[index];
        let dispatch = registry
          .claim_delivery(delivery.capability())
          .expect("the accepted delivery must be claimable");
        let mut host_turn = executor
          .try_admit_host_turn(dispatch)
          .expect("the claimed delivery must be admitted");
        registry.mark_serviced(dispatch);
        host_turn.drive();
        drop(host_turn);
        let completion = registry.finish_delivery(delivery, false);
        assert!(completion.failed_dispatches.is_empty());
        assert!(!completion.redispatch);
      };

      let dropped = Arc::new(AtomicBool::new(false));
      let flag = DropFlag(Arc::clone(&dropped));
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let work_registration = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let task_b = spawn_registered(
        &backend,
        Arc::clone(&metrics),
        async move {
          let _flag = flag;
          shared_for_b.await;
        },
        work_registration,
      );
      service(0);
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert_eq!(backend.work.state.lock().unwrap().active, 1);

      let (queue_one_tx, queue_one_rx) = mpsc::channel::<()>();
      let (queued_tx, queued_rx) = mpsc::channel::<()>();
      let producer_executor = Arc::clone(&executor);
      let producer = std::thread::spawn(move || {
        let mut submissions = 0usize;
        while queue_one_rx.recv().is_ok() {
          let scheduler = Arc::clone(&producer_executor);
          let (runnable, task) = async_task::spawn(std::future::pending::<()>(), move |runnable| {
            scheduler.schedule(runnable);
          });
          task.detach();
          producer_executor.schedule(runnable);
          submissions += 1;
          if queued_tx.send(()).is_err() {
            break;
          }
        }
        submissions
      });
      // The producer feeds exactly the deliveries the budget can pay for, and
      // the host refuses exactly those: it is healthy from the next one.
      driver.arm_producer(BUDGETED_DELIVERIES, queue_one_tx, queued_rx);
      driver
        .fail_budget
        .store(BUDGETED_DELIVERIES, Ordering::SeqCst);

      let before = driver.deliveries().len();
      tx.send(()).expect("B must still hold its Shared clone");
      let during_wake = driver.deliveries().len() - before;
      let unspent = driver.disarm_producer();
      let submissions = producer.join().expect("the producer must not panic");

      assert_eq!(
        during_wake,
        BUDGETED_DELIVERIES + 1,
        "the budget must be followed by the one offer a producer cannot \
         inflate; without it the wake stops after {BUDGETED_DELIVERIES} \
         deliveries and never asks the host that would have accepted"
      );
      assert_eq!(
        submissions, BUDGETED_DELIVERIES,
        "the producer must have queued a runnable during every budgeted \
         publication and gone quiescent before the final offer"
      );
      assert_eq!(
        unspent, 0,
        "the producer must have run dry exactly as the budget ran out"
      );
      assert_eq!(
        driver.fail_budget.load(Ordering::SeqCst),
        0,
        "the host must have refused every budgeted delivery and no more"
      );
      assert!(
        !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
        "the final offer must reopen the executor before the waker returns"
      );
      assert!(
        executor.has_rejected_work(),
        "nothing may be dropped on the waker's stack"
      );
      assert_ne!(
        executor.dispatch_pending.load(Ordering::Acquire),
        0,
        "the wake must leave a dispatch outstanding: that accepted delivery is \
         the continuation the parked work has"
      );
      let mut task_b = Box::pin(task_b);
      assert!(poll_ready_within(&mut task_b, Duration::ZERO).is_none());
      assert!(!dropped.load(Ordering::SeqCst));
      assert_eq!(backend.work.state.lock().unwrap().active, 1);

      // The ONLY continuation: the host serves the final offer. No submission,
      // no drain request, no unregistration, no shutdown.
      service(driver.deliveries().len() - 1);
      assert!(
        !executor.has_rejected_work(),
        "that host turn is a depth-0 stack and must retire everything the wake \
         moved aside"
      );
      assert!(
        poll_ready_within(&mut task_b, WAIT)
          .expect("the final offer's host turn must cancel B")
          .is_err()
      );
      assert!(
        dropped.load(Ordering::SeqCst),
        "B's future must be destroyed, on the host's stack and not the waker's"
      );
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert_eq!(
        backend.work.state.lock().unwrap().active,
        0,
        "no GenerationWorkGuard may outlive the retirement"
      );
      drop(shared);

      registry.unregister(registration);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx.recv_timeout(WAIT).expect(
      "the retirement turns never returned, or the final offer deadlocked on the waker's stack",
    );
  }

  /// Regression test for the turn a REFUSED offer owes, with no producer at
  /// all.
  ///
  /// Until this commit the turns were driven by a thread-local flag that only
  /// a NESTED terminal transition set. An offer the host simply refused with
  /// an empty queue reserves no replacement, so it reached no transition and
  /// set no flag, and the owner frame returned after a single offer with seven
  /// attempts unspent -- the same stranded state the budget's exhaustion
  /// leaves, reached with nothing racing at all. Measured before: 3 deliveries
  /// during the wake, `dispatch_pending` 0, B parked in `queue.rejected` with
  /// its guard held, and a host that was healthy for its very next delivery
  /// never asked for one.
  ///
  /// What a turn owes is executor state, not a message: work parked and no
  /// dispatch outstanding. Reading that instead of a flag makes both routes
  /// one route, and this host -- which refuses the wake's publication, its
  /// replacement and the first offer, and accepts the second -- is served.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_rejected_work_retirement_offers_again_when_the_host_refuses() {
    use std::{sync::mpsc, time::Duration};

    const WAIT: Duration = Duration::from_secs(5);
    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      struct DropFlag(Arc<AtomicBool>);
      impl Drop for DropFlag {
        fn drop(&mut self) {
          self.0.store(true, Ordering::SeqCst);
        }
      }

      let registry = &*CURRENT_THREAD_RETIREMENT_RETRY_TASK_DRIVERS;
      {
        let state = registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(BoundedFailureCurrentThreadTaskDriver::new(registry));
      let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_retirement_retry_current_thread_tasks,
        registry,
      ));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

      let service = |index: usize| {
        let delivery = driver.deliveries()[index];
        let dispatch = registry
          .claim_delivery(delivery.capability())
          .expect("the accepted delivery must be claimable");
        let mut host_turn = executor
          .try_admit_host_turn(dispatch)
          .expect("the claimed delivery must be admitted");
        registry.mark_serviced(dispatch);
        host_turn.drive();
        drop(host_turn);
        let completion = registry.finish_delivery(delivery, false);
        assert!(completion.failed_dispatches.is_empty());
        assert!(!completion.redispatch);
      };

      let dropped = Arc::new(AtomicBool::new(false));
      let flag = DropFlag(Arc::clone(&dropped));
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let work_registration = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let task_b = spawn_registered(
        &backend,
        Arc::clone(&metrics),
        async move {
          let _flag = flag;
          shared_for_b.await;
        },
        work_registration,
      );
      service(0);
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert_eq!(backend.work.state.lock().unwrap().active, 1);

      // The wake's publication, its one replacement, and the first retirement
      // offer are lost. The host is healthy from the second offer on, and no
      // producer ever runs: every offer after the first is refused with an
      // empty queue, which reserves no replacement and reaches no transition.
      let before = driver.deliveries().len();
      driver.fail_budget.store(3, Ordering::SeqCst);
      tx.send(()).expect("B must still hold its Shared clone");
      let during_wake = driver.deliveries().len() - before;

      assert_eq!(
        during_wake, 4,
        "a refused offer owes another turn just as a nested transition does: \
         work is parked and no dispatch is outstanding"
      );
      assert_ne!(
        executor.dispatch_pending.load(Ordering::Acquire),
        0,
        "the accepted second offer is the continuation the parked work has"
      );
      assert!(executor.has_rejected_work());
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      let mut task_b = Box::pin(task_b);
      assert!(poll_ready_within(&mut task_b, Duration::ZERO).is_none());
      assert!(!dropped.load(Ordering::SeqCst));

      // The ONLY continuation: the host serves the offer it accepted.
      service(driver.deliveries().len() - 1);
      assert!(!executor.has_rejected_work());
      assert!(
        poll_ready_within(&mut task_b, WAIT)
          .expect("the accepted offer's host turn must cancel B")
          .is_err()
      );
      assert!(dropped.load(Ordering::SeqCst));
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert_eq!(backend.work.state.lock().unwrap().active, 0);
      drop(shared);

      registry.unregister(registration);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(WAIT)
      .expect("a refused retirement offer left B stranded with a healthy host");
  }

  /// Regression test for the continuation the FINAL offer owes when the host
  /// services it from inside `dispatch`.
  ///
  /// `6cfe2002` makes one last offer after the attempt budget with the
  /// terminal-cancellation claim held, so nothing can inflate it, and then
  /// reopens and returns. A driver may claim, drive and acknowledge a delivery
  /// inside `dispatch` -- the registry supports that synchronous completion,
  /// and `RacingTaskDriver` in this module drives one inline -- and such a turn
  /// on THIS offer can do nothing at all:
  /// `retire_rejected_work_off_waker_stack` returns at nonzero schedule depth,
  /// and `take_runnable` returns `None` while `cancelling_failed_dispatch` is
  /// held. It only consumes `dispatch_pending`. The offer then returned with
  /// the executor reopened, no dispatch outstanding and `queue.rejected` still
  /// holding B. Measured before this commit: 11 deliveries during the wake,
  /// `dispatch_pending` 0, `queued_runnables` 0, B's `JoinHandle` pending, its
  /// future never dropped, its `GenerationWorkGuard` still active -- and not
  /// one delivery afterwards, with the driver registered and healthy.
  ///
  /// An offer the host ACCEPTED but could not act on leaves exactly the state
  /// a refused one leaves, and the invariant is the one this branch already
  /// reads off the executor: while work is parked in `queue.rejected` and no
  /// dispatch is outstanding, this stack still owes a continuation. So the
  /// offer reports whether the host accepted it, and an accepted offer whose
  /// dispatch was consumed is followed by ONE ordinary publication -- the
  /// executor is open again, so that is the path `5857092f` reopened it for.
  /// It is one publication and not a loop, and a nested terminal transition
  /// inside it finds `CURRENT_THREAD_RETIRING_REJECTED_WORK` held and
  /// publishes nothing.
  ///
  /// Nothing here supplies any other entry: no submission after the wake, no
  /// drain request, no unregistration, no shutdown.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_final_retirement_offer_serviced_inside_dispatch_leaves_a_continuation() {
    use std::{sync::mpsc, time::Duration};

    const WAIT: Duration = Duration::from_secs(5);
    /// The wake's publication, its one replacement, and every budgeted turn.
    const REFUSED_DELIVERIES: usize = 2 + CurrentThreadExecutor::REJECTED_WORK_RETIREMENT_ATTEMPTS;

    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      struct DropFlag(Arc<AtomicBool>);
      impl Drop for DropFlag {
        fn drop(&mut self) {
          self.0.store(true, Ordering::SeqCst);
        }
      }

      let registry = &*CURRENT_THREAD_INLINE_FINAL_OFFER_TASK_DRIVERS;
      {
        let state = registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        assert!(state.entries.is_empty());
        assert!(state.dispatches.is_empty());
      }
      let driver = Arc::new(BoundedFailureCurrentThreadTaskDriver::new(registry));
      let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
        Arc::clone(&metrics),
        dispatch_inline_final_offer_current_thread_tasks,
        registry,
      ));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

      let service = |index: usize| {
        let delivery = driver.deliveries()[index];
        let dispatch = registry
          .claim_delivery(delivery.capability())
          .expect("the accepted delivery must be claimable");
        let mut host_turn = executor
          .try_admit_host_turn(dispatch)
          .expect("the claimed delivery must be admitted");
        registry.mark_serviced(dispatch);
        host_turn.drive();
        drop(host_turn);
        let completion = registry.finish_delivery(delivery, false);
        assert!(completion.failed_dispatches.is_empty());
        assert!(!completion.redispatch);
      };

      let dropped = Arc::new(AtomicBool::new(false));
      let flag = DropFlag(Arc::clone(&dropped));
      let (tx, rx) = futures::channel::oneshot::channel::<()>();
      let shared = rx.map(|_| ()).boxed().shared();
      let shared_for_b = shared.clone();
      let work_registration = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let task_b = spawn_registered(
        &backend,
        Arc::clone(&metrics),
        async move {
          let _flag = flag;
          shared_for_b.await;
        },
        work_registration,
      );
      service(0);
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert_eq!(backend.work.state.lock().unwrap().active, 1);

      // The wake's publication, its one replacement and every budgeted turn
      // are refused. The delivery right after them is the final offer, and the
      // host claims, drives and acknowledges THAT one from inside `dispatch`:
      // on the waker's stack, with the terminal-cancellation claim held.
      let before = driver.deliveries().len();
      let serviced_inline = Arc::new(AtomicBool::new(false));
      {
        let executor = Arc::clone(&executor);
        let hook_driver = Arc::clone(&driver);
        let serviced_inline = Arc::clone(&serviced_inline);
        driver.during_delivery(before + REFUSED_DELIVERIES, move || {
          let delivery = *hook_driver
            .deliveries()
            .last()
            .expect("the final offer must be recorded before the hook runs");
          let dispatch = registry
            .claim_delivery(delivery.capability())
            .expect("the final offer must be claimable");
          let mut host_turn = executor
            .try_admit_host_turn(dispatch)
            .expect("the claimed final offer must be admitted");
          registry.mark_serviced(dispatch);
          host_turn.drive();
          drop(host_turn);
          let completion = registry.finish_delivery(delivery, false);
          assert!(completion.failed_dispatches.is_empty());
          serviced_inline.store(true, Ordering::SeqCst);
        });
      }
      driver
        .fail_budget
        .store(REFUSED_DELIVERIES, Ordering::SeqCst);
      tx.send(()).expect("B must still hold its Shared clone");
      let during_wake = driver.deliveries().len() - before;

      assert!(
        serviced_inline.load(Ordering::SeqCst),
        "the host must have claimed, driven and acknowledged the final offer inside `dispatch`"
      );
      assert_eq!(
        during_wake,
        REFUSED_DELIVERIES + 2,
        "an accepted offer whose host turn could not act owes the same continuation a refused \
         one owes: work parked and no dispatch outstanding"
      );
      assert_ne!(
        executor.dispatch_pending.load(Ordering::Acquire),
        0,
        "the publication that follows the consumed offer is the continuation the parked work has"
      );
      assert!(executor.has_rejected_work());
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      let mut task_b = Box::pin(task_b);
      assert!(poll_ready_within(&mut task_b, Duration::ZERO).is_none());
      assert!(!dropped.load(Ordering::SeqCst));

      // The ONLY continuation: the host serves it on a clean stack.
      service(driver.deliveries().len() - 1);
      assert!(!executor.has_rejected_work());
      assert!(
        poll_ready_within(&mut task_b, WAIT)
          .expect("the host turn that follows the consumed offer must cancel B")
          .is_err()
      );
      assert!(dropped.load(Ordering::SeqCst));
      assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
      assert_eq!(backend.work.state.lock().unwrap().active, 0);
      drop(shared);

      registry.unregister(registration);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      done_tx.send(()).unwrap();
    });
    done_rx.recv_timeout(WAIT).expect(
      "a final offer serviced inside `dispatch` left B stranded with a registered, healthy host",
    );
  }

  /// Regression test for the continuation an ordinary `spawn` owes itself.
  /// `async-task` runs one scheduler callback for two different things: a
  /// wake, which any `Waker` can raise from any stack, and the first schedule
  /// of a freshly submitted task, which `spawn` makes on its caller's own
  /// stack. Only the wake can arrive under a foreign lock. When the host fails
  /// a submission's publication and its one replacement synchronously, the
  /// terminal transition is that submission's ONLY continuation: it produced
  /// no host turn, `complete_current_thread_task_delivery` has already run,
  /// and nothing else will reach `retire_rejected_work`. Treating the frame as
  /// a waker's parked the runnable in `queue.rejected` with the driver
  /// registered and healthy again, so the `JoinHandle` stayed pending forever
  /// and its `GenerationWorkGuard` stayed active. Nothing here supplies a
  /// later entry: no drain request, no host turn, no unregistration, no
  /// shutdown.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_submission_dispatch_failure_cancels_on_the_submitter_stack() {
    use std::time::Duration;

    let registry = &*CURRENT_THREAD_SUBMISSION_FAILURE_TASK_DRIVERS;
    {
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
    }
    let driver = Arc::new(SynchronouslyFailingCurrentThreadTaskDriver::new(registry));
    let registration = registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch_registry(
      Arc::clone(&metrics),
      dispatch_submission_failure_current_thread_tasks,
      registry,
    ));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

    // Every accepted delivery fails before `dispatch` returns, the way a
    // closing threadsafe function does.
    driver.fail.store(true, Ordering::SeqCst);

    let work_registration = backend
      .work
      .try_register_async()
      .expect("the backend must accept work");
    let task = spawn_registered(
      &backend,
      Arc::clone(&metrics),
      std::future::pending::<()>(),
      work_registration,
    );

    assert_eq!(
      driver.deliveries().len(),
      2,
      "the submission must publish the dispatch and exactly one replacement"
    );
    assert!(
      !executor.cancelling_failed_dispatch.load(Ordering::Acquire),
      "the terminal failure must reopen the executor"
    );
    assert!(
      !executor.has_rejected_work(),
      "a submission's own stack is not a waker's: the rejected work must be        cancelled here, because nothing else will"
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(backend.work.state.lock().unwrap().active, 0);

    let mut task = Box::pin(task);
    assert_eq!(
      poll_ready_within(&mut task, Duration::ZERO)
        .expect("the submission must settle without any later entry")
        .unwrap_err()
        .to_string(),
      "async runtime stopped before the task completed",
      "terminal host failure must settle the submitted operation as cancelled"
    );

    registry.unregister(registration);
    let state = registry
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(state.entries.is_empty());
    assert!(state.dispatches.is_empty());
  }

  /// MultiThread twin of
  /// `current_thread_shutdown_does_not_drop_in_flight_rejected_runnable_inline`.
  /// The same wake is in flight when shutdown starts: B's schedule closure
  /// runs inside `futures::Shared`'s notifier, under its `wakers` mutex, and
  /// B's future owns a clone of that `Shared`. `MultiThreadExecutor::schedule`
  /// has no closed-queue branch: the late runnable is pushed to the injector
  /// (or the worker's LIFO slot) exactly like any other, and the drainer that
  /// claims it under the published stop cancels it on its own stack
  /// (`claim_runnable` -> `RunnableClaim::Cancel` -> `cancel_runnable`). That
  /// stack never holds `wakers`, so the drop only waits for the waker thread
  /// to leave the notifier. This pins that shape: a closed-queue rejection
  /// added to `schedule` that dropped the runnable inline would deadlock
  /// here, exactly as the CurrentThread executor did.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_shutdown_does_not_drop_in_flight_rejected_runnable_inline() {
    use std::{
      sync::{Barrier, mpsc},
      time::Duration,
    };

    let (done_tx, done_rx) = mpsc::channel();
    std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 1,
        thread_name_prefix: "mt-inline-drop".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::MultiThread(Arc::clone(&executor)));
      let generation = backend.generation();

      // Task A: registered like production work; its JoinHandle is shared.
      let (abort_a, guard_a) = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let scheduler_a = Arc::clone(&executor);
      let (runnable_a, task_a) = async_task::spawn(
        RegisteredTaskFuture::new(
          Abortable::new(std::future::pending::<()>(), abort_a),
          guard_a,
          generation,
        ),
        move |runnable| scheduler_a.schedule(runnable),
      );
      let shared = async move { task_a.fallible().await.is_some() }
        .boxed()
        .shared();
      let shared_for_b = shared.clone();

      // Task B: registered and abortable too, awaiting a clone of that Shared.
      // Its schedule closure pauses before it reaches the executor, exactly
      // where a waker thread may be descheduled while shutdown runs.
      let (abort_b, guard_b) = backend
        .work
        .try_register_async()
        .expect("the backend must accept work");
      let wake_in_flight = Arc::new(Barrier::new(2));
      let wake_release = Arc::new(Barrier::new(2));
      let scheduler_b = Arc::clone(&executor);
      let (runnable_b, task_b) = async_task::spawn(
        RegisteredTaskFuture::new(
          Abortable::new(
            async move {
              shared_for_b.await;
            },
            abort_b,
          ),
          guard_b,
          generation,
        ),
        {
          let wake_in_flight = Arc::clone(&wake_in_flight);
          let wake_release = Arc::clone(&wake_release);
          move |runnable| {
            wake_in_flight.wait();
            wake_release.wait();
            scheduler_b.schedule(runnable);
          }
        },
      );
      // The first poll runs on a pool drainer; wait until B has parked on the
      // Shared and left the drainer, so the wake below is a real re-schedule
      // from the notifier rather than a wake-while-running that the drainer
      // would re-publish from its own stack.
      executor.schedule(runnable_b);
      wait_until("B parked after its first poll", || {
        metrics.runnable_polls.load(Ordering::SeqCst) == 1
          && metrics.active_runnables.load(Ordering::SeqCst) == 0
          && metrics.queued_runnables.load(Ordering::SeqCst) == 0
      });

      // Cancel A on another thread: closing A notifies its awaiter, and the
      // Shared notifier wakes B while holding `wakers`. B's schedule closure
      // then parks at the barrier with that lock still held.
      let waker_thread = std::thread::spawn(move || drop(runnable_a));
      wake_in_flight.wait();

      // Shutdown: `close_and_abort` aborts B, which is already SCHEDULED, so
      // the abort wake is a no-op; the stop is then published.
      backend.begin_shutdown();
      wake_release.wait();
      backend.wait_until_idle();

      waker_thread
        .join()
        .expect("the waker thread must not panic");
      assert_eq!(metrics.queued_runnables.load(Ordering::SeqCst), 0);
      assert!(
        futures::executor::block_on(task_b.fallible()).is_none(),
        "B's late wake must still cancel B"
      );
      assert_eq!(backend.work.state.lock().unwrap().active, 0);
      drop(shared);
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("shutdown deadlocked: inline runnable drop re-entered a waker lock");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_recovery_reservation_blocks_new_host_publication() {
    use std::sync::mpsc;

    CURRENT_THREAD_INTERLEAVED_RECOVERY_HOST_DISPATCHES.store(0, Ordering::SeqCst);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_interleaved_recovery_host_dispatch,
    ));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

    let registration = backend
      .work
      .try_register_async()
      .expect("the backend must accept work");
    let task = spawn_registered(
      &backend,
      Arc::clone(&metrics),
      std::future::pending::<()>(),
      registration,
    );
    let failed_dispatch = current_thread_dispatch(&executor);
    assert_eq!(
      CURRENT_THREAD_INTERLEAVED_RECOVERY_HOST_DISPATCHES.load(Ordering::SeqCst),
      1
    );

    let (recovery_cleared_tx, recovery_cleared_rx) = mpsc::channel();
    let (release_recovery_tx, release_recovery_rx) = mpsc::channel();
    let cancelling_executor = Arc::clone(&executor);
    let cancellation = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_RECOVERY_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          recovery_cleared_tx.send(()).unwrap();
          release_recovery_rx.recv().unwrap();
        }));
      });
      cancelling_executor.cancel_host_dispatch_for_test(failed_dispatch);
    });
    recovery_cleared_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("failed dispatch cancellation must pause after consuming the old capability");

    let (publication_blocked_tx, publication_blocked_rx) = mpsc::channel();
    let (publication_done_tx, publication_done_rx) = mpsc::channel();
    let publishing_executor = Arc::clone(&executor);
    let publication = std::thread::spawn(move || {
      CURRENT_THREAD_DISPATCH_PUBLICATION_BLOCKED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          publication_blocked_tx.send(()).unwrap();
        }));
      });
      publishing_executor.request_drain_if_queued();
      publication_done_tx.send(()).unwrap();
    });

    if let Err(error) = publication_blocked_rx.recv_timeout(Duration::from_secs(2)) {
      release_recovery_tx.send(()).unwrap();
      cancellation.join().unwrap();
      publication.join().unwrap();
      panic!("a newly registered host must wait for recovery reservation: {error}");
    }
    assert!(
      matches!(
        publication_done_rx.try_recv(),
        Err(mpsc::TryRecvError::Empty)
      ),
      "the new host must not publish in the consumed-to-recovery gap"
    );
    release_recovery_tx.send(()).unwrap();

    cancellation.join().unwrap();
    publication_done_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap();
    publication.join().unwrap();

    let replacement_dispatch = current_thread_dispatch(&executor);
    assert_ne!(replacement_dispatch, failed_dispatch);
    assert_eq!(
      executor.recovery_dispatch.load(Ordering::Acquire),
      replacement_dispatch
    );
    assert_eq!(
      CURRENT_THREAD_INTERLEAVED_RECOVERY_HOST_DISPATCHES.load(Ordering::SeqCst),
      3,
      "the original publication and two host attempts for its one replacement must run"
    );

    executor.cancel_host_dispatch_for_test(replacement_dispatch);

    assert_eq!(
      CURRENT_THREAD_INTERLEAVED_RECOVERY_HOST_DISPATCHES.load(Ordering::SeqCst),
      3,
      "failure of the tagged replacement must cancel work without a second replacement"
    );
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), 0);
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(
      futures::executor::block_on(task).unwrap_err().to_string(),
      "async runtime stopped before the task completed"
    );

    let later_registration = backend
      .work
      .try_register_async()
      .expect("terminal cancellation must reopen acceptance");
    let later_task = spawn_registered(
      &backend,
      Arc::clone(&metrics),
      async { 2usize },
      later_registration,
    );
    assert_eq!(
      CURRENT_THREAD_INTERLEAVED_RECOVERY_HOST_DISPATCHES.load(Ordering::SeqCst),
      4
    );
    executor.drive_host_turn();
    assert_eq!(futures::executor::block_on(later_task).unwrap(), 2);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_terminal_dispatch_failure_keeps_blocking_capture_registered_until_drop() {
    use std::sync::mpsc;

    struct BlockingDrop {
      entered: mpsc::Sender<()>,
      release: mpsc::Receiver<()>,
    }

    impl Drop for BlockingDrop {
      fn drop(&mut self) {
        self.entered.send(()).unwrap();
        self.release.recv().unwrap();
      }
    }

    reset_current_thread_recovery_host_dispatches();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      count_current_thread_recovery_host_dispatch,
    ));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

    let holder_registration = backend
      .work
      .try_register_work()
      .expect("the backend must accept the blocking holder");
    let (holder_started_tx, holder_started_rx) = mpsc::channel();
    let (release_holder_tx, release_holder_rx) = mpsc::channel();
    let holder_executor = Arc::clone(&executor);
    let holder = std::thread::spawn(move || {
      let handle = holder_executor.schedule_blocking(
        move || {
          holder_started_tx.send(()).unwrap();
          release_holder_rx.recv().unwrap();
        },
        holder_registration,
      );
      futures::executor::block_on(handle).unwrap();
    });
    holder_started_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the first blocking call must hold the CurrentThread lane");

    let cancelled_registration = backend
      .work
      .try_register_work()
      .expect("the backend must accept queued blocking work");
    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let blocking_drop = BlockingDrop {
      entered: drop_entered_tx,
      release: release_drop_rx,
    };
    let cancelled = executor.schedule_blocking(
      move || {
        let _blocking_drop = blocking_drop;
      },
      cancelled_registration,
    );

    let async_registration = backend
      .work
      .try_register_async()
      .expect("the backend must accept queued async work");
    let pending = spawn_registered(
      &backend,
      Arc::clone(&metrics),
      std::future::pending::<()>(),
      async_registration,
    );
    let failed_dispatch = current_thread_dispatch(&executor);
    executor.cancel_host_dispatch_for_test(failed_dispatch);
    let replacement_dispatch = current_thread_dispatch(&executor);

    let (cancel_done_tx, cancel_done_rx) = mpsc::channel();
    let cancelling_executor = Arc::clone(&executor);
    let cancellation = std::thread::spawn(move || {
      cancelling_executor.cancel_host_dispatch_for_test(replacement_dispatch);
      cancel_done_tx.send(()).unwrap();
    });
    drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("terminal dispatch cancellation must destroy the queued blocking capture");
    let active_during_drop = backend.work.state.lock().unwrap().active;
    let cancellation_blocked = cancel_done_rx.try_recv().is_err();

    release_drop_tx.send(()).unwrap();
    cancel_done_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    cancellation.join().unwrap();

    assert_eq!(
      active_during_drop, 2,
      "the blocking capture's work registration must remain active until its destructor returns"
    );
    assert!(
      cancellation_blocked,
      "terminal cancellation must wait for capture destruction"
    );
    assert!(futures::executor::block_on(cancelled).is_err());
    assert!(futures::executor::block_on(pending).is_err());
    assert_eq!(backend.work.state.lock().unwrap().active, 1);

    release_holder_tx.send(()).unwrap();
    holder.join().unwrap();
    assert_eq!(backend.work.state.lock().unwrap().active, 0);
  }

  #[test]
  fn current_thread_unavailable_recovery_dispatch_cancels_original_work() {
    reset_current_thread_one_shot_host_dispatches();
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::clone(&metrics),
      accept_only_first_current_thread_host_dispatch,
    ));

    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(std::future::pending::<()>(), move |runnable| {
      scheduler.schedule(runnable)
    });
    executor.schedule(runnable);
    let failed_dispatch = current_thread_dispatch(&executor);

    executor.cancel_host_dispatch_for_test(failed_dispatch);

    assert_eq!(
      current_thread_one_shot_host_dispatches(),
      2,
      "the original and its one bounded replacement must be attempted"
    );
    assert_eq!(executor.dispatch_pending.load(Ordering::Acquire), 0);
    assert_eq!(executor.recovery_dispatch.load(Ordering::Acquire), 0);
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert!(
      futures::executor::block_on(task.fallible()).is_none(),
      "an unavailable replacement host must settle the original task as cancelled"
    );
  }

  enum TestCurrentThreadTaskDriverBehavior {
    Healthy,
    PanicInLivenessAndSweep,
    PanicInDispatchAndSweep,
  }

  struct TestCurrentThreadTaskDriver {
    behavior: TestCurrentThreadTaskDriverBehavior,
    dispatched: AtomicBool,
  }

  #[derive(Default)]
  struct ManualCurrentThreadTaskDriver {
    deliveries: Mutex<Vec<CurrentThreadTaskDelivery>>,
  }

  struct FailDuringAuthoritativePanicPublication;
  struct FailDuringLateRegistrationPublication;
  struct FailDuringNestedUnwindPublication;
  struct FailDuringReplacementRepublishPublication;
  struct FirstHostileCurrentThreadPanic;
  struct LaterHostileCurrentThreadPanic;

  impl Drop for FirstHostileCurrentThreadPanic {
    fn drop(&mut self) {
      CURRENT_THREAD_FIRST_HOSTILE_PANIC_DROPS.fetch_add(1, Ordering::SeqCst);
      panic!("the first retained CurrentThread panic payload was dropped");
    }
  }

  impl Drop for LaterHostileCurrentThreadPanic {
    fn drop(&mut self) {
      CURRENT_THREAD_LATER_HOSTILE_PANIC_DROPS.fetch_add(1, Ordering::SeqCst);
      panic!("a later CurrentThread panic payload escaped containment");
    }
  }

  impl ManualCurrentThreadTaskDriver {
    fn deliveries(&self) -> Vec<CurrentThreadTaskDelivery> {
      self.deliveries.lock().unwrap().clone()
    }
  }

  impl CurrentThreadTaskDriver for ManualCurrentThreadTaskDriver {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      self.deliveries.lock().unwrap().push(delivery);
      true
    }
  }

  /// Accepts every delivery; once `fail` is set it also fails the accepted
  /// delivery before `dispatch` returns, from a helper thread it joins, the
  /// way a host whose env is tearing down reports a threadsafe-function call
  /// that cannot land.
  struct SynchronouslyFailingCurrentThreadTaskDriver {
    registry: &'static CurrentThreadTaskDriverRegistry,
    fail: AtomicBool,
    deliveries: Mutex<Vec<CurrentThreadTaskDelivery>>,
  }

  impl SynchronouslyFailingCurrentThreadTaskDriver {
    fn new(registry: &'static CurrentThreadTaskDriverRegistry) -> Self {
      Self {
        registry,
        fail: AtomicBool::new(false),
        deliveries: Mutex::default(),
      }
    }

    fn deliveries(&self) -> Vec<CurrentThreadTaskDelivery> {
      self.deliveries.lock().unwrap().clone()
    }
  }

  impl CurrentThreadTaskDriver for SynchronouslyFailingCurrentThreadTaskDriver {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      self.deliveries.lock().unwrap().push(delivery);
      if self.fail.load(Ordering::SeqCst) {
        let registry = self.registry;
        let completion = std::thread::spawn(move || registry.finish_delivery(delivery, true))
          .join()
          .expect("the failing helper must not panic");
        assert!(
          completion.failed_dispatches.is_empty(),
          "the failed delivery must remain provisional until its publication retires"
        );
      }
      true
    }
  }

  /// Accepts every delivery, and fails the first `fail_budget` of them before
  /// `dispatch` returns -- from a helper thread it joins, exactly like
  /// `SynchronouslyFailingCurrentThreadTaskDriver`. Once the budget is spent
  /// the host is healthy again, so the retirement turn a waker-stack terminal
  /// failure publishes for itself is accepted instead of lost.
  /// A one-shot the test runs from inside a chosen delivery; see
  /// `BoundedFailureCurrentThreadTaskDriver::during_delivery`.
  type DeliveryHook = Box<dyn FnOnce() + Send>;

  struct BoundedFailureCurrentThreadTaskDriver {
    registry: &'static CurrentThreadTaskDriverRegistry,
    fail_budget: AtomicUsize,
    deliveries: Mutex<Vec<CurrentThreadTaskDelivery>>,
    during_delivery: Mutex<Option<(usize, DeliveryHook)>>,
  }

  impl BoundedFailureCurrentThreadTaskDriver {
    fn new(registry: &'static CurrentThreadTaskDriverRegistry) -> Self {
      Self {
        registry,
        fail_budget: AtomicUsize::new(0),
        deliveries: Mutex::default(),
        during_delivery: Mutex::default(),
      }
    }

    fn deliveries(&self) -> Vec<CurrentThreadTaskDelivery> {
      self.deliveries.lock().unwrap().clone()
    }

    /// Run `hook` from inside the `index`-th delivery (0-based over every
    /// delivery this driver receives), before that delivery is failed. This is
    /// the window another thread needs to queue work while a publication is in
    /// flight.
    fn during_delivery(&self, index: usize, hook: impl FnOnce() + Send + 'static) {
      *self.during_delivery.lock().unwrap() = Some((index, Box::new(hook)));
    }
  }

  impl CurrentThreadTaskDriver for BoundedFailureCurrentThreadTaskDriver {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      let index = {
        let mut deliveries = self.deliveries.lock().unwrap();
        deliveries.push(delivery);
        deliveries.len() - 1
      };
      let hook = {
        let mut slot = self.during_delivery.lock().unwrap();
        if matches!(slot.as_ref(), Some((at, _)) if *at == index) {
          slot.take().map(|(_, hook)| hook)
        } else {
          None
        }
      };
      if let Some(hook) = hook {
        hook();
      }
      let budget = self.fail_budget.load(Ordering::SeqCst);
      if budget != 0 {
        self.fail_budget.store(budget - 1, Ordering::SeqCst);
        let registry = self.registry;
        let completion = std::thread::spawn(move || registry.finish_delivery(delivery, true))
          .join()
          .expect("the failing helper must not panic");
        assert!(
          completion.failed_dispatches.is_empty(),
          "the failed delivery must remain provisional until its publication retires"
        );
      }
      true
    }
  }

  /// Accepts every delivery and, while `fail` is set, fails it synchronously
  /// from inside `dispatch` on the calling thread -- the option
  /// [`CurrentThreadTaskDriver::dispatch`] documents for an SPI host. While a
  /// producer is armed it also rendezvouses with the producer thread from
  /// inside every delivery, so exactly one runnable is queued while each
  /// publication is in flight.
  struct SustainedProducerGate {
    remaining: usize,
    queue_one: std::sync::mpsc::Sender<()>,
    queued: std::sync::mpsc::Receiver<()>,
  }

  struct SustainedProducerCurrentThreadTaskDriver {
    registry: &'static CurrentThreadTaskDriverRegistry,
    /// Deliveries still to be failed: `usize::MAX` fails every one of them,
    /// `n` fails the next `n` and is healthy after, `0` is healthy.
    fail_budget: AtomicUsize,
    deliveries: Mutex<Vec<CurrentThreadTaskDelivery>>,
    producer: Mutex<Option<SustainedProducerGate>>,
  }

  impl SustainedProducerCurrentThreadTaskDriver {
    fn new(registry: &'static CurrentThreadTaskDriverRegistry) -> Self {
      Self {
        registry,
        fail_budget: AtomicUsize::new(0),
        deliveries: Mutex::default(),
        producer: Mutex::default(),
      }
    }

    fn deliveries(&self) -> Vec<CurrentThreadTaskDelivery> {
      self.deliveries.lock().unwrap().clone()
    }

    fn arm_producer(
      &self,
      remaining: usize,
      queue_one: std::sync::mpsc::Sender<()>,
      queued: std::sync::mpsc::Receiver<()>,
    ) {
      *self.producer.lock().unwrap() = Some(SustainedProducerGate {
        remaining,
        queue_one,
        queued,
      });
    }

    /// Close the gate and report how many submissions the producer was still
    /// willing to make.
    fn disarm_producer(&self) -> usize {
      self
        .producer
        .lock()
        .unwrap()
        .take()
        .map_or(0, |gate| gate.remaining)
    }
  }

  impl CurrentThreadTaskDriver for SustainedProducerCurrentThreadTaskDriver {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      self.deliveries.lock().unwrap().push(delivery);
      {
        let mut slot = self.producer.lock().unwrap();
        if let Some(gate) = slot.as_mut()
          && gate.remaining != 0
        {
          gate.remaining -= 1;
          gate.queue_one.send(()).expect("the producer must be live");
          gate
            .queued
            .recv_timeout(std::time::Duration::from_secs(5))
            .expect("the producer must queue one runnable per publication");
        }
      }
      let budget = self.fail_budget.load(Ordering::SeqCst);
      if budget != 0 {
        if budget != usize::MAX {
          self.fail_budget.store(budget - 1, Ordering::SeqCst);
        }
        let completion = self.registry.finish_delivery(delivery, true);
        assert!(
          completion.failed_dispatches.is_empty(),
          "the failed delivery must remain provisional until its publication retires"
        );
      }
      true
    }
  }

  impl CurrentThreadTaskDriver for FailDuringAuthoritativePanicPublication {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      let completion =
        CURRENT_THREAD_AUTHORITATIVE_PANIC_TASK_DRIVERS.finish_delivery(delivery, true);
      assert!(
        completion.failed_dispatches.is_empty(),
        "the failed delivery must remain provisional until its publication retires"
      );
      true
    }
  }

  impl CurrentThreadTaskDriver for FailDuringLateRegistrationPublication {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      let completion =
        CURRENT_THREAD_LATE_REGISTRATION_TASK_DRIVERS.finish_delivery(delivery, true);
      assert!(
        completion.failed_dispatches.is_empty(),
        "the failed delivery must remain provisional until its publication retires"
      );
      true
    }
  }

  impl CurrentThreadTaskDriver for FailDuringNestedUnwindPublication {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      let completion = CURRENT_THREAD_NESTED_UNWIND_TASK_DRIVERS.finish_delivery(delivery, true);
      assert!(
        completion.failed_dispatches.is_empty(),
        "the failed delivery must remain provisional until its publication retires"
      );
      true
    }
  }

  impl CurrentThreadTaskDriver for FailDuringReplacementRepublishPublication {
    fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
      let completion =
        CURRENT_THREAD_REPLACEMENT_FAILED_REPUBLISH_TASK_DRIVERS.finish_delivery(delivery, true);
      assert!(
        completion.failed_dispatches.is_empty(),
        "the failed delivery must remain provisional until its publication retires"
      );
      true
    }
  }

  struct ReentrantCurrentThreadTaskDriver {
    registry: std::sync::Weak<CurrentThreadTaskDriverRegistry>,
    registration: Mutex<Option<CurrentThreadTaskDriverId>>,
  }

  impl CurrentThreadTaskDriver for ReentrantCurrentThreadTaskDriver {
    fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
      true
    }

    fn is_live(&self) -> bool {
      let registration = *self.registration.lock().unwrap();
      if let (Some(registry), Some(id)) = (self.registry.upgrade(), registration) {
        registry.unregister(id);
      }
      false
    }
  }

  struct ReentrantMultiUnregisterCurrentThreadTaskDriver {
    registry: std::sync::Weak<CurrentThreadTaskDriverRegistry>,
    registrations: Mutex<Vec<CurrentThreadTaskDriverId>>,
  }

  impl CurrentThreadTaskDriver for ReentrantMultiUnregisterCurrentThreadTaskDriver {
    fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
      true
    }

    fn is_live(&self) -> bool {
      if let Some(registry) = self.registry.upgrade() {
        for registration in self.registrations.lock().unwrap().iter().copied() {
          let completion = registry.unregister(registration);
          assert!(completion.failed_dispatches.is_empty());
          assert!(!completion.redispatch);
        }
      }
      false
    }
  }

  struct ReentrantDispatchMultiUnregisterCurrentThreadTaskDriver {
    registry: std::sync::Weak<CurrentThreadTaskDriverRegistry>,
    registrations: Mutex<Vec<CurrentThreadTaskDriverId>>,
    drops: Arc<AtomicUsize>,
  }

  impl CurrentThreadTaskDriver for ReentrantDispatchMultiUnregisterCurrentThreadTaskDriver {
    fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
      if let Some(registry) = self.registry.upgrade() {
        for registration in self.registrations.lock().unwrap().iter().copied() {
          let completion = registry.unregister(registration);
          assert!(completion.failed_dispatches.is_empty());
          assert!(!completion.redispatch);
        }
      }
      true
    }
  }

  impl Drop for ReentrantDispatchMultiUnregisterCurrentThreadTaskDriver {
    fn drop(&mut self) {
      self.drops.fetch_add(1, Ordering::SeqCst);
      panic!("intentional reentrant CurrentThread task-driver destructor panic");
    }
  }

  struct PanickingDropCurrentThreadTaskDriver {
    drops: Arc<AtomicUsize>,
  }

  impl CurrentThreadTaskDriver for PanickingDropCurrentThreadTaskDriver {
    fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
      true
    }
  }

  impl Drop for PanickingDropCurrentThreadTaskDriver {
    fn drop(&mut self) {
      self.drops.fetch_add(1, Ordering::SeqCst);
      panic!("intentional CurrentThread task-driver destructor panic");
    }
  }

  struct ReentrantCurrentThreadTaskDriverDrop {
    registry: std::sync::Weak<CurrentThreadTaskDriverRegistry>,
    fallback: CurrentThreadTaskDriverId,
  }

  impl CurrentThreadTaskDriver for ReentrantCurrentThreadTaskDriverDrop {
    fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
      true
    }
  }

  impl Drop for ReentrantCurrentThreadTaskDriverDrop {
    fn drop(&mut self) {
      if let Some(registry) = self.registry.upgrade() {
        registry.unregister(self.fallback);
      }
    }
  }

  impl CurrentThreadTaskDriver for TestCurrentThreadTaskDriver {
    fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
      assert!(
        !matches!(
          self.behavior,
          TestCurrentThreadTaskDriverBehavior::PanicInDispatchAndSweep
        ),
        "intentional task-driver dispatch panic"
      );
      self.dispatched.store(true, Ordering::SeqCst);
      true
    }

    fn is_live(&self) -> bool {
      assert!(
        !matches!(
          self.behavior,
          TestCurrentThreadTaskDriverBehavior::PanicInLivenessAndSweep
        ),
        "intentional task-driver liveness panic"
      );
      true
    }

    fn on_swept(&self) {
      assert!(
        matches!(self.behavior, TestCurrentThreadTaskDriverBehavior::Healthy),
        "intentional task-driver sweep panic"
      );
    }
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_task_driver_panics_fall_back_to_a_live_host() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let fallback = Arc::new(TestCurrentThreadTaskDriver {
      behavior: TestCurrentThreadTaskDriverBehavior::Healthy,
      dispatched: AtomicBool::new(false),
    });
    registry.register(Arc::clone(&fallback) as Arc<dyn CurrentThreadTaskDriver>);
    registry.register(Arc::new(TestCurrentThreadTaskDriver {
      behavior: TestCurrentThreadTaskDriverBehavior::PanicInLivenessAndSweep,
      dispatched: AtomicBool::new(false),
    }));
    registry.register(Arc::new(TestCurrentThreadTaskDriver {
      behavior: TestCurrentThreadTaskDriverBehavior::PanicInDispatchAndSweep,
      dispatched: AtomicBool::new(false),
    }));

    assert_eq!(
      registry.dispatch(37),
      CurrentThreadHostDispatchResult::Accepted,
      "a panicking newest host must fall back to a live host"
    );
    assert!(fallback.dispatched.load(Ordering::SeqCst));
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_registry_publication_unwind_releases_barrier_and_can_retry() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let first = Arc::new(ManualCurrentThreadTaskDriver::default());
    let second = Arc::new(ManualCurrentThreadTaskDriver::default());
    registry.register(Arc::clone(&first) as Arc<dyn CurrentThreadTaskDriver>);
    registry.register(Arc::clone(&second) as Arc<dyn CurrentThreadTaskDriver>);
    registry
      .next_delivery
      .store(u64::MAX - 1, Ordering::Relaxed);

    let publication = catch_unwind(AssertUnwindSafe(|| registry.dispatch(38)));
    assert!(
      publication.is_err(),
      "delivery-id exhaustion on the second host must unwind the publication"
    );
    {
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        !state.dispatches.contains_key(&38),
        "unwind cleanup must release the exact registry publication barrier"
      );
      assert!(
        state
          .entries
          .values()
          .all(|entry| entry.delivery.is_none() && entry.pending.is_none()),
        "failed transactional reservation must leave every physical host slot clean"
      );
    }
    assert!(first.deliveries().is_empty());
    assert!(second.deliveries().is_empty());

    registry.next_delivery.store(0, Ordering::Relaxed);
    assert_eq!(
      registry.dispatch(38),
      CurrentThreadHostDispatchResult::Accepted
    );
    let first_delivery = first.deliveries()[0];
    let second_delivery = second.deliveries()[0];
    assert_eq!(
      registry.claim_delivery(first_delivery.capability()),
      Some(38)
    );
    assert_eq!(
      registry.claim_delivery(second_delivery.capability()),
      Some(38)
    );
    registry.mark_serviced(38);
    assert!(
      registry
        .finish_delivery(first_delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert!(
      registry
        .finish_delivery(second_delivery, false)
        .failed_dispatches
        .is_empty()
    );

    assert_eq!(
      registry.dispatch(39),
      CurrentThreadHostDispatchResult::Accepted
    );
    let first_later = first.deliveries()[1];
    let second_later = second.deliveries()[1];
    assert_eq!(registry.claim_delivery(first_later.capability()), Some(39));
    assert_eq!(registry.claim_delivery(second_later.capability()), Some(39));
    registry.mark_serviced(39);
    assert!(
      registry
        .finish_delivery(first_later, false)
        .failed_dispatches
        .is_empty()
    );
    assert!(
      registry
        .finish_delivery(second_later, false)
        .failed_dispatches
        .is_empty()
    );
    assert!(
      registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .dispatches
        .is_empty()
    );
    let state = registry
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(
      state
        .entries
        .values()
        .all(|entry| entry.delivery.is_none() && entry.pending.is_none())
    );
  }

  #[test]
  fn current_thread_registry_rearms_failed_dispatch_for_new_host() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let failed = Arc::new(ManualCurrentThreadTaskDriver::default());
    let failed_id = registry.register(Arc::clone(&failed) as Arc<dyn CurrentThreadTaskDriver>);
    let dispatch = 40;

    assert_eq!(
      registry.dispatch(dispatch),
      CurrentThreadHostDispatchResult::Accepted
    );
    let failed_delivery = failed.deliveries()[0];
    let failure = current_thread_dispatch_failure(dispatch, 0);
    assert_eq!(
      registry
        .finish_delivery(failed_delivery, true)
        .failed_dispatches,
      vec![failure]
    );
    registry.unregister(failed_id);

    let replacement = Arc::new(ManualCurrentThreadTaskDriver::default());
    registry.register(Arc::clone(&replacement) as Arc<dyn CurrentThreadTaskDriver>);
    assert!(
      registry.rearm_failed_publication(failure),
      "a closed unreferenced dispatch must reopen for its armed publication owner"
    );
    assert_eq!(
      registry.dispatch(dispatch),
      CurrentThreadHostDispatchResult::Accepted
    );
    let replacement_delivery = replacement.deliveries()[0];
    assert_eq!(replacement_delivery.dispatch, dispatch);
    assert_eq!(
      registry.claim_delivery(replacement_delivery.capability()),
      Some(dispatch)
    );
    registry.mark_serviced(dispatch);
    assert!(
      registry
        .finish_delivery(replacement_delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert!(registry.state.lock().unwrap().dispatches.is_empty());
  }

  #[test]
  fn current_thread_dispatch_races_all_live_hosts_with_one_capability() {
    struct RacingTaskDriver {
      executor: Arc<CurrentThreadExecutor>,
      drives: bool,
      dispatches: Mutex<Vec<u64>>,
    }

    impl CurrentThreadTaskDriver for RacingTaskDriver {
      fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
        self.dispatches.lock().unwrap().push(delivery.dispatch);
        if self.drives {
          self
            .executor
            .drive_host_turn_for_dispatch(delivery.dispatch);
        }
        true
      }
    }

    let executor = Arc::new(CurrentThreadExecutor::with_task_dispatch(
      Arc::new(RuntimeMetrics::default()),
      accept_current_thread_host_dispatch,
    ));
    let polls = Arc::new(AtomicUsize::new(0));
    let task_polls = Arc::clone(&polls);
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        task_polls.fetch_add(1, Ordering::SeqCst);
      },
      move |runnable| scheduler.schedule(runnable),
    );
    executor.schedule(runnable);
    let dispatch = current_thread_dispatch(&executor);

    let registry = CurrentThreadTaskDriverRegistry::default();
    let responsive = Arc::new(RacingTaskDriver {
      executor: Arc::clone(&executor),
      drives: true,
      dispatches: Mutex::new(Vec::new()),
    });
    let starved = Arc::new(RacingTaskDriver {
      executor: Arc::clone(&executor),
      drives: false,
      dispatches: Mutex::new(Vec::new()),
    });
    registry.register(Arc::clone(&responsive) as Arc<dyn CurrentThreadTaskDriver>);
    // The newest host is intentionally live but unresponsive.
    registry.register(Arc::clone(&starved) as Arc<dyn CurrentThreadTaskDriver>);

    assert_eq!(
      registry.dispatch(dispatch),
      CurrentThreadHostDispatchResult::Accepted
    );
    assert_eq!(
      responsive.dispatches.lock().unwrap().as_slice(),
      &[dispatch]
    );
    assert_eq!(starved.dispatches.lock().unwrap().as_slice(), &[dispatch]);
    assert_eq!(
      polls.load(Ordering::SeqCst),
      1,
      "the responsive older host must win even when the newest host is starved"
    );

    // The delayed callback from the starved host carries the same consumed
    // capability and cannot poll the task a second time.
    executor.drive_host_turn_for_dispatch(dispatch);
    assert_eq!(polls.load(Ordering::SeqCst), 1);
    futures::executor::block_on(task);
  }

  #[test]
  fn current_thread_task_driver_indexes_preserve_large_pool_lifecycle() {
    const HOSTS: usize = 1_024;

    let registry = CurrentThreadTaskDriverRegistry::default();
    let mut ids = Vec::with_capacity(HOSTS);
    let mut drivers = Vec::with_capacity(HOSTS);
    for _ in 0..HOSTS {
      let driver = Arc::new(ManualCurrentThreadTaskDriver::default());
      ids.push(registry.register(Arc::clone(&driver) as Arc<dyn CurrentThreadTaskDriver>));
      drivers.push(driver);
    }

    let dispatch = u64::MAX - 300;
    assert_eq!(
      registry.dispatch(dispatch),
      CurrentThreadHostDispatchResult::Accepted
    );
    let deliveries = drivers
      .iter()
      .map(|driver| driver.deliveries()[0])
      .collect::<Vec<_>>();
    {
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(state.delivery_drivers.len(), HOSTS);
      assert_eq!(
        state
          .dispatches
          .get(&dispatch)
          .map(|state| state.references),
        Some(HOSTS)
      );
      assert_eq!(
        state
          .ordered_snapshot()
          .iter()
          .map(|(id, _)| *id)
          .collect::<Vec<_>>(),
        ids,
        "keyed driver lookup must retain registration order"
      );
    }

    for delivery in &deliveries {
      assert_eq!(
        registry.claim_delivery(delivery.capability()),
        Some(dispatch)
      );
    }
    registry.mark_serviced(dispatch);
    for delivery in deliveries {
      assert!(
        registry
          .finish_delivery(delivery, false)
          .failed_dispatches
          .is_empty()
      );
    }
    {
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.delivery_drivers.is_empty());
      assert!(state.dispatches.is_empty());
    }

    let removed = ids.iter().copied().step_by(2).collect::<FxHashSet<_>>();
    for id in &removed {
      let completion = registry.unregister(*id);
      assert!(completion.failed_dispatches.is_empty());
      assert!(!completion.redispatch);
    }
    let expected = ids
      .iter()
      .copied()
      .filter(|id| !removed.contains(id))
      .collect::<Vec<_>>();
    let live = registry.live().live;
    assert_eq!(
      live
        .as_slice()
        .iter()
        .map(|(id, _)| *id)
        .collect::<Vec<_>>(),
      expected,
      "O(1) removals must preserve the relative order of surviving host registrations"
    );
    drop(live);

    for id in expected {
      registry.unregister(id);
    }
    let state = registry
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(state.entries.is_empty());
    assert!(state.oldest.is_none());
    assert!(state.newest.is_none());
  }

  #[test]
  fn current_thread_host_failure_waits_for_delayed_and_healthy_attempts() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let failing = Arc::new(ManualCurrentThreadTaskDriver::default());
    let delayed = Arc::new(ManualCurrentThreadTaskDriver::default());
    let healthy = Arc::new(ManualCurrentThreadTaskDriver::default());
    registry.register(Arc::clone(&failing) as Arc<dyn CurrentThreadTaskDriver>);
    registry.register(Arc::clone(&delayed) as Arc<dyn CurrentThreadTaskDriver>);
    registry.register(Arc::clone(&healthy) as Arc<dyn CurrentThreadTaskDriver>);

    let dispatch = 41;
    assert_eq!(
      registry.dispatch(dispatch),
      CurrentThreadHostDispatchResult::Accepted
    );
    let failing_delivery = failing.deliveries()[0];
    let delayed_delivery = delayed.deliveries()[0];
    let healthy_delivery = healthy.deliveries()[0];
    assert_eq!(failing_delivery.dispatch, dispatch);
    assert_eq!(delayed_delivery.dispatch, dispatch);
    assert_eq!(healthy_delivery.dispatch, dispatch);

    assert!(
      registry
        .finish_delivery(failing_delivery, true)
        .failed_dispatches
        .is_empty(),
      "one host failure must not recover while other accepted attempts remain"
    );
    assert_eq!(
      registry.claim_delivery(healthy_delivery.capability()),
      Some(dispatch)
    );
    registry.mark_serviced(dispatch);
    assert!(
      registry
        .finish_delivery(healthy_delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert_eq!(
      registry.claim_delivery(delayed_delivery.capability()),
      None,
      "a delayed losing delivery must become stale after another host services the dispatch"
    );
    assert!(
      registry
        .finish_delivery(delayed_delivery, true)
        .failed_dispatches
        .is_empty(),
      "a stale losing failure must not recover or cancel a serviced dispatch"
    );
    assert!(
      registry.state.lock().unwrap().dispatches.is_empty(),
      "all per-dispatch acknowledgement state must retire"
    );
  }

  #[test]
  fn current_thread_unclaimed_callback_success_is_delivery_failure() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let no_op = Arc::new(ManualCurrentThreadTaskDriver::default());
    registry.register(Arc::clone(&no_op) as Arc<dyn CurrentThreadTaskDriver>);

    let dispatch = 56;
    assert_eq!(
      registry.dispatch(dispatch),
      CurrentThreadHostDispatchResult::Accepted
    );
    let delivery = no_op.deliveries()[0];
    let completion = registry.finish_delivery(delivery, false);
    let failure = current_thread_dispatch_failure(dispatch, 0);
    assert_eq!(
      completion.failed_dispatches,
      vec![failure],
      "a callback return without an exact capability claim must enter recovery"
    );
    assert!(
      registry
        .state
        .lock()
        .unwrap()
        .dispatches
        .get(&dispatch)
        .is_some_and(CurrentThreadDispatchState::is_cancelling)
    );
    registry.finish_cancellation(failure);
    assert!(registry.state.lock().unwrap().dispatches.is_empty());
  }

  #[test]
  fn current_thread_publication_retains_accepted_failure_until_provisionals_resolve() {
    struct FailDuringPublication {
      registry: std::sync::Weak<CurrentThreadTaskDriverRegistry>,
    }

    impl CurrentThreadTaskDriver for FailDuringPublication {
      fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
        let completion = self
          .registry
          .upgrade()
          .expect("the registry must outlive publication")
          .finish_delivery(delivery, true);
        assert!(
          completion.failed_dispatches.is_empty(),
          "failure must remain provisional until the broadcast closes"
        );
        true
      }
    }

    struct RejectProvisional;

    impl CurrentThreadTaskDriver for RejectProvisional {
      fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
        false
      }
    }

    let registry = Arc::new(CurrentThreadTaskDriverRegistry::default());
    registry.register(Arc::new(RejectProvisional));
    // Newest-first publication calls the accepted-then-failing host while the
    // rejecting host still has an unresolved provisional delivery.
    registry.register(Arc::new(FailDuringPublication {
      registry: Arc::downgrade(&registry),
    }));

    let failure = current_thread_dispatch_failure(57, 0);
    assert_eq!(
      registry.dispatch(57),
      CurrentThreadHostDispatchResult::Failed(failure),
      "the final provisional rejection must expose the earlier accepted failure"
    );
    assert!(
      registry
        .state
        .lock()
        .unwrap()
        .dispatches
        .get(&57)
        .is_some_and(CurrentThreadDispatchState::is_cancelling)
    );
    assert_eq!(
      registry.dispatch(57),
      CurrentThreadHostDispatchResult::Failed(failure),
      "a racing replacement publication must preserve terminal failure until cancellation runs"
    );
    registry.finish_cancellation(failure);
  }

  #[test]
  fn current_thread_publication_distinguishes_no_host_acceptance_from_accepted_failure() {
    struct RejectProvisional;

    impl CurrentThreadTaskDriver for RejectProvisional {
      fn dispatch(&self, _delivery: CurrentThreadTaskDelivery) -> bool {
        false
      }
    }

    let registry = CurrentThreadTaskDriverRegistry::default();
    registry.register(Arc::new(RejectProvisional));
    registry.register(Arc::new(RejectProvisional));

    assert_eq!(
      registry.dispatch(58),
      CurrentThreadHostDispatchResult::Unavailable
    );
    assert!(
      registry.state.lock().unwrap().dispatches.is_empty(),
      "a broadcast with no accepted attempt must not enter failure recovery"
    );
  }

  #[test]
  fn current_thread_blocked_host_keeps_one_delivery_and_only_the_latest_pending_capability() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let blocked = Arc::new(ManualCurrentThreadTaskDriver::default());
    let blocked_id = registry.register(Arc::clone(&blocked) as Arc<dyn CurrentThreadTaskDriver>);

    assert_eq!(
      registry.dispatch(1),
      CurrentThreadHostDispatchResult::Accepted
    );
    let first = blocked.deliveries()[0];
    for dispatch in 2..=256 {
      assert_eq!(
        registry.dispatch(dispatch),
        CurrentThreadHostDispatchResult::Accepted
      );
      assert_eq!(
        blocked.deliveries().len(),
        1,
        "a blocked host must never receive a second queued or in-flight callback"
      );
    }
    {
      let state = registry.state.lock().unwrap();
      let entry = state
        .entries
        .get(&blocked_id)
        .expect("the blocked host must remain registered");
      assert_eq!(entry.pending, Some(256));
      assert_eq!(
        state.dispatches.len(),
        2,
        "only the in-flight and latest pending dispatches may retain registry state"
      );
    }

    assert_eq!(registry.claim_delivery(first.capability()), Some(1));
    registry.mark_serviced(1);
    let completion = registry.finish_delivery(first, false);
    assert!(completion.failed_dispatches.is_empty());
    assert!(completion.redispatch);
    assert_eq!(
      registry.dispatch(256),
      CurrentThreadHostDispatchResult::Accepted
    );
    let deliveries = blocked.deliveries();
    assert_eq!(deliveries.len(), 2);
    assert_eq!(
      deliveries[1].dispatch, 256,
      "completion must schedule exactly the latest coalesced capability"
    );
    assert_eq!(registry.claim_delivery(first.capability()), None);
    assert_eq!(
      registry.claim_delivery(deliveries[1].capability()),
      Some(256)
    );
    registry.mark_serviced(256);
    assert!(
      registry
        .finish_delivery(deliveries[1], false)
        .failed_dispatches
        .is_empty()
    );
    assert!(registry.state.lock().unwrap().dispatches.is_empty());
  }

  #[test]
  fn current_thread_coalesced_follow_up_rejection_is_reported_as_delivery_failure() {
    struct RejectAfterFirst {
      calls: AtomicUsize,
      deliveries: Mutex<Vec<CurrentThreadTaskDelivery>>,
    }

    impl CurrentThreadTaskDriver for RejectAfterFirst {
      fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
        self.deliveries.lock().unwrap().push(delivery);
        self.calls.fetch_add(1, Ordering::SeqCst) == 0
      }
    }

    let registry = CurrentThreadTaskDriverRegistry::default();
    let host = Arc::new(RejectAfterFirst {
      calls: AtomicUsize::new(0),
      deliveries: Mutex::new(Vec::new()),
    });
    registry.register(Arc::clone(&host) as Arc<dyn CurrentThreadTaskDriver>);
    assert_eq!(
      registry.dispatch(11),
      CurrentThreadHostDispatchResult::Accepted
    );
    let first = host.deliveries.lock().unwrap()[0];
    assert_eq!(
      registry.dispatch(12),
      CurrentThreadHostDispatchResult::Accepted
    );

    assert_eq!(registry.claim_delivery(first.capability()), Some(11));
    registry.mark_serviced(11);
    let completion = registry.finish_delivery(first, false);
    assert!(completion.redispatch);
    let failure = current_thread_dispatch_failure(12, 0);
    assert_eq!(
      registry.dispatch(12),
      CurrentThreadHostDispatchResult::Failed(failure),
      "an accepted coalesced capability must report failure if its eventual host queue rejects it"
    );
    assert!(
      registry
        .state
        .lock()
        .unwrap()
        .dispatches
        .get(&12)
        .is_some_and(CurrentThreadDispatchState::is_cancelling)
    );
    registry.finish_cancellation(failure);
    assert!(registry.state.lock().unwrap().dispatches.is_empty());
  }

  #[test]
  fn current_thread_unregister_reregister_rejects_old_delivery_generation() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let old = Arc::new(ManualCurrentThreadTaskDriver::default());
    let old_id = registry.register(Arc::clone(&old) as Arc<dyn CurrentThreadTaskDriver>);
    assert_eq!(
      registry.dispatch(73),
      CurrentThreadHostDispatchResult::Accepted
    );
    let old_delivery = old.deliveries()[0];

    let completion = registry.unregister(old_id);
    let failure = current_thread_dispatch_failure(73, 0);
    assert_eq!(
      completion.failed_dispatches,
      vec![failure],
      "unregistering the final accepting host must retire its exact dispatch"
    );
    registry.finish_cancellation(failure);
    let replacement = Arc::new(ManualCurrentThreadTaskDriver::default());
    let replacement_id =
      registry.register(Arc::clone(&replacement) as Arc<dyn CurrentThreadTaskDriver>);
    assert_ne!(replacement_id, old_id);
    assert_eq!(
      registry.dispatch(74),
      CurrentThreadHostDispatchResult::Accepted
    );
    let replacement_delivery = replacement.deliveries()[0];
    assert_ne!(replacement_delivery.capability(), old_delivery.capability());

    assert_eq!(registry.claim_delivery(old_delivery.capability()), None);
    assert!(
      registry
        .finish_delivery(old_delivery, true)
        .failed_dispatches
        .is_empty()
    );
    assert!(
      registry
        .fail_delivery(old_delivery.capability())
        .failed_dispatches
        .is_empty()
    );
    assert_eq!(
      registry.claim_delivery(replacement_delivery.capability()),
      Some(74)
    );
    registry.mark_serviced(74);
    assert!(
      registry
        .finish_delivery(replacement_delivery, false)
        .failed_dispatches
        .is_empty()
    );
    assert!(registry.state.lock().unwrap().dispatches.is_empty());
  }

  #[test]
  fn current_thread_rejected_publication_reports_concurrent_pending_failure() {
    struct QueuePendingThenReject {
      registry: std::sync::Weak<CurrentThreadTaskDriverRegistry>,
    }

    impl CurrentThreadTaskDriver for QueuePendingThenReject {
      fn dispatch(&self, delivery: CurrentThreadTaskDelivery) -> bool {
        assert_eq!(delivery.dispatch, 81);
        let completion = self
          .registry
          .upgrade()
          .expect("the registry must outlive publication")
          .dispatch_with_completion(82);
        assert_eq!(completion.result, CurrentThreadHostDispatchResult::Accepted);
        assert!(completion.failed_dispatches.is_empty());
        false
      }
    }

    let registry = Arc::new(CurrentThreadTaskDriverRegistry::default());
    registry.register(Arc::new(QueuePendingThenReject {
      registry: Arc::downgrade(&registry),
    }));

    let completion = registry.dispatch_with_completion(81);
    assert_eq!(
      completion.result,
      CurrentThreadHostDispatchResult::Unavailable
    );
    let failure = current_thread_dispatch_failure(82, 0);
    assert_eq!(
      completion.failed_dispatches,
      vec![failure],
      "rejecting the physical slot must surface the accepted coalesced dispatch it retired"
    );
    assert!(
      registry
        .state
        .lock()
        .unwrap()
        .dispatches
        .get(&82)
        .is_some_and(CurrentThreadDispatchState::is_cancelling)
    );
    registry.finish_cancellation(failure);
    assert!(registry.state.lock().unwrap().dispatches.is_empty());
  }

  #[test]
  fn current_thread_shutdown_retires_pending_state_without_breaking_single_flight() {
    let registry = CurrentThreadTaskDriverRegistry::default();
    let host = Arc::new(ManualCurrentThreadTaskDriver::default());
    let host_id = registry.register(Arc::clone(&host) as Arc<dyn CurrentThreadTaskDriver>);
    assert_eq!(
      registry.dispatch(91),
      CurrentThreadHostDispatchResult::Accepted
    );
    let old_delivery = host.deliveries()[0];
    assert_eq!(
      registry.dispatch(92),
      CurrentThreadHostDispatchResult::Accepted
    );

    registry.retire_for_shutdown();
    {
      let state = registry.state.lock().unwrap();
      assert!(state.dispatches.is_empty());
      let entry = state
        .entries
        .get(&host_id)
        .expect("the host must remain registered");
      assert_eq!(entry.pending, None);
      assert!(
        entry.delivery.is_some(),
        "the physical callback remains single-flight until it actually retires"
      );
    }
    assert_eq!(registry.claim_delivery(old_delivery.capability()), None);

    assert_eq!(
      registry.dispatch(93),
      CurrentThreadHostDispatchResult::Accepted
    );
    assert_eq!(host.deliveries().len(), 1);
    let completion = registry.finish_delivery(old_delivery, true);
    assert!(
      completion.failed_dispatches.is_empty(),
      "a retired-generation failure must not cancel restarted work"
    );
    assert!(completion.redispatch);
    assert_eq!(
      registry.dispatch(93),
      CurrentThreadHostDispatchResult::Accepted
    );
    let restarted_delivery = host.deliveries()[1];
    assert_eq!(restarted_delivery.dispatch, 93);
    assert_eq!(
      registry.claim_delivery(restarted_delivery.capability()),
      Some(93)
    );
    registry.mark_serviced(93);
    assert!(
      registry
        .finish_delivery(restarted_delivery, false)
        .failed_dispatches
        .is_empty()
    );

    registry.unregister(host_id);
    let state = registry.state.lock().unwrap();
    assert!(state.entries.is_empty());
    assert!(state.dispatches.is_empty());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_task_driver_callbacks_and_drops_run_outside_registry_lock() {
    use std::{sync::mpsc, time::Duration};

    let registry = Arc::new(CurrentThreadTaskDriverRegistry::default());
    let fallback = Arc::new(TestCurrentThreadTaskDriver {
      behavior: TestCurrentThreadTaskDriverBehavior::Healthy,
      dispatched: AtomicBool::new(false),
    });
    let fallback_id = registry.register(Arc::clone(&fallback) as Arc<dyn CurrentThreadTaskDriver>);
    let reentrant = Arc::new(ReentrantCurrentThreadTaskDriver {
      registry: Arc::downgrade(&registry),
      registration: Mutex::new(None),
    });
    let reentrant_id =
      registry.register(Arc::clone(&reentrant) as Arc<dyn CurrentThreadTaskDriver>);
    *reentrant.registration.lock().unwrap() = Some(reentrant_id);

    let (selection_tx, selection_rx) = mpsc::sync_channel(1);
    let selection_registry = Arc::clone(&registry);
    let selection_thread = std::thread::spawn(move || {
      selection_tx
        .send(selection_registry.current().map(|(id, _)| id))
        .unwrap();
    });
    assert_eq!(
      selection_rx
        .recv_timeout(Duration::from_secs(10))
        .expect("is_live re-entry deadlocked"),
      Some(fallback_id)
    );
    selection_thread.join().unwrap();

    let drop_driver: Arc<dyn CurrentThreadTaskDriver> =
      Arc::new(ReentrantCurrentThreadTaskDriverDrop {
        registry: Arc::downgrade(&registry),
        fallback: fallback_id,
      });
    let drop_id = registry.register(Arc::clone(&drop_driver));
    drop(drop_driver);

    let (drop_tx, drop_rx) = mpsc::sync_channel(1);
    let drop_registry = Arc::clone(&registry);
    let drop_thread = std::thread::spawn(move || {
      drop_registry.unregister(drop_id);
      drop_tx.send(()).unwrap();
    });
    drop_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("driver destructor re-entry deadlocked");
    drop_thread.join().unwrap();
    assert!(
      registry.current().is_none(),
      "the destructor must unregister the fallback"
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn current_thread_task_driver_registry_snapshot_contains_each_driver_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_TASK_DRIVER_SNAPSHOT_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let registry = Arc::new(CurrentThreadTaskDriverRegistry::default());
      let fallback = Arc::new(TestCurrentThreadTaskDriver {
        behavior: TestCurrentThreadTaskDriverBehavior::Healthy,
        dispatched: AtomicBool::new(false),
      });
      let fallback_id =
        registry.register(Arc::clone(&fallback) as Arc<dyn CurrentThreadTaskDriver>);
      let reentrant = Arc::new(ReentrantMultiUnregisterCurrentThreadTaskDriver {
        registry: Arc::downgrade(&registry),
        registrations: Mutex::new(Vec::new()),
      });
      registry.register(Arc::clone(&reentrant) as Arc<dyn CurrentThreadTaskDriver>);

      let first_drops = Arc::new(AtomicUsize::new(0));
      let first = Arc::new(PanickingDropCurrentThreadTaskDriver {
        drops: Arc::clone(&first_drops),
      });
      let first_id = registry.register(Arc::clone(&first) as Arc<dyn CurrentThreadTaskDriver>);
      drop(first);

      let second_drops = Arc::new(AtomicUsize::new(0));
      let second = Arc::new(PanickingDropCurrentThreadTaskDriver {
        drops: Arc::clone(&second_drops),
      });
      let second_id = registry.register(Arc::clone(&second) as Arc<dyn CurrentThreadTaskDriver>);
      drop(second);
      *reentrant.registrations.lock().unwrap() = vec![first_id, second_id];

      assert_eq!(
        registry.current().map(|(id, _)| id),
        Some(fallback_id),
        "selection must retry after reentrant removals and preserve the healthy fallback"
      );
      assert_eq!(first_drops.load(Ordering::SeqCst), 1);
      assert_eq!(second_drops.load(Ordering::SeqCst), 1);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(state.entries.len(), 1);
      assert!(state.entries.contains_key(&fallback_id));
      assert!(state.dispatches.is_empty());
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg(
        "async_runtime::tests::current_thread_task_driver_registry_snapshot_contains_each_driver_drop",
      )
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile task-driver snapshot subprocess test must start");
    assert!(
      output.status.success(),
      "reentrant liveness removal must not combine task-driver destructor panics; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn current_thread_task_driver_dispatch_contains_each_delivery_driver_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_TASK_DRIVER_DELIVERY_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let registry = Arc::new(CurrentThreadTaskDriverRegistry::default());

      let first_drops = Arc::new(AtomicUsize::new(0));
      let first = Arc::new(PanickingDropCurrentThreadTaskDriver {
        drops: Arc::clone(&first_drops),
      });
      let first_id = registry.register(Arc::clone(&first) as Arc<dyn CurrentThreadTaskDriver>);
      drop(first);

      let second_drops = Arc::new(AtomicUsize::new(0));
      let second = Arc::new(PanickingDropCurrentThreadTaskDriver {
        drops: Arc::clone(&second_drops),
      });
      let second_id = registry.register(Arc::clone(&second) as Arc<dyn CurrentThreadTaskDriver>);
      drop(second);

      let reentrant_drops = Arc::new(AtomicUsize::new(0));
      let reentrant = Arc::new(ReentrantDispatchMultiUnregisterCurrentThreadTaskDriver {
        registry: Arc::downgrade(&registry),
        registrations: Mutex::new(Vec::new()),
        drops: Arc::clone(&reentrant_drops),
      });
      let reentrant_id =
        registry.register(Arc::clone(&reentrant) as Arc<dyn CurrentThreadTaskDriver>);
      *reentrant.registrations.lock().unwrap() = vec![reentrant_id, second_id, first_id];
      drop(reentrant);

      let dispatch = 59;
      let failure = current_thread_dispatch_failure(dispatch, 0);
      assert_eq!(
        registry.dispatch(dispatch),
        CurrentThreadHostDispatchResult::Failed(failure),
        "reentrant removal of every provisional host must report accepted delivery failure"
      );
      assert_eq!(reentrant_drops.load(Ordering::SeqCst), 1);
      assert_eq!(first_drops.load(Ordering::SeqCst), 1);
      assert_eq!(second_drops.load(Ordering::SeqCst), 1);
      registry.finish_cancellation(failure);
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(state.entries.is_empty());
      assert!(state.dispatches.is_empty());
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg(
        "async_runtime::tests::current_thread_task_driver_dispatch_contains_each_delivery_driver_drop",
      )
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile task-driver delivery subprocess test must start");
    assert!(
      output.status.success(),
      "reentrant dispatch removal must not combine delivery-driver destructor panics; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  // Builds the `JoinHandleInner::Task` literal directly, whose `dependency`
  // field only exists where the MultiThread machinery is compiled in.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn dropping_join_handle_detaches_task_like_tokio() {
    let completed = Arc::new(AtomicBool::new(false));
    let completed_task = Arc::clone(&completed);
    let (runnable, task) = async_task::spawn(
      async move {
        completed_task.store(true, Ordering::SeqCst);
        Ok::<ContainedTaskOutput<()>, JoinError>(ContainedTaskOutput::new((), u64::MAX))
      },
      |_| {},
    );
    let handle = JoinHandle(JoinHandleInner::Task {
      task: task.fallible(),
      awaiter: None,
      dependency: Arc::new(TaskDependency::default()),
    });

    drop(handle);
    runnable.run();
    assert!(completed.load(Ordering::SeqCst));
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn join_handle_completion_contains_panicking_awaiter_wake_and_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_JOIN_HANDLE_COMPLETION_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let wakes = Arc::new(AtomicUsize::new(0));
      let drops = Arc::new(AtomicUsize::new(0));
      let (runnable, task) = async_task::spawn(
        async { Ok::<ContainedTaskOutput<()>, JoinError>(ContainedTaskOutput::new((), u64::MAX)) },
        |_| {},
      );
      let mut handle = JoinHandle(JoinHandleInner::Task {
        task: task.fallible(),
        awaiter: None,
        dependency: Arc::new(TaskDependency::default()),
      });
      let waker = panicking_join_awaiter_waker(Arc::clone(&wakes), Arc::clone(&drops));
      {
        let mut cx = Context::from_waker(&waker);
        assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
      }
      drop(waker);

      runnable.run();

      let waker = futures::task::noop_waker();
      let mut cx = Context::from_waker(&waker);
      assert!(matches!(
        Pin::new(&mut handle).poll(&mut cx),
        Poll::Ready(Ok(()))
      ));
      assert_eq!(
        drops.load(Ordering::SeqCst),
        1,
        "a completed handle must not retain the caller's awaiter"
      );
      drop(handle);
      assert!(wakes.load(Ordering::SeqCst) >= 1);
      assert_eq!(drops.load(Ordering::SeqCst), 1);
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::join_handle_completion_contains_panicking_awaiter_wake_and_drop")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the JoinHandle completion awaiter subprocess must start");
    assert!(
      output.status.success(),
      "a panicking JoinHandle completion awaiter must not abort the process; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn join_handle_shutdown_contains_panicking_awaiter_wake_and_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_JOIN_HANDLE_SHUTDOWN_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let controller = multi_thread_controller("join-awaiter-shutdown", 2, 1);
      let wakes = Arc::new(AtomicUsize::new(0));
      let drops = Arc::new(AtomicUsize::new(0));
      let mut handle = controller.spawn(std::future::pending::<()>());
      let waker = panicking_join_awaiter_waker(Arc::clone(&wakes), Arc::clone(&drops));
      {
        let mut cx = Context::from_waker(&waker);
        assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
      }
      drop(waker);

      controller
        .shutdown()
        .expect("shutdown must survive the hostile awaiter");
      drop(handle);
      assert!(wakes.load(Ordering::SeqCst) >= 1);
      assert_eq!(drops.load(Ordering::SeqCst), 1);
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::join_handle_shutdown_contains_panicking_awaiter_wake_and_drop")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the JoinHandle shutdown awaiter subprocess must start");
    assert!(
      output.status.success(),
      "a panicking JoinHandle shutdown awaiter must not abort the process; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn join_handle_awaiter_completion_retains_its_registered_generation_after_restart() {
    let controller = multi_thread_controller("join-awaiter-completion-generation", 2, 1);
    let mut handle = controller.spawn(std::future::pending::<()>());
    let old_generation = controller.backend().generation();
    let state = Arc::new(JoinAwaiterWakerState {
      events: Mutex::new(Vec::new()),
    });
    let waker = {
      let _generation = RuntimeGenerationGuard::enter(old_generation);
      join_awaiter_waker(Arc::clone(&state))
    };
    {
      let _generation = RuntimeGenerationGuard::enter(old_generation);
      let mut cx = Context::from_waker(&waker);
      assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
    }
    {
      let _generation = RuntimeGenerationGuard::enter(old_generation);
      drop(waker);
    }

    controller
      .shutdown()
      .expect("the first generation must stop");
    controller.start().expect("the runtime must restart");
    let new_generation = controller.backend().generation();
    assert_ne!(new_generation, old_generation);
    state.clear();

    let replacement = futures::task::noop_waker();
    {
      let _generation = RuntimeGenerationGuard::enter(new_generation);
      let mut cx = Context::from_waker(&replacement);
      assert!(matches!(
        Pin::new(&mut handle).poll(&mut cx),
        Poll::Ready(Err(_))
      ));
    }

    let events = state.snapshot();
    assert!(
      !events.is_empty(),
      "completion must retire the registered awaiter waker"
    );
    assert!(
      events.iter().all(|(kind, generation)| {
        *kind == JoinAwaiterWakerEventKind::Drop && *generation == Some(old_generation)
      }),
      "old-generation awaiter retirement escaped its generation: {events:?}"
    );
    controller
      .shutdown()
      .expect("the replacement generation must stop");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn dropping_join_handle_retains_awaiter_generation_after_restart() {
    let controller = multi_thread_controller("join-awaiter-drop-generation", 2, 1);
    let mut handle = controller.spawn(std::future::pending::<()>());
    let old_generation = controller.backend().generation();
    let state = Arc::new(JoinAwaiterWakerState {
      events: Mutex::new(Vec::new()),
    });
    let waker = {
      let _generation = RuntimeGenerationGuard::enter(old_generation);
      join_awaiter_waker(Arc::clone(&state))
    };
    {
      let _generation = RuntimeGenerationGuard::enter(old_generation);
      let mut cx = Context::from_waker(&waker);
      assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
    }
    {
      let _generation = RuntimeGenerationGuard::enter(old_generation);
      drop(waker);
    }

    controller
      .shutdown()
      .expect("the first generation must stop");
    controller.start().expect("the runtime must restart");
    let new_generation = controller.backend().generation();
    assert_ne!(new_generation, old_generation);
    state.clear();

    {
      let _generation = RuntimeGenerationGuard::enter(new_generation);
      drop(handle);
    }

    let events = state.snapshot();
    assert!(
      !events.is_empty(),
      "handle drop must retire the registered awaiter waker"
    );
    assert!(
      events.iter().all(|(kind, generation)| {
        *kind == JoinAwaiterWakerEventKind::Drop && *generation == Some(old_generation)
      }),
      "old-generation awaiter destruction escaped its generation: {events:?}"
    );
    controller
      .shutdown()
      .expect("the replacement generation must stop");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn every_rayon_worker_is_classified_without_enabling_the_lifo_slot() {
    use std::{sync::mpsc, time::Duration};

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "worker-classification".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let id = executor.id;
    let (tx, rx) = mpsc::sync_channel(1);

    executor.pool.spawn(move || {
      tx.send((
        ON_POOL_WORKER.with(std::cell::Cell::get),
        IN_SCHEDULER_DRIVER.with(std::cell::Cell::get),
      ))
      .unwrap();
    });

    let (worker, driver) = rx.recv_timeout(Duration::from_secs(1)).unwrap();
    assert_eq!(
      worker,
      Some(id),
      "nested Rayon work must use cooperative block_on"
    );
    assert_eq!(
      driver, None,
      "arbitrary Rayon work must not use a LIFO slot that no scheduler frame will drain"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_block_on_does_not_park_pool_worker() {
    // Pool-worker reentrancy invariant: a task that calls `block_on` on an inner
    // future depending on pool-scheduled blocking work must not park its worker.
    // If every worker parks this way, no worker remains to pick up the blocking
    // jobs they await.
    use std::sync::{Barrier, mpsc};
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd1-test".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      let task_count = 2usize;
      // Guarantees every task is being polled on its own pool worker *before*
      // any of them parks in `block_on`, so the deadlock is deterministic.
      let barrier = Arc::new(Barrier::new(task_count));

      let mut tasks = Vec::new();
      for _ in 0..task_count {
        let exec = Arc::clone(&executor);
        let barrier = Arc::clone(&barrier);
        let body = async move {
          barrier.wait();
          let inner_exec = Arc::clone(&exec);
          let mut inner = std::pin::pin!(async move {
            let value = inner_exec.schedule_blocking(|| 7usize).await.unwrap();
            assert_eq!(value, 7);
          });
          // Synchronous `block_on` from inside a pool-worker task: the vector.
          exec.block_on(inner.as_mut());
        };
        let scheduler = Arc::clone(&executor);
        let (runnable, task) =
          async_task::spawn(body, move |runnable| scheduler.schedule(runnable));
        executor.schedule(runnable);
        tasks.push(task);
      }

      for task in tasks {
        futures::executor::block_on(task);
      }
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "MultiThread block_on deadlocked ({error}): pool workers parked waiting on pool-scheduled work"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lingering_drainer_periodic_work_does_not_starve_rayon_jobs() {
    // Idle-linger residence bound (adversarial rayon-starvation shape).
    //
    // W=2 pool. Worker B runs a blocking closure that spawns a raw rayon job
    // R onto the SAME pool (it lands in worker B's rayon deque) and then
    // cooperatively block_on's R's completion -- so worker B never returns to
    // rayon's scheduler. Worker A's drain frame runs the queues empty and
    // lingers on its own parker. A producer then publishes one trivial
    // runnable every ~200us (< the 500us idle budget), stopping only after R
    // ran. Every wake pops the MOST recently registered parker -- the
    // lingering drainer, which re-registers on top after each task -- and
    // every executed task clears the idle deadline, so without a bound on the
    // frame's TOTAL lingering residence worker A never exits its drain frame,
    // never returns its thread to rayon, and R (which only an idle rayon
    // worker can steal) starves indefinitely: producer never stops, worker B
    // never unparks. The frame residence bound must force the drainer out
    // through `finish_draining` (exit-and-respawn through rayon's queue is
    // exactly the interleaving point that lets R run), well inside the
    // watchdog below.
    use std::sync::mpsc;

    for round in 0..3 {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 1,
        thread_name_prefix: format!("linger-starve-{round}"),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      let r_done = Arc::new(AtomicBool::new(false));
      let give_up = Arc::new(AtomicBool::new(false));
      let (done_tx, done_rx) = mpsc::channel::<Duration>();

      // T1 pins worker A until the cooperative driver (worker B, inside the
      // blocking closure's re-entrant block_on) has parked. Worker A's drain
      // frame then observes empty queues and starts lingering AFTER the
      // cooperative driver registered, making the lingering drainer the
      // most-recently-registered (i.e. wake-preferred) parker.
      let t1_executor = Arc::clone(&executor);
      let t1_started = Arc::new(AtomicBool::new(false));
      let t1_started_setter = Arc::clone(&t1_started);
      let t1_body = async move {
        t1_started_setter.store(true, Ordering::SeqCst);
        let deadline = Instant::now() + Duration::from_secs(10);
        while t1_executor.parked_drivers.count.load(Ordering::SeqCst) == 0 {
          if Instant::now() >= deadline {
            // Give the worker back; the watchdog below reports the failure.
            return;
          }
          std::hint::spin_loop();
        }
      };
      let t1_scheduler = Arc::clone(&executor);
      let (t1_runnable, t1_task) = async_task::spawn(t1_body, move |r| t1_scheduler.schedule(r));
      executor.schedule(t1_runnable);
      wait_until("the worker-pinning task to start", || {
        t1_started.load(Ordering::SeqCst)
      });

      // The blocking closure on worker B: spawn R, then block_on its result.
      let blocking_executor = Arc::clone(&executor);
      let r_done_setter = Arc::clone(&r_done);
      let started = Instant::now();
      let handle = executor.schedule_blocking(move || {
        let (r_tx, r_rx) = oneshot::channel::<()>();
        blocking_executor.pool.spawn(move || {
          r_done_setter.store(true, Ordering::SeqCst);
          let _ = r_tx.send(());
        });
        let mut wait_for_r = std::pin::pin!(async move {
          let _ = r_rx.await;
        });
        blocking_executor.block_on(wait_for_r.as_mut());
        let _ = done_tx.send(started.elapsed());
      });

      // Wait until both the cooperative driver and the lingering drainer are
      // registered; if the linger expired first (R already ran), that round
      // completed without ever reaching the adversarial interleaving.
      let arm_deadline = Instant::now() + Duration::from_secs(15);
      while executor.parked_drivers.count.load(Ordering::SeqCst) != 2
        && !r_done.load(Ordering::SeqCst)
      {
        assert!(
          Instant::now() < arm_deadline,
          "timed out arming the linger-starvation interleaving"
        );
        std::thread::yield_now();
      }

      // Producer: one trivial runnable every ~200us (spin-paced, so cadence
      // stays far below the 500us idle budget), until R completed.
      let producer_executor = Arc::clone(&executor);
      let producer_r_done = Arc::clone(&r_done);
      let producer_give_up = Arc::clone(&give_up);
      let producer = std::thread::spawn(move || {
        let cadence = Duration::from_micros(200);
        let mut next_tick = Instant::now();
        while !producer_r_done.load(Ordering::SeqCst) && !producer_give_up.load(Ordering::SeqCst) {
          let scheduler = Arc::clone(&producer_executor);
          let (runnable, task) = async_task::spawn(async {}, move |r| scheduler.schedule(r));
          producer_executor.schedule(runnable);
          task.detach();
          next_tick += cadence;
          while Instant::now() < next_tick {
            std::hint::spin_loop();
          }
        }
      });

      let outcome = done_rx.recv_timeout(Duration::from_secs(5));
      give_up.store(true, Ordering::SeqCst);
      producer.join().unwrap();
      match outcome {
        Ok(elapsed) => {
          futures::executor::block_on(handle).expect("blocking closure join");
          drop(t1_task);
          eprintln!("round {round}: completed in {elapsed:?}");
        }
        Err(error) => panic!(
          "round {round}: lingering drainer starved the rayon job for 5s ({error}): \
           sub-budget periodic work must not keep a drain frame resident forever"
        ),
      }
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  #[ignore = "microbenchmark: run explicitly in release mode"]
  fn parked_drivers_registry_cycle_microbench() {
    // Isolates the registry traffic of one steady-state linger cycle at
    // various registry sizes: wake_one pops the LIFO top (O(1)), the woken
    // drainer deregisters (the entry is already gone, so the position scan
    // walks the WHOLE vector and fails), then re-registers (push). Also
    // measures the timeout-path deregister (entry present) and a
    // wake_one_owner_dependency sweep over dependency-less lingerers.
    for &n in &[8usize, 64, 256] {
      let registry = ParkedDrivers::default();
      let parkers: Vec<Arc<DriverParker>> =
        (0..n).map(|_| Arc::new(DriverParker::default())).collect();
      for parker in &parkers {
        registry.register_with_role(parker, true, None);
      }
      let hot = &parkers[n - 1];

      let iters = 2_000_000u32;
      let start = Instant::now();
      for _ in 0..iters {
        assert!(registry.wake_one());
        registry.deregister(hot);
        assert!(hot.consume_permit());
        registry.register_with_role(hot, true, None);
      }
      let wake_cycle = start.elapsed() / iters;

      let start = Instant::now();
      for _ in 0..iters {
        registry.deregister(hot);
        registry.register_with_role(hot, true, None);
      }
      let timeout_cycle = start.elapsed() / iters;

      let owner = BlockingOwnerToken {
        executor_id: u64::MAX,
        frame: u64::MAX,
      };
      let start = Instant::now();
      for _ in 0..iters {
        assert!(!registry.wake_one_owner_dependency(owner));
      }
      let owner_sweep = start.elapsed() / iters;

      eprintln!(
        "N={n:>3}: wake+failed-deregister+re-register {wake_cycle:?}, \
         timeout-deregister+re-register {timeout_cycle:?}, \
         owner-dependency sweep {owner_sweep:?}"
      );
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_block_on_from_caller_thread_still_parks() {
    // The non-pool (napi caller) path must keep using the plain parking
    // `block_on`; here we just assert it drives a ready future to completion.
    let metrics = Arc::new(RuntimeMetrics::default());
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 3,
      max_blocking_tasks: 2,
      thread_name_prefix: "rd1-caller".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

    let mut output = None;
    let mut future = std::pin::pin!(async {
      output = Some(41usize + 1);
    });
    executor.block_on(future.as_mut());
    assert_eq!(output, Some(42));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_block_on_from_caller_thread_receives_pool_produced_value() {
    // Cross-thread liveness guard for the NON-pool (napi-caller) path of
    // `MultiThreadExecutor::block_on`. The caller thread is not a pool worker, so
    // `block_on` takes the parking branch (`futures::executor::block_on`) while a
    // SEPARATELY spawned task runs on a pool worker and produces the awaited value.
    // This pins ONLY the cross-thread wake path: the pool task completing must wake
    // the parked caller's waker so `block_on` returns the pool-computed value.
    //
    // HONEST ORDERING (no sleeps): the awaited pool task is GATED on a oneshot and
    // therefore returns `Pending` on its first poll. A `CallerProbe` future wraps the
    // task and, ONLY after the task poll returns `Pending` (i.e. AFTER `block_on`'s
    // parking waker is registered on the task), signals "caller parked" to a releaser
    // thread. The releaser then -- and only then -- releases the gate, so the pool
    // task completes strictly AFTER the caller registered its waker. This forecloses
    // the "already-ready before await" interleaving: the task cannot be `Ready` on the
    // caller's first poll, because its gate is opened only in response to that first
    // `Pending` poll. The completion is thus forced to travel the real cross-thread
    // wake (pool worker completes task -> wakes parked caller -> `block_on` returns);
    // if that wake is broken the caller parks forever and the bounded recv_timeout
    // below fails loudly instead of hanging the suite.
    //
    // SCOPE: this is the cross-thread liveness guard only. It does NOT exercise the
    // caller-is-pool-worker case, which has dedicated reentrancy tests.
    use std::sync::mpsc;
    use std::time::Duration;

    // Wraps the pool task so the caller's FIRST poll registers `block_on`'s waker on
    // the task and, only when that poll is `Pending`, hands the "caller parked" signal
    // to the releaser. Sending strictly after the `Pending` poll guarantees the waker
    // is already registered before the gate can open.
    struct CallerProbe {
      task: Task<usize>,
      parked_tx: Option<mpsc::Sender<()>>,
    }
    impl Future for CallerProbe {
      type Output = usize;
      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<usize> {
        // `Task` is `Unpin`; poll it through a fresh `Pin`.
        let poll = Pin::new(&mut self.task).poll(cx);
        if poll.is_pending()
          && let Some(tx) = self.parked_tx.take()
        {
          // Waker is now registered on `task`; release the gate is safe.
          let _ = tx.send(());
        }
        poll
      }
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd10-caller".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      // The pool task's inner future is GATED on a oneshot: its first poll on a pool
      // worker registers the gate waker and returns `Pending`. When the releaser sends
      // on `gate_tx`, the gate's wake reschedules the task (via `schedule` ->
      // `ensure_drainer`) onto a pool worker, where it resolves to 42.
      let (gate_tx, gate_rx) = oneshot::channel::<usize>();
      let scheduler = Arc::clone(&executor);
      let (runnable, task) = async_task::spawn(
        async move { gate_rx.await.expect("gate sender dropped") },
        move |r| {
          scheduler.schedule(r);
        },
      );
      executor.schedule(runnable);

      // Releaser thread: opens the gate ONLY after the caller has parked (registered
      // its waker on the task). This enforces caller-parked HAPPENS-BEFORE pool-task
      // completes, so completion must travel the cross-thread wake path.
      let (parked_tx, parked_rx) = mpsc::channel::<()>();
      let releaser = std::thread::spawn(move || {
        if parked_rx.recv().is_ok() {
          let _ = gate_tx.send(42usize);
        }
      });

      // The caller (this child) thread is NOT a pool worker, so `block_on` parks via
      // `futures::executor::block_on` rather than driving the queue cooperatively.
      let mut output = None;
      {
        let mut future = std::pin::pin!(async {
          output = Some(
            CallerProbe {
              task,
              parked_tx: Some(parked_tx),
            }
            .await,
          );
        });
        executor.block_on(future.as_mut());
      }

      releaser.join().unwrap();
      assert_eq!(
        output,
        Some(42usize),
        "block_on must return the pool-computed value"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "non-pool block_on did not receive the pool-produced value ({error}): the cross-thread wake path stalled"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_block_on_wakes_parked_driver_after_workers_park() {
    // Parked-driver wake invariant: a pool-worker task may park in `block_on`
    // before the work that will wake it is scheduled. Once every pool worker
    // is parked this way, `ensure_drainer` cannot spawn a replacement because
    // the parked workers are still counted as active drainers. A later
    // `schedule()` must wake a parked driver directly so the runnable can run.
    use std::sync::{Barrier, mpsc};
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd1-park".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      let task_count = 2usize;
      let barrier = Arc::new(Barrier::new(task_count));

      let mut senders = Vec::new();
      let mut tasks = Vec::new();
      for _ in 0..task_count {
        let (tx, rx) = oneshot::channel::<usize>();
        senders.push(tx);
        let exec = Arc::clone(&executor);
        let barrier = Arc::clone(&barrier);
        let body = async move {
          // Make sure both pool workers are occupied before either parks.
          barrier.wait();
          // Child task whose wake routes through `schedule()`: the oneshot
          // receiver's waker -> child runnable -> `schedule` -> `ensure_drainer`.
          let child_exec = Arc::clone(&exec);
          let (child_runnable, child_task) =
            async_task::spawn(async move { rx.await.unwrap() }, move |r| {
              child_exec.schedule(r)
            });
          exec.schedule(child_runnable);
          let mut inner = std::pin::pin!(async move {
            assert_eq!(child_task.await, 9usize);
          });
          exec.block_on(inner.as_mut());
        };
        let scheduler = Arc::clone(&executor);
        let (runnable, task) = async_task::spawn(body, move |r| scheduler.schedule(r));
        executor.schedule(runnable);
        tasks.push(task);
      }

      // Give both workers time to poll their child Pending and park in block_on.
      std::thread::sleep(Duration::from_millis(200));
      for tx in senders {
        let _ = tx.send(9usize);
      }

      for task in tasks {
        futures::executor::block_on(task);
      }
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("parked pool drivers missed a post-park schedule wake ({error})"),
    }
  }

  /// Spin (yielding) until `condition` holds, failing loudly on timeout.
  /// Used to observe executor-internal states (e.g. "both drivers are
  /// registered as parked") without sleeps. The bound is a HANG detector,
  /// not a latency assertion: starved CI runners can stall fresh threads for
  /// hundreds of milliseconds, so it is deliberately generous.
  #[cfg(napi_runtime_os_threads)]
  fn wait_until(what: &str, condition: impl Fn() -> bool) {
    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(15);
    while !condition() {
      assert!(
        std::time::Instant::now() < deadline,
        "timed out waiting for: {what}"
      );
      std::thread::yield_now();
    }
  }

  /// Bounded join for harness threads that already signalled completion of
  /// their assertions: everything left on the thread is teardown (executor
  /// drop -- rayon pool release, `TimerHeap::drop`'s timekeeper join -- plus
  /// TLS destructors). An unbounded `join()` there turns a teardown wedge
  /// into a silent libtest-worker hang for the full CI step timeout (observed
  /// on Windows in run 29195160953: several park-deadline-family tests never
  /// completed while every in-test assertion had already passed). Fail loudly
  /// and NAME the awaited phase instead.
  #[cfg(napi_runtime_os_threads)]
  fn join_within(what: &str, handle: std::thread::JoinHandle<()>, timeout: Duration) {
    let deadline = std::time::Instant::now() + timeout;
    while !handle.is_finished() {
      assert!(
        std::time::Instant::now() < deadline,
        "thread wedged past its {timeout:?} bound while: {what}"
      );
      std::thread::sleep(Duration::from_millis(10));
    }
    handle.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  fn run_claim_with_deadlock_gate_assertion<T: Send + 'static>(
    executor: &Arc<MultiThreadExecutor>,
    start_counter: &AtomicU64,
    claim: impl FnOnce() -> T + Send + 'static,
  ) -> T {
    use std::sync::mpsc;

    let (claimed_tx, claimed_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let (started_tx, started_rx) = mpsc::channel();
    let (release_start_tx, release_start_rx) = mpsc::channel();
    let starts_before = start_counter.load(Ordering::SeqCst);
    let worker = std::thread::spawn(move || {
      MULTI_THREAD_WORK_CLAIMED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claimed_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      MULTI_THREAD_WORK_STARTED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          started_tx.send(()).unwrap();
          release_start_rx.recv().unwrap();
        }));
      });
      claim()
    });
    claimed_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the scheduler claim must pause after removing work");

    let admission_active = executor.deadlock_state.admissions.load(Ordering::SeqCst) != 0;
    let verdict = executor.try_begin_deadlock_verdict();
    let claim_verdict_rejected = verdict.is_none();
    drop(verdict);
    release_claim_tx.send(()).unwrap();

    started_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the scheduler claim must pause after publishing its start");
    let admission_active_after_start =
      executor.deadlock_state.admissions.load(Ordering::SeqCst) != 0;
    let start_published = start_counter.load(Ordering::SeqCst) > starts_before;
    let verdict = executor.try_begin_deadlock_verdict();
    let start_verdict_rejected = verdict.is_none();
    drop(verdict);
    release_start_tx.send(()).unwrap();
    let output = worker.join().unwrap();

    assert!(
      admission_active,
      "removing scheduler work must retain a detector admission until start accounting"
    );
    assert!(
      claim_verdict_rejected,
      "a deadline verdict must not close while removed work has not published its start"
    );
    assert!(
      start_published,
      "work start accounting must publish before admission retires"
    );
    assert!(
      admission_active_after_start,
      "the detector admission must remain active until after start accounting"
    );
    assert!(
      start_verdict_rejected,
      "a deadline verdict must not close between start accounting and admission retirement"
    );
    output
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_runnable_claims_hold_deadlock_admission_until_start() {
    let executor =
      multi_thread_executor(1, Some(Duration::from_secs(1)), "runnable-claim-admission");

    let fifo_ran = Arc::new(AtomicBool::new(false));
    let fifo_task_ran = Arc::clone(&fifo_ran);
    let (fifo, fifo_task) = async_task::spawn(
      async move {
        fifo_task_ran.store(true, Ordering::SeqCst);
      },
      |_| {},
    );
    executor.metrics.runnable_scheduled();
    executor.push_fifo_raw(fifo);
    let fifo_executor = Arc::clone(&executor);
    assert!(run_claim_with_deadlock_gate_assertion(
      &executor,
      &executor.metrics.runnable_polls,
      move || {
        let _driver = OnPoolWorkerGuard::enter(fifo_executor.id);
        fifo_executor.run_one_fifo_runnable()
      }
    ));
    futures::executor::block_on(fifo_task);
    assert!(fifo_ran.load(Ordering::SeqCst));

    let fifo_order = Arc::new(Mutex::new(Vec::new()));
    let mut fifo_tasks = Vec::new();
    for name in ["first", "second"] {
      let task_order = Arc::clone(&fifo_order);
      let (runnable, task) = async_task::spawn(
        async move {
          task_order.lock().unwrap().push(name);
        },
        |_| {},
      );
      executor.metrics.runnable_scheduled();
      executor.push_fifo_raw(runnable);
      fifo_tasks.push(task);
    }
    for _ in 0..2 {
      let fifo_executor = Arc::clone(&executor);
      assert!(run_claim_with_deadlock_gate_assertion(
        &executor,
        &executor.metrics.runnable_polls,
        move || {
          let _driver = OnPoolWorkerGuard::enter(fifo_executor.id);
          fifo_executor.run_one_runnable()
        }
      ));
    }
    for task in fifo_tasks {
      futures::executor::block_on(task);
    }
    assert_eq!(
      *fifo_order.lock().unwrap(),
      ["first", "second"],
      "the detector-enabled normal fallback must preserve FIFO order"
    );

    let lifo_ran = Arc::new(AtomicBool::new(false));
    let lifo_task_ran = Arc::clone(&lifo_ran);
    let (lifo, lifo_task) = async_task::spawn(
      async move {
        lifo_task_ran.store(true, Ordering::SeqCst);
      },
      |_| {},
    );
    executor.metrics.runnable_scheduled();
    let lifo_executor = Arc::clone(&executor);
    assert!(run_claim_with_deadlock_gate_assertion(
      &executor,
      &executor.metrics.runnable_polls,
      move || {
        let _driver = OnPoolWorkerGuard::enter(lifo_executor.id);
        LIFO_SLOT.with(|slot| {
          assert!(slot.replace(Some((lifo_executor.id, lifo))).is_none());
        });
        lifo_executor.run_one_runnable()
      }
    ));
    futures::executor::block_on(lifo_task);
    assert!(lifo_ran.load(Ordering::SeqCst));

    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_blocking_claims_hold_deadlock_admission_until_start() {
    let executor =
      multi_thread_executor(1, Some(Duration::from_secs(1)), "blocking-claim-admission");

    let fifo_ran = Arc::new(AtomicBool::new(false));
    let fifo_job_ran = Arc::clone(&fifo_ran);
    executor.metrics.blocking_scheduled();
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: BlockingJobId(u64::MAX - 90),
        run: Box::new(move || {
          fifo_job_ran.store(true, Ordering::SeqCst);
        }),
      });
    let fifo_executor = Arc::clone(&executor);
    assert!(run_claim_with_deadlock_gate_assertion(
      &executor,
      &executor.metrics.blocking_tasks_started,
      move || {
        let _driver = OnPoolWorkerGuard::enter(fifo_executor.id);
        fifo_executor.run_one_blocking()
      }
    ));
    assert!(fifo_ran.load(Ordering::SeqCst));

    let owner = executor.fresh_owner_token();
    let active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let exact_job = BlockingJobId(u64::MAX - 91);
    let exact_ran = Arc::new(AtomicBool::new(false));
    let exact_job_ran = Arc::clone(&exact_ran);
    executor.metrics.blocking_scheduled();
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: exact_job,
        run: Box::new(move || {
          exact_job_ran.store(true, Ordering::SeqCst);
        }),
      });
    let dependency = Arc::new(TaskDependency::new(executor.generation, Some(owner)));
    dependency.set_owned(BlockingDependency {
      job: exact_job,
      owner: Some(owner),
    });
    let exact_executor = Arc::clone(&executor);
    assert!(run_claim_with_deadlock_gate_assertion(
      &executor,
      &executor.metrics.blocking_tasks_started,
      move || {
        let _driver = OnPoolWorkerGuard::enter(exact_executor.id);
        let _owner = BlockingOwnerGuard::enter(Some(owner));
        exact_executor.try_owned_blocking_over_cap(&dependency)
      }
    ));
    assert!(exact_ran.load(Ordering::SeqCst));

    drop(active_owner);
    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn parked_drivers_wake_one_with_no_parked_drivers_skips_the_lock() {
    // Empty-registry behavior: with nothing registered, `wake_one` must return
    // `false` WITHOUT touching the registry mutex (the no-waiter fast path --
    // the common case, since queue-wakes fire on every schedule while drivers
    // park only in rare re-entrant `block_on`). Proxy for "did not take the
    // mutex": the test HOLDS the registry lock; a fast-path wake_one completes
    // anyway, while (control) a wake_one issued with a parker registered must
    // take the slow path and block on that held lock until it is released.
    use std::sync::mpsc;
    use std::time::Duration;

    let registry = Arc::new(ParkedDrivers::default());

    // Fast path: empty registry -> wake_one completes although the lock is held.
    let guard = registry.parked.lock().unwrap();
    let (done_tx, done_rx) = mpsc::channel();
    let waker_thread = {
      let registry = Arc::clone(&registry);
      std::thread::spawn(move || {
        done_tx.send(registry.wake_one()).unwrap();
      })
    };
    let woke = done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("wake_one with an empty registry must skip the lock (no-waiter fast path)");
    assert!(!woke, "an empty registry has nobody to wake");
    waker_thread.join().unwrap();
    drop(guard);

    // Control: with a parker registered the SAME held lock must block
    // wake_one (slow path). This proves the fast path above genuinely skipped
    // the lock rather than wake_one never locking at all.
    let parker = Arc::new(DriverParker::default());
    registry.register(&parker);
    let guard = registry.parked.lock().unwrap();
    let (done_tx, done_rx) = mpsc::channel();
    let waker_thread = {
      let registry = Arc::clone(&registry);
      std::thread::spawn(move || {
        done_tx.send(registry.wake_one()).unwrap();
      })
    };
    assert!(
      done_rx.recv_timeout(Duration::from_millis(300)).is_err(),
      "wake_one with a registered parker must take the slow path (block on the held lock)"
    );
    drop(guard);
    let woke = done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("slow-path wake_one must complete once the lock is released");
    assert!(
      woke,
      "the slow path must pop and wake the registered parker"
    );
    waker_thread.join().unwrap();
    // The popped parker received its permit: a park now returns immediately
    // instead of sleeping (bounded by the test harness if broken).
    parker.park();
    assert_eq!(
      registry.count.load(Ordering::SeqCst),
      0,
      "wake_one deregisters what it pops"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn driver_parker_permit_granted_while_running_is_not_lost() {
    // Stored-permit behavior: a wake delivered while the driver is RUNNING (not
    // parked) must be stored as a permit that makes the next `park` return
    // immediately; multiple such wakes coalesce into ONE permit.
    use std::sync::mpsc;
    use std::time::Duration;

    let parker = Arc::new(DriverParker::default());
    // Two wakes while "running" (nobody parked yet).
    parker.unpark();
    parker.unpark();

    let (tx, rx) = mpsc::channel();
    let driver = {
      let parker = Arc::clone(&parker);
      std::thread::spawn(move || {
        parker.park(); // must consume the stored permit without sleeping
        tx.send(1).unwrap();
        parker.park(); // no permit left: must genuinely sleep
        tx.send(2).unwrap();
      })
    };

    assert_eq!(
      rx.recv_timeout(Duration::from_secs(5))
        .expect("a stored permit must not be lost"),
      1
    );
    assert!(
      rx.recv_timeout(Duration::from_millis(300)).is_err(),
      "two pre-park wakes must coalesce into one permit (second park must sleep)"
    );
    parker.unpark();
    assert_eq!(
      rx.recv_timeout(Duration::from_secs(5))
        .expect("unpark must wake a sleeping driver"),
      2
    );
    driver.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn driver_parker_unrepresentable_timeout_remains_wakeable() {
    use std::sync::mpsc;

    let parker = Arc::new(DriverParker::default());
    assert!(
      Instant::now().checked_add(Duration::MAX).is_none(),
      "Duration::MAX must exercise the unrepresentable-deadline path"
    );
    let (done_tx, done_rx) = mpsc::channel();
    let driver = {
      let parker = Arc::clone(&parker);
      std::thread::spawn(move || {
        done_tx.send(parker.park_timeout(Duration::MAX)).unwrap();
      })
    };
    wait_until("the unbounded timeout driver to sleep", || {
      parker.state.load(Ordering::SeqCst) == PARKER_SLEEPING
    });
    assert!(
      done_rx.recv_timeout(Duration::from_millis(100)).is_err(),
      "an unrepresentable timeout must not expire immediately"
    );

    let unparker = {
      let parker = Arc::clone(&parker);
      std::thread::spawn(move || parker.unpark())
    };
    assert!(
      done_rx
        .recv_timeout(Duration::from_secs(1))
        .expect("an unrepresentable timeout must remain wakeable"),
      "a permit must be reported as a wake"
    );
    unparker.join().unwrap();
    driver.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn parked_drivers_wake_one_wakes_exactly_one() {
    // Single-wake behavior: 2 parked drivers + 1 wake -> exactly one wakes, the
    // other stays parked. Targeted wakes must neither wake everyone nor lose
    // the wake.
    use std::sync::mpsc;
    use std::time::Duration;

    let registry = Arc::new(ParkedDrivers::default());
    let (woke_tx, woke_rx) = mpsc::channel();
    let mut drivers = Vec::new();
    for index in 0..2 {
      let registry = Arc::clone(&registry);
      let woke_tx = woke_tx.clone();
      drivers.push(std::thread::spawn(move || {
        let parker = Arc::new(DriverParker::default());
        registry.register(&parker);
        parker.park();
        registry.deregister(&parker);
        woke_tx.send(index).unwrap();
      }));
    }
    wait_until("both drivers registered as parked", || {
      registry.count.load(Ordering::SeqCst) == 2
    });

    assert!(registry.wake_one(), "wake_one must wake a parked driver");
    woke_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("exactly one driver must wake");
    assert!(
      woke_rx.recv_timeout(Duration::from_millis(300)).is_err(),
      "the second driver must stay parked after a single wake_one"
    );
    assert_eq!(
      registry.count.load(Ordering::SeqCst),
      1,
      "one driver must remain registered"
    );

    assert!(
      registry.wake_one(),
      "a second wake_one must wake the remaining driver"
    );
    woke_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the second driver must wake");
    for driver in drivers {
      driver.join().unwrap();
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn parked_driver_dependency_retirement_drops_waiter_outside_registry_lock() {
    use std::sync::mpsc;

    struct ReenterRegistryOnDrop {
      registry: Arc<ParkedDrivers>,
      dropped: mpsc::Sender<()>,
    }

    #[expect(
      clippy::manual_noop_waker,
      reason = "the test observes the waker payload's Drop"
    )]
    impl std::task::Wake for ReenterRegistryOnDrop {
      fn wake(self: Arc<Self>) {}
    }

    impl Drop for ReenterRegistryOnDrop {
      fn drop(&mut self) {
        let parker = Arc::new(DriverParker::default());
        self.registry.register(&parker);
        self.registry.deregister(&parker);
        self.dropped.send(()).unwrap();
      }
    }

    let registry = Arc::new(ParkedDrivers::default());
    let dependency = Arc::new(TaskDependency::default());
    let (dropped_tx, dropped_rx) = mpsc::channel();
    let waiter = Waker::from(Arc::new(ReenterRegistryOnDrop {
      registry: Arc::clone(&registry),
      dropped: dropped_tx,
    }));
    dependency.register_waiter(&waiter);
    drop(waiter);

    let parker = Arc::new(DriverParker::default());
    registry.register_with_role(&parker, true, Some(Arc::clone(&dependency)));
    drop(dependency);

    let retiring_registry = Arc::clone(&registry);
    let retiring_parker = Arc::clone(&parker);
    let retiring = std::thread::spawn(move || retiring_registry.deregister(&retiring_parker));
    dropped_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("retained dependency waiters must be destroyed after releasing the registry lock");
    retiring.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn owner_handoff_dependency_predicate_runs_outside_registry_lock() {
    use std::sync::mpsc;

    let registry = Arc::new(ParkedDrivers::default());
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 70,
      frame: u64::MAX - 71,
    };
    let dependency = Arc::new(TaskDependency::default());
    dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 72),
      owner: Some(owner),
    });
    let parker = Arc::new(DriverParker::default());
    registry.register_with_role(&parker, true, Some(Arc::clone(&dependency)));

    let (predicate_tx, predicate_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let selecting_registry = Arc::clone(&registry);
    let selector = std::thread::spawn(move || {
      DEPENDENCY_PREDICATE_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          predicate_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      selecting_registry.wake_one_owner_dependency(owner)
    });

    predicate_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("owner selection must reach the dependency predicate");
    let registry_was_unlocked = registry.parked.try_lock().is_ok();
    release_tx.send(()).unwrap();
    assert!(
      selector.join().unwrap(),
      "the exact-owner parker must still be selected"
    );

    assert!(
      registry_was_unlocked,
      "owner dependency predicates must not run while the parked-driver registry is locked"
    );
    assert!(parker.consume_permit());
    assert_eq!(parker.take_owner_handoff(), Some(owner));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn owner_handoff_skips_newer_untagged_dependency() {
    let registry = ParkedDrivers::default();
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 1,
      frame: u64::MAX - 2,
    };
    let owned_dependency = Arc::new(TaskDependency::default());
    owned_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 3),
      owner: Some(owner),
    });
    let untagged_dependency = Arc::new(TaskDependency::default());
    untagged_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 4),
      owner: None,
    });
    let owned = Arc::new(DriverParker::default());
    let untagged = Arc::new(DriverParker::default());

    registry.register_with_role(&owned, true, Some(Arc::clone(&owned_dependency)));
    // Register the unrelated dependency last so an unfiltered LIFO retry
    // would consume the exact owner handoff.
    registry.register_with_role(&untagged, true, Some(Arc::clone(&untagged_dependency)));

    assert!(registry.wake_one_owner_dependency(owner));
    assert!(
      owned.consume_permit(),
      "the exact owner dependency must receive the retry"
    );
    assert!(
      !untagged.consume_permit(),
      "an untagged dependency must not consume an exact owner handoff"
    );
    registry.deregister(&untagged);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn withdrawn_owner_handoff_rearms_next_same_owner_dependency() {
    let executor = multi_thread_executor(2, None, "withdrawn-owner-handoff");
    let owner = executor.fresh_owner_token();
    let valid_dependency = Arc::new(TaskDependency::default());
    valid_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 45),
      owner: Some(owner),
    });
    let withdrawn_dependency = Arc::new(TaskDependency::default());
    withdrawn_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 46),
      owner: Some(owner),
    });
    let valid = Arc::new(DriverParker::default());
    let withdrawn = Arc::new(DriverParker::default());

    executor
      .parked_drivers
      .register_with_role(&valid, true, Some(Arc::clone(&valid_dependency)));
    executor.parked_drivers.register_with_role(
      &withdrawn,
      true,
      Some(Arc::clone(&withdrawn_dependency)),
    );
    assert!(executor.parked_drivers.wake_one_owner_dependency(owner));
    withdrawn_dependency.clear();

    assert_eq!(
      executor.service_owner_handoff(&withdrawn, &withdrawn_dependency, true),
      Some(false),
      "a selected dependency withdrawn before retry must forward the owner handoff"
    );
    assert!(
      valid.consume_permit(),
      "the next live same-owner dependency must receive the forwarded wake"
    );
    assert_eq!(
      valid.take_owner_handoff(),
      Some(owner),
      "the forwarded wake must retain the exact owner identity"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn direct_future_wake_cannot_overtake_owner_handoff_publication() {
    use std::sync::mpsc;

    let executor = multi_thread_executor(2, None, "owner-handoff-publication");
    let owner = executor.fresh_owner_token();
    let fallback_dependency = Arc::new(TaskDependency::default());
    fallback_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 47),
      owner: Some(owner),
    });
    let exiting_dependency = Arc::new(TaskDependency::default());
    exiting_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 48),
      owner: Some(owner),
    });
    let fallback = Arc::new(DriverParker::default());
    let exiting = Arc::new(DriverParker::default());

    executor.parked_drivers.register_with_role(
      &fallback,
      true,
      Some(Arc::clone(&fallback_dependency)),
    );
    executor.parked_drivers.register_with_role(
      &exiting,
      true,
      Some(Arc::clone(&exiting_dependency)),
    );

    let (selected_tx, selected_rx) = mpsc::channel();
    let (release_selection_tx, release_selection_rx) = mpsc::channel();
    let selector_executor = Arc::clone(&executor);
    let selector = std::thread::spawn(move || {
      OWNER_HANDOFF_SELECTED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          selected_tx.send(()).unwrap();
          release_selection_rx.recv().unwrap();
        }));
      });
      assert!(
        selector_executor
          .parked_drivers
          .wake_one_owner_dependency(owner)
      );
    });
    selected_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("selection must pause after removing the exact-owner parker");

    let (exited_tx, exited_rx) = mpsc::channel();
    let exiting_executor = Arc::clone(&executor);
    let exiting_driver = Arc::clone(&exiting);
    let driver = std::thread::spawn(move || {
      exiting_driver.park();
      exiting_executor.parked_drivers.deregister(&exiting_driver);
      exiting_executor.forward_owner_handoff(&exiting_driver);
      exited_tx.send(()).unwrap();
    });
    exiting.unpark();
    exited_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the direct future wake must let the selected driver exit");

    release_selection_tx.send(()).unwrap();
    selector.join().unwrap();
    driver.join().unwrap();

    assert!(
      fallback.consume_permit(),
      "an exiting selected driver must forward the owner handoff to the next dependency"
    );
    assert_eq!(
      fallback.take_owner_handoff(),
      Some(owner),
      "the forwarded handoff must retain the exact owner identity"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn cooperative_panic_forwards_pending_owner_handoff() {
    use std::sync::mpsc;

    struct PanicAfterWake {
      dependency: BlockingDependency,
      first_poll: Option<mpsc::Sender<()>>,
    }

    impl Future for PanicAfterWake {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if let Some(first_poll) = self.first_poll.take() {
          // This shape never retires its publication -- the driver panics
          // instead -- so the returned token is dropped straight away.
          let mut published = PublishedBlockingDependencies::default();
          record_blocking_dependency(&mut published, self.dependency);
          first_poll.send(()).unwrap();
          return Poll::Pending;
        }
        panic!("intentional cooperative driver panic after owner handoff");
      }
    }

    let executor = multi_thread_executor(2, None, "panic-owner-handoff");
    let owner = executor.fresh_owner_token();
    let fallback_dependency = Arc::new(TaskDependency::default());
    fallback_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 49),
      owner: Some(owner),
    });
    let fallback = Arc::new(DriverParker::default());
    executor.parked_drivers.register_with_role(
      &fallback,
      true,
      Some(Arc::clone(&fallback_dependency)),
    );

    let (first_poll_tx, first_poll_rx) = mpsc::channel();
    let (panicked_tx, panicked_rx) = mpsc::channel();
    let driver_executor = Arc::clone(&executor);
    let driver = std::thread::spawn(move || {
      let _on_pool = OnPoolWorkerGuard::enter(driver_executor.id);
      let mut future = std::pin::pin!(PanicAfterWake {
        dependency: BlockingDependency {
          job: BlockingJobId(u64::MAX - 50),
          owner: Some(owner)
        },
        first_poll: Some(first_poll_tx),
      });
      let panicked = catch_unwind(AssertUnwindSafe(|| {
        driver_executor.block_on(future.as_mut());
      }))
      .is_err();
      panicked_tx.send(panicked).unwrap();
    });

    first_poll_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    wait_until("the panicking cooperative driver to park", || {
      executor.parked_drivers.count.load(Ordering::SeqCst) == 2
    });
    assert!(
      executor.parked_drivers.wake_one_owner_dependency(owner),
      "the exact owner handoff must select the cooperative driver"
    );
    assert!(
      panicked_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      "the test future must unwind from its second poll"
    );
    driver.join().unwrap();

    assert!(
      fallback.consume_permit(),
      "panic cleanup must forward the unconsumed owner handoff"
    );
    assert_eq!(
      fallback.take_owner_handoff(),
      Some(owner),
      "panic cleanup must preserve the exact owner identity"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn cooperative_panic_flushes_lifo_slot() {
    struct ScheduleThenPanic {
      executor: Arc<MultiThreadExecutor>,
      ran: Arc<AtomicBool>,
    }

    impl Future for ScheduleThenPanic {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        let ran = Arc::clone(&self.ran);
        let scheduler = Arc::clone(&self.executor);
        let (runnable, task) = async_task::spawn(
          async move {
            ran.store(true, Ordering::SeqCst);
          },
          move |runnable| scheduler.schedule(runnable),
        );
        self.executor.schedule(runnable);
        task.detach();
        panic!("intentional cooperative driver panic with a populated LIFO slot");
      }
    }

    let executor = multi_thread_executor(2, None, "panic-lifo-flush");
    executor
      .active_drainers
      .store(executor.max_drainers, Ordering::SeqCst);
    let ran = Arc::new(AtomicBool::new(false));
    let panicked = {
      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let mut future = std::pin::pin!(ScheduleThenPanic {
        executor: Arc::clone(&executor),
        ran: Arc::clone(&ran),
      });
      catch_unwind(AssertUnwindSafe(|| {
        executor.block_on(future.as_mut());
      }))
      .is_err()
    };

    assert!(panicked, "the test future must unwind from its first poll");
    assert!(
      executor.pop_lifo_slot().is_none(),
      "panic cleanup must empty the LIFO slot"
    );
    assert_eq!(
      executor.injector.len(),
      1,
      "panic cleanup must move the slot runnable to the shared FIFO"
    );
    assert!(
      executor.run_one(),
      "the flushed runnable must remain executable"
    );
    assert!(ran.load(Ordering::SeqCst));
    executor.active_drainers.store(0, Ordering::SeqCst);
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn cooperative_panic_compensates_absorbed_queue_wake() {
    use std::sync::mpsc;

    struct PanicAfterWake {
      first_poll: Option<mpsc::Sender<()>>,
    }

    impl Future for PanicAfterWake {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if let Some(first_poll) = self.first_poll.take() {
          first_poll.send(()).unwrap();
          return Poll::Pending;
        }
        panic!("intentional cooperative driver panic after a queue wake");
      }
    }

    let executor = multi_thread_executor(2, None, "panic-wake-compensation");
    executor
      .active_drainers
      .store(executor.max_drainers, Ordering::SeqCst);
    let fallback = Arc::new(DriverParker::default());
    executor.parked_drivers.register(&fallback);
    let (first_poll_tx, first_poll_rx) = mpsc::channel();
    let (panicked_tx, panicked_rx) = mpsc::channel();
    let driver_executor = Arc::clone(&executor);
    let driver = std::thread::spawn(move || {
      let _on_pool = OnPoolWorkerGuard::enter(driver_executor.id);
      let mut future = std::pin::pin!(PanicAfterWake {
        first_poll: Some(first_poll_tx)
      });
      let panicked = catch_unwind(AssertUnwindSafe(|| {
        driver_executor.block_on(future.as_mut());
      }))
      .is_err();
      panicked_tx.send(panicked).unwrap();
    });

    first_poll_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    wait_until(
      "the panicking cooperative driver to park after the fallback",
      || executor.parked_drivers.count.load(Ordering::SeqCst) == 2,
    );

    let ran = Arc::new(AtomicBool::new(false));
    let ran_task = Arc::clone(&ran);
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        ran_task.store(true, Ordering::SeqCst);
      },
      move |runnable| scheduler.schedule(runnable),
    );
    task.detach();
    executor.metrics.runnable_scheduled();
    executor.push_fifo_raw(runnable);
    assert!(
      executor.parked_drivers.wake_one(),
      "the queued runnable's wake must be absorbed by the cooperative driver"
    );

    assert!(
      panicked_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      "the test future must unwind after absorbing the queue wake"
    );
    driver.join().unwrap();
    assert!(
      fallback.consume_permit(),
      "panic cleanup must compensate the absorbed queue wake to the fallback driver"
    );
    assert!(
      executor.run_one(),
      "the queued runnable must remain executable"
    );
    assert!(ran.load(Ordering::SeqCst));
    executor.active_drainers.store(0, Ordering::SeqCst);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_future_wake_targets_its_own_parked_driver() {
    // Future-wake targeting invariant: a future-wake must reach the driver that
    // AWAITS that future, not "some parked driver". D1 parks first awaiting
    // rx1; D2 parks after it awaiting rx2. Completing rx1 must wake D1 even
    // though D2 parked more recently -- a future-wake misrouted through the
    // registry (which pops most-recently-parked) would wake D2, leave D1
    // parked forever, and trip the bounded timeout. The old notify_all
    // broadcast never distinguished drivers, so this pins the new obligation.
    use std::sync::mpsc;
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "wake-target".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      let (tx1, rx1) = oneshot::channel::<usize>();
      let (tx2, rx2) = oneshot::channel::<usize>();
      let t1_done = Arc::new(AtomicBool::new(false));
      let t2_done = Arc::new(AtomicBool::new(false));

      // T1: parks FIRST, awaiting rx1.
      let t1_exec = Arc::clone(&executor);
      let t1_flag = Arc::clone(&t1_done);
      let t1_body = async move {
        let mut inner = std::pin::pin!(async move {
          assert_eq!(rx1.await.unwrap(), 7usize);
        });
        t1_exec.block_on(inner.as_mut());
        t1_flag.store(true, Ordering::SeqCst);
      };
      let sched1 = Arc::clone(&executor);
      let (runnable1, task1) = async_task::spawn(t1_body, move |r| sched1.schedule(r));
      executor.schedule(runnable1);
      wait_until("driver 1 parked", || {
        executor.parked_drivers.count.load(Ordering::SeqCst) == 1
      });

      // T2: parks SECOND (most recently). Its runnable is pushed RAW (no
      // `schedule`, so no wake_one can pop the already-parked D1) and a
      // drainer is spawned for it on the free second worker.
      let t2_exec = Arc::clone(&executor);
      let t2_flag = Arc::clone(&t2_done);
      let t2_body = async move {
        let mut inner = std::pin::pin!(async move {
          assert_eq!(rx2.await.unwrap(), 9usize);
        });
        t2_exec.block_on(inner.as_mut());
        t2_flag.store(true, Ordering::SeqCst);
      };
      let sched2 = Arc::clone(&executor);
      let (runnable2, task2) = async_task::spawn(t2_body, move |r| sched2.schedule(r));
      executor.metrics.runnable_scheduled(); // keep the raw push's accounting balanced
      executor.push_fifo_raw(runnable2);
      executor.ensure_drainer();
      wait_until("driver 2 parked", || {
        executor.parked_drivers.count.load(Ordering::SeqCst) == 2
      });

      // Complete D1's future. The wake must land on D1 (first-parked), the
      // driver that owns rx1's waker -- not on the more recently parked D2.
      tx1.send(7usize).unwrap();
      wait_until("T1 completed via its own driver's wake", || {
        t1_done.load(Ordering::SeqCst)
      });
      futures::executor::block_on(task1);
      assert!(
        !t2_done.load(Ordering::SeqCst),
        "D2 must still be parked: its future was never completed"
      );
      // D1's drain frame LINGERS after T1 retires (see `drain`'s idle
      // linger): its linger parker joins the registry alongside D2 for the
      // idle budget. The registry count is NON-MONOTONIC here -- it reads 1
      // in the window between the cooperative parker's wake-deregistration
      // and the drain frame's linger registration, then 2 while lingering,
      // then 1 again after expiry -- so a `count == 1` wait can return
      // during the transient window and prove nothing about the linger.
      // Observe the lifecycle itself instead, via the test counters that
      // `drain` maintains: the linger parker must REGISTER, and its idle
      // budget must EXPIRE (`drain_linger_expiries` is incremented only
      // after the expiry path deregistered the parker, and no further work
      // exists to start another episode), after which the registry has
      // deterministically settled: EXACTLY the untargeted driver D2 remains
      // (a misrouted wake would have left D1 cooperatively parked instead,
      // already excluded by the `t1_done` wait above, and a linger parker
      // stranded in the registry would read 2 here).
      wait_until(
        "the retiring drain frame registered its linger parker",
        || executor.drain_linger_registrations.load(Ordering::SeqCst) >= 1,
      );
      wait_until("the lingering drainer's idle budget expired", || {
        executor.drain_linger_expiries.load(Ordering::SeqCst) >= 1
      });
      assert_eq!(
        executor.parked_drivers.count.load(Ordering::SeqCst),
        1,
        "exactly the untargeted driver must remain parked after the linger expired"
      );
      assert!(
        !t2_done.load(Ordering::SeqCst),
        "D2 must still be parked after the lingering drainer expired"
      );

      // Teardown: release D2 as well.
      tx2.send(9usize).unwrap();
      futures::executor::block_on(task2);
      assert!(t2_done.load(Ordering::SeqCst));
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "future-wake did not reach its own parked driver ({error}): the wake was misdirected or lost"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_cooperative_exit_hands_absorbed_wake_to_parked_driver() {
    // Miss-compensation invariant: a driver that exits `cooperative_block_on`
    // with queue work remaining must hand the wake on because it may have
    // absorbed a `wake_one` permit meant for that work. The SOLE pool worker
    // is parked as a cooperative driver, a runnable is pushed without a wake,
    // and the test thread forces a ready future through the cooperative branch.
    // Exit compensation is the ONLY mechanism left that can wake the parked
    // worker to drain the runnable.
    use std::sync::mpsc;
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "wake-compensate".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      // Park the sole worker as a cooperative driver awaiting a gate.
      let (gate_tx, gate_rx) = oneshot::channel::<()>();
      let td_exec = Arc::clone(&executor);
      let td_body = async move {
        let mut inner = std::pin::pin!(async move {
          gate_rx.await.unwrap();
        });
        td_exec.block_on(inner.as_mut());
      };
      let sched = Arc::clone(&executor);
      let (td_runnable, td_task) = async_task::spawn(td_body, move |r| sched.schedule(r));
      executor.schedule(td_runnable);
      wait_until("the sole driver parked", || {
        executor.parked_drivers.count.load(Ordering::SeqCst) == 1
      });

      // Strand a runnable: pushed RAW, so no wake accompanies it, and the
      // sole worker is parked-as-drainer, so `ensure_drainer` cannot help.
      let (ran_tx, ran_rx) = mpsc::channel::<()>();
      let sched_stranded = Arc::clone(&executor);
      let (stranded_runnable, stranded_task) = async_task::spawn(
        async move {
          ran_tx.send(()).unwrap();
        },
        move |r| sched_stranded.schedule(r),
      );
      executor.metrics.runnable_scheduled(); // keep the raw push's accounting balanced
      executor.push_fifo_raw(stranded_runnable);
      stranded_task.detach();

      // Drive a ready future through the cooperative branch on THIS thread
      // (fake on-pool marker, as in the executor-scoping test). Its first
      // poll is Ready, so the loop performs no work itself -- only the exit
      // compensation can hand the queued runnable to the parked driver.
      {
        let _on_pool = OnPoolWorkerGuard::enter(executor.id);
        let mut ready = std::pin::pin!(async {});
        executor.block_on(ready.as_mut());
      }

      ran_rx.recv_timeout(Duration::from_secs(5)).expect(
        "exit compensation must wake the parked driver to run the stranded queued runnable",
      );

      // Teardown: release the parked driver.
      gate_tx.send(()).unwrap();
      futures::executor::block_on(td_task);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("cooperative-exit miss compensation failed ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cooperative_exit_compensates_blocking_only_residue() {
    use std::sync::mpsc;

    struct Controlled {
      ready: Arc<AtomicBool>,
      entered: Option<mpsc::Sender<()>>,
    }

    impl Future for Controlled {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if let Some(entered) = self.entered.take() {
          entered.send(()).unwrap();
        }
        if self.ready.load(Ordering::SeqCst) {
          Poll::Ready(())
        } else {
          Poll::Pending
        }
      }
    }

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "blocking-exit-compensation".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let ready = Arc::new(AtomicBool::new(false));
    let (entered_tx, entered_rx) = mpsc::channel();
    let (returned_tx, returned_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let task_exec = Arc::clone(&executor);
    let task_ready = Arc::clone(&ready);
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        let mut future = std::pin::pin!(Controlled {
          ready: task_ready,
          entered: Some(entered_tx)
        });
        task_exec.block_on(future.as_mut());
        returned_tx.send(()).unwrap();
        release_rx.recv().unwrap();
      },
      move |runnable| scheduler.schedule(runnable),
    );
    executor.schedule(runnable);
    entered_rx.recv_timeout(Duration::from_secs(10)).unwrap();

    // The cooperative frame must be PARKED (registered) before the timer task
    // is scheduled, so that schedule's wake targets the frame instead of
    // spawning a second drainer. A second drainer would later LINGER as a
    // registered blocking-capable parker, and `wake_one_blocking` prefers the
    // most recently parked candidate: on a starved runner (observed on the
    // Windows CI) the linger parker absorbs the blocking wake below, the
    // drainer services the job, and the frame -- whose exit compensation is
    // the subject under test -- sleeps in its timer-bounded park until the
    // 120s heap timer, far past any sane recv bound.
    wait_until("the cooperative frame parked", || {
      executor.parked_drivers.count.load(Ordering::SeqCst) == 1
    });

    let timer_exec = Arc::clone(&executor);
    let timer_scheduler = Arc::clone(&executor);
    let (timer_runnable, timer_task) = async_task::spawn(
      async move {
        heap_sleep(&timer_exec, Instant::now() + Duration::from_secs(120)).await;
      },
      move |runnable| timer_scheduler.schedule(runnable),
    );
    executor.schedule(timer_runnable);
    wait_until("the dedicated timekeeper parked", || {
      executor
        .timers
        .inner
        .lock()
        .unwrap()
        .timekeeper_parker
        .is_some()
    });
    // Re-parked after running the timer runnable: the blocking wake below
    // must find the frame registered (the sole candidate), so the frame
    // absorbs the wake, observes its ready future, and its EXIT COMPENSATION
    // services the blocking-only residue.
    wait_until(
      "the cooperative frame re-parked in its timer-bounded park",
      || executor.parked_drivers.count.load(Ordering::SeqCst) == 1,
    );

    ready.store(true, Ordering::SeqCst);
    let (blocking_tx, blocking_rx) = mpsc::channel();
    let blocking = executor.schedule_blocking(move || {
      blocking_tx.send(()).unwrap();
    });
    // Generous hang-detector bounds, not latency assertions: starved CI
    // runners (msys2 CLANG64) can stall a woken thread for whole seconds.
    blocking_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("blocking-only residue must be serviced by a Rayon worker");
    returned_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("the cooperative frame must observe its ready future and return after the absorbed blocking wake");
    release_tx.send(()).unwrap();
    futures::executor::block_on(task);
    futures::executor::block_on(blocking).unwrap();
    executor.shutdown_timers();
    futures::executor::block_on(timer_task);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cooperative_exit_compensation_does_not_start_blocking_after_stop() {
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "stopped-exit-compensation".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let ran = Arc::new(AtomicBool::new(false));
    let blocking_ran = Arc::clone(&ran);

    // Keep schedule_blocking from starting a Rayon drainer so the stop flag can
    // become observable while this job remains queued, matching the original
    // begin_shutdown ordering window exactly.
    executor
      .active_drainers
      .store(executor.max_drainers, Ordering::SeqCst);
    let blocking = executor.schedule_blocking(move || {
      blocking_ran.store(true, Ordering::SeqCst);
    });
    assert!(!executor.blocking_queue.lock().unwrap().is_empty());

    executor.stop.begin_shutdown();
    executor.compensate_queued_work_wake(true);
    let ran_after_stop = ran.load(Ordering::SeqCst);

    executor.active_drainers.store(0, Ordering::SeqCst);
    executor.begin_shutdown();
    let blocking_result = futures::executor::block_on(blocking);

    assert!(
      !ran_after_stop,
      "exit compensation started queued blocking work after stop"
    );
    assert!(
      blocking_result.is_err(),
      "shutdown must cancel the queued blocking job"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn wake_path_wake_one_vs_park_interleaving_loses_no_wakeups() {
    // Targeted-wake stress: N rounds of {producer: publish work,
    // wake_one()} racing {consumer: check work, register, re-check, park} --
    // the exact schedule-vs-park protocol `schedule` and
    // `cooperative_block_on` run. This walks the interleaving at every offset
    // the OS scheduler produces; a single lost wakeup parks the consumer
    // forever with work pending, and the bounded recv_timeout turns that into
    // a loud failure instead of a hung suite. (No loom in this repo; std
    // threads.)
    use std::sync::mpsc;
    use std::time::Duration;

    const ROUNDS: usize = 20_000;

    let (done_tx, done_rx) = mpsc::channel();
    let registry = Arc::new(ParkedDrivers::default());
    let work = Arc::new(AtomicBool::new(false));

    let consumer = {
      let registry = Arc::clone(&registry);
      let work = Arc::clone(&work);
      std::thread::spawn(move || {
        let parker = Arc::new(DriverParker::default());
        for _ in 0..ROUNDS {
          loop {
            if work.swap(false, Ordering::SeqCst) {
              break;
            }
            // The cooperative park protocol: register FIRST, then re-check,
            // then park (see `ParkedDrivers::wake_one`).
            registry.register(&parker);
            if work.load(Ordering::SeqCst) {
              registry.deregister(&parker);
              continue;
            }
            parker.park();
            registry.deregister(&parker);
          }
        }
        done_tx.send(()).unwrap();
      })
    };

    for _ in 0..ROUNDS {
      work.store(true, Ordering::SeqCst);
      // The schedule side: publish work, then wake one parked driver. When
      // wake_one misses (consumer not registered yet), the consumer's
      // post-register re-check must see the work instead.
      let _ = registry.wake_one();
      while work.load(Ordering::SeqCst) {
        std::hint::spin_loop();
      }
    }

    done_rx
      .recv_timeout(Duration::from_secs(30))
      .expect("a wake_one()-side wakeup was lost: the consumer is parked with work pending");
    consumer.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_same_worker_schedule_runs_before_older_fifo_work() {
    // LIFO locality invariant: a runnable scheduled from a pool worker of the SAME
    // executor lands in that worker's LIFO slot (no FIFO push, no wake) and is
    // run by the next drain/run_one iteration BEFORE older shared-FIFO work.
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "lifo-order".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let order = Arc::new(Mutex::new(Vec::<&'static str>::new()));

    // Older work, pushed RAW onto the FIFO (so no drainer is spawned that
    // could race the manual `run_one` calls below).
    let old_order = Arc::clone(&order);
    let sched = Arc::clone(&executor);
    let (old_runnable, old_task) = async_task::spawn(
      async move {
        old_order.lock().unwrap().push("old");
      },
      move |r| sched.schedule(r),
    );
    executor.metrics.runnable_scheduled(); // keep the raw push's accounting balanced
    executor.push_fifo_raw(old_runnable);
    old_task.detach();

    // Simulate being on this executor's pool worker: the schedule below must
    // take the slot path (which never touches the FIFO nor spawns a drainer).
    let _on_pool = OnPoolWorkerGuard::enter(executor.id);
    let new_order = Arc::clone(&order);
    let sched = Arc::clone(&executor);
    let (new_runnable, new_task) = async_task::spawn(
      async move {
        new_order.lock().unwrap().push("new");
      },
      move |r| sched.schedule(r),
    );
    executor.schedule(new_runnable);
    new_task.detach();
    assert_eq!(
      executor.injector.len(),
      1,
      "the slot-path schedule must not push to the shared FIFO"
    );

    assert!(executor.run_one(), "run_one must pop the slot first");
    assert!(executor.run_one(), "run_one must then pop the FIFO");
    assert!(!executor.run_one(), "no work must remain");
    assert_eq!(
      *order.lock().unwrap(),
      vec!["new", "old"],
      "the slot runnable (newest) must run before older FIFO work"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn drain_fifo_runnable_does_not_inherit_blocking_owner() {
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "fifo-owner".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let observed_owner = Arc::new(Mutex::new(None));
    let observed = Arc::clone(&observed_owner);
    let (runnable, task) = async_task::spawn(
      async move {
        *observed.lock().unwrap() = Some(BLOCKING_OWNER.with(std::cell::Cell::get));
      },
      |_| {},
    );
    task.detach();
    executor.metrics.runnable_scheduled();
    executor.push_fifo_raw(runnable);
    executor.active_drainers.store(1, Ordering::Release);

    let owner = executor.fresh_owner_token();
    let _owner_guard = BlockingOwnerGuard::enter(Some(owner));
    Arc::clone(&executor).drain();

    assert_eq!(
      *observed_owner.lock().unwrap(),
      Some(None),
      "FIFO runnables must not borrow a blocking closure's over-cap privilege"
    );
    assert_eq!(
      BLOCKING_OWNER.with(std::cell::Cell::get),
      Some(owner),
      "the ambient blocking owner must be restored after the runnable"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_drain_runs_slot_before_older_fifo_work() {
    // Drain integration: with one worker, task P scheduling
    // child C mid-drain must see C run IMMEDIATELY after P (via the slot),
    // jumping ahead of the older queued T1/T2.
    use std::sync::mpsc;
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "lifo-drain".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
      let order = Arc::new(Mutex::new(Vec::<&'static str>::new()));

      let p_exec = Arc::clone(&executor);
      let p_order = Arc::clone(&order);
      let p_body = async move {
        p_order.lock().unwrap().push("P");
        // Scheduled from the pool worker mid-drain: must land in the slot.
        let c_order = Arc::clone(&p_order);
        let sched = Arc::clone(&p_exec);
        let (c_runnable, c_task) = async_task::spawn(
          async move {
            c_order.lock().unwrap().push("C");
          },
          move |r| sched.schedule(r),
        );
        p_exec.schedule(c_runnable);
        c_task.detach();
      };

      // Push P, T1, T2 RAW (deterministic FIFO order, exactly one drainer),
      // mirroring the `runnable_scheduled` accounting a real schedule does so
      // the queued-runnables counter stays balanced.
      let mut tasks = Vec::new();
      let sched = Arc::clone(&executor);
      let (p_runnable, p_task) = async_task::spawn(p_body, move |r| sched.schedule(r));
      executor.metrics.runnable_scheduled();
      executor.push_fifo_raw(p_runnable);
      tasks.push(p_task);
      for name in ["T1", "T2"] {
        let t_order = Arc::clone(&order);
        let sched = Arc::clone(&executor);
        let (t_runnable, t_task) = async_task::spawn(
          async move {
            t_order.lock().unwrap().push(name);
          },
          move |r| sched.schedule(r),
        );
        executor.metrics.runnable_scheduled();
        executor.push_fifo_raw(t_runnable);
        tasks.push(t_task);
      }
      executor.ensure_drainer();

      for task in tasks {
        futures::executor::block_on(task);
      }
      wait_until("the detached child C ran", || {
        order.lock().unwrap().len() == 4
      });
      assert_eq!(
        *order.lock().unwrap(),
        vec!["P", "C", "T1", "T2"],
        "the slot child C must run right after its scheduler P, ahead of older FIFO work"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("LIFO drain-order test did not complete ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_displaced_occupant_falls_back_to_fifo() {
    // Single-slot displacement invariant: two same-executor schedules from one worker -- the
    // NEWEST takes the slot; the displaced occupant must land on the shared
    // FIFO (with a wake), never be dropped. `active_drainers` is saturated so
    // the displacement wake cannot spawn a real drainer racing the manual
    // `run_one` calls.
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "lifo-displace".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    executor
      .active_drainers
      .store(executor.max_drainers, Ordering::SeqCst);
    let order = Arc::new(Mutex::new(Vec::<&'static str>::new()));

    let _on_pool = OnPoolWorkerGuard::enter(executor.id);
    for name in ["a", "b"] {
      let n_order = Arc::clone(&order);
      let sched = Arc::clone(&executor);
      let (runnable, task) = async_task::spawn(
        async move {
          n_order.lock().unwrap().push(name);
        },
        move |r| sched.schedule(r),
      );
      executor.schedule(runnable);
      task.detach();
    }
    assert_eq!(
      executor.injector.len(),
      1,
      "the displaced occupant (a) must have been pushed to the shared FIFO"
    );

    assert!(executor.run_one(), "run_one must pop the slot (b) first");
    assert!(
      executor.run_one(),
      "run_one must then pop the displaced (a) from the FIFO"
    );
    assert!(!executor.run_one(), "no work must remain");
    assert_eq!(
      *order.lock().unwrap(),
      vec!["b", "a"],
      "the newest schedule must win the slot; the displaced one must survive via the FIFO"
    );
    executor.active_drainers.store(0, Ordering::SeqCst);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_is_executor_scoped() {
    // Executor-scoping invariant: the slot is tagged with the executor id (mirroring the
    // ON_POOL_WORKER / BlockingOwnerToken scoping). A worker of executor A
    // scheduling onto executor B must bypass the slot (B's FIFO); and with
    // A's runnable IN the slot, B must neither pop nor displace it.
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "lifo-scope".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let exec1 =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let exec2 =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    assert_ne!(exec1.id, exec2.id, "executors must get distinct ids");
    exec1
      .active_drainers
      .store(exec1.max_drainers, Ordering::SeqCst);
    exec2
      .active_drainers
      .store(exec2.max_drainers, Ordering::SeqCst);
    let order = Arc::new(Mutex::new(Vec::<&'static str>::new()));

    // As exec1's worker: r1 goes to the slot, tagged exec1.
    let _on_pool1 = OnPoolWorkerGuard::enter(exec1.id);
    let r1_order = Arc::clone(&order);
    let sched = Arc::clone(&exec1);
    let (r1, t1) = async_task::spawn(
      async move {
        r1_order.lock().unwrap().push("one");
      },
      move |r| sched.schedule(r),
    );
    exec1.schedule(r1);
    t1.detach();
    assert!(
      exec1.injector.is_empty(),
      "r1 must sit in the slot, not exec1's FIFO"
    );

    {
      // Nested: now act as exec2's worker while exec1's runnable occupies the
      // slot. exec2 must not displace the foreign entry; r2 goes to its FIFO.
      let _on_pool2 = OnPoolWorkerGuard::enter(exec2.id);
      let r2_order = Arc::clone(&order);
      let sched = Arc::clone(&exec2);
      let (r2, t2) = async_task::spawn(
        async move {
          r2_order.lock().unwrap().push("two");
        },
        move |r| sched.schedule(r),
      );
      exec2.schedule(r2);
      t2.detach();
      assert_eq!(
        exec2.injector.len(),
        1,
        "a foreign-occupied slot must route exec2's schedule to exec2's FIFO"
      );
      assert!(
        exec2.pop_lifo_slot().is_none(),
        "exec2 must not pop exec1's slot entry (executor-scoped pop)"
      );
      assert!(exec2.run_one(), "exec2 must drive r2 from its own FIFO");
    }

    // Back as exec1's worker: its slot entry is intact and runnable.
    assert!(
      exec1.run_one(),
      "exec1's slot entry must have survived the foreign activity"
    );
    assert_eq!(*order.lock().unwrap(), vec!["two", "one"]);
    exec1.active_drainers.store(0, Ordering::SeqCst);
    exec2.active_drainers.store(0, Ordering::SeqCst);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_flushed_on_budget_exhaustion_completes_long_chains() {
    // LIFO chain flush invariant: a 200-link chain in which each task schedules the
    // next FROM the pool worker (every link lands in the slot) crosses
    // multiple RUNNABLE_BUDGET windows. At each exhaustion the slot MUST be
    // flushed to the FIFO before `finish_draining` (so its re-check sees the
    // runnable and re-arms a drainer); a missing flush strands the chain at
    // the first budget boundary (lost task + queued_runnables leak).
    use std::sync::mpsc;
    use std::time::Duration;

    const CHAIN: u64 = 200; // > RUNNABLE_BUDGET (64)

    fn spawn_link(
      executor: &Arc<MultiThreadExecutor>,
      remaining: u64,
      counter: Arc<AtomicU64>,
      done: mpsc::Sender<()>,
    ) {
      let body_exec = Arc::clone(executor);
      let body = async move {
        counter.fetch_add(1, Ordering::SeqCst);
        if remaining > 0 {
          spawn_link(&body_exec, remaining - 1, counter, done);
        } else {
          done.send(()).unwrap();
        }
      };
      let sched = Arc::clone(executor);
      let (runnable, task) = async_task::spawn(body, move |r| sched.schedule(r));
      executor.schedule(runnable);
      task.detach();
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "lifo-budget".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());

      let counter = Arc::new(AtomicU64::new(0));
      let (chain_tx, chain_rx) = mpsc::channel();
      spawn_link(&executor, CHAIN - 1, Arc::clone(&counter), chain_tx);

      chain_rx
        .recv_timeout(Duration::from_secs(10))
        .expect("the slot chain stalled at a budget boundary: slot not flushed on drain exit");
      assert_eq!(
        counter.load(Ordering::SeqCst),
        CHAIN,
        "every chain link must have run"
      );
      wait_until("runnable counters settle to zero (no slot leak)", || {
        metrics.queued_runnables.load(Ordering::Relaxed) == 0
          && metrics.active_runnables.load(Ordering::Relaxed) == 0
      });
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(15)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("LIFO budget-flush chain test did not complete ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_flush_moves_slot_runnable_to_shared_fifo() {
    // Direct flush primitive test: pin the flush behavior used at drain
    // exits, before cooperative parks and by the unwind guard -- a
    // slot-resident runnable moves to the shared FIFO with its task still
    // completable, never dropped. (The pre-park call is defensive: `run_one`
    // pops the slot before any park is reachable, so this primitive is its
    // only observable seam.)
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "lifo-flush".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    executor
      .active_drainers
      .store(executor.max_drainers, Ordering::SeqCst);
    let ran = Arc::new(AtomicBool::new(false));

    let _on_pool = OnPoolWorkerGuard::enter(executor.id);
    let ran_flag = Arc::clone(&ran);
    let sched = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        ran_flag.store(true, Ordering::SeqCst);
      },
      move |r| sched.schedule(r),
    );
    executor.schedule(runnable);
    task.detach();
    assert!(
      executor.injector.is_empty(),
      "the runnable must start in the slot"
    );

    executor.flush_lifo_slot();
    assert!(
      executor.pop_lifo_slot().is_none(),
      "the slot must be empty after a flush"
    );
    assert_eq!(
      executor.injector.len(),
      1,
      "the flushed runnable must be on the shared FIFO"
    );
    assert!(executor.run_one(), "the flushed runnable must still run");
    assert!(
      ran.load(Ordering::SeqCst),
      "the flushed task must complete, not be dropped"
    );
    executor.active_drainers.store(0, Ordering::SeqCst);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_runnable_does_not_inherit_blocking_owner() {
    // Blocking-owner isolation must cover the LIFO slot path: a runnable
    // popped from the slot runs with BLOCKING_OWNER cleared, so it cannot
    // borrow the driving owner frame's over-cap privilege; the ambient owner
    // is restored afterwards.
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "lifo-owner".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let observed = Arc::new(Mutex::new(None::<Option<BlockingOwnerToken>>));

    let _on_pool = OnPoolWorkerGuard::enter(executor.id);

    // Install the slot entry from RUNNABLE context (no ambient owner), the
    // only context that may use the slot because schedules issued under an
    // owner frame are diverted to the shared FIFO.
    let observed_slot = Arc::clone(&observed);
    let sched = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        *observed_slot.lock().unwrap() = Some(BLOCKING_OWNER.with(std::cell::Cell::get));
      },
      move |r| sched.schedule(r),
    );
    executor.schedule(runnable);
    task.detach();
    assert!(
      executor.injector.is_empty(),
      "the runnable must sit in the slot"
    );

    // The POP can still happen while an owner frame is ambient (a cooperative
    // `block_on` entered from a blocking closure drives `run_one` with the
    // closure's token on the stack); the slot branch must clear it.
    let token = executor.fresh_owner_token();
    let _owner = BlockingOwnerGuard::enter(Some(token));
    assert!(executor.run_one(), "the slot runnable must run");
    assert_eq!(
      *observed.lock().unwrap(),
      Some(None),
      "a slot runnable must observe a CLEARED blocking owner"
    );
    assert_eq!(
      BLOCKING_OWNER.with(std::cell::Cell::get),
      Some(token),
      "the ambient owner frame must be restored after the slot runnable"
    );
  }

  // Shared ping-pong probe for the LIFO fairness tests: two tasks that wake
  // each other on every poll. Scheduled from a pool worker, each wake lands in
  // that worker's LIFO slot, keeping the slot hot indefinitely. A task
  // finishes when `stop` is raised (or `stop_after` polls happened), releasing
  // its partner's stored waker so both complete.
  #[cfg(napi_runtime_os_threads)]
  struct PingPongShared {
    count: AtomicU64,
    stop: AtomicBool,
    stop_after: u64,
    wakers: Mutex<[Option<std::task::Waker>; 2]>,
  }

  #[cfg(napi_runtime_os_threads)]
  struct PingPong {
    shared: Arc<PingPongShared>,
    me: usize,
  }

  #[cfg(napi_runtime_os_threads)]
  impl Future for PingPong {
    type Output = ();
    fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
      let shared = &self.shared;
      let polls = shared.count.fetch_add(1, Ordering::SeqCst);
      if shared.stop.load(Ordering::SeqCst) || polls >= shared.stop_after {
        let partner = shared.wakers.lock().unwrap()[1 - self.me].take();
        if let Some(partner) = partner {
          partner.wake();
        }
        return Poll::Ready(());
      }
      let mut wakers = shared.wakers.lock().unwrap();
      wakers[self.me] = Some(cx.waker().clone());
      if let Some(partner) = wakers[1 - self.me].take() {
        drop(wakers);
        partner.wake();
      }
      Poll::Pending
    }
  }

  #[cfg(napi_runtime_os_threads)]
  fn spawn_ping_pong_pair(
    executor: &Arc<MultiThreadExecutor>,
    shared: &Arc<PingPongShared>,
  ) -> Vec<Task<()>> {
    let mut tasks = Vec::new();
    for me in 0..2 {
      let sched = Arc::clone(executor);
      let (runnable, task) = async_task::spawn(
        PingPong {
          shared: Arc::clone(shared),
          me,
        },
        move |r| sched.schedule(r),
      );
      executor.schedule(runnable);
      tasks.push(task);
    }
    tasks
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn lifo_slot_ping_pong_does_not_starve_queued_fifo_task() {
    // LIFO streak-cap invariant: slot pops share `drain`'s RUNNABLE_BUDGET, so
    // a hot wake/await pair holds a worker for at most one budget window
    // before the slot is flushed and the FIFO gets its turn. With ONE worker,
    // a third task queued behind an unbounded ping-pong pair must still run;
    // if slot pops bypassed the budget the drain would never exit and T3
    // would starve forever (caught by the bounded timeout).
    use std::sync::mpsc;
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 0,
        thread_name_prefix: "lifo-streak".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let shared = Arc::new(PingPongShared {
        count: AtomicU64::new(0),
        stop: AtomicBool::new(false),
        stop_after: u64::MAX,
        wakers: Mutex::new([None, None]),
      });
      let pair = spawn_ping_pong_pair(&executor, &shared);

      // T3: queued on the shared FIFO behind the hot pair.
      let (t3_tx, t3_rx) = mpsc::channel::<()>();
      let sched = Arc::clone(&executor);
      let (t3_runnable, t3_task) = async_task::spawn(
        async move {
          t3_tx.send(()).unwrap();
        },
        move |r| sched.schedule(r),
      );
      executor.schedule(t3_runnable);

      t3_rx
        .recv_timeout(Duration::from_secs(10))
        .expect("a hot LIFO pair starved the FIFO: the budget streak cap is broken");
      assert!(
        shared.count.load(Ordering::SeqCst) >= 32,
        "the pair must have been bouncing through the slot before T3 got its turn"
      );

      // Teardown: stop the pair and release whichever side is waiting.
      shared.stop.store(true, Ordering::SeqCst);
      let stored: Vec<_> = shared
        .wakers
        .lock()
        .unwrap()
        .iter_mut()
        .filter_map(Option::take)
        .collect();
      for waker in stored {
        waker.wake();
      }
      for task in pair {
        futures::executor::block_on(task);
      }
      futures::executor::block_on(t3_task);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(15)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("LIFO streak-cap test did not complete ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_hot_lifo_pair_does_not_wedge_queued_blocking_job() {
    // Runnable/blocking fairness invariant: runnables (slot included) outrank blocking work per
    // drain iteration -- unchanged from the FIFO-only drain -- but a hot LIFO
    // pair must not turn that priority into a permanent wedge. The budget
    // flush keeps the drain exiting, `finish_draining` keeps re-checking the
    // blocking queue, and the queued blocking job completes once the pair
    // finishes its (long) run on the SOLE worker.
    use std::sync::mpsc;
    use std::time::Duration;

    const BOUNCES: u64 = 2_000; // ~31 budget windows on one worker

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "lifo-blocking".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let shared = Arc::new(PingPongShared {
        count: AtomicU64::new(0),
        stop: AtomicBool::new(false),
        stop_after: BOUNCES,
        wakers: Mutex::new([None, None]),
      });
      let pair = spawn_ping_pong_pair(&executor, &shared);

      // Queued while the pair keeps the slot hot on the only worker.
      let blocking = executor.schedule_blocking(|| 11usize);

      assert_eq!(
        futures::executor::block_on(blocking).unwrap(),
        11,
        "the queued blocking job must complete despite the hot LIFO pair"
      );
      for task in pair {
        futures::executor::block_on(task);
      }
      assert!(
        shared.count.load(Ordering::SeqCst) >= BOUNCES,
        "the pair must have actually run its full bounce quota"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(15)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("LIFO blocking-fairness test did not complete ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn infinite_hot_runnable_yields_to_blocking_fifo() {
    use std::sync::mpsc;

    struct HotFuture {
      stop: Arc<AtomicBool>,
    }

    impl Future for HotFuture {
      type Output = ();

      fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        if self.stop.load(Ordering::SeqCst) {
          Poll::Ready(())
        } else {
          cx.waker().wake_by_ref();
          Poll::Pending
        }
      }
    }

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "blocking-fairness".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let stop = Arc::new(AtomicBool::new(false));
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      HotFuture {
        stop: Arc::clone(&stop),
      },
      move |r| scheduler.schedule(r),
    );
    task.detach();
    let (blocking_tx, blocking_rx) = mpsc::sync_channel(1);
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: BlockingJobId(u64::MAX),
        run: Box::new(move || blocking_tx.send(()).unwrap()),
      });

    let _driver = OnPoolWorkerGuard::enter(executor.id);
    executor.schedule(runnable);
    let mut runnable_streak = 0;
    for _ in 0..=MultiThreadExecutor::RUNNABLE_FAIRNESS_QUANTUM {
      assert!(executor.run_one_fair(&mut runnable_streak));
    }
    blocking_rx
      .try_recv()
      .expect("an infinite self-waker must yield a bounded quantum to blocking work");

    stop.store(true, Ordering::SeqCst);
    assert!(executor.run_one_fair(&mut runnable_streak));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_hot_runnable_yields_to_exact_blocking_dependency() {
    use std::sync::mpsc;

    struct HotFuture {
      stop: Arc<AtomicBool>,
    }

    impl Future for HotFuture {
      type Output = ();

      fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        if self.stop.load(Ordering::SeqCst) {
          Poll::Ready(())
        } else {
          cx.waker().wake_by_ref();
          Poll::Pending
        }
      }
    }

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 1,
      max_blocking_tasks: 1,
      thread_name_prefix: "exact-dependency-fairness".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let stop = Arc::new(AtomicBool::new(false));
    let (queued_tx, queued_rx) = mpsc::channel();
    let (exact_tx, exact_rx) = mpsc::channel();
    let owner_executor = Arc::clone(&executor);
    let owner_stop = Arc::clone(&stop);
    let owner = executor.schedule_blocking(move || {
      let scheduler = Arc::clone(&owner_executor);
      let hot_stop = Arc::clone(&owner_stop);
      let (runnable, hot_task) = async_task::spawn(HotFuture { stop: hot_stop }, move |runnable| {
        scheduler.schedule(runnable);
      });
      owner_executor.schedule(runnable);

      let exact_stop = Arc::clone(&owner_stop);
      let exact = owner_executor.schedule_blocking(move || {
        exact_tx.send(!exact_stop.load(Ordering::SeqCst)).unwrap();
        41usize
      });
      queued_tx.send(()).unwrap();

      let mut value = None;
      {
        let mut future = std::pin::pin!(async {
          value = Some(exact.await.unwrap());
          hot_task.await;
        });
        assert_eq!(
          owner_executor.block_on(future.as_mut()),
          BlockOnOutcome::Completed
        );
      }
      value.unwrap()
    });

    queued_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the exact dependency must be queued behind the saturated owner");
    let exact_before_stop = exact_rx.recv_timeout(Duration::from_secs(2)).ok();
    stop.store(true, Ordering::SeqCst);
    assert_eq!(futures::executor::block_on(owner).unwrap(), 41);
    let exact_before_stop = exact_before_stop.or_else(|| exact_rx.try_recv().ok());
    assert_eq!(
      exact_before_stop,
      Some(true),
      "a hot local runnable must yield to the exact dependency before it is stopped"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_exact_dependency_precedes_last_slot_fifo_admission() {
    use std::sync::mpsc;

    struct BlockingPoll {
      started: Option<mpsc::Sender<()>>,
      released: Arc<(Mutex<bool>, Condvar)>,
    }

    impl Future for BlockingPoll {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if let Some(started) = self.started.take() {
          started.send(()).unwrap();
        }
        let (released, changed) = &*self.released;
        let mut released = released
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        while !*released {
          released = changed
            .wait(released)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
        Poll::Ready(())
      }
    }

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 3,
      max_blocking_tasks: 2,
      thread_name_prefix: "exact-before-last-slot".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

    let released = Arc::new((Mutex::new(false), Condvar::new()));
    let (blocker_started_tx, blocker_started_rx) = mpsc::channel();
    let mut blockers = Vec::new();
    for _ in 0..2 {
      let scheduler = Arc::clone(&executor);
      let blocker_released = Arc::clone(&released);
      let started = blocker_started_tx.clone();
      let (runnable, task) = async_task::spawn(
        BlockingPoll {
          started: Some(started),
          released: blocker_released,
        },
        move |runnable| scheduler.schedule(runnable),
      );
      executor.schedule(runnable);
      blockers.push(task);
    }
    drop(blocker_started_tx);
    for _ in 0..2 {
      blocker_started_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("two workers must be gated before the owner starts");
    }

    let dependency_started = Arc::new(AtomicBool::new(false));
    let owner_executor = Arc::clone(&executor);
    let owner_dependency_started = Arc::clone(&dependency_started);
    let (unrelated_observed_tx, unrelated_observed_rx) = mpsc::channel();
    let dependency_signal = Arc::new((Mutex::new(false), Condvar::new()));
    let owner_signal = Arc::clone(&dependency_signal);
    let owner = executor.schedule_blocking(move || {
      let unrelated_signal = Arc::clone(&owner_signal);
      let unrelated_started = Arc::clone(&owner_dependency_started);
      let unrelated = owner_executor.schedule_blocking(move || {
        let observed = unrelated_started.load(Ordering::SeqCst);
        unrelated_observed_tx.send(observed).unwrap();
        let (ready, changed) = &*unrelated_signal;
        let mut ready = ready
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        while !*ready {
          ready = changed
            .wait(ready)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
      });

      let exact_signal = Arc::clone(&owner_signal);
      let exact_started = Arc::clone(&owner_dependency_started);
      let exact = owner_executor.schedule_blocking(move || {
        exact_started.store(true, Ordering::SeqCst);
        let (ready, changed) = &*exact_signal;
        *ready
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner) = true;
        changed.notify_all();
        41usize
      });

      let mut output = None;
      {
        let mut future = std::pin::pin!(async {
          output = Some(exact.await.unwrap());
          unrelated.await.unwrap();
        });
        assert_eq!(
          owner_executor.block_on(future.as_mut()),
          BlockOnOutcome::Completed
        );
      }
      output.unwrap()
    });

    let (owner_done_tx, owner_done_rx) = mpsc::channel();
    let owner_waiter = std::thread::spawn(move || {
      owner_done_tx
        .send(futures::executor::block_on(owner))
        .unwrap();
    });
    let (completed_while_gated, owner_result) =
      match owner_done_rx.recv_timeout(Duration::from_secs(2)) {
        Ok(result) => (true, result),
        Err(_) => {
          // Let a broken implementation recover so the regression fails
          // deterministically instead of leaving blocked Rayon workers behind.
          let (released, changed) = &*released;
          *released
            .lock()
            .unwrap_or_else(std::sync::PoisonError::into_inner) = true;
          changed.notify_all();
          (
            false,
            owner_done_rx
              .recv_timeout(Duration::from_secs(2))
              .expect("releasing the other workers must let the broken ordering recover"),
          )
        }
      };
    let unrelated_observed = unrelated_observed_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the unrelated FIFO job must eventually run");

    {
      let (released, changed) = &*released;
      *released
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner) = true;
      changed.notify_all();
    }
    owner_waiter.join().unwrap();
    for blocker in blockers {
      futures::executor::block_on(blocker);
    }
    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();

    assert!(
      completed_while_gated,
      "the exact dependency must complete while unrelated workers remain gated"
    );
    assert_eq!(owner_result.unwrap(), 41);
    assert!(
      unrelated_observed,
      "the exact dependency must signal before unrelated FIFO admission consumes the last slot"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn blocking_saturation_preserves_a_runnable_execution_lane() {
    use std::{sync::mpsc, time::Duration};

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "blocking-reserve".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
    .validate()
    .expect("production options must reserve a runnable lane");
    assert_eq!((options.worker_threads, options.max_blocking_tasks), (2, 1));
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let (release_tx, release_rx) = mpsc::channel();
    let (started_tx, started_rx) = mpsc::channel();
    let first = executor.schedule_blocking(move || {
      started_tx.send(()).unwrap();
      release_rx.recv().unwrap();
    });
    started_rx.recv_timeout(Duration::from_secs(1)).unwrap();

    let (queued_tx, queued_rx) = mpsc::channel();
    let second = executor.schedule_blocking(move || {
      queued_tx.send(()).unwrap();
    });
    assert!(
      queued_rx.try_recv().is_err(),
      "the second blocking job must remain queued while the sole blocking slot is occupied"
    );

    let (runnable_tx, runnable_rx) = mpsc::sync_channel(1);
    let scheduler = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        runnable_tx.send(()).unwrap();
      },
      move |r| scheduler.schedule(r),
    );
    task.detach();
    executor.schedule(runnable);
    runnable_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("all admitted blocking jobs consumed the scheduler's runnable execution capacity");

    release_tx.send(()).unwrap();
    futures::executor::block_on(first).unwrap();
    futures::executor::block_on(second).unwrap();
    queued_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("queued blocking work must run after the occupied slot is released");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cooperative_exit_flushes_slot_work_spawned_by_final_poll() {
    // Final-poll slot-flush invariant: the awaited future's FINAL poll can
    // schedule same-executor work, which lands in THIS worker's LIFO slot --
    // no FIFO push, no wake. The Ready exit of
    // `cooperative_block_on` must flush the slot: the caller may wait on that
    // child synchronously (and the enclosing drain frame can be arbitrarily
    // far away -- here it does not exist at all, via the fake on-pool
    // marker), so a stranded slot entry is an invisible, dead task.
    use std::sync::mpsc;
    use std::time::Duration;

    struct SpawnOnReady {
      executor: Arc<MultiThreadExecutor>,
      child_tx: Option<mpsc::Sender<u64>>,
    }
    impl Future for SpawnOnReady {
      type Output = ();
      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        let child_tx = self.child_tx.take().expect("polled once");
        let sched = Arc::clone(&self.executor);
        let (runnable, task) = async_task::spawn(
          async move {
            child_tx.send(21).unwrap();
          },
          move |r| sched.schedule(r),
        );
        // On-pool + same executor + no ambient owner: lands in the slot.
        self.executor.schedule(runnable);
        task.detach();
        Poll::Ready(())
      }
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "exit-flush".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let (child_tx, child_rx) = mpsc::channel::<u64>();
      {
        // The test-only on-pool marker runs the cooperative branch on THIS
        // thread, with NO enclosing drain loop to bail the slot out.
        let _on_pool = OnPoolWorkerGuard::enter(executor.id);
        let mut future = std::pin::pin!(SpawnOnReady {
          executor: Arc::clone(&executor),
          child_tx: Some(child_tx)
        });
        executor.block_on(future.as_mut() as Pin<&mut dyn Future<Output = ()>>);
      }

      // Synchronous bounded wait, NOT via the executor: only the exit flush
      // (slot -> shared FIFO -> wake/ensure_drainer -> pool worker) can
      // complete the child.
      let value = child_rx
        .recv_timeout(Duration::from_secs(5))
        .expect("the child scheduled by the final poll was stranded in the LIFO slot");
      assert_eq!(value, 21);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("cooperative-exit slot-flush test did not complete ({error})"),
    }
  }

  /// Perpetual same-executor chain: each link schedules its successor from
  /// the pool worker (so every link lands in the LIFO slot) until `stop` is
  /// raised. `hops` counts executed links.
  #[cfg(napi_runtime_os_threads)]
  fn spawn_hot_chain(
    executor: &Arc<MultiThreadExecutor>,
    stop: Arc<AtomicBool>,
    hops: Arc<AtomicU64>,
  ) {
    if stop.load(Ordering::SeqCst) {
      return;
    }
    let link_exec = Arc::clone(executor);
    let body = async move {
      hops.fetch_add(1, Ordering::SeqCst);
      spawn_hot_chain(&link_exec, stop, hops);
    };
    let sched = Arc::clone(executor);
    let (runnable, task) = async_task::spawn(body, move |r| sched.schedule(r));
    executor.schedule(runnable);
    task.detach();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cooperative_block_on_budget_prevents_slot_chain_starving_fifo() {
    // Runnable-budget invariant: `cooperative_block_on`'s loop must mirror
    // `drain`'s RUNNABLE_BUDGET streak cap. `run_one` pops the slot before
    // the FIFO, so a hot chain (every link schedules its successor into the
    // slot) keeps run_one succeeding forever and the FIFO is never reached
    // from this thread. On the direct 1-worker test topology a FIFO task that
    // completes the awaited future then never runs: deadlock. The budgeted
    // loop must flush the slot every RUNNABLE_BUDGET runs so the FIFO task
    // gets its turn.
    use std::sync::mpsc;
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        // This locality test intentionally bypasses RuntimeOptions::validate
        // to isolate one physical worker without admitting blocking work.
        max_blocking_tasks: 0,
        thread_name_prefix: "coop-budget".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let stop = Arc::new(AtomicBool::new(false));
      let hops = Arc::new(AtomicU64::new(0));

      // M runs on the sole worker: it queues F (the task that completes the
      // awaited future) on the FIFO, heats the slot with the chain, then
      // block_on's the value F produces.
      let m_exec = Arc::clone(&executor);
      let m_stop = Arc::clone(&stop);
      let m_hops = Arc::clone(&hops);
      let m_body = async move {
        let (tx, rx) = oneshot::channel::<u64>();
        // Schedule F first: it takes the slot momentarily...
        let sched_f = Arc::clone(&m_exec);
        let (f_runnable, f_task) = async_task::spawn(
          async move {
            let _ = tx.send(7);
          },
          move |r| sched_f.schedule(r),
        );
        m_exec.schedule(f_runnable);
        f_task.detach();
        // ...then the chain starter displaces it to the FIFO and keeps the
        // slot hot from here on.
        spawn_hot_chain(&m_exec, Arc::clone(&m_stop), m_hops);

        let mut inner = std::pin::pin!(async move {
          assert_eq!(
            rx.await.unwrap(),
            7,
            "F must run and complete the awaited future"
          );
        });
        m_exec.block_on(inner.as_mut());
        m_stop.store(true, Ordering::SeqCst);
      };
      let sched_m = Arc::clone(&executor);
      let (m_runnable, m_task) = async_task::spawn(m_body, move |r| sched_m.schedule(r));
      executor.schedule(m_runnable);

      futures::executor::block_on(m_task);
      assert!(
        hops.load(Ordering::SeqCst) >= 64,
        "the chain must have been genuinely hot (>= one budget window) before F ran"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "cooperative block_on starved the FIFO behind a hot slot chain ({error}): the loop needs the RUNNABLE_BUDGET streak cap"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cooperative_budget_forces_fifo_after_future_refills_lifo_slot() {
    use std::sync::mpsc;

    struct RefillLifo {
      executor: Arc<MultiThreadExecutor>,
      fifo_ran: Arc<AtomicBool>,
    }

    impl Future for RefillLifo {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if self.fifo_ran.load(Ordering::SeqCst) {
          return Poll::Ready(());
        }
        let scheduler = Arc::clone(&self.executor);
        let (runnable, task) =
          async_task::spawn(async {}, move |runnable| scheduler.schedule(runnable));
        self.executor.schedule(runnable);
        task.detach();
        Poll::Pending
      }
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 0,
        thread_name_prefix: "forced-fifo".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
      executor
        .active_drainers
        .store(executor.max_drainers, Ordering::SeqCst);

      let fifo_ran = Arc::new(AtomicBool::new(false));
      let fifo_flag = Arc::clone(&fifo_ran);
      let scheduler = Arc::clone(&executor);
      let (fifo, task) = async_task::spawn(
        async move {
          fifo_flag.store(true, Ordering::SeqCst);
        },
        move |runnable| scheduler.schedule(runnable),
      );
      task.detach();
      executor.metrics.runnable_scheduled();
      executor.push_fifo_raw(fifo);

      {
        let _driver = OnPoolWorkerGuard::enter(executor.id);
        let mut future = std::pin::pin!(RefillLifo {
          executor: Arc::clone(&executor),
          fifo_ran: Arc::clone(&fifo_ran)
        });
        executor.block_on(future.as_mut());
        while executor.run_one() {}
      }
      executor.active_drainers.store(0, Ordering::SeqCst);
      assert!(fifo_ran.load(Ordering::SeqCst));
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(Duration::from_secs(3))
      .expect("a refilled LIFO slot starved the forced shared-FIFO turn");
    runner.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn blocking_closure_spawn_is_not_stranded_in_slot() {
    // Blocking-closure scheduling invariant: ON_POOL_WORKER spans the whole
    // drain frame, INCLUDING blocking-closure bodies. A closure that spawns a
    // same-executor task and then waits for it synchronously would deadlock if
    // the child were slotted because the slot only drains after the closure
    // returns. `schedule` must bypass the slot while BLOCKING_OWNER is set and
    // push to the shared FIFO with a wake.
    use std::sync::mpsc;
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "blk-spawn-wait".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      // Closure spawns a child and BLOCKS on the channel the child must fill.
      // A spare worker exists; only a real FIFO push + wake can reach it.
      let blk_exec = Arc::clone(&executor);
      let handle = executor.schedule_blocking(move || {
        let (tx, rx) = mpsc::channel::<u64>();
        let sched = Arc::clone(&blk_exec);
        let (runnable, task) = async_task::spawn(
          async move {
            tx.send(21).unwrap();
          },
          move |r| sched.schedule(r),
        );
        blk_exec.schedule(runnable);
        task.detach();
        rx.recv_timeout(Duration::from_secs(5))
          .expect("child spawned by a blocking closure was stranded in the worker's LIFO slot")
      });
      assert_eq!(futures::executor::block_on(handle).unwrap(), 21);

      // Variant: the closure exits WITHOUT waiting; the child must still
      // complete promptly (no stranding on the closure-exit path either).
      let (v_tx, v_rx) = mpsc::channel::<u64>();
      let v_exec = Arc::clone(&executor);
      let v_handle = executor.schedule_blocking(move || {
        let sched = Arc::clone(&v_exec);
        let (runnable, task) = async_task::spawn(
          async move {
            v_tx.send(42).unwrap();
          },
          move |r| sched.schedule(r),
        );
        v_exec.schedule(runnable);
        task.detach();
        1u64
      });
      assert_eq!(futures::executor::block_on(v_handle).unwrap(), 1);
      assert_eq!(
        v_rx
          .recv_timeout(Duration::from_secs(5))
          .expect("fire-and-forget child must complete"),
        42
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(15)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("blocking-closure spawn test did not complete ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_nested_spawn_blocking_does_not_deadlock_when_saturated() {
    // Saturated nested-blocking invariant: a blocking closure re-enters
    // `block_on` and awaits another `spawn_blocking` while
    // `max_blocking_tasks` is already saturated by the outer blocking jobs.
    // The driver must not park while still holding its blocking slot, because
    // the inner job would then have no capacity to run.
    use std::sync::{Barrier, mpsc};
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd1-nested-blk".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      let outer_count = 2usize; // saturates max_blocking_tasks
      let barrier = Arc::new(Barrier::new(outer_count));

      let mut handles = Vec::new();
      for _ in 0..outer_count {
        let exec = Arc::clone(&executor);
        let barrier = Arc::clone(&barrier);
        let handle = executor.schedule_blocking(move || {
          // Both outer blocking jobs hold a slot before either nests.
          barrier.wait();
          let inner_exec = Arc::clone(&exec);
          let mut value = 0usize;
          {
            let mut inner = std::pin::pin!(async {
              value = inner_exec.schedule_blocking(|| 5usize).await.unwrap();
            });
            exec.block_on(inner.as_mut());
          }
          value
        });
        handles.push(handle);
      }

      for handle in handles {
        assert_eq!(futures::executor::block_on(handle).unwrap(), 5usize);
      }
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("nested spawn_blocking deadlocked at blocking capacity ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn scheduler_unclaimed_worker_cannot_infer_sole_blocking_owner() {
    let executor = multi_thread_executor(2, None, "no-owner-cardinality-inference");
    let owner = executor.fresh_owner_token();
    let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let job = BlockingJobId(u64::MAX - 5);
    let dependency = TaskDependency::default();
    dependency.set_owned(BlockingDependency { job, owner: None });
    let ran = Arc::new(AtomicBool::new(false));
    let job_ran = Arc::clone(&ran);
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: job,
        run: Box::new(move || job_ran.store(true, Ordering::SeqCst)),
      });

    assert_eq!(BLOCKING_OWNER.with(std::cell::Cell::get), None);
    assert!(
      !executor.try_owned_blocking_over_cap(&dependency),
      "an untagged worker must not infer ancestry from a sole active owner"
    );
    assert!(!ran.load(Ordering::SeqCst));
    assert!(
      executor
        .blocking_queue
        .lock()
        .unwrap()
        .jobs
        .contains_key(&job),
      "rejected owner inference must leave the exact job queued"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn owner_lending_is_exact_frame_scoped_with_two_saturated_owners() {
    use std::sync::{Barrier, mpsc};

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "exact-owner-frame".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let owners_saturated = Arc::new(Barrier::new(3));
    let (dependency_queued_tx, dependency_queued_rx) = mpsc::channel();
    let begin_lending = Arc::new(Barrier::new(3));
    let release_dependencies = Arc::new(Barrier::new(3));
    let (dependency_started_tx, dependency_started_rx) = mpsc::channel();
    let mut owners = Vec::new();

    for owner_index in 0..2 {
      let owner_executor = Arc::clone(&executor);
      let owners_saturated = Arc::clone(&owners_saturated);
      let dependency_queued_tx = dependency_queued_tx.clone();
      let begin_lending = Arc::clone(&begin_lending);
      let release_dependencies = Arc::clone(&release_dependencies);
      let dependency_started_tx = dependency_started_tx.clone();
      owners.push(executor.schedule_blocking(move || {
        let owner_thread = std::thread::current().id();
        owners_saturated.wait();
        let child_started = dependency_started_tx.clone();
        let child_release = Arc::clone(&release_dependencies);
        let child = owner_executor.schedule_blocking(move || {
          assert_eq!(
            std::thread::current().id(),
            owner_thread,
            "an owner frame must execute only its own exact dependency on its lent lane"
          );
          child_started.send(owner_index).unwrap();
          child_release.wait();
          owner_index
        });
        dependency_queued_tx.send(()).unwrap();
        begin_lending.wait();

        let mut result = None;
        {
          let mut future = std::pin::pin!(async {
            result = Some(child.await.unwrap());
          });
          assert_eq!(
            owner_executor.block_on(future.as_mut()),
            BlockOnOutcome::Completed
          );
        }
        result.unwrap()
      }));
    }
    drop(dependency_queued_tx);
    drop(dependency_started_tx);
    owners_saturated.wait();

    for _ in 0..2 {
      dependency_queued_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("both owner-scoped dependencies must be queued while the cap is saturated");
    }
    let (unrelated_tx, unrelated_rx) = mpsc::channel();
    let unrelated = executor.schedule_blocking(move || unrelated_tx.send(()).unwrap());
    begin_lending.wait();

    let mut started = Vec::new();
    for _ in 0..2 {
      started.push(
        dependency_started_rx
          .recv_timeout(Duration::from_secs(2))
          .expect("each owner must service its own exact dependency"),
      );
    }
    started.sort_unstable();
    assert_eq!(started, vec![0, 1]);
    assert!(
      unrelated_rx.try_recv().is_err(),
      "a later unrelated blocking job must remain queued while both exact owner lanes are lent"
    );

    release_dependencies.wait();
    for (owner_index, owner) in owners.into_iter().enumerate() {
      assert_eq!(futures::executor::block_on(owner).unwrap(), owner_index);
    }
    unrelated_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the unrelated job must run after an owner releases a counted lane");
    futures::executor::block_on(unrelated).unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn parked_unrelated_rayon_worker_cannot_block_later_lending_or_idle() {
    use std::sync::{Mutex, mpsc};

    const DEPENDENCY_COUNT: usize = 4;

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 3,
      max_blocking_tasks: 1,
      thread_name_prefix: "parked-unrelated-worker".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let (parked_tx, parked_rx) = mpsc::channel();
    let (release_parked_tx, release_parked_rx) = mpsc::channel();
    executor.pool.spawn(move || {
      parked_tx.send(()).unwrap();
      release_parked_rx.recv().unwrap();
    });
    parked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the unrelated Rayon worker must remain occupied");

    let owner_executor = Arc::clone(&executor);
    let owner = executor.schedule_blocking(move || {
      let owner = BLOCKING_OWNER
        .with(std::cell::Cell::get)
        .expect("the blocking closure must carry its exact owner frame");
      let (descendant_started_tx, descendant_started_rx) = mpsc::sync_channel(0);
      let results = Arc::new(Mutex::new(Vec::new()));
      let descendant_results = Arc::clone(&results);
      let descendant_executor = Arc::clone(&owner_executor);
      rayon::scope(move |scope| {
        scope.spawn(move |_| {
          assert_eq!(
            BLOCKING_OWNER.with(std::cell::Cell::get),
            None,
            "the parked owner must force its descendant onto the remaining worker"
          );
          let _owner = BlockingOwnerGuard::enter(Some(owner));
          descendant_started_tx.send(()).unwrap();
          for value in 0..DEPENDENCY_COUNT {
            let handle = descendant_executor.schedule_blocking(move || value);
            let mut result = None;
            {
              let mut future = std::pin::pin!(async {
                result = Some(handle.await.unwrap());
              });
              assert_eq!(
                descendant_executor.block_on(future.as_mut()),
                BlockOnOutcome::Completed
              );
            }
            descendant_results.lock().unwrap().push(result.unwrap());
          }
        });
        descendant_started_rx
          .recv_timeout(Duration::from_secs(2))
          .expect("the nested descendant must start on the only unoccupied worker");
      });
      Arc::try_unwrap(results).unwrap().into_inner().unwrap()
    });

    assert_eq!(
      futures::executor::block_on(owner).unwrap(),
      (0..DEPENDENCY_COUNT).collect::<Vec<_>>()
    );

    let (idle_tx, idle_rx) = mpsc::channel();
    let idle_executor = Arc::clone(&executor);
    let idle_waiter = std::thread::spawn(move || {
      idle_executor.begin_shutdown();
      idle_executor.wait_until_scheduler_idle();
      idle_tx.send(()).unwrap();
    });
    idle_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("an unrelated parked worker must not retain owner-probe idle accounting");

    release_parked_tx.send(()).unwrap();
    idle_waiter.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn same_owner_lending_rearms_one_parked_dependency_per_completion() {
    use std::sync::{Condvar, Mutex, mpsc};

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 3,
      max_blocking_tasks: 1,
      thread_name_prefix: "same-owner-rearm".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let releases = Arc::new((Mutex::new([false; 2]), Condvar::new()));
    let (job_started_tx, job_started_rx) = mpsc::channel();
    let owner_executor = Arc::clone(&executor);
    let owner_releases = Arc::clone(&releases);
    let owner = executor.schedule_blocking(move || {
      let owner = BLOCKING_OWNER
        .with(std::cell::Cell::get)
        .expect("the blocking closure must carry its exact owner frame");
      let (descendant_ready_tx, descendant_ready_rx) = mpsc::channel();
      let results = Arc::new(Mutex::new(Vec::new()));
      let scope_results = Arc::clone(&results);
      rayon::scope(move |scope| {
        for index in 0..2 {
          let descendant_ready_tx = descendant_ready_tx.clone();
          let descendant_executor = Arc::clone(&owner_executor);
          let descendant_results = Arc::clone(&scope_results);
          let job_started_tx = job_started_tx.clone();
          let releases = Arc::clone(&owner_releases);
          scope.spawn(move |_| {
            assert_eq!(BLOCKING_OWNER.with(std::cell::Cell::get), None);
            let _owner = BlockingOwnerGuard::enter(Some(owner));
            descendant_ready_tx.send(()).unwrap();
            let handle = descendant_executor.schedule_blocking(move || {
              job_started_tx.send(index).unwrap();
              let (released, changed) = &*releases;
              let mut state = released.lock().unwrap();
              while !state[index] {
                state = changed.wait(state).unwrap();
              }
              index
            });
            let mut result = None;
            {
              let mut future = std::pin::pin!(async {
                result = Some(handle.await.unwrap());
              });
              assert_eq!(
                descendant_executor.block_on(future.as_mut()),
                BlockOnOutcome::Completed
              );
            }
            descendant_results.lock().unwrap().push(result.unwrap());
          });
        }
        drop(descendant_ready_tx);
        for _ in 0..2 {
          descendant_ready_rx
            .recv_timeout(Duration::from_secs(2))
            .expect("both descendants must be stolen before the owner leaves its Rayon scope");
        }
      });
      Arc::try_unwrap(results).unwrap().into_inner().unwrap()
    });

    let first = job_started_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("one exact dependency must borrow the owner lane");
    assert!(
      job_started_rx
        .recv_timeout(Duration::from_millis(100))
        .is_err(),
      "one owner frame must not service two dependencies concurrently"
    );
    let unrelated_parker = Arc::new(DriverParker::default());
    executor
      .parked_drivers
      .register_with_role(&unrelated_parker, true, None);
    {
      let (released, changed) = &*releases;
      released.lock().unwrap()[first] = true;
      changed.notify_all();
    }

    let second = job_started_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("completion must rearm one parked same-owner dependency");
    assert_ne!(second, first);
    assert!(
      !unrelated_parker.consume_permit(),
      "the bounded owner handoff must skip a newer parked driver with no live owner dependency"
    );
    executor.parked_drivers.deregister(&unrelated_parker);
    {
      let (released, changed) = &*releases;
      released.lock().unwrap()[second] = true;
      changed.notify_all();
    }

    let mut results = futures::executor::block_on(owner).unwrap();
    results.sort_unstable();
    assert_eq!(results, vec![0, 1]);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn failed_exact_claim_rearms_parked_same_owner_dependency() {
    let executor = multi_thread_executor(2, None, "failed-claim-owner-handoff");
    let owner = executor.fresh_owner_token();
    let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let failed_dependency = Arc::new(TaskDependency::default());
    failed_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 21),
      owner: Some(owner),
    });
    let parked_dependency = Arc::new(TaskDependency::default());
    parked_dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX - 22),
      owner: Some(owner),
    });
    let parker = Arc::new(DriverParker::default());

    let queue = executor.blocking_queue.lock().unwrap();
    let claimant_executor = Arc::clone(&executor);
    let claimant_dependency = Arc::clone(&failed_dependency);
    let claimant = std::thread::spawn(move || {
      let _owner = BlockingOwnerGuard::enter(Some(owner));
      claimant_executor.try_owned_blocking_over_cap(&claimant_dependency)
    });
    wait_until("the failed claimant to reserve the owner lane", || {
      !executor.active_blocking_owners.is_available(owner)
    });
    executor
      .parked_drivers
      .register_with_role(&parker, true, Some(Arc::clone(&parked_dependency)));
    failed_dependency.clear();
    drop(queue);

    assert!(
      !claimant.join().unwrap(),
      "the cancelled dependency must not execute"
    );
    assert!(
      parker.consume_permit(),
      "releasing a failed exact claim must hand the owner lane to another parked dependency"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn exact_owner_lending_does_not_start_blocking_after_stop() {
    use std::sync::mpsc;

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "stopped-exact-owner".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let ran = Arc::new(AtomicBool::new(false));
    let (claim_entered_tx, claim_entered_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let owner_executor = Arc::clone(&executor);
    let child_ran = Arc::clone(&ran);
    let owner = executor.schedule_blocking(move || {
      BEFORE_OWNED_BLOCKING_QUEUE_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claim_entered_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      let child = owner_executor.schedule_blocking(move || {
        child_ran.store(true, Ordering::SeqCst);
      });
      let mut future = std::pin::pin!(async move {
        let _ = child.await;
      });
      owner_executor.block_on(future.as_mut())
    });

    claim_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the cooperative driver must pause before the exact-owner queue claim");
    assert_eq!(
      executor.blocking_queue.lock().unwrap().jobs.len(),
      1,
      "the exact dependency must remain queued before stop publication"
    );

    // Pin the reported race: the cooperative driver already passed its loop's
    // stop check, then shutdown publishes stop before the exact queue claim.
    executor.stop.begin_shutdown();
    release_claim_tx.send(()).unwrap();

    assert_eq!(
      futures::executor::block_on(owner).unwrap(),
      BlockOnOutcome::Stopped,
      "the cooperative driver must stop instead of executing its queued dependency"
    );
    assert!(
      !ran.load(Ordering::SeqCst),
      "exact-owner lending started blocking work after stop"
    );
    assert_eq!(
      executor.blocking_queue.lock().unwrap().jobs.len(),
      1,
      "the stopped exact-owner claim must leave the queued job for shutdown cancellation"
    );

    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
    assert!(executor.blocking_queue.lock().unwrap().is_empty());
    assert!(!ran.load(Ordering::SeqCst));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn exact_owner_lending_attempts_scale_linearly_with_topology() {
    const DEPENDENCY_COUNT: usize = 1024;

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "linear-owner-lending".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let completed = Arc::new(AtomicUsize::new(0));

    for index in 0..DEPENDENCY_COUNT {
      let owner = executor.fresh_owner_token();
      let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
      let dependency = TaskDependency::new(u64::MAX, Some(owner));
      let blocking = BlockingDependency {
        job: BlockingJobId(u64::MAX - index as u64),
        owner: Some(owner),
      };
      dependency.set_owned(blocking);
      let completed = Arc::clone(&completed);
      executor
        .blocking_queue
        .lock()
        .unwrap()
        .push(QueuedBlocking {
          id: blocking.job,
          run: Box::new(move || {
            completed.fetch_add(1, Ordering::SeqCst);
          }),
        });

      let _owner = BlockingOwnerGuard::enter(Some(owner));
      assert!(executor.try_owned_blocking_over_cap(&dependency));
    }

    assert_eq!(completed.load(Ordering::SeqCst), DEPENDENCY_COUNT);
    assert_eq!(
      executor.owner_lending_attempts.load(Ordering::Relaxed),
      DEPENDENCY_COUNT,
      "targeted lending must perform one O(1) claim attempt per exact dependency"
    );
    let queue = executor.blocking_queue.lock().unwrap();
    assert!(queue.is_empty());
    assert_eq!(queue.head, None);
    assert_eq!(queue.tail, None);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn one_dependency_interspersed_owner_publications_stays_linear() {
    const PUBLICATION_COUNT: usize = 1024;

    let executor = multi_thread_executor(2, None, "linear-publication-lending");
    let owner = executor.fresh_owner_token();
    let wrong_owner = executor.fresh_owner_token();
    let dependency = TaskDependency::new(u64::MAX, Some(owner));
    let completed = Arc::new(AtomicUsize::new(0));
    for index in 0..PUBLICATION_COUNT {
      let cancelled_source = TaskDependency::default();
      cancelled_source.set_owned(BlockingDependency {
        job: BlockingJobId(u64::MAX - 100_000 - index as u64),
        owner: Some(owner),
      });
      dependency.set_borrowed(
        &cancelled_source
          .get()
          .expect("the source publication must initially be live"),
      );
      cancelled_source.clear();

      dependency.set_owned(BlockingDependency {
        job: BlockingJobId(u64::MAX - 200_000 - index as u64),
        owner: Some(wrong_owner),
      });
      let blocking = BlockingDependency {
        job: BlockingJobId(u64::MAX - 1_000 - index as u64),
        owner: Some(owner),
      };
      dependency.set_owned(blocking);
      let completed = Arc::clone(&completed);
      executor
        .blocking_queue
        .lock()
        .unwrap()
        .push(QueuedBlocking {
          id: blocking.job,
          run: Box::new(move || {
            completed.fetch_add(1, Ordering::SeqCst);
          }),
        });
    }
    dependency.reset_entry_visits();

    let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let _owner = BlockingOwnerGuard::enter(Some(owner));
    for _ in 0..PUBLICATION_COUNT {
      assert!(
        dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Exact),
        "the owner-handoff predicate must find the next exact publication"
      );
      assert!(
        dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Available),
        "the park-availability predicate must find the next serviceable publication"
      );
      assert!(executor.try_owned_blocking_over_cap(&dependency));
    }

    assert_eq!(completed.load(Ordering::SeqCst), PUBLICATION_COUNT);
    assert!(
      !dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Exact),
      "wrong-owner publications must not satisfy an exact handoff"
    );
    assert!(
      !dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Available),
      "wrong-owner publications must not make the owner's lane appear serviceable"
    );
    assert!(
      dependency.entry_visits() <= PUBLICATION_COUNT * 9 + 8,
      "selection, handoff/availability predicates, stale retirement, and claims must visit O(n) entries across n publications, visits={}",
      dependency.entry_visits()
    );
    assert!(executor.blocking_queue.lock().unwrap().is_empty());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn binding_unowned_dependency_updates_exact_owner_predicate() {
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 200,
      frame: u64::MAX - 201,
    };
    let dependency = TaskDependency::default();
    let blocking = BlockingDependency {
      job: BlockingJobId(u64::MAX - 202),
      owner: None,
    };
    dependency.set_owned(blocking);

    assert!(
      !dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Exact),
      "an unowned publication must not satisfy an exact owner handoff"
    );
    assert!(
      dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Available),
      "an unowned publication is available to the ambient owner"
    );

    let selected = dependency
      .select_for_owner(owner)
      .expect("the owner must bind the unowned publication");
    assert_eq!(selected.publication.dependency.owner, Some(owner));
    assert!(
      dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Exact),
      "binding must immediately publish the entry to exact-owner predicates"
    );
    assert!(dependency.try_claim(&selected));
    assert!(!dependency.has_live_owner_dependency(owner, OwnerDependencyMode::Exact));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn owner_selection_preserves_unowned_and_exact_publication_order() {
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 210,
      frame: u64::MAX - 211,
    };
    let dependency = TaskDependency::default();
    let first = BlockingDependency {
      job: BlockingJobId(u64::MAX - 212),
      owner: None,
    };
    let second = BlockingDependency {
      job: BlockingJobId(u64::MAX - 213),
      owner: Some(owner),
    };
    dependency.set_owned(first);
    dependency.set_owned(second);

    let selected = dependency
      .select_for_owner(owner)
      .expect("the first publication must be found");
    assert_eq!(
      selected.publication.dependency,
      BlockingDependency {
        owner: Some(owner),
        ..first
      }
    );
    assert!(dependency.try_claim(&selected));

    let selected = dependency
      .select_for_owner(owner)
      .expect("the second publication must remain eligible");
    assert_eq!(selected.publication.dependency, second);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn blocking_queue_exact_removal_reclaims_fifo_links() {
    const JOB_COUNT: u64 = 4096;

    let mut queue = BlockingQueue {
      closed: false,
      head: None,
      tail: None,
      jobs: FxHashMap::default(),
    };
    for id in 1..=JOB_COUNT {
      queue.push(QueuedBlocking {
        id: BlockingJobId(id),
        run: Box::new(|| {}),
      });
    }
    for id in (2..=JOB_COUNT).step_by(2) {
      drop(
        queue
          .remove(BlockingJobId(id))
          .expect("even job must remain indexed"),
      );
    }
    for id in (1..=JOB_COUNT).step_by(2) {
      drop(
        queue
          .remove(BlockingJobId(id))
          .expect("odd job must remain indexed"),
      );
    }
    assert!(queue.jobs.is_empty());
    assert_eq!(queue.head, None);
    assert_eq!(queue.tail, None);

    let order = Arc::new(Mutex::new(Vec::new()));
    for id in 1..=3 {
      let order = Arc::clone(&order);
      queue.push(QueuedBlocking {
        id: BlockingJobId(id),
        run: Box::new(move || order.lock().unwrap().push(id)),
      });
    }
    drop(
      queue
        .remove(BlockingJobId(2))
        .expect("middle job must be removable"),
    );
    queue.pop_front().expect("FIFO head must remain linked")();
    queue.pop_front().expect("FIFO tail must remain linked")();
    assert!(queue.pop_front().is_none());
    assert_eq!(*order.lock().unwrap(), vec![1, 3]);
    assert_eq!(queue.head, None);
    assert_eq!(queue.tail, None);
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn dependency_lending_keeps_public_blocking_metrics_within_cap() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_DEPENDENCY_LENDING_METRICS_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      configure(RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 1,
        thread_name_prefix: "dependency-lending-metrics".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .unwrap();

      let outer = spawn_blocking(|| {
        let inner = spawn_blocking(|| 42usize);
        block_on(inner).unwrap()
      });
      assert_eq!(block_on(outer).unwrap(), 42);

      // Result delivery wakes the joiner from inside the blocking closure,
      // immediately before the scheduler-owned metrics guard retires. Use
      // shutdown quiescence before sampling completed/live counters so this
      // test does not race that final bookkeeping.
      shutdown().unwrap();
      let snapshot = metrics();
      assert_eq!(snapshot.blocking_tasks_started, 2);
      assert_eq!(snapshot.blocking_tasks_completed, 2);
      assert_eq!(snapshot.active_blocking_tasks, 0);
      assert_eq!(
        snapshot.max_active_blocking_tasks, snapshot.max_blocking_tasks as u64,
        "dependency lending reuses the owner's admitted lane instead of increasing the active gauge"
      );
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::dependency_lending_keeps_public_blocking_metrics_within_cap")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the dependency-lending metrics subprocess must start");
    assert!(
      output.status.success(),
      "dependency lending must preserve the public blocking-cap metric invariant; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn nested_blocking_runs_exact_awaited_job_before_same_owner_sibling() {
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 1,
        thread_name_prefix: "exact-blocking-job".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
      let outer_exec = Arc::clone(&executor);
      let (sibling_started_tx, sibling_started_rx) = mpsc::channel();
      let (release_sibling_tx, release_sibling_rx) = mpsc::channel();
      let (awaited_ran_tx, awaited_ran_rx) = mpsc::channel();
      let outer = executor.schedule_blocking(move || {
        let sibling = outer_exec.schedule_blocking(move || {
          sibling_started_tx.send(()).unwrap();
          release_sibling_rx.recv().unwrap();
        });
        let awaited = outer_exec.schedule_blocking(move || {
          awaited_ran_tx.send(()).unwrap();
          17usize
        });
        let mut value = None;
        {
          let mut future = std::pin::pin!(async {
            value = Some(awaited.await.unwrap());
          });
          outer_exec.block_on(future.as_mut());
        }
        (sibling, value.unwrap())
      });

      awaited_ran_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the exact awaited job must bypass the earlier detached sibling");
      let (sibling, value) = futures::executor::block_on(outer).unwrap();
      assert_eq!(value, 17);
      sibling_started_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the sibling must run after the owner releases its counted slot");
      release_sibling_tx.send(()).unwrap();
      futures::executor::block_on(sibling).unwrap();
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("same-owner sibling selection deadlocked the exact awaited job");
    runner.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn blocking_dependency_propagates_through_async_join_lineage() {
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let controller = Arc::new(multi_thread_controller("blocking-lineage", 2, 1));
      let owner_controller = Arc::clone(&controller);
      let (child_tx, child_rx) = mpsc::channel();
      let outer = controller
        .try_spawn_blocking(move || {
          let async_controller = Arc::clone(&owner_controller);
          let async_child = owner_controller
            .try_spawn(async move {
              async_controller
                .try_spawn_blocking(move || {
                  child_tx.send(()).unwrap();
                  23usize
                })
                .unwrap_or_else(|_| panic!("runtime must accept the descendant blocking job"))
                .await
                .unwrap()
            })
            .unwrap_or_else(|_| panic!("runtime must accept the async descendant"));
          let mut value = None;
          {
            let mut future = std::pin::pin!(async {
              value = Some(async_child.await.unwrap());
            });
            owner_controller.block_on(future.as_mut());
          }
          value.unwrap()
        })
        .unwrap_or_else(|_| panic!("runtime must accept the blocking owner"));

      child_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the async descendant's exact blocking dependency must inherit the owner lane");
      assert_eq!(futures::executor::block_on(outer).unwrap(), 23);
      controller.shutdown().unwrap();
      done_tx.send(()).unwrap();
    });
    done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("blocking dependency lineage deadlocked");
    runner.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn blocking_dependency_does_not_escape_a_serviced_runnable() {
    use std::sync::mpsc;

    let controller = Arc::new(multi_thread_controller("blocking-lineage-isolation", 2, 1));
    let outer_controller = Arc::clone(&controller);
    let (child_queued_tx, child_queued_rx) = mpsc::channel();
    let (unrelated_ran_tx, unrelated_ran_rx) = mpsc::channel();
    let (release_outer_tx, release_outer_rx) = oneshot::channel();
    let outer = controller
      .try_spawn_blocking(move || {
        let child_controller = Arc::clone(&outer_controller);
        let child = outer_controller
          .try_spawn(async move {
            let blocking = child_controller
              .try_spawn_blocking(move || {
                unrelated_ran_tx.send(()).unwrap();
                31usize
              })
              .unwrap_or_else(|_| panic!("runtime must accept the unrelated blocking job"));
            child_queued_tx.send(()).unwrap();
            blocking.await.unwrap()
          })
          .unwrap_or_else(|_| panic!("runtime must accept the serviced async task"));
        let mut released = false;
        {
          let mut future = std::pin::pin!(async {
            release_outer_rx.await.unwrap();
            released = true;
          });
          outer_controller.block_on(future.as_mut());
        }
        assert!(released);
        child
      })
      .unwrap_or_else(|_| panic!("runtime must accept the blocking owner"));

    child_queued_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the cooperative driver must service the unrelated async runnable");
    assert!(
      unrelated_ran_rx
        .recv_timeout(Duration::from_millis(200))
        .is_err(),
      "an unrelated serviced runnable leaked its blocking job into the owner's over-cap lineage"
    );

    release_outer_tx.send(()).unwrap();
    let child = futures::executor::block_on(outer).unwrap();
    unrelated_ran_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the unrelated blocking job must run after the owner releases its counted slot");
    assert_eq!(futures::executor::block_on(child).unwrap(), 31);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn dropping_pending_join_handle_clears_parent_blocking_dependency() {
    let parent = Arc::new(TaskDependency::default());
    let _context = TaskDependencyGuard::enter(&parent);
    let dependency = BlockingDependency {
      job: BlockingJobId(u64::MAX),
      owner: None,
    };
    let (sender, receiver) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let mut handle = JoinHandle(JoinHandleInner::Blocking {
      receiver,
      dependency,
      published: PublishedBlockingDependencies::default(),
    });
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);

    assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
    assert_eq!(parent.get_dependency(), Some(dependency));
    drop(handle);
    assert_eq!(
      parent.get_dependency(),
      None,
      "an abandoned JoinHandle must clear stale dependency lineage"
    );
    drop(sender);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn dropping_owner_enriched_blocking_handle_clears_parent_dependency() {
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 40,
      frame: u64::MAX - 41,
    };
    let parent = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    let _context = TaskDependencyGuard::enter(&parent);
    let dependency = BlockingDependency {
      job: BlockingJobId(u64::MAX - 42),
      owner: None,
    };
    let (sender, receiver) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let mut handle = JoinHandle(JoinHandleInner::Blocking {
      receiver,
      dependency,
      published: PublishedBlockingDependencies::default(),
    });
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);

    assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
    assert_eq!(
      parent.get_dependency(),
      Some(BlockingDependency {
        owner: Some(owner),
        ..dependency
      }),
      "the ambient task owner must enrich an untagged direct blocking dependency"
    );
    drop(handle);
    assert_eq!(
      parent.get_dependency(),
      None,
      "detach cleanup must match the stable job id after owner enrichment"
    );
    drop(sender);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn one_poll_preserves_every_observed_blocking_dependency() {
    let parent = Arc::new(TaskDependency::default());
    let _context = TaskDependencyGuard::enter(&parent);
    let first = BlockingDependency {
      job: BlockingJobId(u64::MAX - 60),
      owner: None,
    };
    let second = BlockingDependency {
      job: BlockingJobId(u64::MAX - 61),
      owner: None,
    };
    let (first_sender, first_receiver) =
      oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let (second_sender, second_receiver) =
      oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let mut first_handle = JoinHandle(JoinHandleInner::Blocking {
      receiver: first_receiver,
      dependency: first,
      published: PublishedBlockingDependencies::default(),
    });
    let mut second_handle = JoinHandle(JoinHandleInner::Blocking {
      receiver: second_receiver,
      dependency: second,
      published: PublishedBlockingDependencies::default(),
    });
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);

    assert!(Pin::new(&mut first_handle).poll(&mut cx).is_pending());
    assert!(Pin::new(&mut second_handle).poll(&mut cx).is_pending());
    assert_eq!(
      parent.get_dependencies(),
      vec![first, second],
      "publishing a later dependency in one user poll must not replace an earlier dependency"
    );

    drop(first_handle);
    drop(second_handle);
    drop(first_sender);
    drop(second_sender);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn double_polled_then_detached_handle_does_not_outrank_a_live_dependency() {
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 900,
      frame: u64::MAX - 901,
    };
    let parent = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    let _context = TaskDependencyGuard::enter(&parent);
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);

    let j1 = BlockingDependency {
      job: BlockingJobId(u64::MAX - 910),
      owner: Some(owner),
    };
    let j2 = BlockingDependency {
      job: BlockingJobId(u64::MAX - 911),
      owner: Some(owner),
    };

    let (s1, r1) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let (s2, r2) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();

    let mut h1 = JoinHandle(JoinHandleInner::Blocking {
      receiver: r1,
      dependency: j1,
      published: PublishedBlockingDependencies::default(),
    });
    // TWO Pending polls in one pass. Each publishes, so without coalescing the
    // handle leaves two live entries for J1 and can retire only the newer one.
    assert!(Pin::new(&mut h1).poll(&mut cx).is_pending());
    assert!(Pin::new(&mut h1).poll(&mut cx).is_pending());
    let entries_after_double_poll = parent
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .current
      .len();
    drop(h1);

    let mut h2 = JoinHandle(JoinHandleInner::Blocking {
      receiver: r2,
      dependency: j2,
      published: PublishedBlockingDependencies::default(),
    });
    assert!(Pin::new(&mut h2).poll(&mut cx).is_pending());

    assert_eq!(
      entries_after_double_poll, 1,
      "a repeat Pending poll must supersede the handle's own previous publication"
    );
    let selected = parent
      .select_for_owner(owner)
      .expect("a live dependency must be selectable");
    assert_eq!(
      selected.publication.dependency.job, j2.job,
      "a DETACHED job must not be selected for owner lending ahead of the live one"
    );
    drop((s1, s2));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn handle_polled_under_a_nested_frame_retires_both_publications() {
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 920,
      frame: u64::MAX - 921,
    };
    let outer = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    let inner = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);

    let j1 = BlockingDependency {
      job: BlockingJobId(u64::MAX - 930),
      owner: Some(owner),
    };
    let j2 = BlockingDependency {
      job: BlockingJobId(u64::MAX - 931),
      owner: Some(owner),
    };
    let (s1, r1) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let (s2, r2) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let mut h1 = JoinHandle(JoinHandleInner::Blocking {
      receiver: r1,
      dependency: j1,
      published: Default::default(),
    });

    {
      let _outer_ctx = TaskDependencyGuard::enter(&outer);
      // A handle can publish into more than one frame: once here, and again
      // under a nested re-entrant frame. Detaching must retire BOTH, or the
      // forgotten entry keeps a detached job selectable for owner lending.
      assert!(Pin::new(&mut h1).poll(&mut cx).is_pending());
      {
        let _inner_ctx = TaskDependencyGuard::enter(&inner);
        assert!(Pin::new(&mut h1).poll(&mut cx).is_pending());
      }
      drop(h1);
      assert!(
        outer.get_dependencies().is_empty(),
        "detaching must retire the publication made in the outer frame too"
      );
      let mut h2 = JoinHandle(JoinHandleInner::Blocking {
        receiver: r2,
        dependency: j2,
        published: Default::default(),
      });
      assert!(Pin::new(&mut h2).poll(&mut cx).is_pending());
      let selected = outer.select_for_owner(owner).expect("selectable");
      assert_eq!(
        selected.publication.dependency.job, j2.job,
        "a detached job published in an outer frame must not outrank a live one"
      );
      drop(h2);
    }
    drop((s1, s2));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn a_pending_handle_does_not_retain_the_frames_it_has_left() {
    const FRAME_COUNT: usize = 64;
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);
    let (sender, receiver) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let mut handle = JoinHandle(JoinHandleInner::Blocking {
      receiver,
      dependency: BlockingDependency {
        job: BlockingJobId(u64::MAX - 940),
        owner: None,
      },
      published: PublishedBlockingDependencies::default(),
    });
    let mut frames = Vec::new();
    for _ in 0..FRAME_COUNT {
      let frame = Arc::new(TaskDependency::default());
      frames.push(Arc::downgrade(&frame));
      let _context = TaskDependencyGuard::enter(&frame);
      assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
    }
    // A handle carried through a sequence of completed frames must not keep
    // any of them alive: it remembers each publication by `Weak`, and prunes
    // the expired tokens on its next publication, so the history stays at the
    // live frame count instead of growing with every frame ever seen.
    let retained = frames
      .iter()
      .filter(|frame| frame.strong_count() > 0)
      .count();
    assert_eq!(
      retained, 0,
      "a completed frame must not be kept alive by a pending handle's publication history"
    );
    drop(handle);
    drop(sender);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn repolling_a_handle_does_not_reorder_it_behind_a_later_dependency() {
    // H1 -> H2 -> H1 in one poll pass. `select_for_owner` picks the LOWEST live
    // sequence, so H1 must keep the position its FIRST poll gave it: if
    // re-polling appended a replacement at the tail, H2 would be lent first,
    // and an H2 that waits on H1 would deadlock the owner's single lane.
    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 950,
      frame: u64::MAX - 951,
    };
    let parent = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    let _context = TaskDependencyGuard::enter(&parent);
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);

    let j1 = BlockingDependency {
      job: BlockingJobId(u64::MAX - 960),
      owner: Some(owner),
    };
    let j2 = BlockingDependency {
      job: BlockingJobId(u64::MAX - 961),
      owner: Some(owner),
    };
    let (s1, r1) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let (s2, r2) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let mut h1 = JoinHandle(JoinHandleInner::Blocking {
      receiver: r1,
      dependency: j1,
      published: PublishedBlockingDependencies::default(),
    });
    let mut h2 = JoinHandle(JoinHandleInner::Blocking {
      receiver: r2,
      dependency: j2,
      published: PublishedBlockingDependencies::default(),
    });

    assert!(Pin::new(&mut h1).poll(&mut cx).is_pending());
    assert!(Pin::new(&mut h2).poll(&mut cx).is_pending());
    assert!(Pin::new(&mut h1).poll(&mut cx).is_pending());

    let selected = parent
      .select_for_owner(owner)
      .expect("a live dependency must be selectable");
    assert_eq!(
      selected.publication.dependency.job, j1.job,
      "re-polling a handle must not push its dependency behind one published later"
    );
    drop((h1, h2, s1, s2));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn a_handle_carried_through_reused_frames_keeps_a_bounded_history() {
    // Frames here are RETAINED (as a completed task's `JoinHandle` retains its
    // `TaskDependency`) but each drains `current` at the start of its poll,
    // which is what a real task poll does. A drained frame no longer holds the
    // entry, so its token stops standing and is dropped on the next
    // publication: the history tracks frames that still hold an entry, not
    // every frame the handle has ever been polled under.
    const FRAME_COUNT: usize = 256;
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);
    let (sender, receiver) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
    let mut handle = JoinHandle(JoinHandleInner::Blocking {
      receiver,
      dependency: BlockingDependency {
        job: BlockingJobId(u64::MAX - 970),
        owner: None,
      },
      published: PublishedBlockingDependencies::default(),
    });
    let mut retained = Vec::new();
    for _ in 0..FRAME_COUNT {
      let frame = Arc::new(TaskDependency::default());
      retained.push(Arc::clone(&frame));
      let _context = TaskDependencyGuard::enter(&frame);
      assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
      // The frame's next poll drains what the previous one published.
      frame.begin_poll();
    }
    let JoinHandle(JoinHandleInner::Blocking { published, .. }) = &handle else {
      panic!("the handle must still be a blocking handle");
    };
    let remembered = usize::from(published.first.is_some()) + published.rest.len();
    assert!(
      remembered <= 2,
      "a drained frame must not stay in the publication history, remembered={remembered}"
    );
    drop(handle);
    drop(sender);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn mass_detach_of_pending_blocking_handles_stays_linear() {
    // A cancelled fan-out: N blocking handles are polled Pending inside ONE
    // poll pass -- so `begin_poll` never runs to drain `current` and all N
    // entries are simultaneously registered and still pending -- and are then
    // dropped together. Retiring a handle's own entry is O(1) and
    // `prune_stale_prefix` is amortised, so the whole detach is O(N).
    //
    // This is the shape that made an earlier attempt at this optimisation
    // quadratic: it replaced the job index with a scan of `current` on every
    // drop, which costs exactly N(N+1)/2 entry visits here, all of it under
    // the dependency mutex.
    const HANDLE_COUNT: usize = 512;

    let parent = Arc::new(TaskDependency::default());
    let _context = TaskDependencyGuard::enter(&parent);
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);

    let mut senders = Vec::with_capacity(HANDLE_COUNT);
    let mut handles = Vec::with_capacity(HANDLE_COUNT);
    for index in 0..HANDLE_COUNT {
      let (sender, receiver) = oneshot::channel::<Result<ContainedTaskOutput<()>, JoinError>>();
      senders.push(sender);
      handles.push(JoinHandle(JoinHandleInner::Blocking {
        receiver,
        dependency: BlockingDependency {
          job: BlockingJobId(u64::MAX - 300_000 - index as u64),
          owner: None,
        },
        published: PublishedBlockingDependencies::default(),
      }));
    }
    for handle in &mut handles {
      assert!(Pin::new(handle).poll(&mut cx).is_pending());
    }
    assert_eq!(
      parent
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .current
        .len(),
      HANDLE_COUNT,
      "every handle must be registered and still pending before the detach"
    );

    parent.reset_entry_visits();
    drop(handles);

    assert!(
      parent.entry_visits() <= HANDLE_COUNT * 4,
      "mass-detach must visit O(n) entries across n handles, visits={}",
      parent.entry_visits()
    );
    assert_eq!(
      parent.get_dependency(),
      None,
      "every detached handle must have retired its own publication"
    );
    drop(senders);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn dependency_tls_borrow_is_released_before_reentrant_wake() {
    use std::sync::mpsc;

    struct ReenterDependencyContext {
      dependency: Arc<TaskDependency>,
      woke: mpsc::Sender<()>,
    }

    impl std::task::Wake for ReenterDependencyContext {
      fn wake(self: Arc<Self>) {
        let _context = TaskDependencyGuard::enter(&self.dependency);
        self.woke.send(()).unwrap();
      }
    }

    let parent = Arc::new(TaskDependency::default());
    let nested = Arc::new(TaskDependency::default());
    let (woke_tx, woke_rx) = mpsc::channel();
    let waiter = Waker::from(Arc::new(ReenterDependencyContext {
      dependency: Arc::clone(&nested),
      woke: woke_tx,
    }));
    parent.register_waiter(&waiter);
    let blocking = BlockingDependency {
      job: BlockingJobId(u64::MAX - 62),
      owner: None,
    };

    let _context = TaskDependencyGuard::enter(&parent);
    let mut published = PublishedBlockingDependencies::default();
    record_blocking_dependency(&mut published, blocking);
    woke_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("dependency notification must permit reentrant TLS context access");

    parent.register_waiter(&waiter);
    clear_blocking_dependency(published);
    woke_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("dependency clearing must permit reentrant TLS context access");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn dependency_free_begin_poll_does_not_lock_state() {
    use std::sync::mpsc;

    let dependency = Arc::new(TaskDependency::default());
    let state = dependency.state.lock().unwrap();
    let (completed_tx, completed_rx) = mpsc::channel();
    let polling_dependency = Arc::clone(&dependency);
    let polling = std::thread::spawn(move || {
      polling_dependency.begin_poll();
      completed_tx.send(()).unwrap();
    });

    let completed_without_lock = completed_rx
      .recv_timeout(Duration::from_millis(200))
      .is_ok();
    drop(state);
    polling.join().unwrap();
    assert!(
      completed_without_lock,
      "a task with no published dependency must skip the dependency-state mutex"
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn deep_dependency_liveness_chain_is_iterative() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_DEEP_DEPENDENCY_CHAIN_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      const DEPTH: usize = 100_000;

      let mut links = Vec::with_capacity(DEPTH + 1);
      links.push(DependencyLink::root());
      for _ in 0..DEPTH {
        links.push(DependencyLink::derived(links.last().unwrap()));
      }
      assert!(links.last().unwrap().is_live());
      links[0].cancel();
      assert!(!links.last().unwrap().is_live());
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::deep_dependency_liveness_chain_is_iterative")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the subprocess test must start");
    assert!(
      output.status.success(),
      "deep dependency liveness traversal must not overflow the stack; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn task_dependency_set_contains_panicking_waiter() {
    struct PanicWake;
    impl std::task::Wake for PanicWake {
      fn wake(self: Arc<Self>) {
        panic!("intentional TaskDependency::set waiter panic");
      }
    }

    let dependency = TaskDependency::default();
    let blocking = BlockingDependency {
      job: BlockingJobId(u64::MAX),
      owner: None,
    };
    dependency.register_waiter(&Waker::from(Arc::new(PanicWake)));

    let result = catch_unwind(AssertUnwindSafe(|| dependency.set_owned(blocking)));
    assert!(
      result.is_ok(),
      "set notification must not unwind its caller"
    );
    assert_eq!(
      dependency.get_dependency(),
      Some(blocking),
      "set must commit before notifying its waiter"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn task_dependency_clear_contains_panicking_waiter() {
    struct PanicWake;
    impl std::task::Wake for PanicWake {
      fn wake(self: Arc<Self>) {
        panic!("intentional TaskDependency::clear waiter panic");
      }
    }

    let dependency = TaskDependency::default();
    dependency.set_owned(BlockingDependency {
      job: BlockingJobId(u64::MAX),
      owner: None,
    });
    dependency.register_waiter(&Waker::from(Arc::new(PanicWake)));

    let result = catch_unwind(AssertUnwindSafe(|| dependency.clear()));
    assert!(
      result.is_ok(),
      "clear notification must not unwind its caller"
    );
    assert_eq!(
      dependency.get_dependency(),
      None,
      "clear must commit before notifying its waiter"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn task_dependency_clear_if_contains_panicking_waiter() {
    struct PanicWake;
    impl std::task::Wake for PanicWake {
      fn wake(self: Arc<Self>) {
        panic!("intentional TaskDependency::clear_if waiter panic");
      }
    }

    let dependency = TaskDependency::default();
    let blocking = BlockingDependency {
      job: BlockingJobId(u64::MAX),
      owner: None,
    };
    let sequence = dependency.set_owned(blocking);
    dependency.register_waiter(&Waker::from(Arc::new(PanicWake)));

    let result = catch_unwind(AssertUnwindSafe(|| dependency.retire(sequence)));
    assert!(
      result.is_ok(),
      "retire notification must not unwind its caller"
    );
    assert_eq!(
      dependency.get_dependency(),
      None,
      "retire must commit before notifying its waiter"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn task_dependency_waiter_replacement_contains_panicking_drop() {
    use std::sync::mpsc;

    const GENERATION: u64 = u64::MAX - 20;

    struct PanicOnDropWake {
      dropped: mpsc::Sender<Option<u64>>,
    }

    #[expect(
      clippy::manual_noop_waker,
      reason = "the test observes the waker payload's Drop"
    )]
    impl std::task::Wake for PanicOnDropWake {
      fn wake(self: Arc<Self>) {}
    }

    impl Drop for PanicOnDropWake {
      fn drop(&mut self) {
        self
          .dropped
          .send(ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get))
          .unwrap();
        panic!("intentional replaced dependency waiter destructor panic");
      }
    }

    let dependency = TaskDependency::new(GENERATION, None);
    let (dropped_tx, dropped_rx) = mpsc::channel();
    let waiter = Waker::from(Arc::new(PanicOnDropWake {
      dropped: dropped_tx,
    }));
    dependency.register_waiter(&waiter);
    drop(waiter);

    let replacement = futures::task::noop_waker();
    let result = catch_unwind(AssertUnwindSafe(|| {
      dependency.register_waiter(&replacement)
    }));
    assert!(
      result.is_ok(),
      "replacing a hostile waiter must not unwind registration"
    );
    assert_eq!(
      dropped_rx.recv_timeout(Duration::from_secs(1)).unwrap(),
      Some(GENERATION),
      "the replaced waiter must be destroyed under its runtime generation"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn task_dependency_retirement_contains_stored_waiter_drop() {
    use std::sync::mpsc;

    const GENERATION: u64 = u64::MAX - 21;

    struct PanicOnDropWake {
      dropped: mpsc::Sender<Option<u64>>,
    }

    #[expect(
      clippy::manual_noop_waker,
      reason = "the test observes the waker payload's Drop"
    )]
    impl std::task::Wake for PanicOnDropWake {
      fn wake(self: Arc<Self>) {}
    }

    impl Drop for PanicOnDropWake {
      fn drop(&mut self) {
        self
          .dropped
          .send(ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get))
          .unwrap();
        panic!("intentional stored dependency waiter destructor panic");
      }
    }

    let dependency = TaskDependency::new(GENERATION, None);
    let (dropped_tx, dropped_rx) = mpsc::channel();
    let waiter = Waker::from(Arc::new(PanicOnDropWake {
      dropped: dropped_tx,
    }));
    dependency.register_waiter(&waiter);
    drop(waiter);

    let result = catch_unwind(AssertUnwindSafe(|| drop(dependency)));
    assert!(
      result.is_ok(),
      "retiring a hostile stored waiter must not unwind"
    );
    assert_eq!(
      dropped_rx.recv_timeout(Duration::from_secs(1)).unwrap(),
      Some(GENERATION),
      "the retained waiter must be destroyed under its runtime generation"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn detaching_task_clears_dependency_waiter_parent_retention() {
    struct RetainingWake {
      retained_parent: Arc<()>,
    }

    impl std::task::Wake for RetainingWake {
      fn wake(self: Arc<Self>) {
        let _ = &self.retained_parent;
      }
    }

    let dependency = Arc::new(TaskDependency::default());
    let retained_parent = Arc::new(());
    let retained_parent_weak = Arc::downgrade(&retained_parent);
    let waiter = Waker::from(Arc::new(RetainingWake {
      retained_parent: Arc::clone(&retained_parent),
    }));
    dependency.register_waiter(&waiter);
    drop(waiter);
    drop(retained_parent);
    assert!(
      retained_parent_weak.upgrade().is_some(),
      "the stored dependency waiter must retain its parent before detachment"
    );

    let (runnable, task) = async_task::spawn(
      futures::future::pending::<Result<ContainedTaskOutput<()>, JoinError>>(),
      |_| {},
    );
    drop(JoinHandle(JoinHandleInner::Task {
      task: task.fallible(),
      awaiter: None,
      dependency: Arc::clone(&dependency),
    }));
    assert!(
      retained_parent_weak.upgrade().is_none(),
      "detachment must clear the dependency waiter instead of retaining its parent task"
    );
    drop(runnable);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn detaching_task_clears_many_parent_publications_linearly() {
    const PUBLICATION_COUNT: usize = 1024;

    struct CountWake(Arc<AtomicUsize>);

    impl std::task::Wake for CountWake {
      fn wake(self: Arc<Self>) {
        self.0.fetch_add(1, Ordering::SeqCst);
      }
    }

    fn latest_publication(dependency: &TaskDependency) -> DependencyPublication {
      dependency
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .current
        .back()
        .expect("the sentinel publication must be appended")
        .publication
        .clone()
    }

    let owner = BlockingOwnerToken {
      executor_id: u64::MAX - 300,
      frame: u64::MAX - 301,
    };
    let other_owner = BlockingOwnerToken {
      executor_id: u64::MAX - 302,
      frame: u64::MAX - 303,
    };
    let child = Arc::new(TaskDependency::default());
    for index in 0..PUBLICATION_COUNT {
      child.set_owned(BlockingDependency {
        job: BlockingJobId(1_000_000 + index as u64),
        owner: (index % 2 == 0).then_some(owner),
      });
    }
    let child_publications = child.snapshot_all_live();
    let source = child_publications[0].clone();

    let parent = Arc::new(TaskDependency::default());
    let _context = TaskDependencyGuard::enter(&parent);
    let (runnable, task) = async_task::spawn(
      futures::future::pending::<Result<ContainedTaskOutput<()>, JoinError>>(),
      |_| {},
    );
    let mut handle = JoinHandle(JoinHandleInner::Task {
      task: task.fallible(),
      awaiter: None,
      dependency: Arc::clone(&child),
    });
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);
    assert!(Pin::new(&mut handle).poll(&mut cx).is_pending());
    assert_eq!(
      parent.get_dependencies().len(),
      PUBLICATION_COUNT,
      "polling the child handle must propagate every current publication"
    );

    let mut wrong_claim_source = source.clone();
    wrong_claim_source.claim = Arc::new(DependencyClaim::new());
    parent.set_borrowed(&wrong_claim_source);
    let wrong_claim_publication = latest_publication(&parent);

    let mut wrong_job_source = source.clone();
    wrong_job_source.dependency.job = BlockingJobId(u64::MAX - 304);
    parent.set_borrowed(&wrong_job_source);
    let wrong_job_publication = latest_publication(&parent);

    let wrong_immediate_source = source.derived(None);
    parent.set_borrowed(&wrong_immediate_source);
    let wrong_immediate_publication = latest_publication(&parent);

    let wakes = Arc::new(AtomicUsize::new(0));
    parent.register_waiter(&Waker::from(Arc::new(CountWake(Arc::clone(&wakes)))));
    parent.reset_entry_visits();
    drop(handle);

    assert_eq!(
      wakes.load(Ordering::SeqCst),
      1,
      "one batched parent cleanup must emit one waiter notification"
    );
    assert!(
      parent.entry_visits() <= PUBLICATION_COUNT * 2 + 8,
      "detach must hash child sources once, scan the parent once, and reclaim at most one stale prefix; visits={}",
      parent.entry_visits()
    );
    assert!(
      wrong_claim_publication.is_live(),
      "claim identity must remain part of the match"
    );
    assert!(
      wrong_job_publication.is_live(),
      "job identity must remain part of the match"
    );
    assert!(
      wrong_immediate_publication.is_live(),
      "only an exact immediate-parent link may be retired"
    );

    {
      let state = parent
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(state.current.len(), 3);
      // The `job_sequences` index is gone -- a blocking handle retires its own
      // entry by sequence -- so "the index retains no stale sequence" is
      // structurally impossible rather than something to assert. The
      // substantive property that assertion protected, that only the three
      // NON-matching sentinels survived the clear, is checked directly on the
      // authoritative structure.
      assert!(
        state
          .current
          .iter()
          .all(|entry| entry.publication.is_live()),
        "only the three non-matching sentinels may remain, all still live"
      );
      assert!(state.unowned_sequences.is_empty());
      assert_eq!(state.owner_sequences.len(), 1);
      assert_eq!(
        state.owner_sequences.get(&owner).map(VecDeque::len),
        Some(3)
      );
    }
    assert!(parent.has_live_owner_dependency(owner, OwnerDependencyMode::Exact));
    assert!(
      !parent.has_live_owner_dependency(other_owner, OwnerDependencyMode::Available),
      "cancelled unowned publications must not survive in availability predicates"
    );
    drop(runnable);
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn dependency_waker_and_buffered_result_drop_panics_are_independently_contained() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_DEPENDENCY_WAKER_DOUBLE_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      struct PanicWake;
      impl std::task::Wake for PanicWake {
        fn wake(self: Arc<Self>) {
          panic!("intentional dependency waker panic");
        }
      }

      struct PanicOnDrop;
      impl Drop for PanicOnDrop {
        fn drop(&mut self) {
          panic!("intentional buffered blocking result destructor panic");
        }
      }

      let parent = Arc::new(TaskDependency::default());
      let dependency = BlockingDependency {
        job: BlockingJobId(u64::MAX - 1),
        owner: None,
      };
      // The handle is built by hand rather than by polling, so hand it the
      // publication token a Pending poll would have recorded; detach retires
      // the entry by sequence.
      let sequence = parent.set_owned(dependency);
      parent.register_waiter(&Waker::from(Arc::new(PanicWake)));
      let _context = TaskDependencyGuard::enter(&parent);
      let (sender, receiver) = oneshot::channel();
      let _ = sender.send(Ok::<ContainedTaskOutput<PanicOnDrop>, JoinError>(
        ContainedTaskOutput::new(PanicOnDrop, u64::MAX),
      ));
      drop(JoinHandle(JoinHandleInner::Blocking {
        receiver,
        dependency,
        published: PublishedBlockingDependencies {
          first: Some(PublishedBlockingDependency {
            state: Arc::downgrade(&parent),
            sequence,
          }),
          rest: Vec::new(),
        },
      }));
      assert_eq!(parent.get_dependency(), None);
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg(
        "async_runtime::tests::dependency_waker_and_buffered_result_drop_panics_are_independently_contained",
      )
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the subprocess test must start");
    assert!(
      output.status.success(),
      "dependency cleanup and buffered result destruction must not double-panic; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_block_on_respects_blocking_cap_for_non_owner_driver() {
    // Non-owner blocking-cap invariant: a plain pool-worker runnable driver
    // that does NOT own a counted blocking slot and re-enters `block_on`
    // must NOT run queued blocking jobs over `max_blocking_tasks` via the
    // cooperative over-cap fallback. Two holder blocking jobs saturate the cap;
    // two driver tasks then `block_on(spawn_blocking(..))`. If a non-owner
    // driver could use the over-cap fallback, the inner jobs would run while
    // both holders still occupy slots and push peak active blocking above 2.
    // The cap must be honored AND everything must still complete.
    use std::sync::{Barrier, mpsc};
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let peak_out = Arc::new(Mutex::new(None));
    let peak_slot = Arc::clone(&peak_out);
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 4,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd1-cap".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());

      let holder_count = 2usize; // saturates max_blocking_tasks
      let driver_count = 2usize;

      // Holders signal once they hold a counted slot, then wait to be released.
      let (held_tx, held_rx) = mpsc::channel();
      let release = Arc::new(Barrier::new(holder_count + 1));

      let mut holder_handles = Vec::new();
      for _ in 0..holder_count {
        let held_tx = held_tx.clone();
        let release = Arc::clone(&release);
        let handle = executor.schedule_blocking(move || {
          held_tx.send(()).unwrap();
          release.wait();
          0usize
        });
        holder_handles.push(handle);
      }
      // Wait until both holders hold their slots (cap fully saturated).
      for _ in 0..holder_count {
        held_rx.recv().unwrap();
      }

      // Driver tasks: plain runnables (NOT blocking-slot owners) that block_on
      // an inner spawn_blocking.
      let mut driver_tasks = Vec::new();
      for _ in 0..driver_count {
        let exec = Arc::clone(&executor);
        let body = async move {
          let inner_exec = Arc::clone(&exec);
          let mut inner = std::pin::pin!(async move {
            let v = inner_exec.schedule_blocking(|| 5usize).await.unwrap();
            assert_eq!(v, 5);
          });
          exec.block_on(inner.as_mut());
        };
        let scheduler = Arc::clone(&executor);
        let (runnable, task) = async_task::spawn(body, move |r| scheduler.schedule(r));
        executor.schedule(runnable);
        driver_tasks.push(task);
      }

      // Let the driver tasks reach block_on. They must park until a holder
      // frees a slot instead of running their inner jobs over the cap.
      std::thread::sleep(Duration::from_millis(300));

      // Release the holders so the inner jobs can run within the cap.
      release.wait();

      for task in driver_tasks {
        futures::executor::block_on(task);
      }
      for handle in holder_handles {
        assert_eq!(futures::executor::block_on(handle).unwrap(), 0usize);
      }

      *peak_slot.lock().unwrap() = Some(metrics.max_active_blocking_tasks.load(Ordering::Relaxed));
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("non-owner block_on blocking-cap test deadlocked ({error})"),
    }
    let peak = peak_out.lock().unwrap().expect("peak captured");
    assert!(
      peak <= 2,
      "peak active blocking tasks {peak} exceeded max_blocking_tasks 2"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_block_on_runnable_driven_by_owner_respects_cap() {
    // Blocking-owner isolation invariant: a counted blocking OWNER that
    // re-enters cooperative `block_on` can drive a plain queued runnable via
    // `run_one`. That runnable must NOT inherit the owner's over-cap blocking
    // privilege. If it re-enters `block_on` awaiting a `spawn_blocking` while
    // the cap is saturated, the inner job must wait for a slot instead of
    // borrowing the owner's token.
    //
    // Setup (worker_threads=2, max_blocking=2): owner O (a counted blocking closure)
    // holds slot 1; holder H2 holds slot 2 -> cap saturated. O spawns a plain task R
    // and drives it via cooperative `block_on`. With only 2 workers and 2 active
    // drainers, no replacement drainer can be spawned, so O itself runs R via
    // `run_one`. R re-enters `block_on` awaiting an inner `spawn_blocking` J.
    // R must not inherit O's slot flag: it parks until H2 frees a slot, so J
    // runs within the cap and the peak remains 2. Everything must still
    // complete.
    use std::sync::{Barrier, mpsc};
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let peak_out = Arc::new(Mutex::new(None));
    let peak_slot = Arc::clone(&peak_out);
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd1-owner-runnable".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());

      let saturated = Arc::new(Barrier::new(2));
      let release = Arc::new(Barrier::new(2));

      // Holder H2: holds the second counted slot until released. Not the driver.
      let h2_saturated = Arc::clone(&saturated);
      let h2_release = Arc::clone(&release);
      let h2 = executor.schedule_blocking(move || {
        h2_saturated.wait();
        h2_release.wait();
        0usize
      });

      // Owner O: a counted blocking closure (slot 1). Once the cap is saturated it
      // spawns plain runnable R and drives it cooperatively via `block_on`.
      let o_exec = Arc::clone(&executor);
      let o_saturated = Arc::clone(&saturated);
      let o = executor.schedule_blocking(move || {
        o_saturated.wait(); // both slots held -> cap saturated

        let r_exec = Arc::clone(&o_exec);
        let body = async move {
          let inner_exec = Arc::clone(&r_exec);
          let mut inner = std::pin::pin!(async move {
            let v = inner_exec.schedule_blocking(|| 5usize).await.unwrap();
            assert_eq!(v, 5);
          });
          r_exec.block_on(inner.as_mut());
        };
        let sched = Arc::clone(&o_exec);
        let (runnable, task) = async_task::spawn(body, move |r| sched.schedule(r));
        o_exec.schedule(runnable);

        let mut wait_r = std::pin::pin!(async move {
          task.await;
        });
        o_exec.block_on(wait_r.as_mut());
        1usize
      });

      // Give O time to drive R into its inner `block_on`; R must be parked
      // waiting for a slot.
      std::thread::sleep(Duration::from_millis(300));
      // Release H2 so the inner job can run within the cap.
      release.wait();

      assert_eq!(futures::executor::block_on(o).unwrap(), 1usize);
      assert_eq!(futures::executor::block_on(h2).unwrap(), 0usize);

      *peak_slot.lock().unwrap() = Some(metrics.max_active_blocking_tasks.load(Ordering::Relaxed));
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("owner-driven runnable blocking-cap test deadlocked ({error})"),
    }
    let peak = peak_out.lock().unwrap().expect("peak captured");
    assert!(
      peak <= 2,
      "peak active blocking tasks {peak} exceeded max_blocking_tasks 2"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_over_cap_escape_runs_only_owner_job_not_unrelated() {
    // The over-cap fallback must select the exact pending JoinHandle job, not
    // the front of the shared blocking queue.
    //
    // Setup (worker_threads=2, max_blocking=2): owner O is a counted blocking
    // closure (slot 1); holder H holds slot 2 -> cap saturated. An unrelated job
    // U is queued ahead of O's descendant D. O re-enters `block_on` awaiting D.
    // The exact dependency must skip U and run D. Because U can only run once
    // a real slot frees after O completes, D must STRICTLY precede U.
    use std::sync::{Barrier, mpsc};

    let (done_tx, done_rx) = mpsc::channel();
    let order_out = Arc::new(Mutex::new(Vec::<&'static str>::new()));
    let order_read = Arc::clone(&order_out);
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd1-unrelated".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());

      // O and H signal once they each hold a counted slot (cap saturated), then
      // wait so U is queued before O nests. H stays held until the very end.
      let (held_tx, held_rx) = mpsc::channel();
      let u_ready = Arc::new(Barrier::new(2)); // O <-> main: U is queued
      let h_release = Arc::new(Barrier::new(2)); // H <-> main: end of test

      // Holder H: holds slot 2 for the whole test.
      let h_held = held_tx.clone();
      let h_rel = Arc::clone(&h_release);
      let h = executor.schedule_blocking(move || {
        h_held.send(()).unwrap();
        h_rel.wait();
        0usize
      });

      // Owner O: holds slot 1, then (once U is queued) nests `block_on` awaiting
      // its OWN descendant D.
      let o_exec = Arc::clone(&executor);
      let o_ready = Arc::clone(&u_ready);
      let o_order = Arc::clone(&order_out);
      let o = executor.schedule_blocking(move || {
        held_tx.send(()).unwrap();
        o_ready.wait(); // wait until U is queued ahead of D
        let inner_exec = Arc::clone(&o_exec);
        let d_order = Arc::clone(&o_order);
        let mut inner = std::pin::pin!(async move {
          let v = inner_exec
            .schedule_blocking(move || {
              d_order.lock().unwrap().push("D");
              5usize
            })
            .await
            .unwrap();
          assert_eq!(v, 5);
        });
        o_exec.block_on(inner.as_mut());
        1usize
      });

      // Wait until BOTH O and H hold their slots -> cap saturated.
      held_rx.recv().unwrap();
      held_rx.recv().unwrap();

      // Queue U ahead of D; it must not be mistaken for the awaited dependency.
      let u_order = Arc::clone(&order_out);
      let u = executor.schedule_blocking(move || {
        u_order.lock().unwrap().push("U");
        2usize
      });

      // Release O to nest now that U is queued ahead of D.
      u_ready.wait();

      // O makes progress by running D over cap; U only runs after O frees a slot.
      assert_eq!(futures::executor::block_on(o).unwrap(), 1usize);
      assert_eq!(futures::executor::block_on(u).unwrap(), 2usize);

      // Release H and finish.
      h_release.wait();
      assert_eq!(futures::executor::block_on(h).unwrap(), 0usize);

      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(std::time::Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("owner-scoped over-cap escape test deadlocked ({error})"),
    }
    let order = order_read.lock().unwrap().clone();
    assert_eq!(
      order,
      vec!["D", "U"],
      "owner must run its OWN descendant D over cap; unrelated U must wait for a real slot"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_over_cap_escape_is_dependency_and_executor_scoped() {
    use std::sync::{Barrier, mpsc};

    let opts = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "rd1-scope".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let exec1 =
      Arc::new(MultiThreadExecutor::new(&opts, Arc::new(RuntimeMetrics::default())).unwrap());
    let exec2 =
      Arc::new(MultiThreadExecutor::new(&opts, Arc::new(RuntimeMetrics::default())).unwrap());
    assert_ne!(exec1.id, exec2.id, "executors must get distinct ids");

    let holder_count = opts.max_blocking_tasks;
    let (held_tx, held_rx) = mpsc::channel();
    let release = Arc::new(Barrier::new(holder_count + 1));
    let mut holder_handles = Vec::new();
    for _ in 0..holder_count {
      let held_tx = held_tx.clone();
      let release = Arc::clone(&release);
      holder_handles.push(exec2.schedule_blocking(move || {
        held_tx.send(()).unwrap();
        release.wait();
        0usize
      }));
    }
    for _ in 0..holder_count {
      held_rx.recv().unwrap();
    }
    assert_eq!(
      exec2.active_blocking.load(Ordering::Acquire),
      opts.max_blocking_tasks
    );

    let exact = BlockingJobId(u64::MAX);
    let ran = Arc::new(AtomicBool::new(false));
    let ran_job = Arc::clone(&ran);
    exec2.blocking_queue.lock().unwrap().push(QueuedBlocking {
      id: exact,
      run: Box::new(move || ran_job.store(true, Ordering::SeqCst)),
    });
    let dependency = TaskDependency::default();

    let token1 = exec1.fresh_owner_token();
    {
      let _owner = BlockingOwnerGuard::enter(Some(token1));
      dependency.set_owned(BlockingDependency {
        job: exact,
        owner: Some(token1),
      });
      assert!(
        !exec2.try_owned_blocking_over_cap(&dependency),
        "a foreign-executor ambient token must fail the executor gate"
      );
    }

    let token2 = exec2.fresh_owner_token();
    {
      let _active_owner = ActiveBlockingOwnerGuard::enter(&exec2.active_blocking_owners, token2);
      let _owner = BlockingOwnerGuard::enter(Some(token2));
      dependency.set_owned(BlockingDependency {
        job: BlockingJobId(u64::MAX - 1),
        owner: Some(token2),
      });
      assert!(
        !exec2.try_owned_blocking_over_cap(&dependency),
        "a foreign or unrelated dependency id must fail the exact-job gate"
      );
      dependency.set_owned(BlockingDependency {
        job: BlockingJobId(exact.0 - 2),
        owner: Some(token2),
      });
      assert!(
        !exec2.try_owned_blocking_over_cap(&dependency),
        "a different job id must not consume the queued dependency"
      );
      dependency.set_owned(BlockingDependency {
        job: exact,
        owner: Some(token2),
      });
      assert!(
        exec2.try_owned_blocking_over_cap(&dependency),
        "the exact awaited job must run over cap"
      );
    }
    assert!(
      ran.load(Ordering::SeqCst),
      "the exact dependency must have run"
    );

    release.wait();
    for handle in holder_handles {
      assert_eq!(futures::executor::block_on(handle).unwrap(), 0usize);
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn ambiguous_active_owners_do_not_authorize_untagged_dependency() {
    let executor = multi_thread_executor(2, None, "untagged-owner-dependency");
    let first_owner = executor.fresh_owner_token();
    let second_owner = executor.fresh_owner_token();
    let _first_owner =
      ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, first_owner);
    let _second_owner =
      ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, second_owner);
    let exact = BlockingJobId(u64::MAX - 30);
    let dependency = TaskDependency::default();
    dependency.set_owned(BlockingDependency {
      job: exact,
      owner: None,
    });
    let ran = Arc::new(AtomicBool::new(false));
    let ran_job = Arc::clone(&ran);
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: exact,
        run: Box::new(move || ran_job.store(true, Ordering::SeqCst)),
      });

    assert!(
      !executor.try_owned_blocking_over_cap(&dependency),
      "an untagged driver must not choose between multiple active owner frames"
    );
    assert!(!ran.load(Ordering::SeqCst));
    let queued = executor.blocking_queue.lock().unwrap().remove(exact);
    assert!(
      queued.is_some(),
      "ambiguous ownership must leave the exact job queued"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn owner_lending_claims_live_dependency_not_stale_snapshot() {
    let executor = multi_thread_executor(2, None, "live-parked-dependency");
    let owner = executor.fresh_owner_token();
    let dependency = TaskDependency::new(u64::MAX, Some(owner));
    let stale = BlockingJobId(u64::MAX - 10);
    let live = BlockingJobId(u64::MAX - 9);
    dependency.set_owned(BlockingDependency {
      job: stale,
      owner: Some(owner),
    });
    dependency.begin_poll();
    dependency.set_owned(BlockingDependency {
      job: live,
      owner: Some(owner),
    });

    let stale_ran = Arc::new(AtomicBool::new(false));
    let stale_job_ran = Arc::clone(&stale_ran);
    let live_ran = Arc::new(AtomicBool::new(false));
    let live_job_ran = Arc::clone(&live_ran);
    {
      let mut queue = executor
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      queue.push(QueuedBlocking {
        id: stale,
        run: Box::new(move || stale_job_ran.store(true, Ordering::SeqCst)),
      });
      queue.push(QueuedBlocking {
        id: live,
        run: Box::new(move || live_job_ran.store(true, Ordering::SeqCst)),
      });
    }

    let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let _owner = BlockingOwnerGuard::enter(Some(owner));
    assert!(
      executor.try_owned_blocking_over_cap(&dependency),
      "the owner lane must claim the currently published dependency"
    );
    assert!(
      live_ran.load(Ordering::SeqCst),
      "the live dependency must run"
    );
    assert!(
      !stale_ran.load(Ordering::SeqCst),
      "the stale registered id must remain queued"
    );
    let remaining = executor
      .blocking_queue
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .jobs
      .keys()
      .copied()
      .collect::<Vec<_>>();
    assert_eq!(remaining, vec![stale]);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cancelled_child_publication_cannot_be_claimed_after_parent_publish() {
    let executor = multi_thread_executor(2, None, "cancelled-child-publication");
    let owner = executor.fresh_owner_token();
    let child = TaskDependency::new_task(u64::MAX);
    let parent = TaskDependency::new(u64::MAX, Some(owner));
    let exact = BlockingDependency {
      job: BlockingJobId(u64::MAX - 31),
      owner: Some(owner),
    };

    child.set_owned(exact);
    let stale = child
      .get()
      .expect("the child must publish its direct dependency");
    child.begin_poll();
    parent.set_borrowed(&stale);

    let ran = Arc::new(AtomicBool::new(false));
    let ran_job = Arc::clone(&ran);
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: exact.job,
        run: Box::new(move || ran_job.store(true, Ordering::SeqCst)),
      });
    let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let _owner = BlockingOwnerGuard::enter(Some(owner));
    assert!(
      !executor.try_owned_blocking_over_cap(&parent),
      "a publication copied before child cancellation must remain cancelled after parent install"
    );
    assert!(!ran.load(Ordering::SeqCst));

    child.set_owned(exact);
    parent.set_borrowed(
      &child
        .get()
        .expect("the replacement publication must be live"),
    );
    assert!(
      executor.try_owned_blocking_over_cap(&parent),
      "a fresh child publication must still authorize its exact queued job"
    );
    assert!(ran.load(Ordering::SeqCst));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn intermediate_repoll_does_not_cancel_child_source_claim() {
    let executor = multi_thread_executor(2, None, "intermediate-repoll-source-claim");
    let owner = executor.fresh_owner_token();
    let child = TaskDependency::new_task(u64::MAX);
    let intermediate = TaskDependency::new_task(u64::MAX);
    let parent = TaskDependency::new(u64::MAX, Some(owner));
    let exact = BlockingDependency {
      job: BlockingJobId(u64::MAX - 43),
      owner: Some(owner),
    };

    child.set_owned(exact);
    intermediate.set_borrowed(&child.get().expect("the child source must be live"));
    parent.set_borrowed(
      &intermediate
        .get()
        .expect("the intermediate publication must be live"),
    );

    intermediate.begin_poll();
    assert!(
      child.get().is_some(),
      "withdrawing an intermediate hop must not cancel the child's source claim"
    );
    assert!(
      parent.get().is_none(),
      "the ancestor's old chain must become unclaimable when its intermediate hop is withdrawn"
    );

    intermediate.set_borrowed(&child.get().expect("the child source must remain reusable"));
    parent.set_borrowed(
      &intermediate
        .get()
        .expect("the intermediate must republish the still-live source"),
    );
    let ran = Arc::new(AtomicBool::new(false));
    let ran_job = Arc::clone(&ran);
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: exact.job,
        run: Box::new(move || ran_job.store(true, Ordering::SeqCst)),
      });

    let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let _owner = BlockingOwnerGuard::enter(Some(owner));
    assert!(
      executor.try_owned_blocking_over_cap(&parent),
      "a fresh chain through the repolled intermediate must retain the exact source claim"
    );
    assert!(ran.load(Ordering::SeqCst));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn exact_claim_linearizes_before_concurrent_source_withdrawal() {
    use std::sync::mpsc;

    let executor = multi_thread_executor(2, None, "claim-cancel-linearization");
    let owner = executor.fresh_owner_token();
    let _active_owner = ActiveBlockingOwnerGuard::enter(&executor.active_blocking_owners, owner);
    let child = Arc::new(TaskDependency::new_task(u64::MAX));
    let parent = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    let exact = BlockingDependency {
      job: BlockingJobId(u64::MAX - 44),
      owner: Some(owner),
    };
    child.set_owned(exact);
    parent.set_borrowed(&child.get().expect("the child source must be live"));

    let ran = Arc::new(AtomicBool::new(false));
    let ran_job = Arc::clone(&ran);
    executor
      .blocking_queue
      .lock()
      .unwrap()
      .push(QueuedBlocking {
        id: exact.job,
        run: Box::new(move || ran_job.store(true, Ordering::SeqCst)),
      });

    let (claim_entered_tx, claim_entered_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let claimant_executor = Arc::clone(&executor);
    let claimant_parent = Arc::clone(&parent);
    let claimant = std::thread::spawn(move || {
      DEPENDENCY_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claim_entered_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      let _owner = BlockingOwnerGuard::enter(Some(owner));
      claimant_executor.try_owned_blocking_over_cap(&claimant_parent)
    });
    claim_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the exact claimant must hold the shared transition lock");

    let (withdrawn_tx, withdrawn_rx) = mpsc::channel();
    let withdrawing_child = Arc::clone(&child);
    let withdrawal = std::thread::spawn(move || {
      withdrawing_child.begin_poll();
      withdrawn_tx.send(()).unwrap();
    });
    let withdrew_before_claim = withdrawn_rx
      .recv_timeout(Duration::from_millis(200))
      .is_ok();
    release_claim_tx.send(()).unwrap();

    assert!(
      claimant.join().unwrap(),
      "the claim that linearized first must execute the exact job"
    );
    withdrawal.join().unwrap();
    assert!(
      !withdrew_before_claim,
      "source withdrawal must not interleave after claim validation but before claim commit"
    );
    assert!(ran.load(Ordering::SeqCst));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_block_on_cooperative_branch_is_executor_scoped() {
    // Pool-worker-marker scoping invariant: `block_on` may take the cooperative
    // (queue-driving) branch ONLY for a re-entrant call OF THE SAME
    // executor whose worker set the marker. A worker of executor A that re-enters
    // `block_on` on executor B must take the PARKING branch instead -- it owns
    // none of B's accounting, so driving B's queue would make it an unaccounted
    // within-cap driver. This mirrors the `BlockingOwnerToken.executor_id` gate.
    //
    // Fully deterministic, no sleeps/threads: we set the ambient pool-worker
    // marker to exec1's id by entering the REAL `OnPoolWorkerGuard`, then call
    // `block_on` on each executor with the SAME probe shape and observe whether
    // the cooperative `run_one` driver actually ran a queued runnable.
    //
    // The probe future returns `Pending` once (self-waking so the parking branch
    // also makes progress) then `Ready`, guaranteeing the cooperative loop reaches
    // `run_one` at least once before the future completes. A single runnable is
    // pushed DIRECTLY onto the target executor's queue (bypassing `schedule`, so
    // no background drainer is ever spawned to steal it). After `block_on`
    // returns: the cooperative branch will have driven that runnable
    // (`runnable_polls == 1`, queue empty); the parking branch leaves it untouched
    // (`runnable_polls == 0`, still queued).
    struct PendThenReady {
      polls: usize,
    }
    impl Future for PendThenReady {
      type Output = ();
      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        self.polls += 1;
        if self.polls >= 2 {
          Poll::Ready(())
        } else {
          // Self-wake so the parking branch (`futures::executor::block_on`)
          // re-polls to completion without any external waker; the cooperative
          // branch re-polls unconditionally each loop iteration regardless.
          cx.waker().wake_by_ref();
          Poll::Pending
        }
      }
    }

    // Push one already-resolvable runnable directly onto `target`'s queue (no
    // `schedule`, so no drainer is spawned) and detach its task.
    fn enqueue_runnable(target: &Arc<MultiThreadExecutor>) {
      let scheduler = Arc::clone(target);
      let (runnable, task) = async_task::spawn(async {}, move |r| scheduler.schedule(r));
      target.push_fifo_raw(runnable);
      task.detach();
    }

    let opts = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "rd-onpool-scope".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let exec1 =
      Arc::new(MultiThreadExecutor::new(&opts, Arc::new(RuntimeMetrics::default())).unwrap());
    let exec2 =
      Arc::new(MultiThreadExecutor::new(&opts, Arc::new(RuntimeMetrics::default())).unwrap());
    assert_ne!(exec1.id, exec2.id, "executors must get distinct ids");

    // Simulate being on exec1's pool worker for the whole scenario.
    let _on_pool = OnPoolWorkerGuard::enter(exec1.id);

    // FOREIGN call: on exec1's worker, drive exec2.block_on. The marker
    // (Some(exec1.id)) does NOT equal exec2.id, so exec2 must PARK and never
    // touch its queue.
    enqueue_runnable(&exec2);
    {
      let mut probe = std::pin::pin!(PendThenReady { polls: 0 });
      exec2.block_on(probe.as_mut());
    }
    assert_eq!(
      exec2.metrics.runnable_polls.load(Ordering::Relaxed),
      0,
      "a foreign-executor on-pool marker must NOT drive exec2's queue (must park)"
    );
    assert_eq!(
      exec2.injector.len(),
      1,
      "the foreign call must leave exec2's runnable untouched on its queue"
    );

    // CONTROL call: on exec1's worker, drive exec1.block_on. The marker equals
    // exec1.id, so exec1 takes the COOPERATIVE branch and drives its queued
    // runnable via `run_one`.
    enqueue_runnable(&exec1);
    {
      let mut probe = std::pin::pin!(PendThenReady { polls: 0 });
      exec1.block_on(probe.as_mut());
    }
    assert_eq!(
      exec1.metrics.runnable_polls.load(Ordering::Relaxed),
      1,
      "a same-executor on-pool marker MUST drive exec1's queue cooperatively"
    );
    assert!(
      exec1.injector.is_empty(),
      "the cooperative branch must have drained exec1's queued runnable"
    );

    // Tidy: drop the untouched exec2 runnable so its task does not leak a waker
    // (steal-drain replaces the former `queue.lock().clear()`).
    while exec2.steal_one().is_some() {}
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_rd2_long_lived_blocking_consumer_does_not_starve_async_producers() {
    // A long-lived blocking consumer may consume the entire configured
    // blocking allowance, but it must not consume the reserve lane required
    // by the async producers that feed it.
    use std::sync::mpsc;
    use std::time::Duration;

    const PRODUCER_COUNT: usize = 8;

    fn schedule_pool_workload(
      executor: &Arc<MultiThreadExecutor>,
      tx: &mpsc::Sender<Option<usize>>,
      count: usize,
    ) {
      for i in 0..count {
        let tx = tx.clone();
        let scheduler = Arc::clone(executor);
        let (runnable, task) =
          async_task::spawn(async move { tx.send(Some(i)).unwrap() }, move |r| {
            scheduler.schedule(r);
          });
        executor.schedule(runnable);
        task.detach();
      }
      let tx = tx.clone();
      let scheduler = Arc::clone(executor);
      let (runnable, task) = async_task::spawn(async move { tx.send(None).unwrap() }, move |r| {
        scheduler.schedule(r)
      });
      executor.schedule(runnable);
      task.detach();
    }

    let expected_sum: usize = (0..PRODUCER_COUNT).sum();
    let (done_tx, done_rx) = mpsc::sync_channel(1);
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "rd2-pre-fix".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      }
      .validate()
      .expect("production MultiThread options must provide a reserve lane");
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let (tx, rx) = mpsc::channel::<Option<usize>>();
      let (started_tx, started_rx) = mpsc::sync_channel(1);
      let handle = executor.schedule_blocking(move || {
        started_tx.send(()).unwrap();
        let mut sum = 0usize;
        while let Ok(msg) = rx.recv() {
          match msg {
            Some(value) => sum += value,
            None => break,
          }
        }
        sum
      });
      started_rx.recv_timeout(Duration::from_secs(1)).unwrap();
      schedule_pool_workload(&executor, &tx, PRODUCER_COUNT);
      let sum = futures::executor::block_on(handle).unwrap();
      done_tx.send(sum).unwrap();
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(sum) => {
        runner.join().unwrap();
        assert_eq!(sum, expected_sum);
      }
      Err(error) => {
        panic!("a saturated blocking lane starved the async producers that feed it ({error})")
      }
    }
  }

  #[test]
  fn current_thread_blocking_work_completes_inline() {
    let metrics = Arc::new(RuntimeMetrics::default());
    let backend = RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::new(
      CurrentThreadExecutor::new(Arc::clone(&metrics)),
    )));
    let registration = backend.work.try_register_work().unwrap();

    let value =
      futures::executor::block_on(backend.spawn_registered_blocking(|| 7, registration, &metrics))
        .expect("blocking task should complete");

    assert_eq!(value, 7);
    assert_eq!(metrics.blocking_tasks_started.load(Ordering::Relaxed), 1);
    assert_eq!(metrics.blocking_tasks_completed.load(Ordering::Relaxed), 1);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_blocking_work_obeys_single_lane_across_callers() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller(
      "current-thread-blocking-admission",
    ));
    let backend = controller.backend();
    let (first_started_tx, first_started_rx) = mpsc::channel();
    let (release_first_tx, release_first_rx) = mpsc::channel();
    let first_controller = Arc::clone(&controller);
    let first = std::thread::spawn(move || {
      let handle = first_controller
        .try_spawn_blocking(move || {
          first_started_tx.send(()).unwrap();
          release_first_rx.recv().unwrap();
          1usize
        })
        .unwrap_or_else(|_| panic!("the first blocking call must be accepted"));
      futures::executor::block_on(handle).unwrap()
    });
    first_started_rx
      .recv_timeout(Duration::from_secs(1))
      .unwrap();

    let (second_started_tx, second_started_rx) = mpsc::channel();
    let second_controller = Arc::clone(&controller);
    let second = std::thread::spawn(move || {
      let handle = second_controller
        .try_spawn_blocking(move || {
          second_started_tx.send(()).unwrap();
          2usize
        })
        .unwrap_or_else(|_| panic!("the second blocking call must be accepted"));
      futures::executor::block_on(handle).unwrap()
    });

    wait_until("both CurrentThread blocking calls to be accepted", || {
      backend
        .work
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .active
        == 2
    });
    assert!(
      second_started_rx
        .recv_timeout(Duration::from_millis(100))
        .is_err(),
      "CurrentThread must not execute two blocking closures concurrently"
    );

    release_first_tx.send(()).unwrap();
    second_started_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("the waiting blocking call must acquire the released lane");
    assert_eq!(first.join().unwrap(), 1);
    assert_eq!(second.join().unwrap(), 2);
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_started
        .load(Ordering::Relaxed),
      2
    );
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_completed
        .load(Ordering::Relaxed),
      2
    );
    assert_eq!(
      controller
        .metrics
        .active_blocking_tasks
        .load(Ordering::Relaxed),
      0
    );
    assert_eq!(
      controller
        .metrics
        .max_active_blocking_tasks
        .load(Ordering::Relaxed),
      1,
      "the public active-lane metric must remain within CurrentThread's reported capacity"
    );
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_nested_blocking_reuses_the_active_lane() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("current-thread-nested-blocking"));
    let (done_tx, done_rx) = mpsc::channel();
    let runner_controller = Arc::clone(&controller);
    let runner = std::thread::spawn(move || {
      let nested_controller = Arc::clone(&runner_controller);
      let outer = runner_controller
        .try_spawn_blocking(move || {
          let inner = nested_controller
            .try_spawn_blocking(|| 41usize)
            .unwrap_or_else(|_| panic!("the nested blocking call must be accepted"));
          futures::executor::block_on(inner).unwrap() + 1
        })
        .unwrap_or_else(|_| panic!("the outer blocking call must be accepted"));
      done_tx
        .send(futures::executor::block_on(outer).unwrap())
        .unwrap();
    });

    assert_eq!(
      done_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("a nested CurrentThread blocking call must not wait on its own lane"),
      42
    );
    runner.join().unwrap();
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_started
        .load(Ordering::Relaxed),
      2
    );
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_completed
        .load(Ordering::Relaxed),
      2
    );
    assert_eq!(
      controller
        .metrics
        .active_blocking_tasks
        .load(Ordering::Relaxed),
      0
    );
    assert_eq!(
      controller
        .metrics
        .max_active_blocking_tasks
        .load(Ordering::Relaxed),
      1,
      "nested work borrows the outer lane instead of reporting a second physical lane"
    );
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_hot_runnable_yields_to_exact_blocking_dependency() {
    use std::sync::mpsc;

    struct HotFuture {
      stop: Arc<AtomicBool>,
    }

    impl Future for HotFuture {
      type Output = ();

      fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        if self.stop.load(Ordering::SeqCst) {
          Poll::Ready(())
        } else {
          cx.waker().wake_by_ref();
          Poll::Pending
        }
      }
    }

    let stop = Arc::new(AtomicBool::new(false));
    let (ready_tx, ready_rx) = mpsc::channel();
    let (exact_tx, exact_rx) = mpsc::channel();
    let (done_tx, done_rx) = mpsc::channel();
    let runner_stop = Arc::clone(&stop);
    let runner = std::thread::spawn(move || {
      let executor = Arc::new(CurrentThreadExecutor::new(Arc::new(
        RuntimeMetrics::default(),
      )));
      let owner = executor.fresh_owner_token();
      let job = BlockingJobId(u64::MAX - 70);
      let (result_tx, result_rx) = oneshot::channel();
      {
        let mut state = executor
          .blocking_admission
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        state.owner = Some(owner);
        let exact_stop = Arc::clone(&runner_stop);
        state.queue.push(QueuedBlocking {
          id: job,
          run: Box::new(move || {
            exact_tx.send(!exact_stop.load(Ordering::SeqCst)).unwrap();
            let _ = result_tx.send(Ok(ContainedTaskOutput::new(41usize, u64::MAX)));
          }),
        });
      }
      let exact = JoinHandle(JoinHandleInner::Blocking {
        receiver: result_rx,
        dependency: BlockingDependency {
          job,
          owner: Some(owner),
        },
        published: PublishedBlockingDependencies::default(),
      });
      let _owner = executor.enter_blocking_owner(owner, false);

      let scheduler = Arc::clone(&executor);
      let hot_stop = Arc::clone(&runner_stop);
      let (runnable, hot_task) = async_task::spawn(HotFuture { stop: hot_stop }, move |runnable| {
        scheduler.schedule(runnable);
      });
      executor.schedule(runnable);
      ready_tx.send(()).unwrap();

      let mut value = None;
      {
        let mut future = std::pin::pin!(async {
          value = Some(exact.await.unwrap());
          hot_task.await;
        });
        assert_eq!(
          executor.block_on(future.as_mut()),
          BlockOnOutcome::Completed
        );
      }
      executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .owner = None;
      done_tx.send(value.unwrap()).unwrap();
    });

    ready_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the fairness driver must start");
    let exact_before_stop = exact_rx.recv_timeout(Duration::from_secs(2)).ok();
    stop.store(true, Ordering::SeqCst);
    assert_eq!(
      done_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the CurrentThread driver must retire"),
      41
    );
    runner.join().unwrap();
    let exact_before_stop = exact_before_stop.or_else(|| exact_rx.try_recv().ok());
    assert_eq!(
      exact_before_stop,
      Some(true),
      "a hot CurrentThread runnable must yield to the exact dependency before it is stopped"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_cross_driver_dependency_reuses_the_owner_lane() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller(
      "current-thread-cross-driver-blocking",
    ));
    let backend = controller.backend();
    let RuntimeExecutor::CurrentThread(executor) = &backend.executor else {
      panic!("configured CurrentThread backend must create a CurrentThread executor");
    };
    let executor = Arc::clone(executor);
    drop(backend);

    let (release_driver_tx, release_driver_rx) = oneshot::channel();
    let (driver_started_tx, driver_started_rx) = mpsc::channel();
    let driver_controller = Arc::clone(&controller);
    let driver = std::thread::spawn(move || {
      driver_started_tx.send(std::thread::current().id()).unwrap();
      block_on_with_controller(&driver_controller, async {
        release_driver_rx
          .await
          .expect("driver release sender must remain alive");
      });
    });
    let driver_thread = driver_started_rx
      .recv_timeout(Duration::from_secs(1))
      .unwrap();
    wait_until("the secondary CurrentThread driver to park", || {
      executor
        .stop
        .parkers
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .iter()
        .filter_map(Weak::upgrade)
        .any(|parker| parker.state.load(Ordering::SeqCst) == PARKER_SLEEPING)
    });

    let (child_polled_tx, child_polled_rx) = mpsc::channel();
    let (release_child_tx, release_child_rx) = mpsc::channel();
    let (owner_awaiting_tx, owner_awaiting_rx) = mpsc::channel();
    let (blocking_ran_tx, blocking_ran_rx) = mpsc::channel();
    let (owner_done_tx, owner_done_rx) = mpsc::channel();
    let owner_controller = Arc::clone(&controller);
    let owner = std::thread::spawn(move || {
      let owner_thread = std::thread::current().id();
      let await_controller = Arc::clone(&owner_controller);
      let child_controller = Arc::clone(&owner_controller);
      let outer = owner_controller
        .try_spawn_blocking(move || {
          let spawn_controller = Arc::clone(&child_controller);
          let child = spawn_controller
            .try_spawn(async move {
              child_polled_tx.send(std::thread::current().id()).unwrap();
              release_child_rx.recv().unwrap();
              child_controller
                .try_spawn_blocking(move || {
                  blocking_ran_tx.send(std::thread::current().id()).unwrap();
                  41usize
                })
                .unwrap_or_else(|_| panic!("runtime must accept the descendant blocking work"))
                .await
                .unwrap()
                + 1
            })
            .unwrap_or_else(|_| panic!("runtime must accept the cross-driver child"));

          assert_eq!(
            child_polled_rx
              .recv_timeout(Duration::from_secs(1))
              .unwrap(),
            driver_thread,
            "the secondary driver must own the child poll that reaches blocking admission"
          );
          owner_awaiting_tx.send(owner_thread).unwrap();
          block_on_with_controller(&await_controller, child).unwrap()
        })
        .unwrap_or_else(|_| panic!("runtime must accept the blocking owner"));
      owner_done_tx
        .send(futures::executor::block_on(outer))
        .unwrap();
    });

    let owner_thread = owner_awaiting_rx
      .recv_timeout(Duration::from_secs(1))
      .unwrap();
    wait_until(
      "the blocking owner to park while awaiting the cross-driver child",
      || {
        executor
          .stop
          .parkers
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .iter()
          .filter_map(Weak::upgrade)
          .any(|parker| parker.state.load(Ordering::SeqCst) == PARKER_SLEEPING)
      },
    );
    release_child_tx.send(()).unwrap();

    assert_eq!(
      blocking_ran_rx
        .recv_timeout(Duration::from_secs(2))
        .unwrap(),
      owner_thread,
      "the exact descendant must be serviced by the lane-owning driver"
    );
    assert_eq!(
      owner_done_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("cross-driver blocking dependency must not deadlock")
        .unwrap(),
      42
    );
    release_driver_tx.send(()).unwrap();
    owner.join().unwrap();
    driver.join().unwrap();
    controller.shutdown().unwrap();
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_started
        .load(Ordering::Relaxed),
      2
    );
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_completed
        .load(Ordering::Relaxed),
      2
    );
    assert_eq!(
      controller
        .metrics
        .active_blocking_tasks
        .load(Ordering::Relaxed),
      0
    );
    assert_eq!(
      controller
        .metrics
        .max_active_blocking_tasks
        .load(Ordering::Relaxed),
      1,
      "cross-driver dependency service must reuse the owner's physical lane"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_blocking_admission_rechecks_stop_under_lock() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller(
      "current-thread-blocking-stop-race",
    ));
    let backend = controller.backend();
    let RuntimeExecutor::CurrentThread(executor) = &backend.executor else {
      panic!("configured CurrentThread backend must create a CurrentThread executor");
    };
    let executor = Arc::clone(executor);
    drop(backend);

    let ran = Arc::new(AtomicBool::new(false));
    let blocking_ran = Arc::clone(&ran);
    let (admission_locked_tx, admission_locked_rx) = mpsc::channel();
    let (release_admission_tx, release_admission_rx) = mpsc::channel();
    let (blocking_result_tx, blocking_result_rx) = mpsc::channel();
    let submit_controller = Arc::clone(&controller);
    let submitter = std::thread::spawn(move || {
      CURRENT_THREAD_BLOCKING_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          admission_locked_tx.send(()).unwrap();
          release_admission_rx.recv().unwrap();
        }));
      });
      let handle = submit_controller
        .try_spawn_blocking(move || {
          blocking_ran.store(true, Ordering::SeqCst);
        })
        .unwrap_or_else(|_| {
          panic!("the submission linearized before shutdown and must be accepted")
        });
      blocking_result_tx
        .send(futures::executor::block_on(handle))
        .unwrap();
    });
    admission_locked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the blocking submitter must pause while holding the admission lock");

    let (shutdown_result_tx, shutdown_result_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_result_tx
        .send(shutdown_controller.shutdown())
        .unwrap();
    });
    wait_until("CurrentThread shutdown to publish generation stop", || {
      executor.stop.is_stopping()
    });
    release_admission_tx.send(()).unwrap();

    let blocking_error = blocking_result_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the admitted blocking handle must resolve")
      .expect_err("stop publication must reject the blocking lane claim");
    assert_eq!(
      blocking_error.to_string(),
      "the async runtime stopped before the blocking task could start"
    );
    assert!(
      !ran.load(Ordering::SeqCst),
      "blocking work must not start after stop publication"
    );
    shutdown_result_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("shutdown must finish after the rejected admission retires")
      .unwrap();
    submitter.join().unwrap();
    shutdown.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_fifo_blocking_claim_rechecks_stop_under_lock() {
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::new(Arc::new(
      RuntimeMetrics::default(),
    )));
    let ran = Arc::new(AtomicBool::new(false));
    let job_ran = Arc::clone(&ran);
    {
      let mut state = executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.queue.push(QueuedBlocking {
        id: BlockingJobId(u64::MAX - 71),
        run: Box::new(move || {
          job_ran.store(true, Ordering::SeqCst);
        }),
      });
    }

    let (claim_locked_tx, claim_locked_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let (claim_result_tx, claim_result_rx) = mpsc::channel();
    let claim_executor = Arc::clone(&executor);
    let claimant = std::thread::spawn(move || {
      CURRENT_THREAD_BLOCKING_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claim_locked_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      claim_result_tx
        .send(claim_executor.run_one_blocking())
        .unwrap();
    });
    claim_locked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the FIFO claimant must pause while holding the admission lock");

    executor.stop.begin_shutdown();
    release_claim_tx.send(()).unwrap();
    assert!(
      !claim_result_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the stopped FIFO claim must finish"),
      "stop publication must reject the queued FIFO claim"
    );
    claimant.join().unwrap();
    assert!(
      !ran.load(Ordering::SeqCst),
      "queued FIFO work must not start after stop publication"
    );
    assert!(
      !executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .queue
        .is_empty(),
      "the rejected FIFO job must remain queued for shutdown cancellation"
    );

    executor.close_blocking_admission();
    assert!(
      executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .queue
        .is_empty()
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_fifo_blocking_claim_rechecks_terminal_cancellation_under_lock() {
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::new(Arc::new(
      RuntimeMetrics::default(),
    )));
    let ran = Arc::new(AtomicBool::new(false));
    let job_ran = Arc::clone(&ran);
    {
      let mut state = executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.queue.push(QueuedBlocking {
        id: BlockingJobId(u64::MAX - 73),
        run: Box::new(move || {
          job_ran.store(true, Ordering::SeqCst);
        }),
      });
    }

    let (claim_locked_tx, claim_locked_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let (claim_result_tx, claim_result_rx) = mpsc::channel();
    let claim_executor = Arc::clone(&executor);
    let claimant = std::thread::spawn(move || {
      CURRENT_THREAD_BLOCKING_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claim_locked_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      claim_result_tx
        .send(claim_executor.run_one_blocking())
        .unwrap();
    });
    claim_locked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the FIFO claimant must pause while holding the admission lock");

    let (cancellation_published_tx, cancellation_published_rx) = mpsc::channel();
    let (cancellation_done_tx, cancellation_done_rx) = mpsc::channel();
    let cancelling_executor = Arc::clone(&executor);
    let cancellation = std::thread::spawn(move || {
      let cancelling = cancelling_executor
        .begin_failed_dispatch_cancellation()
        .expect("the test must publish terminal dispatch cancellation");
      cancellation_published_tx.send(()).unwrap();
      cancelling_executor.cancel_work_after_host_dispatch_failure(cancelling);
      cancellation_done_tx.send(()).unwrap();
    });
    cancellation_published_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("terminal dispatch cancellation must publish before queue cancellation");
    assert!(executor.cancelling_failed_dispatch.load(Ordering::Acquire));
    assert!(
      matches!(
        cancellation_done_rx.try_recv(),
        Err(mpsc::TryRecvError::Empty)
      ),
      "terminal cancellation must wait for the blocking-admission lock"
    );

    release_claim_tx.send(()).unwrap();
    assert!(
      !claim_result_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the cancelled FIFO claim must finish"),
      "terminal cancellation publication must reject the queued FIFO claim"
    );
    cancellation_done_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("terminal cancellation must drain the rejected FIFO job");
    claimant.join().unwrap();
    cancellation.join().unwrap();

    assert!(
      !ran.load(Ordering::SeqCst),
      "terminally cancelled FIFO work must not start"
    );
    assert!(
      executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .queue
        .is_empty(),
      "terminal cancellation must drain the rejected FIFO job"
    );
    assert!(!executor.cancelling_failed_dispatch.load(Ordering::Acquire));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_owned_blocking_claim_rechecks_stop_under_lock() {
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::new(Arc::new(
      RuntimeMetrics::default(),
    )));
    let owner = executor.fresh_owner_token();
    let job = BlockingJobId(u64::MAX - 72);
    let ran = Arc::new(AtomicBool::new(false));
    let job_ran = Arc::clone(&ran);
    {
      let mut state = executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.owner = Some(owner);
      state.queue.push(QueuedBlocking {
        id: job,
        run: Box::new(move || {
          job_ran.store(true, Ordering::SeqCst);
        }),
      });
    }
    let dependency = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    dependency.set_owned(BlockingDependency {
      job,
      owner: Some(owner),
    });

    let (claim_locked_tx, claim_locked_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let (claim_result_tx, claim_result_rx) = mpsc::channel();
    let claim_executor = Arc::clone(&executor);
    let claim_dependency = Arc::clone(&dependency);
    let claimant = std::thread::spawn(move || {
      let _owner = claim_executor.enter_blocking_owner(owner, false);
      CURRENT_THREAD_BLOCKING_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claim_locked_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      claim_result_tx
        .send(claim_executor.try_run_owned_blocking(&claim_dependency))
        .unwrap();
    });
    claim_locked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the owner claimant must pause while holding the admission lock");

    executor.stop.begin_shutdown();
    release_claim_tx.send(()).unwrap();
    assert!(
      !claim_result_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the stopped owner claim must finish"),
      "stop publication must reject the exact-owner claim"
    );
    claimant.join().unwrap();
    assert!(
      !ran.load(Ordering::SeqCst),
      "queued exact-owner work must not start after stop publication"
    );
    assert!(
      !executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .queue
        .is_empty(),
      "the rejected exact-owner job must remain queued for shutdown cancellation"
    );

    executor
      .blocking_admission
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .owner = None;
    executor.close_blocking_admission();
    assert!(
      executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .queue
        .is_empty()
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_owned_blocking_claim_rechecks_terminal_cancellation_under_lock() {
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::new(Arc::new(
      RuntimeMetrics::default(),
    )));
    let owner = executor.fresh_owner_token();
    let job = BlockingJobId(u64::MAX - 74);
    let ran = Arc::new(AtomicBool::new(false));
    let job_ran = Arc::clone(&ran);
    {
      let mut state = executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      state.owner = Some(owner);
      state.queue.push(QueuedBlocking {
        id: job,
        run: Box::new(move || {
          job_ran.store(true, Ordering::SeqCst);
        }),
      });
    }
    let dependency = Arc::new(TaskDependency::new(u64::MAX, Some(owner)));
    dependency.set_owned(BlockingDependency {
      job,
      owner: Some(owner),
    });

    let (claim_locked_tx, claim_locked_rx) = mpsc::channel();
    let (release_claim_tx, release_claim_rx) = mpsc::channel();
    let (claim_result_tx, claim_result_rx) = mpsc::channel();
    let claim_executor = Arc::clone(&executor);
    let claim_dependency = Arc::clone(&dependency);
    let claimant = std::thread::spawn(move || {
      let _owner = claim_executor.enter_blocking_owner(owner, false);
      CURRENT_THREAD_BLOCKING_CLAIM_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          claim_locked_tx.send(()).unwrap();
          release_claim_rx.recv().unwrap();
        }));
      });
      claim_result_tx
        .send(claim_executor.try_run_owned_blocking(&claim_dependency))
        .unwrap();
    });
    claim_locked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the owner claimant must pause while holding the admission lock");

    let (cancellation_published_tx, cancellation_published_rx) = mpsc::channel();
    let (cancellation_done_tx, cancellation_done_rx) = mpsc::channel();
    let cancelling_executor = Arc::clone(&executor);
    let cancellation = std::thread::spawn(move || {
      let cancelling = cancelling_executor
        .begin_failed_dispatch_cancellation()
        .expect("the test must publish terminal dispatch cancellation");
      cancellation_published_tx.send(()).unwrap();
      cancelling_executor.cancel_work_after_host_dispatch_failure(cancelling);
      cancellation_done_tx.send(()).unwrap();
    });
    cancellation_published_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("terminal dispatch cancellation must publish before queue cancellation");
    assert!(executor.cancelling_failed_dispatch.load(Ordering::Acquire));
    assert!(
      matches!(
        cancellation_done_rx.try_recv(),
        Err(mpsc::TryRecvError::Empty)
      ),
      "terminal cancellation must wait for the blocking-admission lock"
    );

    release_claim_tx.send(()).unwrap();
    assert!(
      !claim_result_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the cancelled owner claim must finish"),
      "terminal cancellation publication must reject the exact-owner claim"
    );
    cancellation_done_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("terminal cancellation must drain the rejected exact-owner job");
    claimant.join().unwrap();
    cancellation.join().unwrap();

    assert!(
      !ran.load(Ordering::SeqCst),
      "terminally cancelled exact-owner work must not start"
    );
    assert!(
      executor
        .blocking_admission
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .queue
        .is_empty(),
      "terminal cancellation must drain the rejected exact-owner job"
    );
    assert!(!executor.cancelling_failed_dispatch.load(Ordering::Acquire));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_cancels_waiting_blocking_work() {
    use std::sync::mpsc;

    struct DropSignal(mpsc::Sender<()>);

    impl Drop for DropSignal {
      fn drop(&mut self) {
        let _ = self.0.send(());
      }
    }

    let controller = Arc::new(current_thread_controller(
      "current-thread-blocking-shutdown",
    ));
    let backend = controller.backend();
    let (first_started_tx, first_started_rx) = mpsc::channel();
    let (release_first_tx, release_first_rx) = mpsc::channel();
    let first_controller = Arc::clone(&controller);
    let first = std::thread::spawn(move || {
      let handle = first_controller
        .try_spawn_blocking(move || {
          first_started_tx.send(()).unwrap();
          release_first_rx.recv().unwrap();
        })
        .unwrap_or_else(|_| panic!("the running blocking call must be accepted"));
      futures::executor::block_on(handle)
    });
    first_started_rx
      .recv_timeout(Duration::from_secs(1))
      .unwrap();

    let waiting_ran = Arc::new(AtomicBool::new(false));
    let waiting_ran_task = Arc::clone(&waiting_ran);
    let (waiting_dropped_tx, waiting_dropped_rx) = mpsc::channel();
    let waiting_drop = DropSignal(waiting_dropped_tx);
    let (waiting_result_tx, waiting_result_rx) = mpsc::channel();
    let waiting_controller = Arc::clone(&controller);
    let waiting = std::thread::spawn(move || {
      let handle = waiting_controller
        .try_spawn_blocking(move || {
          let _waiting_drop = waiting_drop;
          waiting_ran_task.store(true, Ordering::SeqCst);
        })
        .unwrap_or_else(|_| panic!("the waiting blocking call must be accepted"));
      waiting_result_tx
        .send(futures::executor::block_on(handle))
        .unwrap();
    });
    wait_until("both CurrentThread blocking calls to be accepted", || {
      backend
        .work
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .active
        == 2
    });

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    waiting_dropped_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("shutdown must destroy blocking work waiting for the CurrentThread lane");
    assert!(
      !waiting_ran.load(Ordering::SeqCst),
      "waiting blocking work must not start"
    );
    assert!(
      waiting_result_rx
        .recv_timeout(Duration::from_secs(1))
        .unwrap()
        .is_err(),
      "the waiting blocking handle must resolve as cancelled"
    );
    assert!(
      shutdown_rx
        .recv_timeout(Duration::from_millis(100))
        .is_err(),
      "shutdown must still wait for the blocking closure that already owns the lane"
    );

    release_first_tx.send(()).unwrap();
    first.join().unwrap().unwrap();
    waiting.join().unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(1))
      .unwrap()
      .unwrap();
    shutdown.join().unwrap();
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_started
        .load(Ordering::Relaxed),
      1
    );
    assert_eq!(
      controller
        .metrics
        .blocking_tasks_completed
        .load(Ordering::Relaxed),
      1
    );
    assert_eq!(
      controller
        .metrics
        .active_blocking_tasks
        .load(Ordering::Relaxed),
      0
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn current_thread_blocking_result_panic_payload_retains_generation_identity() {
    use std::{panic::panic_any, sync::mpsc};

    struct ReentrantPayload {
      controller: Arc<RuntimeController>,
      result: mpsc::Sender<(Option<u64>, Result<(), RuntimeConfigError>)>,
    }

    impl Drop for ReentrantPayload {
      fn drop(&mut self) {
        let generation = ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get);
        let shutdown = self.controller.shutdown();
        self.result.send((generation, shutdown)).unwrap();
      }
    }

    struct PanicPayloadOnDrop(Option<ReentrantPayload>);

    impl Drop for PanicPayloadOnDrop {
      fn drop(&mut self) {
        panic_any(self.0.take().expect("the result must panic only once"));
      }
    }

    let controller = Arc::new(current_thread_controller(
      "current-thread-panic-payload-generation",
    ));
    let backend = controller.backend();
    let generation = backend.generation();
    let RuntimeExecutor::CurrentThread(executor) = &backend.executor else {
      panic!("configured CurrentThread backend must create a CurrentThread executor");
    };
    let executor = Arc::clone(executor);
    drop(backend);

    // Hold the physical lane long enough to force scheduler-owned delivery.
    // Dropping the receiver then makes the queued sender destroy the result.
    let owner = executor.fresh_owner_token();
    executor
      .blocking_admission
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .owner = Some(owner);
    let (result_tx, result_rx) = mpsc::channel();
    let payload_controller = Arc::clone(&controller);
    let handle = controller
      .try_spawn_blocking(move || {
        PanicPayloadOnDrop(Some(ReentrantPayload {
          controller: payload_controller,
          result: result_tx,
        }))
      })
      .unwrap_or_else(|_| panic!("the CurrentThread runtime must accept blocking work"));
    drop(handle);
    executor
      .blocking_admission
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .owner = None;
    let dispatch = current_thread_dispatch(&executor);
    controller.drive_current_thread_dispatch(dispatch, false);

    let (observed_generation, shutdown) = result_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("the caught result panic payload must be destroyed in the scheduler turn");
    assert_eq!(observed_generation, Some(generation));
    let error = shutdown.expect_err("payload destruction is still work in the active generation");
    assert!(error.to_string().contains("work running on that runtime"));
    controller.shutdown().unwrap();
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_detached_blocking_result_drop_is_contained() {
    use std::sync::mpsc;

    struct PanicOnDrop(mpsc::Sender<()>);

    impl Drop for PanicOnDrop {
      fn drop(&mut self) {
        self.0.send(()).unwrap();
        panic!("intentional CurrentThread blocking result destructor panic");
      }
    }

    let controller = current_thread_controller("current-thread-blocking-result-drop");
    let (dropped_tx, dropped_rx) = mpsc::channel();
    let handle = controller
      .try_spawn_blocking(move || PanicOnDrop(dropped_tx))
      .unwrap_or_else(|_| panic!("the CurrentThread runtime must accept blocking work"));

    let result = catch_unwind(AssertUnwindSafe(|| drop(handle)));
    dropped_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("dropping the detached handle must reclaim its blocking result");
    assert!(
      result.is_ok(),
      "the blocking result destructor panic must be contained"
    );
    controller.shutdown().unwrap();
  }

  // ---- Runtime option validation and configuration immutability -------------
  // These build `RuntimeOptions`/`RuntimeController` LOCALLY and never touch the
  // global `RUNTIME` singleton, so they stay deterministic and order-independent.

  #[test]
  fn validate_rejects_zero_worker_threads() {
    let error = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 0,
      max_blocking_tasks: 1,
      thread_name_prefix: "rd8".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
    .validate()
    .expect_err("worker_threads == 0 must be rejected");
    assert_eq!(
      error.to_string(),
      "worker_threads must be greater than zero"
    );
  }

  #[test]
  fn validate_rejects_zero_max_blocking_tasks() {
    let error = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 0,
      thread_name_prefix: "rd8".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
    .validate()
    .expect_err("max_blocking_tasks == 0 must be rejected");
    assert_eq!(
      error.to_string(),
      "max_blocking_tasks must be greater than zero"
    );
  }

  #[test]
  fn validate_current_thread_coerces_worker_threads_to_one() {
    // CurrentThread forces `worker_threads` to 1; `max_blocking_tasks` is then
    // clamped to `.min(worker_threads)` == 1.
    let validated = RuntimeOptions {
      flavor: RuntimeFlavor::CurrentThread,
      worker_threads: 8,
      max_blocking_tasks: 8,
      thread_name_prefix: "rd8".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
    .validate()
    .expect("CurrentThread options must validate");
    assert_eq!(validated.flavor, RuntimeFlavor::CurrentThread);
    assert_eq!(validated.worker_threads, 1);
    assert_eq!(validated.max_blocking_tasks, 1);
  }

  // `validate()` rejects `MultiThread` on builds that cannot create OS threads
  // (after applying the clamp), so this success assertion is valid only where
  // `napi_runtime_os_threads` holds: native and `wasm32-wasip1-threads`.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn validate_reserves_one_worker_from_blocking_admission() {
    let validated = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 8,
      thread_name_prefix: "rd8".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
    .validate()
    .expect("MultiThread options must validate");
    assert_eq!(validated.worker_threads, 2);
    assert_eq!(validated.max_blocking_tasks, 1);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn validate_promotes_multi_thread_one_to_truthful_two_worker_minimum() {
    let validated = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 1,
      max_blocking_tasks: 8,
      thread_name_prefix: "rd8-minimum".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
    .validate()
    .expect("MultiThread options must validate");
    assert_eq!(validated.worker_threads, 2);
    assert_eq!(validated.max_blocking_tasks, 1);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn validate_applies_worker_caps_before_blocking_reserve_and_reporting() {
    let simulated_32_bit = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 256,
      max_blocking_tasks: 256,
      thread_name_prefix: "rd8-rayon-cap-32".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    }
    .validate_with_rayon_max_threads(Some(255))
    .expect("a 32-bit-sized request must clamp to Rayon's 255-thread cap");
    assert_eq!(simulated_32_bit.worker_threads, 255);
    assert_eq!(simulated_32_bit.max_blocking_tasks, 254);

    let rayon_max_threads = max_num_threads();
    let requested_threads = rayon_max_threads
      .max(MAX_ASYNC_RUNTIME_WORKER_THREADS)
      .checked_add(1)
      .expect("supported worker counts must leave room for an oversized request");
    let controller = RuntimeController::new();
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: requested_threads,
        max_blocking_tasks: requested_threads,
        thread_name_prefix: "rd8-rayon-cap".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("an oversized request must clamp to the production worker ceiling");

    let reported = controller.options();
    let expected_workers = rayon_max_threads.min(MAX_ASYNC_RUNTIME_WORKER_THREADS);
    assert_eq!(reported.worker_threads, expected_workers);
    assert_eq!(
      reported.max_blocking_tasks,
      expected_workers - 1,
      "the blocking cap must reserve a lane from the physically realizable worker count"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn drain_linger_extreme_values_are_clamped_and_zero_disables() {
    // u64::MAX microseconds (the exact value an unvalidated
    // `NAPI_RUNTIME_DRAIN_LINGER_US` typo used to freeze into the process
    // via the removed OnceLock) must clamp to the ceiling everywhere a
    // budget enters the system: full options validation, a partial patch
    // through the controller, and the executor's defensive constructor
    // clamp for direct unvalidated test construction.
    let extreme = Duration::from_micros(u64::MAX);
    let validated = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "linger-clamp".to_string(),
      park_deadline: None,
      drain_linger: extreme,
    }
    .validate_with_rayon_max_threads(Some(2))
    .expect("an extreme linger budget must clamp, not fail validation");
    assert_eq!(validated.drain_linger, MAX_DRAIN_LINGER);

    let controller = RuntimeController::new();
    controller
      .configure_partial(RuntimeOptionsPatch {
        drain_linger: Some(extreme),
        ..RuntimeOptionsPatch::default()
      })
      .expect("an extreme linger patch must clamp, not fail validation");
    assert_eq!(
      controller.options().drain_linger,
      MAX_DRAIN_LINGER,
      "introspection must report the clamped budget, not the requested one"
    );
    controller
      .configure_partial(RuntimeOptionsPatch {
        drain_linger: Some(Duration::ZERO),
        ..RuntimeOptionsPatch::default()
      })
      .expect("ZERO (lingering disabled) must remain a valid budget");
    assert_eq!(controller.options().drain_linger, Duration::ZERO);

    let metrics = Arc::new(RuntimeMetrics::default());
    let unvalidated = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "linger-clamp-exec".to_string(),
      park_deadline: None,
      drain_linger: extreme,
    };
    let executor = MultiThreadExecutor::new(&unvalidated, metrics)
      .expect("the executor must construct with an extreme unvalidated budget");
    assert_eq!(
      executor.drain_linger,
      Some(MAX_DRAIN_LINGER),
      "the constructor's defensive clamp must bound unvalidated budgets"
    );

    let metrics = Arc::new(RuntimeMetrics::default());
    let disabled = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 2,
      thread_name_prefix: "linger-clamp-off".to_string(),
      park_deadline: None,
      drain_linger: Duration::ZERO,
    };
    let executor = MultiThreadExecutor::new(&disabled, metrics)
      .expect("the executor must construct with lingering disabled");
    assert_eq!(executor.drain_linger, None, "ZERO must disable lingering");
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn runtime_controller_default_reserves_one_worker_from_blocking_admission() {
    let controller = RuntimeController::new();
    let options = controller.options();
    assert_eq!(options.flavor, RuntimeFlavor::MultiThread);
    assert_eq!(
      options.max_blocking_tasks,
      options.worker_threads.saturating_sub(1).max(1),
      "the unconfigured Rust API must use the same validated reserve as the binding"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn concurrent_partial_configuration_merges_from_latest_committed_options() {
    use std::{sync::mpsc, time::Duration};

    let controller = Arc::new(multi_thread_controller("partial-config-race", 8, 1));
    let (first_merged_tx, first_merged_rx) = mpsc::sync_channel(1);
    let (release_first_tx, release_first_rx) = mpsc::sync_channel(1);
    let first_controller = Arc::clone(&controller);
    let first = std::thread::spawn(move || {
      first_controller
        .configure_partial_inner(
          RuntimeOptionsPatch {
            max_blocking_tasks: Some(3),
            ..RuntimeOptionsPatch::default()
          },
          |candidate| {
            assert_eq!(
              (candidate.worker_threads, candidate.max_blocking_tasks),
              (8, 3)
            );
            first_merged_tx
              .send(())
              .expect("the race coordinator must still be listening");
            release_first_rx
              .recv_timeout(Duration::from_secs(5))
              .expect("the first partial configuration must be released");
          },
        )
        .expect("the first partial configuration must commit");
    });
    first_merged_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the first partial configuration must hold the controller lock after merging");

    let (second_started_tx, second_started_rx) = mpsc::sync_channel(1);
    let (second_candidate_tx, second_candidate_rx) = mpsc::sync_channel(1);
    let second_controller = Arc::clone(&controller);
    let second = std::thread::spawn(move || {
      second_started_tx
        .send(())
        .expect("the race coordinator must still be listening");
      second_controller
        .configure_partial_inner(
          RuntimeOptionsPatch {
            worker_threads: Some(6),
            ..RuntimeOptionsPatch::default()
          },
          |candidate| {
            second_candidate_tx
              .send((candidate.worker_threads, candidate.max_blocking_tasks))
              .expect("the race coordinator must still be listening");
          },
        )
        .expect("the second partial configuration must commit");
    });
    second_started_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the second partial configuration thread must start");
    release_first_tx
      .send(())
      .expect("the first partial configuration must still be waiting");

    first
      .join()
      .expect("the first configuration thread must not panic");
    second
      .join()
      .expect("the second configuration thread must not panic");
    assert_eq!(
      second_candidate_rx
        .recv_timeout(Duration::from_secs(5))
        .expect("the second partial configuration must expose its merged candidate"),
      (6, 3),
      "the second caller must merge against the first caller's committed options"
    );

    let options = controller.options();
    assert_eq!((options.worker_threads, options.max_blocking_tasks), (6, 3));
    assert_eq!(options.thread_name_prefix, "partial-config-race");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn invalid_concurrent_partial_configuration_cannot_overwrite_a_valid_peer() {
    use std::{sync::mpsc, time::Duration};

    let controller = Arc::new(multi_thread_controller("partial-config-rollback", 6, 2));
    let (invalid_merged_tx, invalid_merged_rx) = mpsc::sync_channel(1);
    let (release_invalid_tx, release_invalid_rx) = mpsc::sync_channel(1);
    let invalid_controller = Arc::clone(&controller);
    let invalid = std::thread::spawn(move || {
      invalid_controller
        .configure_partial_inner(
          RuntimeOptionsPatch {
            worker_threads: Some(0),
            ..RuntimeOptionsPatch::default()
          },
          |candidate| {
            assert_eq!(
              (candidate.worker_threads, candidate.max_blocking_tasks),
              (0, 2)
            );
            invalid_merged_tx
              .send(())
              .expect("the race coordinator must still be listening");
            release_invalid_rx
              .recv_timeout(Duration::from_secs(5))
              .expect("the invalid partial configuration must be released");
          },
        )
        .expect_err("the invalid partial configuration must be rejected")
        .to_string()
    });
    invalid_merged_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the invalid partial configuration must hold the lock after merging");

    let (valid_started_tx, valid_started_rx) = mpsc::sync_channel(1);
    let (valid_candidate_tx, valid_candidate_rx) = mpsc::sync_channel(1);
    let valid_controller = Arc::clone(&controller);
    let valid = std::thread::spawn(move || {
      valid_started_tx
        .send(())
        .expect("the race coordinator must still be listening");
      valid_controller
        .configure_partial_inner(
          RuntimeOptionsPatch {
            max_blocking_tasks: Some(4),
            ..RuntimeOptionsPatch::default()
          },
          |candidate| {
            valid_candidate_tx
              .send((candidate.worker_threads, candidate.max_blocking_tasks))
              .expect("the race coordinator must still be listening");
          },
        )
        .expect("the valid partial configuration must commit");
    });
    valid_started_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the valid partial configuration thread must start");
    release_invalid_tx
      .send(())
      .expect("the invalid partial configuration must still be waiting");

    assert_eq!(
      invalid
        .join()
        .expect("the invalid configuration thread must not panic"),
      "worker_threads must be greater than zero"
    );
    valid
      .join()
      .expect("the valid configuration thread must not panic");
    assert_eq!(
      valid_candidate_rx
        .recv_timeout(Duration::from_secs(5))
        .expect("the valid partial configuration must expose its merged candidate"),
      (6, 4),
      "the valid caller must merge against the last committed options, not the rejected candidate"
    );

    let options = controller.options();
    assert_eq!((options.worker_threads, options.max_blocking_tasks), (6, 4));
    assert_eq!(options.thread_name_prefix, "partial-config-rollback");
  }

  #[test]
  fn configure_after_backend_started_is_rejected() {
    // A local controller, not the global `RUNTIME`. Use a CurrentThread backend
    // so starting it is cheap and spawns no OS threads.
    let controller = RuntimeController::new();
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::CurrentThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "rd8".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("first configure before the backend exists must succeed");

    // Materialize the backend; further configuration must now be refused.
    let _backend = controller.backend();

    let error = controller
      .configure(RuntimeOptions::default())
      .expect_err("configure after the backend started must be rejected");
    assert_eq!(
      error.to_string(),
      "the async runtime configuration is frozen; configure it before the first async call"
    );
  }

  #[test]
  fn partial_configuration_after_backend_started_is_rejected() {
    let controller = current_thread_controller("partial-config-frozen");
    let _backend = controller.backend();

    let error = controller
      .configure_partial(RuntimeOptionsPatch {
        worker_threads: Some(2),
        ..RuntimeOptionsPatch::default()
      })
      .expect_err("partial configuration after the backend started must be rejected");
    assert_eq!(
      error.to_string(),
      "the async runtime configuration is frozen; configure it before the first async call"
    );
  }

  fn current_thread_controller(thread_name_prefix: &str) -> RuntimeController {
    let controller = RuntimeController::new();
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::CurrentThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: thread_name_prefix.to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("CurrentThread test configuration must be accepted");
    controller
  }

  #[cfg(napi_runtime_os_threads)]
  fn multi_thread_controller(
    thread_name_prefix: &str,
    worker_threads: usize,
    max_blocking_tasks: usize,
  ) -> RuntimeController {
    let controller = RuntimeController::new();
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads,
        max_blocking_tasks,
        thread_name_prefix: thread_name_prefix.to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("MultiThread test configuration must be accepted");
    controller
  }

  #[test]
  fn blocking_backend_creation_failure_preserves_diagnostic() {
    let controller = current_thread_controller("blocking-backend-creation-failure");
    let ran = Arc::new(AtomicBool::new(false));
    let work_ran = Arc::clone(&ran);

    FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.set(true));
    let Err((error, work)) = controller.try_spawn_blocking(move || {
      work_ran.store(true, Ordering::SeqCst);
      17usize
    }) else {
      panic!("the injected backend creation failure must reject blocking work");
    };
    assert_eq!(
      error.to_string(),
      "injected async runtime backend creation failure"
    );
    assert!(
      !ran.load(Ordering::SeqCst),
      "rejected blocking work must not run"
    );
    assert_eq!(
      work(),
      17,
      "the rejected blocking closure must remain usable"
    );
    assert!(ran.load(Ordering::SeqCst));

    FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.set(true));
    let error = futures::executor::block_on(controller.spawn_blocking(|| 23usize))
      .expect_err("infallible blocking submission must return a failed join handle");
    assert_eq!(
      error.to_string(),
      "injected async runtime backend creation failure"
    );

    let handle = controller
      .try_spawn_blocking(|| 31usize)
      .unwrap_or_else(|_| panic!("a later blocking backend creation retry must succeed"));
    assert_eq!(futures::executor::block_on(handle).unwrap(), 31);
    controller.shutdown().unwrap();
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn try_block_on_dyn_rejects_stopped_runtime_without_polling() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_TRY_BLOCK_ON_DYN_STOPPED_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      struct PollProbe {
        polls: Arc<AtomicUsize>,
      }

      impl Future for PollProbe {
        type Output = ();

        fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
          self.polls.fetch_add(1, Ordering::SeqCst);
          Poll::Ready(())
        }
      }

      shutdown().expect("the isolated runtime must stop before block_on admission");
      let polls = Arc::new(AtomicUsize::new(0));
      let mut future = std::pin::pin!(PollProbe {
        polls: Arc::clone(&polls)
      });
      let error = try_block_on_dyn(future.as_mut())
        .expect_err("the stopped runtime must reject the borrowed future");
      assert_eq!(
        error.to_string(),
        "the async runtime is stopped; call start before submitting work"
      );
      assert_eq!(
        polls.load(Ordering::SeqCst),
        0,
        "rejected block_on must not poll its future"
      );

      start().expect("the isolated runtime must restart");
      try_block_on_dyn(future.as_mut()).expect("restart must accept the same borrowed future");
      assert_eq!(polls.load(Ordering::SeqCst), 1);
      shutdown().expect("the restarted isolated runtime must stop");
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::try_block_on_dyn_rejects_stopped_runtime_without_polling")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the stopped block_on subprocess must start");
    assert!(
      output.status.success(),
      "stopped try_block_on_dyn must preserve the unpolled future; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn try_block_on_dyn_reports_concurrent_shutdown() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_TRY_BLOCK_ON_DYN_SHUTDOWN_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      use std::sync::mpsc;

      struct PendingProbe {
        entered: Option<mpsc::Sender<()>>,
        complete: Arc<AtomicBool>,
      }

      impl Future for PendingProbe {
        type Output = ();

        fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
          if let Some(entered) = self.entered.take() {
            entered.send(()).unwrap();
          }
          if self.complete.load(Ordering::SeqCst) {
            Poll::Ready(())
          } else {
            Poll::Pending
          }
        }
      }

      configure(RuntimeOptions {
        flavor: RuntimeFlavor::CurrentThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "try-block-on-dyn-shutdown".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("the isolated runtime must accept CurrentThread configuration");
      start().expect("the isolated runtime must start");

      let (entered_tx, entered_rx) = mpsc::channel();
      let (error_tx, error_rx) = mpsc::channel();
      let (retry_tx, retry_rx) = mpsc::channel();
      let complete = Arc::new(AtomicBool::new(false));
      let future_complete = Arc::clone(&complete);
      let runner = std::thread::spawn(move || {
        let mut future = std::pin::pin!(PendingProbe {
          entered: Some(entered_tx),
          complete: future_complete
        });
        let error = try_block_on_dyn(future.as_mut())
          .expect_err("concurrent shutdown must interrupt the borrowed future")
          .to_string();
        error_tx.send(error).unwrap();
        retry_rx.recv().unwrap();
        try_block_on_dyn(future.as_mut())
          .expect("restart must accept the same interrupted borrowed future");
      });
      entered_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the borrowed future must be polled before shutdown");
      shutdown().expect("shutdown must wait for the active block_on scope to retire");
      assert_eq!(
        error_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
        "the async runtime stopped before block_on completed its future"
      );
      start().expect("the isolated runtime must restart after the interrupted drive");
      complete.store(true, Ordering::SeqCst);
      retry_tx.send(()).unwrap();
      runner.join().unwrap();
      shutdown().expect("the retried isolated runtime must stop");
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::try_block_on_dyn_reports_concurrent_shutdown")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the concurrent block_on shutdown subprocess must start");
    assert!(
      output.status.success(),
      "try_block_on_dyn must return the shutdown diagnostic; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[test]
  fn initial_lifecycle_start_preserves_lazy_configuration() {
    let controller = RuntimeController::new();
    controller
      .start()
      .expect("initial lifecycle start must succeed");
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::CurrentThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "lifecycle-initial-start".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("module-registration start must not consume the configuration window");

    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(matches!(&state.lifecycle, RuntimeLifecycle::Initial));
  }

  #[test]
  fn zero_work_lifecycle_cycles_preserve_lazy_configuration() {
    let controller = RuntimeController::new();

    for _ in 0..3 {
      controller
        .start()
        .expect("zero-work lifecycle start must succeed");
      assert!(matches!(
        &controller
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .lifecycle,
        RuntimeLifecycle::Initial
      ));

      controller
        .shutdown()
        .expect("zero-work lifecycle shutdown must succeed");
      assert!(matches!(
        &controller
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .lifecycle,
        RuntimeLifecycle::StoppedBeforeFirstUse
      ));
    }

    controller
      .start()
      .expect("a later zero-work restart must remain lazy");
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::CurrentThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "lifecycle-zero-work-config".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("zero-work lifecycle cycles must not consume the configuration window");

    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(matches!(&state.lifecycle, RuntimeLifecycle::Initial));
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn failed_initial_submission_destruction_blocks_retry_and_shutdown() {
    use std::sync::mpsc;

    struct BlockingDropFuture {
      entered: mpsc::Sender<()>,
      release: mpsc::Receiver<()>,
    }

    impl Future for BlockingDropFuture {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        Poll::Pending
      }
    }

    impl Drop for BlockingDropFuture {
      fn drop(&mut self) {
        self.entered.send(()).unwrap();
        self.release.recv().unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller("failed-initial-submission-drop"));
    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let submit_controller = Arc::clone(&controller);
    let submitter = std::thread::spawn(move || {
      FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.set(true));
      let result = futures::executor::block_on(submit_controller.spawn(BlockingDropFuture {
        entered: drop_entered_tx,
        release: release_drop_rx,
      }));
      assert!(
        result.is_err(),
        "the injected backend creation failure must reject the submission"
      );
    });
    drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the rejected future destructor must start");

    let retry_ran = Arc::new(AtomicBool::new(false));
    let retry_ran_task = Arc::clone(&retry_ran);
    let Err(retry) = controller.try_spawn_detached(async move {
      retry_ran_task.store(true, Ordering::SeqCst);
    }) else {
      panic!("backend creation must remain closed during rejected destruction");
    };
    drop(retry);
    assert!(!retry_ran.load(Ordering::SeqCst));

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until("initial shutdown to close runtime admission", || {
      matches!(
        controller
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .lifecycle,
        RuntimeLifecycle::StoppingWithoutBackend(ZeroBackendShutdownTarget::StoppedBeforeFirstUse)
      )
    });
    assert!(
      shutdown_rx
        .recv_timeout(Duration::from_millis(200))
        .is_err(),
      "initial shutdown must wait for rejected user state destruction"
    );
    assert!(
      controller.try_spawn_detached(async {}).is_err(),
      "shutdown must keep first-generation admission closed while it waits"
    );

    let (start_tx, start_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      start_tx.send(start_controller.start()).unwrap();
    });
    assert!(
      start_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "start must wait for the zero-backend shutdown transition to finish"
    );

    release_drop_tx.send(()).unwrap();
    submitter.join().unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    shutdown.join().unwrap();
    start_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    starter.join().unwrap();

    let ran = Arc::new(AtomicBool::new(false));
    let ran_task = Arc::clone(&ran);
    controller
      .try_spawn_detached(async move {
        ran_task.store(true, Ordering::SeqCst);
      })
      .unwrap_or_else(|_| panic!("submission after rejected destruction must create the backend"));
    let dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(dispatch, false);
    assert!(ran.load(Ordering::SeqCst));
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn stopped_shutdown_blocks_restart_until_rejected_destruction_retires() {
    use std::sync::mpsc;

    struct BlockingDropFuture {
      entered: mpsc::Sender<()>,
      release: mpsc::Receiver<()>,
    }

    impl Future for BlockingDropFuture {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        Poll::Pending
      }
    }

    impl Drop for BlockingDropFuture {
      fn drop(&mut self) {
        self.entered.send(()).unwrap();
        self.release.recv().unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller("stopped-submission-drop"));
    let old_generation = controller.backend().generation();
    controller.shutdown().unwrap();

    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let submit_controller = Arc::clone(&controller);
    let submitter = std::thread::spawn(move || {
      let result = futures::executor::block_on(submit_controller.spawn(BlockingDropFuture {
        entered: drop_entered_tx,
        release: release_drop_rx,
      }));
      assert!(
        result.is_err(),
        "the stopped runtime must reject the submission"
      );
    });
    drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap();

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until(
      "stopped shutdown to enter its zero-backend transition",
      || {
        matches!(
          controller
            .state
            .lock()
            .unwrap_or_else(std::sync::PoisonError::into_inner)
            .lifecycle,
          RuntimeLifecycle::StoppingWithoutBackend(ZeroBackendShutdownTarget::Stopped)
        )
      },
    );

    let (start_tx, start_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      start_tx.send(start_controller.start()).unwrap();
    });
    assert!(
      shutdown_rx
        .recv_timeout(Duration::from_millis(200))
        .is_err(),
      "stopped shutdown must wait for rejected destruction"
    );
    assert!(
      start_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "restart must wait for the stopped zero-backend transition"
    );

    release_drop_tx.send(()).unwrap();
    submitter.join().unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    shutdown.join().unwrap();
    start_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    starter.join().unwrap();

    let new_generation = controller.backend().generation();
    assert_ne!(new_generation, old_generation);
    controller.shutdown().unwrap();
  }

  #[test]
  fn failed_initial_submission_destructor_cannot_reenter_shutdown() {
    use std::sync::mpsc;

    struct ShutdownOnDrop {
      controller: Arc<RuntimeController>,
      result: mpsc::Sender<Result<(), RuntimeConfigError>>,
    }

    impl Future for ShutdownOnDrop {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        Poll::Pending
      }
    }

    impl Drop for ShutdownOnDrop {
      fn drop(&mut self) {
        self.result.send(self.controller.shutdown()).unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller(
      "failed-initial-reentrant-shutdown",
    ));
    let (result_tx, result_rx) = mpsc::channel();
    FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.set(true));
    let rejected = futures::executor::block_on(controller.spawn(ShutdownOnDrop {
      controller: Arc::clone(&controller),
      result: result_tx,
    }));
    assert!(rejected.is_err());

    let error = result_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("the rejected destructor must not self-deadlock")
      .expect_err("rejected destruction cannot wait for its own shutdown");
    assert!(error.to_string().contains("rejected submission"));
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Initial));
      assert_eq!(state.rejected_drops, 0);
    }

    let handle = controller
      .try_spawn(async { 23usize })
      .unwrap_or_else(|_| panic!("a later backend creation retry must succeed"));
    let dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(dispatch, false);
    assert_eq!(futures::executor::block_on(handle).unwrap(), 23);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn failed_initial_submission_destructor_cannot_reenter_start() {
    use std::sync::mpsc;

    struct StartOnDrop {
      controller: Arc<RuntimeController>,
      result: mpsc::Sender<Result<(), RuntimeConfigError>>,
      release: mpsc::Receiver<()>,
    }

    impl Future for StartOnDrop {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        Poll::Pending
      }
    }

    impl Drop for StartOnDrop {
      fn drop(&mut self) {
        self.result.send(self.controller.start()).unwrap();
        self.release.recv().unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller("failed-initial-reentrant-start"));
    let (result_tx, result_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let (submission_tx, submission_rx) = mpsc::channel();
    let submit_controller = Arc::clone(&controller);
    let submitter = std::thread::spawn(move || {
      FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.set(true));
      let rejected = futures::executor::block_on(submit_controller.spawn(StartOnDrop {
        controller: Arc::clone(&submit_controller),
        result: result_tx,
        release: release_drop_rx,
      }));
      submission_tx.send(rejected).unwrap();
    });

    let error = result_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("the rejected destructor must not self-deadlock")
      .expect_err("rejected destruction must not report a successful runtime start");
    assert!(error.to_string().contains("rejected submission"));
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Initial));
      assert_eq!(state.rejected_drops, 1);
    }

    let (wait_entered_tx, wait_entered_rx) = mpsc::channel();
    let (external_start_tx, external_start_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      BEFORE_INITIAL_START_WAIT_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          wait_entered_tx.send(()).unwrap();
        }));
      });
      external_start_tx.send(start_controller.start()).unwrap();
    });
    wait_entered_rx
      .recv_timeout(Duration::from_secs(1))
      .expect("external start must reach the Initial rejected-destruction wait");
    assert!(
      external_start_rx.try_recv().is_err(),
      "external start must not return while rejected destruction remains active"
    );

    release_drop_tx.send(()).unwrap();
    assert!(
      submission_rx
        .recv_timeout(Duration::from_secs(2))
        .unwrap()
        .is_err()
    );
    submitter.join().unwrap();
    external_start_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    starter.join().unwrap();

    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Initial));
      assert_eq!(state.rejected_drops, 0);
    }

    let handle = controller
      .try_spawn(async { 31usize })
      .unwrap_or_else(|_| panic!("a later backend creation retry must succeed"));
    let dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(dispatch, false);
    assert_eq!(futures::executor::block_on(handle).unwrap(), 31);
    controller.shutdown().unwrap();
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn failed_initial_block_on_destruction_blocks_retry_and_shutdown() {
    use std::sync::mpsc;

    struct BlockingDropFuture {
      controller: Arc<RuntimeController>,
      entered: mpsc::Sender<(Option<u64>, Result<(), RuntimeConfigError>)>,
      release: mpsc::Receiver<()>,
    }

    impl Future for BlockingDropFuture {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        Poll::Pending
      }
    }

    impl Drop for BlockingDropFuture {
      fn drop(&mut self) {
        let generation = ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get);
        self
          .entered
          .send((generation, self.controller.shutdown()))
          .unwrap();
        self.release.recv().unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller("failed-initial-block-on-drop"));
    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let (runner_done_tx, runner_done_rx) = mpsc::channel();
    let runner_controller = Arc::clone(&controller);
    let runner = std::thread::spawn(move || {
      FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.set(true));
      let result = catch_unwind(AssertUnwindSafe(|| {
        block_on_with_controller(
          &runner_controller,
          BlockingDropFuture {
            controller: Arc::clone(&runner_controller),
            entered: drop_entered_tx,
            release: release_drop_rx,
          },
        );
      }));
      runner_done_tx.send(result.is_err()).unwrap();
    });

    let (generation, reentrant_shutdown) = drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("failed block_on acquisition must destroy its owned future");
    assert_eq!(generation, None, "no runtime generation was created");
    let error = reentrant_shutdown
      .expect_err("rejected block_on destruction cannot wait for its own shutdown");
    assert!(error.to_string().contains("rejected submission"));

    let Err(retry_error) = controller.try_backend() else {
      panic!("backend retry must remain closed during rejected block_on destruction");
    };
    assert!(retry_error.to_string().contains("rejected submission"));

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    assert!(
      shutdown_rx
        .recv_timeout(Duration::from_millis(200))
        .is_err(),
      "initial shutdown must wait for rejected block_on destruction"
    );

    release_drop_tx.send(()).unwrap();
    assert!(
      runner_done_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      "block_on must preserve its infallible panic contract after contained cleanup"
    );
    runner.join().unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    shutdown.join().unwrap();

    controller
      .start()
      .expect("zero-generation shutdown must remain restartable");
    let ran = Arc::new(AtomicBool::new(false));
    let ran_task = Arc::clone(&ran);
    controller
      .try_spawn_detached(async move {
        ran_task.store(true, Ordering::SeqCst);
      })
      .unwrap_or_else(|_| panic!("backend creation must succeed after rejected cleanup retires"));
    let dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(dispatch, false);
    assert!(ran.load(Ordering::SeqCst));
    controller.shutdown().unwrap();
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn public_block_on_contains_poll_and_drop_double_panic() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_BLOCK_ON_DOUBLE_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      struct PanicInPollAndDrop;

      impl Future for PanicInPollAndDrop {
        type Output = ();

        fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
          panic!("intentional block_on poll panic");
        }
      }

      impl Drop for PanicInPollAndDrop {
        fn drop(&mut self) {
          panic!("intentional block_on future destructor panic");
        }
      }

      let controller = current_thread_controller("block-on-double-panic");
      assert!(
        catch_unwind(AssertUnwindSafe(|| {
          block_on_with_controller(&controller, PanicInPollAndDrop);
        }))
        .is_err(),
        "the original poll panic must still reach the caller"
      );
      controller
        .shutdown()
        .expect("contained future destruction must not strand the runtime");
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::public_block_on_contains_poll_and_drop_double_panic")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the subprocess test must start");
    assert!(
      output.status.success(),
      "a block_on poll panic plus future destructor panic must not abort the process; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[test]
  fn real_generation_after_zero_work_cycle_keeps_frozen_restart_semantics() {
    let controller = RuntimeController::new();
    controller
      .start()
      .expect("initial lifecycle start must succeed");
    controller
      .shutdown()
      .expect("zero-work lifecycle shutdown must succeed");
    controller
      .start()
      .expect("zero-work lifecycle restart must remain lazy");
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::CurrentThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "lifecycle-zero-work-real-generation".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("configuration before first real async use must succeed");

    let first_generation = controller.backend().generation();
    controller
      .shutdown()
      .expect("the first real generation must stop");
    assert!(matches!(
      &controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .lifecycle,
      RuntimeLifecycle::Stopped
    ));
    let error = controller
      .configure(RuntimeOptions::default())
      .expect_err("a real generation must permanently freeze configuration");
    assert_eq!(
      error.to_string(),
      "the async runtime configuration is frozen; configure it before the first async call"
    );

    controller
      .start()
      .expect("the stopped real generation must restart");
    let restarted_generation = {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      let RuntimeLifecycle::Running(backend) = &state.lifecycle else {
        panic!("a real generation restart must eagerly create its replacement backend");
      };
      backend.generation()
    };
    assert_ne!(
      restarted_generation, first_generation,
      "a real generation restart must not reuse the retired backend"
    );
    controller
      .shutdown()
      .expect("the replacement generation must stop");
  }

  #[test]
  fn runtime_controller_rejects_submissions_after_shutdown() {
    let controller = current_thread_controller("lifecycle-reject");
    controller.start().expect("runtime must start");
    drop(controller.backend());
    controller.shutdown().expect("runtime must stop");

    let async_ran = Arc::new(AtomicBool::new(false));
    let async_ran_task = Arc::clone(&async_ran);
    let Err(rejected_future) = controller.try_spawn_detached(async move {
      async_ran_task.store(true, Ordering::SeqCst);
    }) else {
      panic!("shutdown must reject async work");
    };
    assert!(
      !async_ran.load(Ordering::SeqCst),
      "a rejected future must not be polled"
    );
    futures::executor::block_on(rejected_future);
    assert!(
      async_ran.load(Ordering::SeqCst),
      "the original future must remain usable"
    );

    let blocking_ran = Arc::new(AtomicBool::new(false));
    let blocking_ran_task = Arc::clone(&blocking_ran);
    let Err((blocking_error, rejected_work)) = controller.try_spawn_blocking(move || {
      blocking_ran_task.store(true, Ordering::SeqCst);
      7
    }) else {
      panic!("shutdown must reject blocking work");
    };
    assert_eq!(
      blocking_error.to_string(),
      "the async runtime is stopped; call start before submitting work"
    );
    assert!(
      !blocking_ran.load(Ordering::SeqCst),
      "rejected blocking work must not run"
    );
    assert_eq!(
      rejected_work(),
      7,
      "the original closure must remain usable"
    );

    let config_error = controller
      .configure(RuntimeOptions::default())
      .expect_err("shutdown must not make runtime configuration mutable again");
    assert_eq!(
      config_error.to_string(),
      "the async runtime configuration is frozen; configure it before the first async call"
    );

    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
  }

  #[test]
  fn rejected_future_can_be_resubmitted_after_restart() {
    let controller = current_thread_controller("lifecycle-retry-future");
    controller.start().expect("runtime must start");
    drop(controller.backend());
    controller.shutdown().expect("runtime must stop");

    let runs = Arc::new(AtomicUsize::new(0));
    let runs_task = Arc::clone(&runs);
    let future = async move {
      runs_task.fetch_add(1, Ordering::SeqCst);
      23
    };
    let Err((error, future)) = controller.try_spawn(future) else {
      panic!("stopped runtime must reject the future");
    };
    assert!(error.to_string().contains("runtime is stopped"));
    assert_eq!(runs.load(Ordering::SeqCst), 0);

    controller.start().expect("runtime must restart");
    let handle = controller
      .try_spawn(future)
      .unwrap_or_else(|_| panic!("restart must accept retained future"));
    let dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(dispatch, false);
    assert_eq!(
      futures::executor::block_on(handle).expect("retained future must complete"),
      23
    );
    assert_eq!(runs.load(Ordering::SeqCst), 1);
    controller
      .shutdown()
      .expect("replacement runtime must stop");
  }

  #[test]
  fn runtime_controller_start_after_shutdown_accepts_work() {
    let controller = current_thread_controller("lifecycle-restart");
    controller.start().expect("runtime must start");
    drop(controller.backend());
    controller.shutdown().expect("runtime must stop");
    controller.start().expect("runtime must restart");

    let async_ran = Arc::new(AtomicBool::new(false));
    let async_ran_task = Arc::clone(&async_ran);
    controller
      .try_spawn_detached(async move {
        async_ran_task.store(true, Ordering::SeqCst);
      })
      .unwrap_or_else(|_| panic!("restarted runtime must accept async work"));
    assert!(
      !async_ran.load(Ordering::SeqCst),
      "hostless CurrentThread submission must remain enqueue-only"
    );
    let dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(dispatch, false);
    assert!(
      async_ran.load(Ordering::SeqCst),
      "restarted runtime must poll submitted work"
    );

    let Ok(handle) = controller.try_spawn_blocking(|| 11) else {
      panic!("restarted runtime must accept blocking work");
    };
    assert_eq!(
      futures::executor::block_on(handle).expect("blocking work must complete after restart"),
      11
    );
  }

  #[test]
  fn stale_current_thread_host_callback_cannot_drive_a_restarted_generation() {
    let controller = current_thread_controller("stale-host-generation");
    let old_generation = controller.backend().generation();
    let old_dispatch = controller_current_thread_dispatch(&controller);
    controller.shutdown().unwrap();
    controller.start().unwrap();
    let new_generation = controller.backend().generation();
    assert_ne!(new_generation, old_generation);

    let ran = Arc::new(AtomicBool::new(false));
    let ran_task = Arc::clone(&ran);
    controller
      .try_spawn_detached(async move {
        ran_task.store(true, Ordering::SeqCst);
      })
      .unwrap_or_else(|_| panic!("the restarted runtime must accept work"));
    let new_dispatch = controller_current_thread_dispatch(&controller);
    assert_ne!(new_dispatch, old_dispatch);

    controller.drive_current_thread_dispatch(old_dispatch, false);
    assert!(
      !ran.load(Ordering::SeqCst),
      "a callback from the retired generation must not touch the restarted executor"
    );
    controller.drive_current_thread_dispatch(new_dispatch, false);
    assert!(ran.load(Ordering::SeqCst));
    controller.shutdown().unwrap();
  }

  #[test]
  fn stale_current_thread_dispatch_cancellation_cannot_clear_a_restarted_generation() {
    let controller = current_thread_controller("stale-host-cancellation");
    let old_generation = controller.backend().generation();
    let old_dispatch = controller_current_thread_dispatch(&controller);
    controller.shutdown().unwrap();
    controller.start().unwrap();
    let backend = controller.backend();
    let new_generation = backend.generation();
    assert_ne!(new_generation, old_generation);
    let RuntimeExecutor::CurrentThread(executor) = &backend.executor else {
      panic!("configured CurrentThread backend must create a CurrentThread executor");
    };
    let new_dispatch = current_thread_dispatch(executor);
    assert_ne!(new_dispatch, old_dispatch);

    controller.cancel_current_thread_dispatch_for_test(old_dispatch);
    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      new_dispatch,
      "a delayed failure from the retired generation must not release the replacement latch"
    );

    controller.cancel_current_thread_dispatch_for_test(new_dispatch);
    assert_eq!(
      executor.dispatch_pending.load(Ordering::Acquire),
      0,
      "the live generation must be able to cancel its accepted dispatch"
    );
    drop(backend);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn retained_current_thread_outputs_cannot_access_a_restarted_generation() {
    use std::sync::mpsc;

    type ProbeResult = (
      &'static str,
      Option<u64>,
      Result<(), String>,
      Result<(), String>,
      Result<(), String>,
    );

    struct StaleGenerationProbe {
      label: &'static str,
      controller: Arc<RuntimeController>,
      result: mpsc::Sender<ProbeResult>,
    }

    impl Drop for StaleGenerationProbe {
      fn drop(&mut self) {
        let generation = active_runtime_generation();
        let submission = match self.controller.try_spawn(async {}) {
          Ok(handle) => {
            drop(handle);
            Ok(())
          }
          Err((error, future)) => {
            drop(future);
            Err(error.to_string())
          }
        };
        let start = self.controller.start().map_err(|error| error.to_string());
        let shutdown = self
          .controller
          .shutdown()
          .map_err(|error| error.to_string());
        self
          .result
          .send((self.label, generation, submission, start, shutdown))
          .unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller("retained-current-thread-output"));
    let old_generation = controller.backend().generation();
    let (result_tx, result_rx) = mpsc::channel();

    let async_controller = Arc::clone(&controller);
    let async_result = result_tx.clone();
    let async_handle = controller
      .try_spawn(async move {
        StaleGenerationProbe {
          label: "async",
          controller: async_controller,
          result: async_result,
        }
      })
      .unwrap_or_else(|_| panic!("the first generation must accept the async output"));
    let old_dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(old_dispatch, false);

    let ready_controller = Arc::clone(&controller);
    let ready_handle = controller
      .try_spawn_blocking(move || StaleGenerationProbe {
        label: "ready",
        controller: ready_controller,
        result: result_tx,
      })
      .unwrap_or_else(|_| panic!("the first generation must accept the immediate output"));

    controller.shutdown().unwrap();
    controller.start().unwrap();
    let new_generation = controller.backend().generation();
    assert_ne!(new_generation, old_generation);

    drop(async_handle);
    let async_result = result_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the retained async output must be destroyed without waiting on the replacement");
    drop(ready_handle);
    let ready_result = result_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the retained immediate output must be destroyed without touching the replacement");

    for (expected_label, result) in [("async", async_result), ("ready", ready_result)] {
      let (label, generation, submission, start, shutdown) = result;
      assert_eq!(label, expected_label);
      assert_eq!(generation, Some(old_generation));
      for error in [submission, start, shutdown] {
        assert!(
          error
            .expect_err("retired-generation output destruction must be rejected")
            .contains("retired generation")
        );
      }
    }

    let survivor = controller
      .try_spawn(async { 29usize })
      .unwrap_or_else(|_| panic!("the replacement generation must remain usable"));
    let new_dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(new_dispatch, false);
    assert_eq!(futures::executor::block_on(survivor).unwrap(), 29);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn retained_blocking_output_cannot_wait_on_replacement_shutdown() {
    use std::sync::mpsc;

    struct ShutdownOnDrop {
      controller: Arc<RuntimeController>,
      result: mpsc::Sender<(Option<u64>, Result<(), RuntimeConfigError>)>,
    }

    impl Drop for ShutdownOnDrop {
      fn drop(&mut self) {
        self
          .result
          .send((active_runtime_generation(), self.controller.shutdown()))
          .unwrap();
      }
    }

    let controller = Arc::new(multi_thread_controller("retained-blocking-output", 2, 1));
    let old_generation = controller.backend().generation();
    let (result_tx, result_rx) = mpsc::channel();
    let old_handle = controller
      .try_spawn_blocking({
        let controller = Arc::clone(&controller);
        move || ShutdownOnDrop {
          controller,
          result: result_tx,
        }
      })
      .unwrap_or_else(|_| panic!("the first generation must accept the blocking output"));
    wait_until(
      "the first-generation blocking result to be buffered",
      || {
        controller
          .metrics
          .blocking_tasks_completed
          .load(Ordering::Acquire)
          == 1
      },
    );
    controller.shutdown().unwrap();
    controller.start().unwrap();
    let new_generation = controller.backend().generation();
    assert_ne!(new_generation, old_generation);

    let (holder_started_tx, holder_started_rx) = mpsc::channel();
    let (release_holder_tx, release_holder_rx) = mpsc::channel();
    let holder = controller
      .try_spawn_blocking(move || {
        holder_started_tx.send(()).unwrap();
        release_holder_rx.recv().unwrap();
      })
      .unwrap_or_else(|_| panic!("the replacement generation must accept the blocking holder"));
    holder_started_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap();

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until("the replacement generation to enter Stopping", || {
      matches!(
        controller.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner).lifecycle,
        RuntimeLifecycle::Stopping(identity) if identity.generation == new_generation
      )
    });

    let dropper = std::thread::spawn(move || drop(old_handle));
    let (observed_generation, reentrant_shutdown) =
      match result_rx.recv_timeout(Duration::from_secs(2)) {
        Ok(result) => result,
        Err(error) => {
          release_holder_tx.send(()).unwrap();
          let _ = shutdown_rx.recv_timeout(Duration::from_secs(2));
          let _ = dropper.join();
          let _ = shutdown.join();
          panic!("retained first-generation output waited on replacement shutdown: {error}");
        }
      };
    assert_eq!(observed_generation, Some(old_generation));
    let error = reentrant_shutdown
      .expect_err("a retained first-generation output must not control replacement shutdown");
    assert!(error.to_string().contains("retired generation"));

    release_holder_tx.send(()).unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    dropper.join().unwrap();
    shutdown.join().unwrap();
    futures::executor::block_on(holder).unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn admitted_current_thread_host_turn_holds_shutdown_until_it_retires() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("host-admission-shutdown"));
    let generation = controller.backend().generation();
    let dispatch = controller_current_thread_dispatch(&controller);
    let (admitted_tx, admitted_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let driver_controller = Arc::clone(&controller);
    let driver = std::thread::spawn(move || {
      AFTER_CURRENT_THREAD_HOST_ADMISSION_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          admitted_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      driver_controller.drive_current_thread_dispatch(dispatch, false);
    });
    admitted_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the host turn must claim its scheduler role before execution");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until(
      "shutdown to close the admitted CurrentThread generation",
      || {
        let state = controller
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        matches!(
          &state.lifecycle,
          RuntimeLifecycle::Stopping(identity) if identity.generation == generation
        )
      },
    );
    assert!(
      shutdown_rx
        .recv_timeout(Duration::from_millis(200))
        .is_err(),
      "shutdown must wait for an admitted host callback even before it starts draining"
    );

    release_tx.send(()).unwrap();
    driver.join().unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    shutdown.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn spawn_racing_shutdown_cannot_recreate_backend() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("lifecycle-race"));
    controller.start().expect("runtime must start");
    drop(controller.backend());

    let (at_hook_tx, at_hook_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let ran = Arc::new(AtomicBool::new(false));
    let ran_task = Arc::clone(&ran);
    let worker_controller = Arc::clone(&controller);
    let worker = std::thread::spawn(move || {
      BEFORE_RUNTIME_SUBMISSION_LOCK_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          at_hook_tx
            .send(())
            .expect("test coordinator must still be listening");
          release_rx
            .recv()
            .expect("test coordinator must release the submission");
        }));
      });

      let future = async move {
        ran_task.store(true, Ordering::SeqCst);
      };
      match worker_controller.try_spawn_detached(future) {
        Ok(()) => panic!("a submission linearized after shutdown must be rejected"),
        Err(future) => drop(future),
      }
    });

    at_hook_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("submitting thread must stop before taking the controller lock");
    controller.shutdown().expect("runtime must stop");
    release_tx
      .send(())
      .expect("submitting thread must still be waiting");
    worker.join().expect("submitting thread must not panic");

    assert!(
      !ran.load(Ordering::SeqCst),
      "the rejected task must never run"
    );
    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(
      matches!(&state.lifecycle, RuntimeLifecycle::Stopped),
      "the rejected submission must not lazily recreate a backend"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn accepted_current_thread_submission_destruction_blocks_shutdown_and_restart() {
    use std::sync::mpsc;

    struct BlockingDropFuture {
      work: Arc<GenerationWork>,
      entered: mpsc::Sender<(Option<u64>, usize)>,
      release: mpsc::Receiver<()>,
    }

    impl Future for BlockingDropFuture {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        Poll::Pending
      }
    }

    impl Drop for BlockingDropFuture {
      fn drop(&mut self) {
        let active = self
          .work
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .active;
        self
          .entered
          .send((ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get), active))
          .unwrap();
        self.release.recv().unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller("accepted-submission-drop"));
    let backend = controller.backend();
    let old_generation = backend.generation();
    let work = Arc::clone(&backend.work);
    let RuntimeExecutor::CurrentThread(executor) = &backend.executor else {
      panic!("configured CurrentThread backend must create a CurrentThread executor");
    };
    let executor = Arc::clone(executor);
    drop(backend);

    let (registered_tx, registered_rx) = mpsc::channel();
    let (release_submission_tx, release_submission_rx) = mpsc::channel();
    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let submit_controller = Arc::clone(&controller);
    let submit_work = Arc::clone(&work);
    let submitter = std::thread::spawn(move || {
      AFTER_ASYNC_WORK_REGISTRATION_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          registered_tx.send(()).unwrap();
          release_submission_rx.recv().unwrap();
        }));
      });
      submit_controller
        .try_spawn_detached(BlockingDropFuture {
          work: submit_work,
          entered: drop_entered_tx,
          release: release_drop_rx,
        })
        .unwrap_or_else(|_| {
          panic!("the submission linearized before shutdown and must be accepted")
        });
    });
    registered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the submitting thread must register generation work before shutdown");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until("CurrentThread shutdown to close the runnable queue", || {
      executor
        .queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .closed
    });
    release_submission_tx.send(()).unwrap();

    let (drop_generation, active_during_drop) = drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the closed queue must destroy the accepted unpolled future");
    assert_eq!(drop_generation, Some(old_generation));
    assert_eq!(
      active_during_drop, 1,
      "accepted generation work must remain registered through user future destruction"
    );

    let (start_tx, start_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      start_tx.send(start_controller.start()).unwrap();
    });
    let early_shutdown = shutdown_rx.recv_timeout(Duration::from_millis(200)).ok();
    let early_start = start_rx.recv_timeout(Duration::from_millis(200)).ok();
    let shutdown_overlapped = early_shutdown.is_some();
    let restart_overlapped = early_start.is_some();

    release_drop_tx.send(()).unwrap();
    submitter.join().unwrap();
    let shutdown_result = early_shutdown.unwrap_or_else(|| {
      shutdown_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("shutdown must finish after drop")
    });
    shutdown_result.unwrap();
    shutdown.join().unwrap();
    let start_result = early_start.unwrap_or_else(|| {
      start_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("restart must follow shutdown")
    });
    start_result.unwrap();
    starter.join().unwrap();

    assert!(
      !shutdown_overlapped,
      "shutdown must not publish Stopped while an accepted old-generation future is being destroyed"
    );
    assert!(
      !restart_overlapped,
      "restart must not create a new generation while an accepted old-generation future is being destroyed"
    );
    assert_ne!(controller.backend().generation(), old_generation);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn accepted_multi_thread_blocking_destruction_blocks_shutdown_and_restart() {
    use std::sync::mpsc;

    struct BlockingDrop {
      work: Arc<GenerationWork>,
      entered: mpsc::Sender<(Option<u64>, usize)>,
      release: mpsc::Receiver<()>,
    }

    impl Drop for BlockingDrop {
      fn drop(&mut self) {
        let active = self
          .work
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .active;
        self
          .entered
          .send((ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get), active))
          .unwrap();
        self.release.recv().unwrap();
      }
    }

    let controller = Arc::new(multi_thread_controller(
      "accepted-blocking-submission-drop",
      2,
      1,
    ));
    let backend = controller.backend();
    let old_generation = backend.generation();
    let work = Arc::clone(&backend.work);
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("configured MultiThread backend must create a MultiThread executor");
    };
    let executor = Arc::downgrade(executor);
    drop(backend);

    let (registered_tx, registered_rx) = mpsc::channel();
    let (release_submission_tx, release_submission_rx) = mpsc::channel();
    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let submit_controller = Arc::clone(&controller);
    let submitter = std::thread::spawn(move || {
      AFTER_BLOCKING_WORK_REGISTRATION_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          registered_tx.send(()).unwrap();
          release_submission_rx.recv().unwrap();
        }));
      });
      let drop_signal = BlockingDrop {
        work,
        entered: drop_entered_tx,
        release: release_drop_rx,
      };
      let handle = submit_controller
        .try_spawn_blocking(move || {
          let _drop_signal = drop_signal;
        })
        .unwrap_or_else(|_| {
          panic!("the submission linearized before shutdown and must be accepted")
        });
      assert!(
        futures::executor::block_on(handle).is_err(),
        "the executor must cancel work that reaches its queue after shutdown closed it"
      );
    });
    registered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the submitting thread must register generation work before shutdown");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until("MultiThread shutdown to close the blocking queue", || {
      executor
        .upgrade()
        .expect("the retiring executor must remain alive until shutdown completes")
        .blocking_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .closed
    });
    release_submission_tx.send(()).unwrap();

    let (drop_generation, active_during_drop) = drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the closed queue must destroy the accepted blocking closure");
    assert_eq!(drop_generation, Some(old_generation));
    assert_eq!(
      active_during_drop, 1,
      "accepted generation work must remain registered through blocking closure destruction"
    );

    let (start_tx, start_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      start_tx.send(start_controller.start()).unwrap();
    });
    let early_shutdown = shutdown_rx.recv_timeout(Duration::from_millis(200)).ok();
    let early_start = start_rx.recv_timeout(Duration::from_millis(200)).ok();
    let shutdown_overlapped = early_shutdown.is_some();
    let restart_overlapped = early_start.is_some();

    release_drop_tx.send(()).unwrap();
    submitter.join().unwrap();
    let shutdown_result = early_shutdown.unwrap_or_else(|| {
      shutdown_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("shutdown must finish after drop")
    });
    shutdown_result.unwrap();
    shutdown.join().unwrap();
    let start_result = early_start.unwrap_or_else(|| {
      start_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("restart must follow shutdown")
    });
    start_result.unwrap();
    starter.join().unwrap();

    assert!(
      !shutdown_overlapped,
      "shutdown must not publish Stopped while accepted old-generation blocking captures are being destroyed"
    );
    assert!(
      !restart_overlapped,
      "restart must not create a new generation while accepted old-generation blocking captures are being destroyed"
    );
    assert_ne!(controller.backend().generation(), old_generation);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_controller_reports_its_exact_physical_worker_count() {
    let controller = multi_thread_controller("lifecycle-physical", 1, 8);
    let options = controller.options();
    assert_eq!((options.worker_threads, options.max_blocking_tasks), (2, 1));

    let backend = controller.backend();
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("configured MultiThread backend must create a Rayon executor");
    };
    assert_eq!(executor.pool.current_num_threads(), options.worker_threads);
    let lifecycle = Arc::clone(&executor.worker_lifecycle);
    drop(backend);

    controller.shutdown().expect("runtime must stop");
    assert_eq!(
      lifecycle.remaining(),
      0,
      "shutdown must observe every physical worker exit"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_shutdown_waits_for_worker_tls_destructors() {
    // Invariant: `shutdown()`'s worker retirement is a JOIN barrier that
    // includes worker TLS-destructor completion -- `wait_for_all_workers`
    // joins the OS threads, and an OS thread only becomes joinable after its
    // TLS destructors ran. Proven by RECORDING (an atomic bump) from each
    // worker's destructor and sampling the counter on the shutdown thread at
    // the very instant `shutdown()` returns: a barrier that excluded the
    // destructors would race that sample and fail loudly.
    //
    // The destructor must never do more than record. The previous shape
    // parked it on a condvar until the harness released it -- on Windows TLS
    // destructors run under the process loader lock, so the first parked
    // worker blocked the second from even ENTERING its destructor, the
    // release condition (both entered) became unsatisfiable, and the parked
    // destructor froze every thread spawn/exit in the process: the
    // whole-suite silent CI wedge (see the LOADER-LOCK RULE at
    // `WorkerTlsDropAction`).
    use std::sync::mpsc;

    let controller = Arc::new(multi_thread_controller("lifecycle-worker-tls", 2, 1));
    let backend = controller.backend();
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("configured MultiThread backend must create a Rayon executor");
    };
    let worker_count = executor.pool.current_num_threads();
    let completed = Arc::new(AtomicUsize::new(0));
    let probe_completed = Arc::clone(&completed);
    executor.pool.broadcast(move |_| {
      WORKER_TLS_DROP_PROBE.with(|slot| {
        let previous = slot.borrow_mut().replace(WorkerTlsDropProbe {
          action: Some(WorkerTlsDropAction::Record {
            completed: Arc::clone(&probe_completed),
          }),
        });
        assert!(
          previous.is_none(),
          "each worker must install exactly one TLS drop probe"
        );
      });
    });
    drop(backend);

    assert_eq!(
      completed.load(Ordering::SeqCst),
      0,
      "no worker TLS destructor may run before shutdown retires the workers"
    );

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let sample_completed = Arc::clone(&completed);
    let shutdown = std::thread::spawn(move || {
      let result = shutdown_controller.shutdown();
      // Sample on the SAME thread, before any further synchronization could
      // mask a barrier gap: at this instant every destructor must already
      // have recorded itself.
      let seen_at_return = sample_completed.load(Ordering::SeqCst);
      shutdown_tx.send((result, seen_at_return)).unwrap();
    });
    let (shutdown_result, seen_at_return) = shutdown_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("shutdown must finish once worker TLS destructors have run");
    shutdown_result.unwrap();
    assert_eq!(
      seen_at_return, worker_count,
      "every worker TLS destructor must have completed before shutdown() returned: \
       the worker-join barrier must include TLS-destructor completion"
    );
    join_within(
      "the shutdown thread exits after teardown",
      shutdown,
      Duration::from_secs(30),
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn worker_tls_destructor_lifecycle_reentry_fails_fast_without_self_join() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_WORKER_TLS_LIFECYCLE_REENTRY_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      use std::sync::mpsc;

      let controller = Arc::new(multi_thread_controller("worker-tls-reentry", 2, 1));
      let backend = controller.backend();
      let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
        panic!("configured MultiThread backend must create a Rayon executor");
      };
      let installed = Arc::new(AtomicBool::new(false));
      let (completed_tx, completed_rx) = mpsc::channel();
      let probe_controller = Arc::clone(&controller);
      let probe_installed = Arc::clone(&installed);
      executor.pool.broadcast(move |_| {
        if probe_installed.swap(true, Ordering::SeqCst) {
          return;
        }
        WORKER_TLS_DROP_PROBE.with(|slot| {
          let previous = slot.borrow_mut().replace(WorkerTlsDropProbe {
            action: Some(WorkerTlsDropAction::ReenterLifecycle {
              controller: Arc::clone(&probe_controller),
              completed: completed_tx.clone(),
            }),
          });
          assert!(
            previous.is_none(),
            "the selected worker must have no prior TLS probe"
          );
        });
      });
      assert!(
        installed.load(Ordering::SeqCst),
        "one worker must install the lifecycle probe"
      );
      drop(backend);

      controller
        .shutdown()
        .expect("external shutdown must join the retiring workers");
      let (start, shutdown) = completed_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the TLS destructor must complete both lifecycle reentry attempts");
      assert_eq!(
        start.unwrap_err(),
        "cannot restart the async runtime from work in the generation being stopped"
      );
      assert_eq!(
        shutdown.unwrap_err(),
        "cannot wait for async runtime shutdown from work in the generation being stopped"
      );
      return;
    }

    let mut child = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg(
        "async_runtime::tests::worker_tls_destructor_lifecycle_reentry_fails_fast_without_self_join",
      )
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .stdout(std::process::Stdio::piped())
      .stderr(std::process::Stdio::piped())
      .spawn()
      .expect("the TLS lifecycle-reentry subprocess must start");
    let deadline = Instant::now() + Duration::from_secs(5);
    let status = loop {
      if let Some(status) = child
        .try_wait()
        .expect("the subprocess status must be readable")
      {
        break status;
      }
      if Instant::now() >= deadline {
        let _ = child.kill();
        let output = child
          .wait_with_output()
          .expect("the timed-out subprocess must be reaped");
        panic!(
          "worker TLS lifecycle reentry deadlocked shutdown\nstdout={}\nstderr={}",
          String::from_utf8_lossy(&output.stdout),
          String::from_utf8_lossy(&output.stderr)
        );
      }
      std::thread::sleep(Duration::from_millis(10));
    };
    let output = child
      .wait_with_output()
      .expect("the completed subprocess output must be read");
    assert!(
      status.success(),
      "worker TLS lifecycle reentry must fail fast; status={:?}\nstdout={}\nstderr={}",
      status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_shutdown_cancels_an_accepted_pending_task() {
    use std::sync::mpsc;

    struct DropSignal(mpsc::Sender<()>);
    impl Drop for DropSignal {
      fn drop(&mut self) {
        let _ = self.0.send(());
      }
    }

    let controller = multi_thread_controller("lifecycle-cancel", 2, 1);
    let (polled_tx, polled_rx) = mpsc::channel();
    let (dropped_tx, dropped_rx) = mpsc::channel();
    controller
      .try_spawn_detached(async move {
        let _drop_signal = DropSignal(dropped_tx);
        polled_tx.send(()).unwrap();
        std::future::pending::<()>().await;
      })
      .unwrap_or_else(|_| panic!("running runtime must accept the pending task"));
    polled_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the pending task must be polled before shutdown");

    controller
      .shutdown()
      .expect("shutdown must cancel accepted async work");
    dropped_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("shutdown must drop the accepted task future before returning");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_outranks_perpetual_self_wake() {
    use std::sync::mpsc;

    struct SelfWakingPending {
      entered: Option<mpsc::Sender<()>>,
    }

    impl Future for SelfWakingPending {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        if let Some(entered) = self.entered.take() {
          entered.send(()).unwrap();
        }
        cx.waker().wake_by_ref();
        Poll::Pending
      }
    }

    let controller = Arc::new(current_thread_controller(
      "current-thread-self-wake-shutdown",
    ));
    let (entered_tx, entered_rx) = mpsc::channel();
    let (outcome_tx, outcome_rx) = mpsc::channel();
    let block_on_controller = Arc::clone(&controller);
    let runner = std::thread::spawn(move || {
      let mut future = std::pin::pin!(SelfWakingPending {
        entered: Some(entered_tx)
      });
      outcome_tx
        .send(block_on_controller.block_on(future.as_mut()))
        .unwrap();
    });
    entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the self-waking future must be polled before shutdown");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("shutdown must outrank a stored self-wake permit")
      .unwrap();
    assert_eq!(
      outcome_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the raw block_on driver must report shutdown"),
      BlockOnOutcome::Stopped
    );
    runner.join().unwrap();
    shutdown.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_fifo_claim_after_stop_publication_cancels_without_polling() {
    use std::sync::mpsc;

    let controller = multi_thread_controller("stopped-fifo-claim", 2, 1);
    let backend = controller.backend();
    let executor = match &backend.executor {
      RuntimeExecutor::MultiThread(executor) => Arc::clone(executor),
      RuntimeExecutor::CurrentThread(_) => unreachable!(),
    };
    let release_workers = Arc::new((Mutex::new(false), Condvar::new()));
    let (worker_ready_tx, worker_ready_rx) = mpsc::channel();
    for _ in 0..2 {
      let worker_ready_tx = worker_ready_tx.clone();
      let release_workers = Arc::clone(&release_workers);
      executor.pool.spawn(move || {
        worker_ready_tx.send(()).unwrap();
        let (released, changed) = &*release_workers;
        let mut released = released
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        while !*released {
          released = changed
            .wait(released)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
      });
    }
    drop(worker_ready_tx);
    for _ in 0..2 {
      worker_ready_rx
        .recv_timeout(Duration::from_secs(5))
        .expect("both workers must be occupied before the FIFO runnable is submitted");
    }
    drop(executor);
    drop(backend);

    let polls = Arc::new(AtomicUsize::new(0));
    let handle = controller.spawn(StopPollProbe {
      polls: Arc::clone(&polls),
      first_poll: None,
    });
    wait_until("the FIFO runnable to be queued", || {
      controller.metrics.queued_runnables.load(Ordering::SeqCst) == 1
    });

    let observed_queue = Arc::new(Mutex::new(None));
    let hook_observed_queue = Arc::clone(&observed_queue);
    let hook_metrics = Arc::clone(&controller.metrics);
    AFTER_GENERATION_STOP_PUBLICATION_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        let (released, changed) = &*release_workers;
        *released
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner) = true;
        changed.notify_all();
        wait_until("the stopped FIFO runnable claim", || {
          hook_metrics.queued_runnables.load(Ordering::SeqCst) == 0
        });
        *hook_observed_queue
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner) =
          Some(hook_metrics.queued_runnables.load(Ordering::SeqCst));
      }));
    });

    controller
      .shutdown()
      .expect("shutdown must cancel the stopped FIFO claim");
    assert_eq!(polls.load(Ordering::SeqCst), 0);
    assert_eq!(
      *observed_queue
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner),
      Some(0)
    );
    assert_eq!(
      controller.metrics.queued_runnables.load(Ordering::SeqCst),
      0
    );
    drop(handle);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_lifo_claim_after_stop_publication_cancels_without_polling() {
    use std::sync::mpsc;

    let controller = multi_thread_controller("stopped-lifo-claim", 2, 1);
    let backend = controller.backend();
    let executor = match &backend.executor {
      RuntimeExecutor::MultiThread(executor) => Arc::clone(executor),
      RuntimeExecutor::CurrentThread(_) => unreachable!(),
    };
    let polls = Arc::new(AtomicUsize::new(0));
    let scheduler = Arc::downgrade(&executor);
    let (runnable, task) = async_task::spawn(
      StopPollProbe {
        polls: Arc::clone(&polls),
        first_poll: None,
      },
      move |runnable| {
        if let Some(executor) = scheduler.upgrade() {
          executor.schedule(runnable);
        }
      },
    );
    let (slot_ready_tx, slot_ready_rx) = mpsc::channel();
    let (release_slot_tx, release_slot_rx) = mpsc::channel();
    let (claim_done_tx, claim_done_rx) = mpsc::channel();
    let worker_executor = Arc::clone(&executor);
    let worker_metrics = Arc::clone(&controller.metrics);
    executor.pool.spawn(move || {
      let _driver = OnPoolWorkerGuard::enter(worker_executor.id);
      worker_executor.schedule(runnable);
      slot_ready_tx.send(()).unwrap();
      release_slot_rx.recv().unwrap();
      let claimed = worker_executor.run_one_runnable();
      claim_done_tx
        .send((
          claimed,
          worker_metrics.queued_runnables.load(Ordering::SeqCst),
        ))
        .unwrap();
    });
    slot_ready_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the worker must publish the LIFO runnable before shutdown");
    assert_eq!(
      controller.metrics.queued_runnables.load(Ordering::SeqCst),
      1
    );
    drop(executor);
    drop(backend);

    let observed_claim = Arc::new(Mutex::new(None));
    let hook_observed_claim = Arc::clone(&observed_claim);
    AFTER_GENERATION_STOP_PUBLICATION_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        release_slot_tx.send(()).unwrap();
        let result = claim_done_rx
          .recv_timeout(Duration::from_secs(5))
          .expect("the stopped LIFO runnable claim must complete before abort");
        *hook_observed_claim
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(result);
      }));
    });

    controller
      .shutdown()
      .expect("shutdown must cancel the stopped LIFO claim");
    assert_eq!(polls.load(Ordering::SeqCst), 0);
    assert_eq!(
      *observed_claim
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner),
      Some((true, 0))
    );
    assert_eq!(
      controller.metrics.queued_runnables.load(Ordering::SeqCst),
      0
    );
    drop(task);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_publishes_stop_before_queued_destructor_cleanup() {
    use std::sync::mpsc;

    struct BlockingDrop {
      entered: mpsc::Sender<()>,
      release: mpsc::Receiver<()>,
    }

    impl Drop for BlockingDrop {
      fn drop(&mut self) {
        self.entered.send(()).unwrap();
        self.release.recv().unwrap();
      }
    }

    struct TwoPollProbe {
      first_poll: Option<mpsc::Sender<()>>,
      release_first_poll: mpsc::Receiver<()>,
      second_poll: mpsc::Sender<()>,
    }

    impl Future for TwoPollProbe {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        if let Some(first_poll) = self.first_poll.take() {
          first_poll.send(()).unwrap();
          self.release_first_poll.recv().unwrap();
        } else {
          self.second_poll.send(()).unwrap();
        }
        cx.waker().wake_by_ref();
        Poll::Pending
      }
    }

    let controller = Arc::new(current_thread_controller("shutdown-stop-before-cleanup"));
    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let blocking_drop = BlockingDrop {
      entered: drop_entered_tx,
      release: release_drop_rx,
    };
    controller
      .try_spawn_detached(async move {
        let _drop = blocking_drop;
        std::future::pending::<()>().await;
      })
      .unwrap_or_else(|_| panic!("the cleanup probe must be accepted"));

    let (first_poll_tx, first_poll_rx) = mpsc::channel();
    let (release_first_poll_tx, release_first_poll_rx) = mpsc::channel();
    let (second_poll_tx, second_poll_rx) = mpsc::channel();
    let (outcome_tx, outcome_rx) = mpsc::channel();
    let runner_controller = Arc::clone(&controller);
    let runner = std::thread::spawn(move || {
      let mut future = std::pin::pin!(TwoPollProbe {
        first_poll: Some(first_poll_tx),
        release_first_poll: release_first_poll_rx,
        second_poll: second_poll_tx,
      });
      outcome_tx
        .send(runner_controller.block_on(future.as_mut()))
        .unwrap();
    });
    first_poll_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the active block_on poll must enter before shutdown");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("shutdown must begin destroying queued work");

    release_first_poll_tx.send(()).unwrap();
    let polled_again = second_poll_rx
      .recv_timeout(Duration::from_millis(200))
      .is_ok();
    release_drop_tx.send(()).unwrap();

    assert!(
      !polled_again,
      "an active block_on driver must observe generation stop before queued user cleanup blocks"
    );
    assert_eq!(
      outcome_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      BlockOnOutcome::Stopped
    );
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    runner.join().unwrap();
    shutdown.join().unwrap();
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn shutdown_cancels_nested_block_on_within_deadline() {
    use std::sync::mpsc;

    let controller = Arc::new(multi_thread_controller("nested-block-on-shutdown", 2, 1));
    let task_controller = Arc::clone(&controller);
    let (entered_tx, entered_rx) = mpsc::channel();
    let task = controller
      .try_spawn(async move {
        entered_tx.send(()).unwrap();
        block_on_with_controller(&task_controller, std::future::pending::<()>());
      })
      .unwrap_or_else(|_| panic!("runtime must accept the nested block_on task"));
    entered_rx.recv_timeout(Duration::from_secs(5)).unwrap();

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("shutdown must wake and cancel an active nested block_on")
      .unwrap();
    shutdown.join().unwrap();
    assert!(
      futures::executor::block_on(task).is_err(),
      "the cancelled nested block_on task must resolve as stopped"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn stopped_public_block_on_drops_future_before_generation_retirement() {
    use std::sync::mpsc;

    struct PendingDrop {
      entered: Option<mpsc::Sender<()>>,
      dropped: mpsc::Sender<Option<u64>>,
      release: mpsc::Receiver<()>,
    }

    impl Future for PendingDrop {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if let Some(entered) = self.entered.take() {
          entered.send(()).unwrap();
        }
        Poll::Pending
      }
    }

    impl Drop for PendingDrop {
      fn drop(&mut self) {
        self
          .dropped
          .send(ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get))
          .unwrap();
        self.release.recv().unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller(
      "public-block-on-generation-destruction",
    ));
    let generation = controller.backend().generation();
    let (entered_tx, entered_rx) = mpsc::channel();
    let (dropped_tx, dropped_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let (runner_done_tx, runner_done_rx) = mpsc::channel();
    let block_controller = Arc::clone(&controller);
    let runner = std::thread::spawn(move || {
      let result = catch_unwind(AssertUnwindSafe(|| {
        block_on_with_controller(
          &block_controller,
          PendingDrop {
            entered: Some(entered_tx),
            dropped: dropped_tx,
            release: release_rx,
          },
        );
      }));
      runner_done_tx.send(result.is_err()).unwrap();
    });
    entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the public block_on future must be polled before shutdown");

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });

    assert_eq!(
      dropped_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("shutdown must wake block_on and begin destroying its future"),
      Some(generation),
      "the stopped future must be destroyed under its retiring generation identity"
    );
    assert!(
      shutdown_rx
        .recv_timeout(Duration::from_millis(200))
        .is_err(),
      "shutdown must not publish Stopped while the public block_on future destructor is running"
    );

    release_tx.send(()).unwrap();
    assert!(
      runner_done_rx.recv_timeout(Duration::from_secs(2)).unwrap(),
      "the public helper must retain its existing early-stop panic behavior"
    );
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    runner.join().unwrap();
    shutdown.join().unwrap();
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn shutdown_contains_panicking_nested_block_on_future_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_NESTED_BLOCK_ON_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      use std::sync::mpsc;

      struct PendingPanicOnDrop {
        entered: Option<mpsc::Sender<()>>,
      }

      impl Future for PendingPanicOnDrop {
        type Output = ();

        fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
          if let Some(entered) = self.entered.take() {
            entered.send(()).unwrap();
          }
          Poll::Pending
        }
      }

      impl Drop for PendingPanicOnDrop {
        fn drop(&mut self) {
          panic!("intentional nested block_on future destructor panic");
        }
      }

      let controller = Arc::new(multi_thread_controller("nested-block-on-drop-panic", 2, 1));
      let task_controller = Arc::clone(&controller);
      let (entered_tx, entered_rx) = mpsc::channel();
      let task = controller
        .try_spawn(async move {
          block_on_with_controller(
            &task_controller,
            PendingPanicOnDrop {
              entered: Some(entered_tx),
            },
          );
        })
        .unwrap_or_else(|_| panic!("the runtime must accept the nested block_on task"));
      entered_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the nested block_on future must be polled before shutdown");

      controller
        .shutdown()
        .expect("shutdown must contain nested future destruction");
      assert!(
        futures::executor::block_on(task).is_err(),
        "shutdown cancellation must still surface as a task error"
      );
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::shutdown_contains_panicking_nested_block_on_future_drop")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the subprocess test must start");
    assert!(
      output.status.success(),
      "shutdown must not abort while destroying a hostile nested block_on future; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn panicking_future_drop_is_contained_before_async_task_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_PANICKING_FUTURE_DROP_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      struct PanicOnDrop;
      impl Drop for PanicOnDrop {
        fn drop(&mut self) {
          panic!("intentional future destructor panic");
        }
      }

      let controller = current_thread_controller("future-drop-subprocess");
      let bomb = PanicOnDrop;
      controller
        .try_spawn_detached(async move {
          let _bomb = bomb;
          std::future::pending::<()>().await;
        })
        .unwrap_or_else(|_| panic!("runtime must accept the pending task"));
      controller
        .shutdown()
        .expect("shutdown must contain the future destructor panic");
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::panicking_future_drop_is_contained_before_async_task_drop")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the subprocess test must start");
    assert!(
      output.status.success(),
      "panicking future destruction must not trigger async-task exit 134; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn panicking_detached_output_drop_is_contained_before_async_task_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_PANICKING_TASK_OUTPUT_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      struct PanicOnDrop;
      impl Drop for PanicOnDrop {
        fn drop(&mut self) {
          panic!("intentional detached output destructor panic");
        }
      }

      let controller = current_thread_controller("output-drop-subprocess");
      let handle = controller
        .try_spawn(async { PanicOnDrop })
        .unwrap_or_else(|_| panic!("runtime must accept the task"));
      drop(handle);
      let dispatch = controller_current_thread_dispatch(&controller);
      controller.drive_current_thread_dispatch(dispatch, false);
      controller.shutdown().unwrap();
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg(
        "async_runtime::tests::panicking_detached_output_drop_is_contained_before_async_task_drop",
      )
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the subprocess test must start");
    assert!(
      output.status.success(),
      "panicking detached output destruction must not trigger async-task exit 134; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_waits_for_host_driven_detached_output_drop() {
    use std::sync::mpsc;

    struct BlockingDrop {
      controller: Arc<RuntimeController>,
      entered: mpsc::Sender<Option<u64>>,
      release: mpsc::Receiver<()>,
      reentrant_shutdown: mpsc::Sender<Result<(), RuntimeConfigError>>,
    }

    impl Drop for BlockingDrop {
      fn drop(&mut self) {
        self
          .entered
          .send(ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get))
          .unwrap();
        self.release.recv().unwrap();
        self
          .reentrant_shutdown
          .send(self.controller.shutdown())
          .unwrap();
      }
    }

    let controller = Arc::new(current_thread_controller(
      "current-thread-host-drain-output-retirement",
    ));
    let old_generation = controller.backend().generation();
    let (entered_tx, entered_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let (reentrant_tx, reentrant_rx) = mpsc::channel();
    let output_controller = Arc::clone(&controller);
    let handle = controller
      .try_spawn(async move {
        BlockingDrop {
          controller: output_controller,
          entered: entered_tx,
          release: release_rx,
          reentrant_shutdown: reentrant_tx,
        }
      })
      .unwrap_or_else(|_| panic!("the CurrentThread runtime must accept the detached task"));
    drop(handle);
    let dispatch = controller_current_thread_dispatch(&controller);

    let driver_controller = Arc::clone(&controller);
    let driver =
      std::thread::spawn(move || driver_controller.drive_current_thread_dispatch(dispatch, false));
    assert_eq!(
      entered_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the host turn must begin destroying the detached output"),
      Some(old_generation),
      "detached output destruction must retain the generation that produced it"
    );

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until(
      "CurrentThread shutdown to enter the old generation's stopping state",
      || {
        let state = controller
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        matches!(
          &state.lifecycle,
          RuntimeLifecycle::Stopping(identity) if identity.generation == old_generation
        )
      },
    );

    let (restart_tx, restart_rx) = mpsc::channel();
    let restart_controller = Arc::clone(&controller);
    let restart = std::thread::spawn(move || {
      restart_controller.start().unwrap();
      restart_tx
        .send(restart_controller.backend().generation())
        .unwrap();
    });

    let early_shutdown = shutdown_rx.recv_timeout(Duration::from_millis(200)).ok();
    let early_restart = restart_rx.recv_timeout(Duration::from_millis(200)).ok();
    let shutdown_overlapped = early_shutdown.is_some();
    let restart_overlapped = early_restart.is_some();
    release_tx.send(()).unwrap();

    let reentrant_error = reentrant_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the retiring output destructor must finish its lifecycle check")
      .expect_err("old-generation output destruction must not shut down a replacement runtime");
    assert!(
      reentrant_error
        .to_string()
        .contains("generation being stopped"),
      "the destructor must still observe its old generation as Stopping: {reentrant_error}"
    );

    let shutdown_result = early_shutdown.unwrap_or_else(|| {
      shutdown_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("shutdown must finish after detached output destruction retires")
    });
    shutdown_result.unwrap();
    let new_generation = early_restart.unwrap_or_else(|| {
      restart_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("restart must finish after the old host turn retires")
    });

    driver.join().unwrap();
    shutdown.join().unwrap();
    restart.join().unwrap();
    assert!(
      !shutdown_overlapped,
      "shutdown must not publish Stopped while a host turn is destroying detached output"
    );
    assert!(
      !restart_overlapped,
      "restart must not overlap a host turn from the retiring generation"
    );
    assert_ne!(new_generation, old_generation);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn queued_destructor_reentrant_shutdown_is_generation_rejected() {
    use std::sync::mpsc;

    struct ShutdownOnDrop {
      controller: Arc<RuntimeController>,
      result: mpsc::Sender<Result<(), RuntimeConfigError>>,
    }

    impl Drop for ShutdownOnDrop {
      fn drop(&mut self) {
        let _ = self.result.send(self.controller.shutdown());
      }
    }

    let controller = Arc::new(multi_thread_controller("reentrant-drop-shutdown", 2, 1));
    let (running_tx, running_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let running = controller
      .try_spawn_blocking(move || {
        running_tx.send(()).unwrap();
        release_rx.recv().unwrap();
      })
      .unwrap_or_else(|_| panic!("runtime must accept the blocking holder"));
    running_rx.recv_timeout(Duration::from_secs(5)).unwrap();

    let (reentrant_tx, reentrant_rx) = mpsc::channel();
    let bomb = ShutdownOnDrop {
      controller: Arc::clone(&controller),
      result: reentrant_tx,
    };
    let queued = controller
      .try_spawn_blocking(move || {
        let _bomb = &bomb;
      })
      .unwrap_or_else(|_| panic!("runtime must accept queued blocking work"));

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    let error = reentrant_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("queued destruction must not self-deadlock")
      .expect_err("the retiring generation must reject reentrant shutdown");
    assert!(error.to_string().contains("generation being stopped"));
    release_tx.send(()).unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    shutdown.join().unwrap();
    futures::executor::block_on(running).unwrap();
    assert!(futures::executor::block_on(queued).is_err());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn rejected_destructor_holds_stopping_generation_until_drop_finishes() {
    use std::sync::mpsc;

    struct ShutdownAfterRelease {
      controller: Arc<RuntimeController>,
      entered: mpsc::Sender<()>,
      release: mpsc::Receiver<()>,
      result: mpsc::Sender<Result<(), RuntimeConfigError>>,
    }

    impl Drop for ShutdownAfterRelease {
      fn drop(&mut self) {
        self.entered.send(()).unwrap();
        self.release.recv().unwrap();
        self.result.send(self.controller.shutdown()).unwrap();
      }
    }

    let controller = Arc::new(multi_thread_controller("rejected-drop-generation", 2, 1));
    let (holder_started_tx, holder_started_rx) = mpsc::channel();
    let (release_holder_tx, release_holder_rx) = mpsc::channel();
    let holder = controller
      .try_spawn_blocking(move || {
        holder_started_tx.send(()).unwrap();
        release_holder_rx.recv().unwrap();
      })
      .unwrap_or_else(|_| panic!("runtime must accept the blocking holder"));
    holder_started_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap();

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    wait_until("the runtime entered Stopping", || {
      matches!(
        controller
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .lifecycle,
        RuntimeLifecycle::Stopping(_)
      )
    });

    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let (reentrant_tx, reentrant_rx) = mpsc::channel();
    let rejected_controller = Arc::clone(&controller);
    let (rejected_done_tx, rejected_done_rx) = mpsc::channel();
    let rejected = std::thread::spawn(move || {
      let bomb = ShutdownAfterRelease {
        controller: Arc::clone(&rejected_controller),
        entered: drop_entered_tx,
        release: release_drop_rx,
        result: reentrant_tx,
      };
      let handle = rejected_controller.spawn(async move {
        let _bomb = bomb;
        std::future::pending::<()>().await;
      });
      rejected_done_tx
        .send(futures::executor::block_on(handle))
        .unwrap();
    });
    drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap();

    release_holder_tx.send(()).unwrap();
    assert!(
      shutdown_rx
        .recv_timeout(Duration::from_millis(200))
        .is_err(),
      "shutdown crossed into Stopped before rejected destruction finished"
    );

    let (start_tx, start_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      start_tx.send(start_controller.start()).unwrap();
    });
    assert!(
      start_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "restart crossed into a new generation before rejected destruction finished"
    );

    release_drop_tx.send(()).unwrap();
    let error = reentrant_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the rejected destructor must complete")
      .expect_err("the retiring generation must reject the destructor's shutdown");
    assert!(error.to_string().contains("generation being stopped"));
    assert!(
      rejected_done_rx
        .recv_timeout(Duration::from_secs(2))
        .unwrap()
        .is_err()
    );
    rejected.join().unwrap();

    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    shutdown.join().unwrap();
    start_rx
      .recv_timeout(Duration::from_secs(2))
      .unwrap()
      .unwrap();
    starter.join().unwrap();
    futures::executor::block_on(holder).unwrap();
    controller.shutdown().unwrap();
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn shutdown_contains_hostile_caught_panic_payload() {
    use std::{panic::panic_any, sync::mpsc};

    struct PanicAgain;
    impl Drop for PanicAgain {
      fn drop(&mut self) {
        panic!("caught panic payload destructor escaped");
      }
    }

    struct PanicPayloadOnDrop(mpsc::Sender<()>);
    impl Drop for PanicPayloadOnDrop {
      fn drop(&mut self) {
        let _ = self.0.send(());
        panic_any(PanicAgain);
      }
    }

    let controller = Arc::new(multi_thread_controller("hostile-panic-payload", 2, 1));
    let (running_tx, running_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let running = controller
      .try_spawn_blocking(move || {
        running_tx.send(()).unwrap();
        release_rx.recv().unwrap();
      })
      .unwrap_or_else(|_| panic!("runtime must accept the blocking holder"));
    running_rx.recv_timeout(Duration::from_secs(5)).unwrap();

    let (drop_tx, drop_rx) = mpsc::channel();
    let payload = PanicPayloadOnDrop(drop_tx);
    let queued = controller
      .try_spawn_blocking(move || {
        let _payload = &payload;
      })
      .unwrap_or_else(|_| panic!("runtime must accept queued blocking work"));

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    drop_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    release_tx.send(()).unwrap();
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("hostile panic payload destruction must remain contained")
      .unwrap();
    shutdown
      .join()
      .expect("the caught payload must not panic during destruction");
    futures::executor::block_on(running).unwrap();
    assert!(futures::executor::block_on(queued).is_err());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_shutdown_drops_queued_blocking_and_waits_for_running_blocking() {
    use std::sync::mpsc;

    struct DropSignal(mpsc::Sender<()>);
    impl Drop for DropSignal {
      fn drop(&mut self) {
        let _ = self.0.send(());
      }
    }

    let controller = Arc::new(multi_thread_controller("lifecycle-blocking", 2, 1));
    let (running_tx, running_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let running = controller
      .try_spawn_blocking(move || {
        running_tx.send(()).unwrap();
        release_rx.recv().unwrap();
        7usize
      })
      .unwrap_or_else(|_| panic!("running blocking work must be accepted"));
    running_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the first blocking job must hold the only blocking slot");

    let queued_ran = Arc::new(AtomicBool::new(false));
    let queued_ran_work = Arc::clone(&queued_ran);
    let (queued_dropped_tx, queued_dropped_rx) = mpsc::channel();
    let queued_drop_signal = DropSignal(queued_dropped_tx);
    let queued = controller
      .try_spawn_blocking(move || {
        let _drop_signal = queued_drop_signal;
        queued_ran_work.store(true, Ordering::SeqCst);
        11usize
      })
      .unwrap_or_else(|_| panic!("queued blocking work must be accepted"));

    let (shutdown_done_tx, shutdown_done_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_controller.shutdown().unwrap();
      shutdown_done_tx.send(()).unwrap();
    });

    queued_dropped_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("shutdown must drop queued blocking work");
    assert!(
      !queued_ran.load(Ordering::SeqCst),
      "queued blocking work must not execute"
    );
    assert!(
      shutdown_done_rx.try_recv().is_err(),
      "shutdown must wait while an accepted blocking closure is still running"
    );

    release_tx.send(()).unwrap();
    shutdown_done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("shutdown must finish after running blocking work retires");
    shutdown.join().unwrap();
    assert_eq!(futures::executor::block_on(running).unwrap(), 7);
    assert!(
      futures::executor::block_on(queued).is_err(),
      "the queued blocking handle must resolve as cancelled"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_shutdown_contains_panicking_queued_blocking_destructor_and_restarts() {
    use std::sync::mpsc;

    struct PanicOnDrop(mpsc::Sender<()>);
    impl Drop for PanicOnDrop {
      fn drop(&mut self) {
        let _ = self.0.send(());
        panic!("intentional queued blocking destructor panic");
      }
    }

    let controller = Arc::new(multi_thread_controller("lifecycle-drop-panic", 2, 1));
    let (running_tx, running_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let running = controller
      .try_spawn_blocking(move || {
        running_tx.send(()).unwrap();
        release_rx.recv().unwrap();
      })
      .unwrap_or_else(|_| panic!("running blocking work must be accepted"));
    running_rx.recv_timeout(Duration::from_secs(5)).unwrap();

    let (drop_tx, drop_rx) = mpsc::channel();
    let panic_on_drop = PanicOnDrop(drop_tx);
    let queued = controller
      .try_spawn_blocking(move || {
        let _keep_captured_until_run = &panic_on_drop;
      })
      .unwrap_or_else(|_| panic!("queued blocking work must be accepted"));

    let (shutdown_done_tx, shutdown_done_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_controller.shutdown().unwrap();
      shutdown_done_tx.send(()).unwrap();
    });

    drop_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("shutdown must attempt to drop the queued closure");
    release_tx.send(()).unwrap();
    shutdown_done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("a panicking queued destructor must not strand shutdown");
    shutdown
      .join()
      .expect("shutdown must contain the destructor panic");
    futures::executor::block_on(running).unwrap();
    assert!(futures::executor::block_on(queued).is_err());

    controller
      .start()
      .expect("the stopped controller must restart");
    let restarted = controller
      .try_spawn_blocking(|| 17usize)
      .unwrap_or_else(|_| panic!("the restarted controller must accept work"));
    assert_eq!(futures::executor::block_on(restarted).unwrap(), 17);
    controller.shutdown().unwrap();
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_dropped_blocking_result_panic_does_not_strand_shutdown() {
    use std::{panic::panic_any, sync::mpsc};

    struct ReentrantPayload {
      controller: Arc<RuntimeController>,
      result: mpsc::Sender<(Option<u64>, Result<(), RuntimeConfigError>)>,
    }

    impl Drop for ReentrantPayload {
      fn drop(&mut self) {
        let generation = ACTIVE_RUNTIME_GENERATION.with(std::cell::Cell::get);
        let shutdown = self.controller.shutdown();
        self.result.send((generation, shutdown)).unwrap();
      }
    }

    struct PanicPayloadOnDrop(Option<ReentrantPayload>);

    impl Drop for PanicPayloadOnDrop {
      fn drop(&mut self) {
        panic_any(self.0.take().expect("the result must panic only once"));
      }
    }

    let controller = Arc::new(multi_thread_controller("blocking-result-drop-panic", 2, 1));
    let generation = controller.backend().generation();
    let (started_tx, started_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let (result_tx, result_rx) = mpsc::channel();
    let payload_controller = Arc::clone(&controller);
    let handle = controller
      .try_spawn_blocking(move || {
        started_tx.send(()).unwrap();
        release_rx.recv().unwrap();
        PanicPayloadOnDrop(Some(ReentrantPayload {
          controller: payload_controller,
          result: result_tx,
        }))
      })
      .unwrap_or_else(|_| panic!("running blocking work must be accepted"));
    started_rx.recv_timeout(Duration::from_secs(5)).unwrap();

    // Detach the receiver before the result is delivered. Sending then drops
    // the result on the worker, whose destructor intentionally panics.
    drop(handle);
    release_tx.send(()).unwrap();
    let (observed_generation, reentrant_shutdown) = result_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the dropped result panic payload must not self-deadlock");
    assert_eq!(observed_generation, Some(generation));
    let error =
      reentrant_shutdown.expect_err("payload destruction is still work in the active generation");
    assert!(error.to_string().contains("work running on that runtime"));

    let (shutdown_done_tx, shutdown_done_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_controller.shutdown().unwrap();
      shutdown_done_tx.send(()).unwrap();
    });
    shutdown_done_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("a dropped-result destructor panic must not strand shutdown");
    shutdown
      .join()
      .expect("shutdown must contain the destructor panic");

    controller
      .start()
      .expect("the stopped controller must restart");
    let restarted = controller
      .try_spawn_blocking(|| 19usize)
      .unwrap_or_else(|_| panic!("the restarted controller must accept work"));
    assert_eq!(futures::executor::block_on(restarted).unwrap(), 19);
    controller.shutdown().unwrap();
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_completed_blocking_result_drop_panic_is_contained() {
    use std::sync::mpsc;

    struct PanicOnDrop(mpsc::Sender<()>);

    impl Drop for PanicOnDrop {
      fn drop(&mut self) {
        self.0.send(()).unwrap();
        panic!("intentional buffered blocking result destructor panic");
      }
    }

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "buffered-blocking-result-drop".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
    let (started_tx, started_rx) = mpsc::channel();
    let (dropped_tx, dropped_rx) = mpsc::channel();
    let handle = executor.schedule_blocking(move || {
      started_tx.send(()).unwrap();
      PanicOnDrop(dropped_tx)
    });
    started_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the blocking closure must run");
    wait_until("the completed blocking result to be buffered", || {
      executor.active_blocking.load(Ordering::Acquire) == 0
    });
    assert!(
      dropped_rx.try_recv().is_err(),
      "the buffered result must remain owned by the live receiver"
    );

    let dropped = catch_unwind(AssertUnwindSafe(|| drop(handle)));
    assert!(
      dropped.is_ok(),
      "dropping the buffered result must contain its destructor panic"
    );
    dropped_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("dropping the receiver must reclaim the buffered result");
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_closed_queue_contains_panicking_blocking_destructor() {
    use std::sync::mpsc;

    struct PanicOnDrop(mpsc::Sender<()>);
    impl Drop for PanicOnDrop {
      fn drop(&mut self) {
        let _ = self.0.send(());
        panic!("intentional late blocking destructor panic");
      }
    }

    let executor = multi_thread_executor(2, None, "closed-queue-drop");
    executor.begin_shutdown();

    let (drop_tx, drop_rx) = mpsc::channel();
    let panic_on_drop = PanicOnDrop(drop_tx);
    let handle = executor.schedule_blocking(move || {
      let _keep_captured_until_run = &panic_on_drop;
    });

    drop_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("the closed queue must retire the rejected closure");
    assert!(
      futures::executor::block_on(handle).is_err(),
      "the rejected blocking handle must resolve as cancelled"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_shutdown_contains_panicking_timer_waker_and_restarts() {
    struct PanicWake;
    impl std::task::Wake for PanicWake {
      fn wake(self: Arc<Self>) {
        panic!("intentional timer waker panic");
      }
    }

    let controller = multi_thread_controller("lifecycle-waker-panic", 2, 1);
    let backend = controller.backend();
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("configured MultiThread backend must create a Rayon executor");
    };
    let mut sleep = heap_sleep(executor, Instant::now() + Duration::from_secs(60));
    let waker = Waker::from(Arc::new(PanicWake));
    let mut cx = Context::from_waker(&waker);
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    drop(backend);

    controller
      .shutdown()
      .expect("shutdown must contain the timer waker panic");
    controller
      .start()
      .expect("the stopped controller must restart");
    let restarted = controller
      .try_spawn_blocking(|| 23usize)
      .unwrap_or_else(|_| panic!("the restarted controller must accept work"));
    assert_eq!(futures::executor::block_on(restarted).unwrap(), 23);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_restart_waits_for_old_generation_worker_exit() {
    use std::sync::mpsc;

    let controller = Arc::new(multi_thread_controller("lifecycle-generation", 2, 1));
    let backend = controller.backend();
    let old_generation = backend.generation();
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("configured MultiThread backend must create a Rayon executor");
    };
    let old_workers = Arc::clone(&executor.worker_lifecycle);
    drop(backend);

    let (running_tx, running_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let running = controller
      .try_spawn_blocking(move || {
        running_tx.send(()).unwrap();
        release_rx.recv().unwrap();
      })
      .unwrap_or_else(|_| panic!("running blocking work must be accepted"));
    running_rx.recv_timeout(Duration::from_secs(5)).unwrap();

    let (shutdown_done_tx, shutdown_done_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_controller.shutdown().unwrap();
      shutdown_done_tx.send(()).unwrap();
    });
    wait_until("controller entered Stopping", || {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      matches!(&state.lifecycle, RuntimeLifecycle::Stopping(_))
    });

    let (start_done_tx, start_done_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      start_controller.start().unwrap();
      start_done_tx.send(()).unwrap();
    });
    assert!(
      start_done_rx.try_recv().is_err(),
      "start must wait while shutdown is quiescing"
    );
    assert!(
      old_workers.remaining() > 0,
      "the held old generation must still own workers"
    );

    release_tx.send(()).unwrap();
    futures::executor::block_on(running).unwrap();
    shutdown_done_rx
      .recv_timeout(Duration::from_secs(5))
      .unwrap();
    start_done_rx.recv_timeout(Duration::from_secs(5)).unwrap();
    shutdown.join().unwrap();
    starter.join().unwrap();
    assert_eq!(
      old_workers.remaining(),
      0,
      "restart may begin only after every old worker exits"
    );

    let backend = controller.backend();
    assert_ne!(backend.generation(), old_generation);
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("restarted backend must remain MultiThread");
    };
    assert_eq!(
      executor.pool.current_num_threads(),
      controller.options().worker_threads
    );
    drop(backend);
    controller.shutdown().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn shutdown_from_runtime_work_is_rejected_instead_of_self_deadlocking() {
    let controller = Arc::new(multi_thread_controller("lifecycle-self-stop", 2, 1));
    let task_controller = Arc::clone(&controller);
    let handle = controller
      .try_spawn(async move {
        task_controller
          .shutdown()
          .expect_err("runtime work must not wait for its own generation")
          .to_string()
      })
      .unwrap_or_else(|_| panic!("running runtime must accept the task"));
    let message = futures::executor::block_on(handle).unwrap();
    assert!(message.contains("cannot shut down"));
    controller.shutdown().unwrap();
  }

  // ---- two-phase shutdown handshake ----------------------------------------
  // `shutdown` is `begin_shutdown` + `finish_shutdown`, so every existing
  // shutdown test above also covers the composition. These cover the window
  // the split opens: phase 1 must return while work is still running, the
  // poll must eventually answer `false`, a re-entered phase 1 must never
  // wait, and every OPENED phase 1 must pair with exactly one
  // `finish_shutdown` -- no more (the extra one is the orphan error) and no
  // fewer (a racing `start` in the window must not turn a completed shutdown
  // into an error).

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn two_phase_shutdown_matches_single_call() {
    // The threaded WASI artifact enters shutdown from the JS thread, so phase
    // 1 has to come back while a blocking closure is still running; phase 2
    // then does exactly what the single call does once the closure retires.
    let controller = multi_thread_controller("two-phase-shutdown", 2, 1);
    let entered = Arc::new(AtomicBool::new(false));
    let release = Arc::new(AtomicBool::new(false));
    let job_entered = Arc::clone(&entered);
    let job_release = Arc::clone(&release);
    let handle = controller
      .try_spawn_blocking(move || {
        job_entered.store(true, Ordering::SeqCst);
        while !job_release.load(Ordering::SeqCst) {
          std::hint::spin_loop();
        }
        7usize
      })
      .unwrap_or_else(|_| panic!("running runtime must accept the blocking job"));
    while !entered.load(Ordering::SeqCst) {
      std::thread::yield_now();
    }

    assert!(
      controller
        .begin_shutdown()
        .expect("phase 1 on a running generation must be accepted"),
      "phase 1 must report the still-running blocking closure instead of waiting for it"
    );
    assert!(
      controller.runtime_work_pending(),
      "the parked closure holds its generation guard"
    );
    // Admission is closed by `backend_locked` the moment `Stopping` is
    // published; phase 1 adds no admission code of its own.
    let Err((error, _work)) = controller.try_spawn_blocking(|| 0usize) else {
      panic!("a submission between the phases must be rejected");
    };
    assert_eq!(
      error.to_string(),
      "the async runtime is stopped; call start before submitting work"
    );

    release.store(true, Ordering::SeqCst);
    let deadline = Instant::now() + Duration::from_secs(5);
    while controller.runtime_work_pending() {
      assert!(
        Instant::now() < deadline,
        "the released closure must retire and the poll must answer false"
      );
      std::thread::yield_now();
    }
    assert_eq!(
      futures::executor::block_on(handle).unwrap(),
      7usize,
      "the closure that phase 1 refused to wait for still delivers its result"
    );

    controller
      .finish_shutdown()
      .expect("phase 2 must complete the outstanding phase 1");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
      assert!(
        state.draining.is_none(),
        "phase 2 must consume the phase-1 handoff"
      );
    }

    // The split leaves the restart path exactly as the single call does.
    controller.start().expect("a stopped runtime must restart");
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the single call must still shut the restarted runtime down");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn concurrent_shutdown_during_two_phase_still_reports_success() {
    // A `shutdown` from a second thread must still answer `Ok(())` while a
    // handshake is in flight, and neither thread may wedge the other. THIS
    // test pins the interleaving where the phase-1 OWNER drains: the
    // concurrent call is started from the owner's own
    // `AFTER_SHUTDOWN_DRAIN_TAKEN_TEST_HOOK`, i.e. after the handoff is out
    // of the state and before the owner waits, so the second thread provably
    // arrives at an already-taken handshake and must report the owner's
    // publication. The mirror image (the concurrent call drains, the owner
    // finishes afterwards) is
    // `phase_one_owner_finishes_after_a_concurrent_shutdown_drains`.
    let controller = Arc::new(multi_thread_controller("two-phase-concurrent", 2, 1));
    let entered = Arc::new(AtomicBool::new(false));
    let committed = Arc::new(AtomicBool::new(false));
    let job_entered = Arc::clone(&entered);
    let job_committed = Arc::clone(&committed);
    // The closure retires only once the concurrent call has committed, so the
    // owner's drain cannot run to completion before the second thread is in
    // flight: both are always overlapped, as before.
    let handle = controller
      .try_spawn_blocking(move || {
        job_entered.store(true, Ordering::SeqCst);
        while !job_committed.load(Ordering::SeqCst) {
          std::hint::spin_loop();
        }
        3usize
      })
      .unwrap_or_else(|_| panic!("running runtime must accept the blocking job"));
    wait_until("the blocking closure to park", || {
      entered.load(Ordering::SeqCst)
    });
    assert!(
      controller
        .begin_shutdown()
        .expect("phase 1 must be accepted")
    );

    let (concurrent_tx, concurrent_rx) = std::sync::mpsc::channel();
    let hook_controller = Arc::clone(&controller);
    let hook_committed = Arc::clone(&committed);
    let owner_took_the_drain = Arc::new(AtomicBool::new(false));
    let hook_took_the_drain = Arc::clone(&owner_took_the_drain);
    AFTER_SHUTDOWN_DRAIN_TAKEN_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        hook_took_the_drain.store(true, Ordering::SeqCst);
        let concurrent = std::thread::spawn(move || {
          hook_committed.store(true, Ordering::SeqCst);
          hook_controller.shutdown()
        });
        concurrent_tx
          .send(concurrent)
          .expect("the test thread must still be waiting for the concurrent handle");
      }));
    });

    controller
      .finish_shutdown()
      .expect("phase 2 must complete the handshake");
    assert!(
      owner_took_the_drain.load(Ordering::SeqCst),
      "the phase-1 owner must be the thread that took the handoff"
    );
    concurrent_rx
      .recv()
      .expect("the hook must have started the concurrent shutdown")
      .join()
      .expect("the concurrent shutdown thread must not panic")
      .expect("a concurrent single-call shutdown must still succeed");

    assert_eq!(futures::executor::block_on(handle).unwrap(), 3usize);
    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
    assert!(state.draining.is_none());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn a_phase_one_during_the_in_flight_drain_answers_without_waiting() {
    // The handoff slot must never go empty while the join is still running.
    // `finish_shutdown` takes the backend out of the state and only then
    // waits; for the whole of that window the lifecycle still reads
    // `Stopping`. If the slot were left `None` there, a re-entering phase 1
    // would fall through to the lifecycle loop and PARK on `lifecycle_changed`
    // until the join it is racing publishes `Stopped` -- breaking the
    // documented "a `begin_shutdown` while one is outstanding never waits"
    // contract -- and `runtime_work_pending` would answer `false` about work
    // that is demonstrably still parked. On a host that drives both calls from
    // the same thread pool that the drained work needs, that park is a
    // deadlock.
    //
    // The probe is started from `AFTER_SHUTDOWN_DRAIN_TAKEN_TEST_HOOK`, i.e.
    // provably after the handoff has left the slot and before the finisher
    // waits, and the closure it must see is released only once the probe has
    // answered (or a bounded watchdog gives up), so a parking probe FAILS the
    // test instead of hanging it.
    let controller = Arc::new(multi_thread_controller("two-phase-inflight-drain", 2, 1));
    let entered = Arc::new(AtomicBool::new(false));
    let release = Arc::new(AtomicBool::new(false));
    let job_entered = Arc::clone(&entered);
    let job_release = Arc::clone(&release);
    let handle = controller
      .try_spawn_blocking(move || {
        job_entered.store(true, Ordering::SeqCst);
        while !job_release.load(Ordering::SeqCst) {
          std::hint::spin_loop();
        }
        11usize
      })
      .unwrap_or_else(|_| panic!("running runtime must accept the blocking job"));
    wait_until("the blocking closure to park", || {
      entered.load(Ordering::SeqCst)
    });
    assert!(
      controller
        .begin_shutdown()
        .expect("phase 1 must be accepted"),
      "the parked closure must be reported as live"
    );

    let (probe_tx, probe_rx) = std::sync::mpsc::channel();
    let hook_controller = Arc::clone(&controller);
    let hook_release = Arc::clone(&release);
    AFTER_SHUTDOWN_DRAIN_TAKEN_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        let probe_controller = Arc::clone(&hook_controller);
        let probe = std::thread::spawn(move || {
          let pending = probe_controller.runtime_work_pending();
          (pending, probe_controller.begin_shutdown())
        });
        let watchdog = std::thread::spawn(move || {
          let deadline = Instant::now() + Duration::from_secs(5);
          while !probe.is_finished() && Instant::now() < deadline {
            std::thread::yield_now();
          }
          // Whether the probe answered BEFORE the drained closure retired is
          // the whole verdict: releasing afterwards would let a parked probe
          // be woken by the `Stopped` publication and look healthy.
          let answered_during_the_drain = probe.is_finished();
          hook_release.store(true, Ordering::SeqCst);
          (answered_during_the_drain, probe.join())
        });
        probe_tx
          .send(watchdog)
          .expect("the test thread must still be waiting for the probe handle");
      }));
    });

    controller
      .finish_shutdown()
      .expect("phase 2 must complete the outstanding phase 1");
    let (answered_during_the_drain, probe) = probe_rx
      .recv()
      .expect("the hook must have started the probe")
      .join()
      .expect("the watchdog thread must not panic");
    let (pending, verdict) = probe.expect("the probe thread must not panic");
    assert!(
      answered_during_the_drain,
      "a phase 1 re-entered during the in-flight drain must answer without waiting for the join"
    );
    assert!(
      pending,
      "the poll must still see the parked closure while the drain that is waiting for it runs"
    );
    assert!(
      verdict.expect("a phase 1 during the in-flight drain must be accepted"),
      "the re-entering phase 1 must report the parked closure as live"
    );

    assert_eq!(futures::executor::block_on(handle).unwrap(), 11usize);
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
      assert!(
        state.draining.is_none(),
        "publishing `Stopped` must retire the in-flight drain marker too"
      );
    }
    assert!(
      !controller.runtime_work_pending(),
      "a stopped runtime has no pending work"
    );

    controller.start().expect("a stopped runtime must restart");
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the single call must still shut the restarted runtime down");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn phase_one_owner_finishes_after_a_concurrent_shutdown_drains() {
    // The other half of the race above, hand-sequenced by a join: a
    // concurrent single-call `shutdown` takes the outstanding handoff AND
    // completes the whole shutdown, and only then does the thread that opened
    // phase 1 call its own phase 2. The runtime is already `Stopped`, so the
    // join that caller is owed has happened -- phase 2 owes it `Ok(())`, not
    // "shutdown was not started", whoever performed that join.
    let controller = Arc::new(multi_thread_controller("two-phase-owner-finish", 2, 1));
    let entered = Arc::new(AtomicBool::new(false));
    let release = Arc::new(AtomicBool::new(false));
    let job_entered = Arc::clone(&entered);
    let job_release = Arc::clone(&release);
    let handle = controller
      .try_spawn_blocking(move || {
        job_entered.store(true, Ordering::SeqCst);
        while !job_release.load(Ordering::SeqCst) {
          std::hint::spin_loop();
        }
        3usize
      })
      .unwrap_or_else(|_| panic!("running runtime must accept the blocking job"));
    wait_until("the blocking closure to park", || {
      entered.load(Ordering::SeqCst)
    });
    assert!(
      controller
        .begin_shutdown()
        .expect("phase 1 must be accepted"),
      "the parked closure must be reported as live"
    );

    let single_call = Arc::clone(&controller);
    let concurrent = std::thread::spawn(move || single_call.shutdown());
    release.store(true, Ordering::SeqCst);
    concurrent
      .join()
      .expect("the concurrent shutdown thread must not panic")
      .expect("a concurrent single-call shutdown must still succeed");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::Stopped),
        "the concurrent call must have published the stop"
      );
      assert!(
        state.draining.is_none(),
        "the concurrent call must have consumed the phase-1 handoff"
      );
    }

    controller
      .finish_shutdown()
      .expect("the thread that began phase 1 must still be told its shutdown completed");
    assert_eq!(futures::executor::block_on(handle).unwrap(), 3usize);

    // Flipped with the idempotent model (it used to expect the orphan error
    // here): a phase 2 after a restart finds nothing outstanding, so it is a
    // no-op `Ok(())` -- and it must NOT adopt the generation the restart
    // published.
    controller.start().expect("a stopped runtime must restart");
    drop(controller.backend());
    controller
      .finish_shutdown()
      .expect("phase 2 after a restart is a no-op, not an error");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::Running(_)),
        "the no-op phase 2 must not stop the restarted generation"
      );
    }
    controller
      .shutdown()
      .expect("the single call must still shut the restarted runtime down");
  }

  #[test]
  fn begin_shutdown_twice_does_not_block() {
    // The host thread may re-enter the handshake from a turn it took between
    // the phases. A second phase 1 must answer from the outstanding one --
    // taking the `Stopping` arm instead would park this thread on the condvar
    // forever, so a regression hangs this test rather than failing it. It
    // also OPENS nothing -- and, flipped with the idempotent model, the second
    // phase 2 is no longer an orphan error: the stop it was asked to complete
    // has been completed, so it answers `Ok(())`.
    let controller = current_thread_controller("two-phase-reentrant-begin");
    drop(controller.backend());

    assert!(
      !controller
        .begin_shutdown()
        .expect("phase 1 on an idle generation must be accepted"),
      "an idle generation has nothing for the host to wait for"
    );
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopping(_)));
    }
    assert!(
      !controller
        .begin_shutdown()
        .expect("a second phase 1 must answer immediately"),
      "the second phase 1 must report the same verdict"
    );

    controller
      .finish_shutdown()
      .expect("one phase 2 completes the single outstanding phase 1");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
      assert!(state.draining.is_none());
    }

    controller
      .finish_shutdown()
      .expect("a second phase 2 repeats the completed stop instead of erroring");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::Stopped),
        "the repeated phase 2 must change nothing"
      );
    }
  }

  #[test]
  fn current_thread_two_phase_is_idle_immediately() {
    // No cfg gate: this is the threadless `wasm32-wasip1` shape, where the
    // handshake must degrade to two cheap calls.
    let controller = current_thread_controller("two-phase-current-thread");
    drop(controller.backend());
    assert!(
      !controller.runtime_work_pending(),
      "an idle running generation has no pending work"
    );

    assert!(
      !controller
        .begin_shutdown()
        .expect("phase 1 must be accepted"),
      "phase 1 on an idle generation must report nothing to wait for"
    );
    assert!(
      !controller.runtime_work_pending(),
      "the poll must stay false across the window"
    );
    controller.finish_shutdown().expect("phase 2 must complete");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
    }

    controller.start().expect("a stopped runtime must restart");
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the single call must still work");
  }

  #[test]
  fn finish_shutdown_without_begin_is_an_error() {
    let controller = current_thread_controller("two-phase-orphan-finish");
    drop(controller.backend());
    let error = controller
      .finish_shutdown()
      .expect_err("phase 2 without an outstanding phase 1 must be rejected");
    assert_eq!(
      error.to_string(),
      "the async runtime shutdown was not started; call begin_shutdown before finish_shutdown"
    );
    controller
      .shutdown()
      .expect("the rejected phase 2 must leave the runtime shuttable");
  }

  #[test]
  fn a_restart_does_not_inherit_a_settled_shutdown_handoff() {
    // A phase 1 on an already stopped runtime settles with no backend. The
    // `start` that follows publishes a FRESH generation, which owes nothing
    // to a handshake opened against the previous one. If the settled handoff
    // survived that `start`, the next `shutdown` would short-circuit on it --
    // phase 1 answering from the stale handoff, phase 2 consuming it -- and
    // report success while this generation was still `Running`, still holding
    // its backend and still accepting work.
    let controller = current_thread_controller("two-phase-stale-settled");
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the first shutdown must complete");

    assert!(
      !controller
        .begin_shutdown()
        .expect("phase 1 on a stopped runtime must be accepted"),
      "a stopped runtime has no work for the host to wait for"
    );
    controller.start().expect("a stopped runtime must restart");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        state.draining.is_none(),
        "a fresh generation must not inherit the settled handoff"
      );
    }
    drop(controller.backend());

    controller
      .shutdown()
      .expect("the second shutdown must stop the restarted generation");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::Stopped),
        "the restarted generation must really be stopped, not reported stopped"
      );
      assert!(state.draining.is_none());
    }
    assert!(
      controller.current_backend.load().is_none(),
      "the stopped generation's backend must be gone"
    );
    assert!(
      !controller.runtime_work_pending(),
      "a stopped runtime has no pending work"
    );
    let Err((error, _work)) = controller.try_spawn_blocking(|| 0usize) else {
      panic!("a submission after the second shutdown must be rejected");
    };
    assert_eq!(
      error.to_string(),
      "the async runtime is stopped; call start before submitting work"
    );
  }

  #[test]
  fn a_settled_phase_one_is_reported_by_every_finish_across_a_restart() {
    // Renamed and flipped again with the idempotent model (it counted phases
    // before, and errored before that): a `start` between the phases DROPS the
    // settled handoff -- so it can never answer for the new generation -- but
    // the stop that was announced still happened, so EVERY phase 2 that
    // follows reports it, and none of them touches the restarted generation.
    // Without this, a single-call `shutdown` racing a `start` reports `Err`
    // for a shutdown it performed.
    let controller = current_thread_controller("two-phase-settled-idempotent");
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the first shutdown must complete");
    assert!(
      !controller
        .begin_shutdown()
        .expect("phase 1 on a stopped runtime must be accepted")
    );
    controller.start().expect("a stopped runtime must restart");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        state.draining.is_none(),
        "the restart must drop the settled handoff"
      );
      assert!(
        state.phase_ever_opened,
        "the restart must not erase the fact that a stop was announced"
      );
    }

    controller
      .finish_shutdown()
      .expect("the announced stop must be reported to the caller that opened it");
    controller
      .finish_shutdown()
      .expect("and to every phase 2 after it -- the call is idempotent");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::Running(_)),
        "neither phase 2 may stop the generation the restart published"
      );
    }
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the no-op phase 2s must leave the runtime shuttable");
  }

  #[test]
  fn shutdown_racing_a_start_still_reports_ok() {
    // The defect this whole rule exists for. The single call takes
    // the lifecycle lock twice; on an already stopped runtime phase 1 settles
    // with no backend and publishes no `Stopping` for a `start` to wait in,
    // so a `start` can land in the window and drop the parked handoff. Phase 2
    // then finds an empty slot and a `Running` lifecycle. `phase_ever_opened`
    // is what lets it answer `Ok(())` for the shutdown this call really did
    // perform, instead of "shutdown was not started".
    //
    // Deterministic, not stressed: the hook runs the `start` inside the window
    // itself. In the wild the same interleaving shows up as a flaky
    // `NO_PHASE_ERROR` from a `shutdown` racing a restart on another thread.
    let controller = Arc::new(current_thread_controller("shutdown-racing-start"));
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the first shutdown must complete");

    let start_controller = Arc::clone(&controller);
    let started = Arc::new(AtomicBool::new(false));
    let hook_started = Arc::clone(&started);
    BETWEEN_SHUTDOWN_PHASES_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        start_controller
          .start()
          .expect("a stopped runtime must restart");
        hook_started.store(true, Ordering::SeqCst);
      }));
    });
    controller
      .shutdown()
      .expect("a shutdown must report the phase it opened, even across a racing start");
    assert!(
      started.load(Ordering::SeqCst),
      "the hook must have run the start inside the window"
    );

    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::Running(_)),
        "the racing start wins the window: its generation is live, not stopped"
      );
      assert!(
        state.draining.is_none(),
        "the start must have dropped the settled handoff"
      );
    }

    // The generation the start published is a real one: it accepts work, and
    // the next shutdown really stops it.
    let ran = Arc::new(AtomicBool::new(false));
    let ran_task = Arc::clone(&ran);
    controller
      .try_spawn_detached(async move {
        ran_task.store(true, Ordering::SeqCst);
      })
      .unwrap_or_else(|_| panic!("the generation the start published must accept work"));
    let dispatch = controller_current_thread_dispatch(&controller);
    controller.drive_current_thread_dispatch(dispatch, false);
    assert!(ran.load(Ordering::SeqCst));
    controller
      .shutdown()
      .expect("the restarted generation must still shut down");
    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
    assert!(state.draining.is_none());
  }

  // The runtime FLAVOR under test is CurrentThread -- that is where the race
  // this pins was 8.2% -- but the probe itself needs a second OS thread, so it
  // cannot run on the threadless `wasm32-wasip1` lane.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn concurrent_split_finish_racing_a_single_call_shutdown() {
    // The interleaving the counting model got wrong (8.2% on CurrentThread in
    // a 100k-iteration probe, and the reason phases are no longer counted): a
    // single call opens the phase and a SECOND thread, using the documented
    // split pair, completes it. With a count, the split thread's finish spent
    // the opener's credit and the single call was then told "shutdown was not
    // started" -- for a stop it had already published.
    //
    // Deterministic, not stressed: the hook parks the single call between its
    // halves and runs the split pair to completion there.
    let controller = Arc::new(current_thread_controller("split-finish-vs-single"));
    drop(controller.backend());

    let split_controller = Arc::clone(&controller);
    let (tx, rx) = std::sync::mpsc::channel();
    BETWEEN_SHUTDOWN_PHASES_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        let split = std::thread::spawn(move || {
          let pending = split_controller
            .begin_shutdown()
            .expect("a second phase 1 must re-report the outstanding handoff");
          split_controller
            .finish_shutdown()
            .expect("an in-protocol phase 2 must complete the outstanding stop");
          pending
        });
        tx.send(
          split
            .join()
            .expect("the split shutdown thread must not panic"),
        )
        .expect("the test thread must still be waiting for the split result");
      }));
    });

    controller
      .shutdown()
      .expect("the single call must report the stop it announced, whoever joined it");
    assert!(
      !rx
        .try_recv()
        .expect("the hook must have run the split pair inside the window"),
      "an idle generation has nothing for the host to wait for"
    );

    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(
      matches!(&state.lifecycle, RuntimeLifecycle::Stopped),
      "the generation must really be stopped, not reported stopped"
    );
    assert!(state.draining.is_none());
  }

  #[test]
  fn repeated_begin_start_pairs_leave_no_residue() {
    // The other half of what the count got wrong: `k x (begin, start)` parked
    // `k` credits that nothing ever drained, so the next `k` stray phase 2s
    // reported success off a leaked count. A sticky bool cannot accumulate --
    // the behaviour is the same at every `k`.
    const PAIRS: usize = 50;
    let controller = current_thread_controller("begin-start-residue");
    drop(controller.backend());
    for _ in 0..PAIRS {
      controller
        .shutdown()
        .expect("each shutdown must stop the live generation");
      assert!(
        !controller
          .begin_shutdown()
          .expect("phase 1 on a stopped runtime must be accepted"),
        "a stopped runtime has no work for the host to wait for"
      );
      controller
        .start()
        .expect("a zero-backend window must let a restart through");
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        state.draining.is_none(),
        "the restart must drop the settled handoff"
      );
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Running(_)));
    }

    controller
      .finish_shutdown()
      .expect("a phase 2 with nothing outstanding is a no-op Ok");
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::Running(_)),
        "the no-op phase 2 must not stop the generation the last restart published"
      );
    }

    controller
      .shutdown()
      .expect("a full shutdown after the begin/start pairs must still work");
    let state = controller
      .state
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
    assert!(state.draining.is_none());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn a_restart_after_a_settled_phase_one_still_joins_its_workers() {
    // The MultiThread half of the same rule: the worker join lives in phase
    // 2, so a stale settled handoff would let `shutdown` return while this
    // generation's workers were still alive.
    let controller = multi_thread_controller("two-phase-stale-settled-mt", 2, 1);
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the first shutdown must complete");
    assert!(
      !controller
        .begin_shutdown()
        .expect("phase 1 on a stopped runtime must be accepted")
    );
    controller.start().expect("a stopped runtime must restart");

    let backend = controller.backend();
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("configured MultiThread backend must create a Rayon executor");
    };
    let workers = Arc::clone(&executor.worker_lifecycle);
    drop(backend);
    let handle = controller
      .try_spawn_blocking(|| 5usize)
      .unwrap_or_else(|_| panic!("the restarted generation must accept work"));
    assert_eq!(futures::executor::block_on(handle).unwrap(), 5usize);

    controller
      .shutdown()
      .expect("the second shutdown must stop the restarted generation");
    assert_eq!(
      workers.remaining(),
      0,
      "phase 2 must join the restarted generation's workers"
    );
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
      assert!(state.draining.is_none());
    }
    let Err((error, _work)) = controller.try_spawn_blocking(|| 0usize) else {
      panic!("a submission after the second shutdown must be rejected");
    };
    assert_eq!(
      error.to_string(),
      "the async runtime is stopped; call start before submitting work"
    );
  }

  /// A rejected submission whose destructor is parked until `release` is sent.
  /// The counted window (`rejected_drops`) stays open for the whole of that
  /// `Drop`, which is the state phase 1 must refuse to wait on.
  #[cfg(napi_runtime_os_threads)]
  struct ParkedRejectedDropFuture {
    entered: std::sync::mpsc::Sender<()>,
    release: std::sync::mpsc::Receiver<()>,
  }

  #[cfg(napi_runtime_os_threads)]
  impl Future for ParkedRejectedDropFuture {
    type Output = ();

    fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
      Poll::Pending
    }
  }

  #[cfg(napi_runtime_os_threads)]
  impl Drop for ParkedRejectedDropFuture {
    fn drop(&mut self) {
      self.entered.send(()).unwrap();
      self.release.recv().unwrap();
    }
  }

  /// Reject one submission on a spawned thread and return once its destructor
  /// has been entered, so the caller runs with `rejected_drops != 0` held open
  /// by a thread that is not it.
  #[cfg(napi_runtime_os_threads)]
  fn park_a_rejected_destructor(
    controller: &Arc<RuntimeController>,
    fail_backend_creation: bool,
  ) -> (std::thread::JoinHandle<()>, std::sync::mpsc::Sender<()>) {
    use std::sync::mpsc;

    let (drop_entered_tx, drop_entered_rx) = mpsc::channel();
    let (release_drop_tx, release_drop_rx) = mpsc::channel();
    let submit_controller = Arc::clone(controller);
    let submitter = std::thread::spawn(move || {
      if fail_backend_creation {
        FAIL_NEXT_RUNTIME_BACKEND_CREATION.with(|fail| fail.set(true));
      }
      let result = futures::executor::block_on(submit_controller.spawn(ParkedRejectedDropFuture {
        entered: drop_entered_tx,
        release: release_drop_rx,
      }));
      assert!(
        result.is_err(),
        "the submission must be rejected, not accepted"
      );
    });
    drop_entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the rejected future destructor must start");
    (submitter, release_drop_tx)
  }

  /// Run phase 1 on a spawned thread and answer within `timeout`.
  ///
  /// A regression HANGS inside `begin_shutdown` instead of returning a wrong
  /// value, so the call cannot be made inline: the `recv_timeout` is what
  /// turns the hang into a failure.
  #[cfg(napi_runtime_os_threads)]
  fn begin_shutdown_within(
    controller: &Arc<RuntimeController>,
    what: &str,
    timeout: Duration,
  ) -> Result<bool, RuntimeConfigError> {
    use std::sync::mpsc;

    let (tx, rx) = mpsc::channel();
    let begin_controller = Arc::clone(controller);
    let beginner = std::thread::spawn(move || {
      tx.send(begin_controller.begin_shutdown()).unwrap();
    });
    let answer = rx
      .recv_timeout(timeout)
      .unwrap_or_else(|_| panic!("phase 1 must not wait: {what}"));
    join_within(what, beginner, Duration::from_secs(2));
    answer
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn begin_shutdown_does_not_wait_for_rejected_destruction_on_a_stopped_runtime() {
    // Phase 1 never waits -- including for a rejected submission whose
    // destructor is running on ANOTHER thread. That destructor is arbitrary
    // user `Drop` code; on the threaded WASI artifact the thread running it
    // may be waiting for the very host turn the phase-1 caller can only give
    // by returning, so waiting here is the deadlock the split API exists to
    // avoid. The wait belongs to phase 2, and the window must report itself
    // as pending work so the host keeps turning its loop.
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("two-phase-zero-backend-stopped"));
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the first shutdown must complete");

    let (submitter, release_drop_tx) = park_a_rejected_destructor(&controller, false);

    assert!(
      begin_shutdown_within(
        &controller,
        "phase 1 on a stopped runtime with a rejected destructor outstanding",
        Duration::from_secs(2),
      )
      .expect("phase 1 on a stopped runtime must be accepted"),
      "the outstanding rejected destruction is a wait phase 2 still owes"
    );
    assert!(
      controller.runtime_work_pending(),
      "the poll must report the destruction, or the host stops turning the loop that frees it"
    );
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(
        &state.lifecycle,
        RuntimeLifecycle::StoppingWithoutBackend(ZeroBackendShutdownTarget::Stopped)
      ));
      assert!(matches!(
        &state.draining,
        Some(ShutdownDrain::ZeroBackend(
          ZeroBackendShutdownTarget::Stopped
        ))
      ));
    }

    assert!(
      begin_shutdown_within(
        &controller,
        "a second phase 1 inside the zero-backend window",
        Duration::from_secs(2),
      )
      .expect("a second phase 1 must answer from the outstanding handoff"),
      "the second phase 1 must repeat the same verdict"
    );

    let (finish_tx, finish_rx) = mpsc::channel();
    let finish_controller = Arc::clone(&controller);
    let finisher = std::thread::spawn(move || {
      finish_tx.send(finish_controller.finish_shutdown()).unwrap();
    });
    assert!(
      finish_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "phase 2 owns the wait phase 1 refused"
    );

    release_drop_tx.send(()).unwrap();
    join_within("the rejected submitter", submitter, Duration::from_secs(2));
    finish_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("phase 2 must return once the destructor retires")
      .expect("phase 2 must complete the announced stop");
    join_within("the phase 2 thread", finisher, Duration::from_secs(2));

    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
      assert!(state.draining.is_none());
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn begin_shutdown_does_not_wait_for_rejected_destruction_on_an_initial_runtime() {
    // The `Initial` twin of the test above: a backend creation that fails
    // leaves the lifecycle `Initial` with the destructor of the rejected
    // submission still running, and phase 1 must publish and return there
    // too. The target it parks is `StoppedBeforeFirstUse`, and phase 2 is
    // what publishes it.
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("two-phase-zero-backend-initial"));
    let (submitter, release_drop_tx) = park_a_rejected_destructor(&controller, true);

    assert!(
      begin_shutdown_within(
        &controller,
        "phase 1 on an initial runtime with a rejected destructor outstanding",
        Duration::from_secs(2),
      )
      .expect("phase 1 on an initial runtime must be accepted"),
      "the outstanding rejected destruction is a wait phase 2 still owes"
    );
    assert!(controller.runtime_work_pending());
    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(
        &state.lifecycle,
        RuntimeLifecycle::StoppingWithoutBackend(ZeroBackendShutdownTarget::StoppedBeforeFirstUse)
      ));
      assert!(matches!(
        &state.draining,
        Some(ShutdownDrain::ZeroBackend(
          ZeroBackendShutdownTarget::StoppedBeforeFirstUse
        ))
      ));
    }
    assert!(
      controller.try_spawn_detached(async {}).is_err(),
      "the announced stop must keep first-generation admission closed"
    );

    let (finish_tx, finish_rx) = mpsc::channel();
    let finish_controller = Arc::clone(&controller);
    let finisher = std::thread::spawn(move || {
      finish_tx.send(finish_controller.finish_shutdown()).unwrap();
    });
    assert!(
      finish_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "phase 2 owns the wait phase 1 refused"
    );

    release_drop_tx.send(()).unwrap();
    join_within("the rejected submitter", submitter, Duration::from_secs(2));
    finish_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("phase 2 must return once the destructor retires")
      .expect("phase 2 must complete the announced stop");
    join_within("the phase 2 thread", finisher, Duration::from_secs(2));

    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(
        matches!(&state.lifecycle, RuntimeLifecycle::StoppedBeforeFirstUse),
        "a generation that never had a backend must stop before first use"
      );
      assert!(state.draining.is_none());
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn start_waits_out_a_zero_backend_phase_one() {
    // Phase 1 no longer waits, so the `StoppingWithoutBackend` window now
    // lasts until phase 2 publishes instead of only for the length of phase
    // 1's internal wait. `start` must wait that whole window out: the
    // destructor still runs under the RETIRED generation's guard, so a
    // restart admitted before phase 2 would publish a fresh backend on top of
    // it. The existing coverage only drives the single-call `shutdown`; this
    // pins the invariant on the split API.
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("two-phase-zero-backend-start"));
    let old_generation = controller.backend().generation();
    controller
      .shutdown()
      .expect("the first shutdown must complete");

    let (submitter, release_drop_tx) = park_a_rejected_destructor(&controller, false);
    assert!(
      begin_shutdown_within(
        &controller,
        "phase 1 before the restart",
        Duration::from_secs(2),
      )
      .expect("phase 1 on a stopped runtime must be accepted")
    );

    let (start_tx, start_rx) = mpsc::channel();
    let start_controller = Arc::clone(&controller);
    let starter = std::thread::spawn(move || {
      start_tx.send(start_controller.start()).unwrap();
    });
    assert!(
      start_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "a restart must wait for the announced zero-backend stop to be published"
    );

    let (finish_tx, finish_rx) = mpsc::channel();
    let finish_controller = Arc::clone(&controller);
    let finisher = std::thread::spawn(move || {
      finish_tx.send(finish_controller.finish_shutdown()).unwrap();
    });
    assert!(
      finish_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "phase 2 must still be waiting on the destructor"
    );

    release_drop_tx.send(()).unwrap();
    join_within("the rejected submitter", submitter, Duration::from_secs(2));
    finish_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("phase 2 must return once the destructor retires")
      .expect("phase 2 must complete the announced stop");
    join_within("the phase 2 thread", finisher, Duration::from_secs(2));
    start_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the restart must be admitted once phase 2 has published")
      .expect("a stopped runtime must restart after phase 2");
    join_within("the restart thread", starter, Duration::from_secs(2));

    let new_generation = controller.backend().generation();
    assert_ne!(
      new_generation, old_generation,
      "the restart must publish a fresh generation"
    );
    controller
      .shutdown()
      .expect("the restarted generation must still shut down");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn zero_backend_phase_one_settles_through_the_poll_before_finish() {
    // The order the production WASI loader actually runs, which the three
    // tests above never do: `begin` -> turn the host loop, polling
    // `runtime_work_pending` until it answers `false` -> only THEN call
    // `finish`. They park phase 2 on a thread BEFORE releasing the
    // destructor, so they prove the wait; this proves the way out of it. The
    // poll must stop reporting work once the rejected destructor retires, and
    // the `finish` entered after that must not block -- a loader that polled
    // to zero and then found phase 2 parked would wedge the disposal on the
    // JavaScript thread, which is the whole failure the split API avoids.
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("two-phase-zero-backend-poll"));
    drop(controller.backend());
    controller
      .shutdown()
      .expect("the first shutdown must complete");

    let (submitter, release_drop_tx) = park_a_rejected_destructor(&controller, false);
    assert!(
      begin_shutdown_within(
        &controller,
        "phase 1 before the loader's poll loop",
        Duration::from_secs(2),
      )
      .expect("phase 1 on a stopped runtime must be accepted"),
      "the outstanding rejected destruction is a wait phase 2 still owes"
    );
    assert!(
      controller.runtime_work_pending(),
      "the loader gates its poll loop on this, so it must report the destruction first"
    );

    release_drop_tx.send(()).unwrap();
    join_within("the rejected submitter", submitter, Duration::from_secs(2));

    // The host's turns, bounded: a handoff that never clears fails here
    // instead of spinning for the length of the CI step.
    let deadline = std::time::Instant::now() + Duration::from_secs(5);
    while controller.runtime_work_pending() {
      assert!(
        std::time::Instant::now() < deadline,
        "the poll must stop reporting work once the rejected destructor retires"
      );
      std::thread::sleep(Duration::from_millis(1));
    }

    let (finish_tx, finish_rx) = mpsc::channel();
    let finish_controller = Arc::clone(&controller);
    let finisher = std::thread::spawn(move || {
      finish_tx.send(finish_controller.finish_shutdown()).unwrap();
    });
    finish_rx
      .recv_timeout(Duration::from_millis(200))
      .expect("phase 2 entered after the poll cleared must not block")
      .expect("phase 2 must complete the announced stop");
    join_within("the phase 2 thread", finisher, Duration::from_secs(2));

    {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert!(matches!(&state.lifecycle, RuntimeLifecycle::Stopped));
      assert!(state.draining.is_none());
    }
  }

  /// Poll `runtime_work_pending` between the phases of an idle generation's
  /// shutdown while `hold` keeps a lock the poll reads under held for good,
  /// and require the answer "pending" -- an exact read would say idle.
  ///
  /// `hold` forgets the guard: that is the pool thread that trapped while
  /// holding the lock on `wasm32-wasip1-threads`, where a trap unwinds
  /// nothing, so the lock never comes back. The loader polls from the
  /// JavaScript thread, so the poll runs on another thread here too, and a
  /// regression HANGS in it: the `recv_timeout` turns that into a failure.
  /// Nothing can take the lock again, so the runtime is leaked, not shut down.
  #[cfg(napi_runtime_os_threads)]
  fn assert_poll_reports_pending_while_held(
    controller: RuntimeController,
    what: &str,
    hold: impl FnOnce(&RuntimeController, &RuntimeBackend),
  ) {
    use std::sync::mpsc;

    let controller = Arc::new(controller);
    let backend = controller.backend();
    assert!(
      !controller
        .begin_shutdown()
        .expect("phase 1 on an idle generation must be accepted"),
      "an idle generation has nothing for the host to wait for"
    );
    assert!(
      !controller.runtime_work_pending(),
      "with every lock free the poll must read the idle generation"
    );

    hold(&controller, &backend);
    let (pending_tx, pending_rx) = mpsc::channel();
    let poll_controller = Arc::clone(&controller);
    let poller = std::thread::spawn(move || {
      pending_tx
        .send(poll_controller.runtime_work_pending())
        .unwrap();
    });
    let pending = pending_rx
      .recv_timeout(Duration::from_secs(5))
      .unwrap_or_else(|_| panic!("the work-pending poll must not wait for {what}"));
    join_within(what, poller, Duration::from_secs(2));
    assert!(
      pending,
      "a poll that cannot read {what} must answer pending, not idle"
    );

    std::mem::forget(backend);
    std::mem::forget(controller);
  }

  #[cfg(napi_runtime_os_threads)]
  fn current_thread_executor(backend: &RuntimeBackend) -> &CurrentThreadExecutor {
    match &backend.executor {
      RuntimeExecutor::CurrentThread(executor) => executor,
      RuntimeExecutor::MultiThread(_) => panic!("expected a CurrentThread backend"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn work_pending_poll_does_not_wait_for_a_held_controller_lock() {
    for controller in [
      current_thread_controller("poll-held-controller-lock-ct"),
      multi_thread_controller("poll-held-controller-lock-mt", 2, 1),
    ] {
      assert_poll_reports_pending_while_held(
        controller,
        "the controller state lock",
        |controller, _| {
          std::mem::forget(controller.state.lock().unwrap());
        },
      );
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn work_pending_poll_does_not_wait_for_a_held_generation_lock() {
    for controller in [
      current_thread_controller("poll-held-generation-lock-ct"),
      multi_thread_controller("poll-held-generation-lock-mt", 2, 1),
    ] {
      assert_poll_reports_pending_while_held(
        controller,
        "the generation state lock",
        |_, backend| {
          std::mem::forget(backend.work.state.lock().unwrap());
        },
      );
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_work_pending_poll_does_not_wait_for_a_held_queue_lock() {
    assert_poll_reports_pending_while_held(
      current_thread_controller("poll-held-queue-lock"),
      "the CurrentThread queue lock",
      |_, backend| {
        std::mem::forget(current_thread_executor(backend).queue.lock().unwrap());
      },
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_work_pending_poll_does_not_wait_for_a_held_scheduler_lock() {
    assert_poll_reports_pending_while_held(
      current_thread_controller("poll-held-scheduler-lock"),
      "the CurrentThread scheduler lock",
      |_, backend| {
        std::mem::forget(
          current_thread_executor(backend)
            .scheduler_idle_lock
            .lock()
            .unwrap(),
        );
      },
    );
  }

  /// Run a shutdown phase on a thread standing in for the host's JavaScript
  /// thread, after the caller left the runtime the way a pool thread that
  /// trapped on `wasm32-wasip1-threads` leaves it: a lock held for good (a
  /// forgotten guard), or work that never retires. The phase must keep
  /// waiting while no thread has crashed, and must give up once the host's
  /// crash flag is up -- a trap on wasm, `GaveUpAfterThreadCrash` here. A
  /// regression HANGS in the phase: the `recv_timeout` turns that into a
  /// failure. Nothing can release what the caller left behind, so the runtime
  /// is leaked, not shut down.
  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  fn assert_shutdown_phase_gives_up_after_a_thread_crash(
    what: &str,
    controller: Arc<RuntimeController>,
    phase: impl FnOnce(&RuntimeController) + Send + 'static,
  ) {
    use std::sync::mpsc;

    let crashed = Arc::new(AtomicBool::new(false));
    let (outcome_tx, outcome_rx) = mpsc::channel();
    let js_thread = {
      let controller = Arc::clone(&controller);
      let crashed = Arc::clone(&crashed);
      std::thread::spawn(move || {
        crate::sync::watch_crash_flag_for_test(crashed);
        let outcome = match catch_unwind(AssertUnwindSafe(|| phase(&controller))) {
          Ok(()) => "returned",
          Err(payload) if payload.is::<crate::sync::GaveUpAfterThreadCrash>() => "gave up",
          Err(_) => "panicked",
        };
        outcome_tx.send(outcome).unwrap();
      })
    };
    assert!(
      outcome_rx.recv_timeout(Duration::from_millis(200)).is_err(),
      "{what}: with no thread crashed, the phase must keep waiting"
    );
    crashed.store(true, Ordering::SeqCst);
    let outcome = outcome_rx
      .recv_timeout(Duration::from_secs(5))
      .unwrap_or_else(|_| panic!("{what}: the phase must stop waiting once a thread crashed"));
    join_within(what, js_thread, Duration::from_secs(2));
    assert_eq!(outcome, "gave up", "{what}");
    std::mem::forget(controller);
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn begin_shutdown_gives_up_on_a_held_lock_after_a_thread_crash() {
    type Hold = fn(&RuntimeController, &RuntimeBackend);
    let holds: [(&str, Hold); 2] = [
      ("the controller state lock", |controller, _| {
        std::mem::forget(controller.state.lock().unwrap());
      }),
      // `close_and_abort` takes it first thing.
      ("the generation state lock", |_, backend| {
        std::mem::forget(backend.work.state.lock().unwrap());
      }),
    ];
    for (what, hold) in holds {
      for controller in [
        current_thread_controller("crash-begin-ct"),
        multi_thread_controller("crash-begin-mt", 2, 1),
      ] {
        let controller = Arc::new(controller);
        let backend = controller.backend();
        hold(&controller, &backend);
        assert_shutdown_phase_gives_up_after_a_thread_crash(
          &format!("begin_shutdown on {what}"),
          controller,
          |controller| {
            let _ = controller.begin_shutdown();
          },
        );
        std::mem::forget(backend);
      }
    }
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn finish_shutdown_gives_up_after_a_thread_crash() {
    for controller in [
      current_thread_controller("crash-finish-work-ct"),
      multi_thread_controller("crash-finish-work-mt", 2, 1),
    ] {
      // A task on the thread that trapped: its guard never drops, so the
      // generation never goes idle and `wait_until_idle` never wakes.
      let controller = Arc::new(controller);
      let backend = controller.backend();
      let work = backend
        .work
        .try_register_work()
        .expect("an open generation must accept work");
      assert!(
        controller
          .begin_shutdown()
          .expect("phase 1 must be accepted"),
        "phase 1 must report the registered work"
      );
      std::mem::forget(work);
      assert_shutdown_phase_gives_up_after_a_thread_crash(
        "finish_shutdown on work that never retires",
        controller,
        |controller| {
          let _ = controller.finish_shutdown();
        },
      );
      std::mem::forget(backend);
    }
    for controller in [
      current_thread_controller("crash-finish-lock-ct"),
      multi_thread_controller("crash-finish-lock-mt", 2, 1),
    ] {
      let controller = Arc::new(controller);
      let backend = controller.backend();
      assert!(
        !controller
          .begin_shutdown()
          .expect("phase 1 on an idle generation must be accepted"),
        "an idle generation has nothing for the host to wait for"
      );
      std::mem::forget(backend.work.state.lock().unwrap());
      assert_shutdown_phase_gives_up_after_a_thread_crash(
        "finish_shutdown on the generation state lock",
        controller,
        |controller| {
          let _ = controller.finish_shutdown();
        },
      );
      std::mem::forget(backend);
    }
  }

  // ---- MultiThread blocking cap, drain budget, and panic propagation ---------
  // All three construct a `MultiThreadExecutor`/`RuntimeMetrics` LOCALLY (never the
  // global `RUNTIME`) and run the workload on a child thread guarded by a
  // `recv_timeout`, so a regression that hangs is reported as a failure instead of
  // wedging the whole suite.

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_blocking_active_never_exceeds_max_blocking() {
    // Blocking-cap invariant: `take_blocking` refuses to pop or run a queued
    // blocking job while `active_blocking >= max_blocking`. The guard is
    // exercised deterministically (no sleeps, no incidental worker overlap):
    //
    //   1. EXACTLY `max_blocking_tasks` HELD holders saturate the cap. Each holder
    //      occupies a counted slot (`take_blocking` increments `active_blocking`
    //      BEFORE running the closure), signals `held`, then parks on a release
    //      barrier -- so all slots are provably occupied before we proceed.
    //   2. While the cap is saturated, we queue MORE blocking jobs ("extras").
    //      With the cap intact `take_blocking` returns `None` for them, so the
    //      idle workers cannot pop them: no extra may signal `extra_started`.
    //   3. We release the holders, then assert EVERY job (holders + extras)
    //      completes with the right result and the recorded peak never exceeded
    //      the cap.
    //
    // Decisive property: if the `active >= self.max_blocking` guard were removed,
    // the two idle workers would pop the extras while both holders are still
    // parked, driving the recorded peak (`max_active_blocking_tasks`, a monotonic
    // fetch_max set at job entry) above the cap -- so this test fails on EVERY run.
    // The release barrier is sized `holder_count + 1` (<= max_blocking + 1), so it
    // can never self-deadlock on the over-cap extras.
    use std::sync::{Barrier, mpsc};
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let peak_out = Arc::new(Mutex::new(None));
    let peak_slot = Arc::clone(&peak_out);
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 4,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd9-blk-cap".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());

      let holder_count = options.max_blocking_tasks; // saturates the cap exactly
      let extra_count = 4usize; // beyond-cap jobs that must NOT run while held

      // Holders: signal once they hold a counted slot, then park until released.
      let (held_tx, held_rx) = mpsc::channel();
      let release = Arc::new(Barrier::new(holder_count + 1));
      let mut holder_handles = Vec::new();
      for _ in 0..holder_count {
        let held_tx = held_tx.clone();
        let release = Arc::clone(&release);
        holder_handles.push(executor.schedule_blocking(move || {
          held_tx.send(()).unwrap();
          release.wait();
          0usize
        }));
      }
      // Wait until every slot is provably occupied (cap fully saturated).
      for _ in 0..holder_count {
        held_rx.recv().unwrap();
      }

      // Queue the beyond-cap extras. Each signals the instant it begins running.
      let (extra_started_tx, extra_started_rx) = mpsc::channel();
      let mut extra_handles = Vec::new();
      for i in 0..extra_count {
        let extra_started_tx = extra_started_tx.clone();
        extra_handles.push(executor.schedule_blocking(move || {
          extra_started_tx.send(i).unwrap();
          i * 2
        }));
      }

      // With the cap intact, `take_blocking` returns `None` while both slots are
      // held, so no extra can have started running yet.
      assert!(
        matches!(extra_started_rx.try_recv(), Err(mpsc::TryRecvError::Empty)),
        "a beyond-cap blocking job ran before the cap was released (cap check broken)"
      );

      // Release the holders so the queued extras can run within the cap.
      release.wait();

      for handle in holder_handles {
        assert_eq!(futures::executor::block_on(handle).unwrap(), 0usize);
      }
      // Each handle owns its own oneshot receiver, so awaiting in order returns
      // each extra's own result regardless of the order the pool ran them.
      for (i, handle) in extra_handles.into_iter().enumerate() {
        assert_eq!(futures::executor::block_on(handle).unwrap(), i * 2);
      }

      // `blocking_tasks_started` is incremented at job entry, so once every result
      // is in, all holder + extra starts are recorded.
      assert_eq!(
        metrics.blocking_tasks_started.load(Ordering::Relaxed),
        (holder_count + extra_count) as u64
      );

      *peak_slot
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner) =
        Some(metrics.max_active_blocking_tasks.load(Ordering::Relaxed));
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("blocking-cap test did not complete ({error})"),
    }
    let peak = peak_out
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner)
      .expect("peak captured");
    assert!(
      peak >= 1,
      "at least one blocking job must have run (peak {peak})"
    );
    assert!(
      peak <= 2,
      "peak active blocking tasks {peak} exceeded max_blocking_tasks 2"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_drain_budget_completes_large_runnable_batch() {
    // `drain` processes at most `RUNNABLE_BUDGET` (64) runnables per pass, then
    // yields and re-drains via `finish_draining` -> `ensure_drainer`. A batch of
    // MORE than 64 runnables must therefore exercise the budget yield/re-drain and
    // still complete every task, with the runnable counters settling back to 0.
    use std::sync::mpsc;
    use std::time::{Duration, Instant};

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd9-budget".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());

      let task_count = 200usize; // > RUNNABLE_BUDGET (64): forces budget re-drain
      let completed = Arc::new(AtomicU64::new(0));
      let mut tasks = Vec::new();
      for _ in 0..task_count {
        let completed = Arc::clone(&completed);
        let scheduler = Arc::clone(&executor);
        let (runnable, task) = async_task::spawn(
          async move {
            completed.fetch_add(1, Ordering::Relaxed);
          },
          move |r| scheduler.schedule(r),
        );
        executor.schedule(runnable);
        tasks.push(task);
      }
      for task in tasks {
        futures::executor::block_on(task);
      }

      // Every immediately-ready future is polled exactly once; `runnable_polls`
      // (incremented at poll entry, before completion) is therefore exact here.
      assert_eq!(completed.load(Ordering::Relaxed), task_count as u64);
      assert_eq!(
        metrics.runnable_polls.load(Ordering::Relaxed),
        task_count as u64
      );

      // The active-runnable guard for the LAST task drops just after its Task
      // resolves (i.e. just after `block_on` returns), so give the counters a
      // brief, bounded moment to settle to 0 rather than asserting them racily.
      let deadline = Instant::now() + Duration::from_secs(5);
      loop {
        let active = metrics.active_runnables.load(Ordering::Relaxed);
        let queued = metrics.queued_runnables.load(Ordering::Relaxed);
        if active == 0 && queued == 0 {
          break;
        }
        assert!(
          Instant::now() < deadline,
          "runnable counters did not settle to 0: active={active} queued={queued}"
        );
        std::thread::yield_now();
      }
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(15)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("drain-budget test did not complete ({error})"),
    }
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_spawned_panic_surfaces_as_join_error() {
    // A panicking spawned future must surface as `Err(JoinError)` carrying the
    // panic payload's message. We mirror the production `spawn` wrapper LOCALLY
    // (catch_unwind the future, map the panic via `JoinError::from_panic`) and
    // drive the resulting `JoinHandle` on this executor -- without touching the
    // global `RUNTIME`. `JoinError::from_panic` downcasts a `&str` payload, so the
    // `panic!("x")` message round-trips as `"x"`.
    use std::sync::mpsc;
    use std::time::Duration;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "rd9-panic".to_string(),
        park_deadline: None,
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, metrics).unwrap());

      let scheduler = Arc::clone(&executor);
      let wrapped = async {
        AssertUnwindSafe(async { panic!("x") })
          .catch_unwind()
          .await
          .map(|()| ContainedTaskOutput::new((), u64::MAX))
          .map_err(panic_payload_to_join_error)
      };
      let (runnable, task) = async_task::spawn(wrapped, move |r| scheduler.schedule(r));
      executor.schedule(runnable);

      let result: Result<(), JoinError> =
        futures::executor::block_on(JoinHandle(JoinHandleInner::Task {
          task: task.fallible(),
          awaiter: None,
          dependency: Arc::new(TaskDependency::default()),
        }));
      let _ = done_tx.send(result);
    });

    let result = match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(result) => {
        runner.join().unwrap();
        result
      }
      Err(error) => panic!("panic-to-JoinError test did not complete ({error})"),
    };
    let error = result.expect_err("a panicking spawned future must surface as Err(JoinError)");
    assert_eq!(error.to_string(), "x");
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn concurrent_runtime_metrics_reset_preserves_live_and_high_water_gauges() {
    use std::sync::mpsc;

    let metrics = Arc::new(RuntimeMetrics::default());
    metrics.tasks_spawned.store(1, Ordering::Relaxed);
    metrics.tasks_completed.store(2, Ordering::Relaxed);
    metrics.tasks_panicked.store(3, Ordering::Relaxed);
    metrics.runnable_schedules.store(4, Ordering::Relaxed);
    metrics.runnable_polls.store(5, Ordering::Relaxed);
    metrics
      .blocking_tasks_scheduled
      .store(14, Ordering::Relaxed);
    metrics.blocking_tasks_started.store(10, Ordering::Relaxed);
    metrics
      .blocking_tasks_completed
      .store(11, Ordering::Relaxed);
    metrics.runnable_scheduled();
    let (guards_live_tx, guards_live_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let guard_metrics = Arc::clone(&metrics);
    let guard_thread = std::thread::spawn(move || {
      let runnable_guard = guard_metrics.runnable_started();
      let blocking_guard = guard_metrics.blocking_started(true);
      guards_live_tx.send(()).unwrap();
      release_rx.recv().unwrap();
      drop(runnable_guard);
      drop(blocking_guard);
    });
    guards_live_rx.recv().unwrap();
    let fingerprint_before_reset = metrics.progress_fingerprint();

    metrics.reset();

    assert!(
      metrics.progress_fingerprint() != fingerprint_before_reset,
      "a reset must advance the deadlock detector generation even if counters later repeat"
    );
    assert_eq!(
      metrics.tasks_spawned.load(Ordering::Relaxed),
      0,
      "tasks_spawned"
    );
    assert_eq!(
      metrics.tasks_completed.load(Ordering::Relaxed),
      0,
      "tasks_completed"
    );
    assert_eq!(
      metrics.tasks_panicked.load(Ordering::Relaxed),
      0,
      "tasks_panicked"
    );
    assert_eq!(
      metrics.runnable_schedules.load(Ordering::Relaxed),
      0,
      "runnable_schedules"
    );
    assert_eq!(
      metrics.runnable_polls.load(Ordering::Relaxed),
      0,
      "runnable_polls"
    );
    assert_eq!(metrics.queued_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(metrics.max_queued_runnables.load(Ordering::Relaxed), 1);
    assert_eq!(metrics.active_runnables.load(Ordering::Relaxed), 1);
    assert_eq!(metrics.max_active_runnables.load(Ordering::Relaxed), 1);
    assert_eq!(
      metrics.blocking_tasks_scheduled.load(Ordering::Relaxed),
      0,
      "blocking_tasks_scheduled"
    );
    assert_eq!(
      metrics.blocking_tasks_started.load(Ordering::Relaxed),
      0,
      "blocking_tasks_started"
    );
    assert_eq!(
      metrics.blocking_tasks_completed.load(Ordering::Relaxed),
      0,
      "blocking_tasks_completed"
    );
    assert_eq!(metrics.active_blocking_tasks.load(Ordering::Relaxed), 1);
    assert_eq!(metrics.max_active_blocking_tasks.load(Ordering::Relaxed), 1);

    release_tx.send(()).unwrap();
    guard_thread.join().unwrap();
    assert_eq!(metrics.active_runnables.load(Ordering::Relaxed), 0);
    assert_eq!(
      metrics.active_blocking_tasks.load(Ordering::Relaxed),
      0,
      "a live blocking guard completed after reset without unsigned underflow"
    );
    assert_eq!(metrics.blocking_tasks_completed.load(Ordering::Relaxed), 1);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn runtime_metrics_snapshot_clamps_high_water_marks_to_loaded_live_gauges() {
    use std::sync::mpsc;

    fn pause_next_high_water_update(entered: mpsc::Sender<()>, release: mpsc::Receiver<()>) {
      RUNTIME_METRICS_HIGH_WATER_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          entered.send(()).unwrap();
          release.recv().unwrap();
        }));
      });
    }

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::CurrentThread,
      worker_threads: 1,
      max_blocking_tasks: 1,
      thread_name_prefix: "metrics-snapshot".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };

    let queued_metrics = Arc::new(RuntimeMetrics::default());
    let (queued_entered_tx, queued_entered_rx) = mpsc::channel();
    let (queued_release_tx, queued_release_rx) = mpsc::channel();
    let queued_writer_metrics = Arc::clone(&queued_metrics);
    let queued_writer = std::thread::spawn(move || {
      pause_next_high_water_update(queued_entered_tx, queued_release_rx);
      queued_writer_metrics.runnable_scheduled();
    });
    queued_entered_rx.recv().unwrap();
    assert_eq!(
      queued_metrics.max_queued_runnables.load(Ordering::Relaxed),
      0
    );
    let snapshot = queued_metrics.snapshot(&options);
    assert_eq!(snapshot.queued_runnables, 1);
    assert_eq!(snapshot.max_queued_runnables, 1);
    queued_release_tx.send(()).unwrap();
    queued_writer.join().unwrap();
    queued_metrics.runnable_cancelled();

    let active_metrics = Arc::new(RuntimeMetrics::default());
    active_metrics.queued_runnables.store(1, Ordering::Relaxed);
    let (active_entered_tx, active_entered_rx) = mpsc::channel();
    let (active_release_tx, active_release_rx) = mpsc::channel();
    let active_writer_metrics = Arc::clone(&active_metrics);
    let active_writer = std::thread::spawn(move || {
      pause_next_high_water_update(active_entered_tx, active_release_rx);
      let _active = active_writer_metrics.runnable_started();
    });
    active_entered_rx.recv().unwrap();
    assert_eq!(
      active_metrics.max_active_runnables.load(Ordering::Relaxed),
      0
    );
    let snapshot = active_metrics.snapshot(&options);
    assert_eq!(snapshot.active_runnables, 1);
    assert_eq!(snapshot.max_active_runnables, 1);
    active_release_tx.send(()).unwrap();
    active_writer.join().unwrap();

    let blocking_metrics = Arc::new(RuntimeMetrics::default());
    let (blocking_entered_tx, blocking_entered_rx) = mpsc::channel();
    let (blocking_release_tx, blocking_release_rx) = mpsc::channel();
    let blocking_writer_metrics = Arc::clone(&blocking_metrics);
    let blocking_writer = std::thread::spawn(move || {
      pause_next_high_water_update(blocking_entered_tx, blocking_release_rx);
      let _active = blocking_writer_metrics.blocking_started(true);
    });
    blocking_entered_rx.recv().unwrap();
    assert_eq!(
      blocking_metrics
        .max_active_blocking_tasks
        .load(Ordering::Relaxed),
      0
    );
    let snapshot = blocking_metrics.snapshot(&options);
    assert_eq!(snapshot.active_blocking_tasks, 1);
    assert_eq!(snapshot.max_active_blocking_tasks, 1);
    blocking_release_tx.send(()).unwrap();
    blocking_writer.join().unwrap();
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn runtime_metrics_reset_fails_before_generation_wraparound() {
    let metrics = RuntimeMetrics::default();
    metrics
      .reset_generation
      .store(u64::MAX - 1, Ordering::SeqCst);
    metrics.tasks_spawned.store(7, Ordering::Relaxed);

    let exhausted = catch_unwind(AssertUnwindSafe(|| metrics.reset()));
    assert!(exhausted.is_err());
    assert!(!metrics.reset_lock.is_poisoned());
    assert_eq!(
      metrics.reset_generation.load(Ordering::SeqCst),
      u64::MAX - 1
    );
    assert_eq!(metrics.tasks_spawned.load(Ordering::Relaxed), 7);
  }

  // ---- Self-detecting block_on deadlocks -------------------------------------
  // Five deadlock-detection shapes are pinned here: (1) a threadless CurrentThread
  // park decision with no pending wake panics with the typed diagnostic; (2) a
  // self-waking future (the PendThenReady shape) must NOT panic -- the panic
  // lives at the PARK DECISION, not at Pending-return; (3) an
  // armed deadline fires on a genuinely dead cooperative MT park; (4) runtime
  // progress RESETS the deadline instead of firing; (5) the
  // foreign/napi whole-build park is excluded from the deadline entirely.

  /// A future that never completes and never wakes anyone: once its driver
  /// parks, no wake can ever arrive. The deadlock-detection probe shape.
  struct NeverReady;
  impl Future for NeverReady {
    type Output = ();
    fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
      Poll::Pending
    }
  }

  #[cfg(napi_runtime_os_threads)]
  struct ReadyAfterOwnerLanePublication {
    dependency: BlockingDependency,
    ready: Arc<AtomicBool>,
  }

  #[cfg(napi_runtime_os_threads)]
  impl Future for ReadyAfterOwnerLanePublication {
    type Output = ();

    fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
      if self.ready.load(Ordering::SeqCst) {
        Poll::Ready(())
      } else {
        // This shape publishes on every pending poll and never retires; the
        // owner-lane assertions read the state, not the token.
        let mut published = PublishedBlockingDependencies::default();
        record_blocking_dependency(&mut published, self.dependency);
        Poll::Pending
      }
    }
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_threadless_park_with_no_pending_wake_panics_with_typed_diagnostic() {
    // Shape (1): on a threadless build a CT park decision with an empty queue
    // and no wake token pending is a PROVABLE deadlock (no other thread exists
    // to deliver the wake) -- `block_on` must panic immediately with the typed
    // `BlockOnDeadlock` diagnostic instead of parking forever. The workload
    // runs on a child thread bounded by recv_timeout so a missing detection
    // (a hang) fails the test rather than wedging the suite.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      // Native stand-in for the threadless wasm build; no deadline because the
      // certain case is not timing-based.
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, true, None));

      let payload = catch_unwind(AssertUnwindSafe(|| {
        let mut future = std::pin::pin!(NeverReady);
        executor.block_on(future.as_mut());
      }))
      .expect_err("a threadless park with an empty queue and no pending wake must panic");
      let diagnostic = payload
        .downcast_ref::<BlockOnDeadlock>()
        .expect("the panic payload must be the typed BlockOnDeadlock diagnostic");
      assert_eq!(diagnostic.kind, BlockOnDeadlockKind::CurrentThreadCertain);
      assert_eq!(
        diagnostic.park_deadline, None,
        "the certain case carries no deadline"
      );
      let message = diagnostic.to_string();
      assert!(
        message.contains("block_on") && message.contains("JS"),
        "the diagnostic must name the block_on-awaiting-JS hazard, got: {message}"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "threadless CurrentThread park did not self-detect ({error}): block_on parked (or failed) instead of panicking with the diagnostic"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_threadless_self_waking_pending_future_does_not_panic() {
    // Shape (2), pinning panic-at-PARK-DECISION: a future that returns
    // `Pending` but wakes itself synchronously during the poll leaves
    // a wake token pending, so the loop must consume the token and re-poll --
    // NOT panic -- even on a threadless build. "Pending returned" alone is
    // never a deadlock.
    use std::sync::mpsc;

    struct PendThenReady {
      polls: usize,
    }
    impl Future for PendThenReady {
      type Output = ();
      fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
        self.polls += 1;
        if self.polls >= 2 {
          Poll::Ready(())
        } else {
          cx.waker().wake_by_ref();
          Poll::Pending
        }
      }
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, true, None));
      let mut future = std::pin::pin!(PendThenReady { polls: 0 });
      executor.block_on(future.as_mut());
      assert_eq!(
        future.polls, 2,
        "the self-woken future must have been re-polled to completion"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "a self-waking Pending future must complete without panicking on a threadless build ({error})"
      ),
    }
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn current_thread_native_park_deadline_fires_with_typed_diagnostic() {
    // Threaded CT is NOT provably dead at the park decision (another OS thread
    // could deliver a wake later), so detection there is deadline-based and
    // opt-in. A park that outlives the armed deadline with ZERO runtime
    // progress must panic with the typed diagnostic.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(
        metrics,
        false,
        Some(Duration::from_millis(50)),
      ));

      let payload = catch_unwind(AssertUnwindSafe(|| {
        let mut future = std::pin::pin!(NeverReady);
        executor.block_on(future.as_mut());
      }))
      .expect_err("a dead native CT park must fire the armed deadline");
      let diagnostic = payload
        .downcast_ref::<BlockOnDeadlock>()
        .expect("typed payload");
      assert_eq!(diagnostic.kind, BlockOnDeadlockKind::CurrentThreadDeadline);
      assert_eq!(diagnostic.park_deadline, Some(Duration::from_millis(50)));
      // Teardown inside the bounded window: a wedged executor drop must fail
      // the recv below loudly, not hang the final join silently.
      drop(executor);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => join_within(
        "the CT deadline-fire runner exits after teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => panic!("native CurrentThread park deadline did not fire ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_native_park_deadline_resets_on_runtime_progress() {
    // PROGRESS-BASED RESET, CT side: metrics advancing while parked means the
    // runtime is alive (e.g. a slow JS plugin with other
    // work proceeding), so the deadline must re-arm instead of firing.
    // Progress is injected by advancing the very counter the reset reads --
    // the exact seam, isolated from wake delivery (production advances it via
    // real runnable polls).
    //
    // Deadline/cadence ratio: the reset is only exercised when at least one
    // tick lands inside EVERY armed window, so the window must dwarf the
    // injector thread's worst-case scheduling stall. On starved CI hosts
    // (GitHub macOS runners: ~3 heavily oversubscribed cores) a 30ms sleep
    // can overshoot past a 60ms window, leaving one window with zero
    // progress -- which IS a deadline fire by design. Ticks every ~25ms
    // against a 1s window tolerate a ~975ms stall while the park is still
    // held across multiple full windows, so the repeated RE-ARM (not merely
    // the first arm) is what keeps the park alive.
    use std::sync::mpsc;

    let deadline = Duration::from_millis(1000);
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(
      Arc::clone(&metrics),
      false,
      Some(deadline),
    ));

    let (value_tx, value_rx) = oneshot::channel::<usize>();
    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let mut output = None;
      {
        let mut future = std::pin::pin!(async {
          output = Some(value_rx.await.unwrap());
        });
        executor.block_on(future.as_mut());
      }
      assert_eq!(output, Some(9));
      // Teardown inside the bounded window (see `join_within`).
      drop(executor);
      let _ = done_tx.send(());
    });

    // Hold the park across several full deadline windows, every one
    // containing many injected progress ticks, then deliver the (legitimately
    // late) wake. The loop is elapsed-based so an oversleeping iteration
    // extends the hold (more windows) instead of thinning the tick supply,
    // and the final tick lands at most one iteration before the wake.
    let hold_until = Instant::now() + deadline * 5 / 2;
    while Instant::now() < hold_until {
      std::thread::sleep(Duration::from_millis(25));
      metrics.runnable_polls.fetch_add(1, Ordering::Relaxed);
    }
    value_tx.send(9).unwrap();

    match done_rx.recv_timeout(Duration::from_secs(30)) {
      Ok(()) => join_within(
        "the CT deadline-reset runner exits after teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => panic!(
        "a CT park with ongoing runtime progress fired its deadline or lost its wake ({error})"
      ),
    }
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_cooperative_park_past_deadline_with_no_progress_panics_with_typed_diagnostic() {
    // Shape (3): the MT deadline applies to the DriverParker inside
    // `cooperative_block_on`. Run the cooperative branch directly on this
    // thread with the test-only on-pool marker so the panic is observable as
    // a typed payload without rayon in between.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "deadline-fire".to_string(),
        park_deadline: Some(Duration::from_millis(50)),
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let payload = {
        let _on_pool = OnPoolWorkerGuard::enter(executor.id);
        catch_unwind(AssertUnwindSafe(|| {
          let mut future = std::pin::pin!(NeverReady);
          executor.block_on(future.as_mut());
        }))
        .expect_err("a dead cooperative park must fire the armed deadline")
      };
      let diagnostic = payload
        .downcast_ref::<BlockOnDeadlock>()
        .expect("typed payload");
      assert_eq!(
        diagnostic.kind,
        BlockOnDeadlockKind::MultiThreadCooperativeDeadline
      );
      assert_eq!(diagnostic.park_deadline, Some(Duration::from_millis(50)));
      let message = diagnostic.to_string();
      assert!(
        message.contains("block_on"),
        "diagnostic must name the hazard, got: {message}"
      );
      assert_eq!(
        executor.parked_drivers.count.load(Ordering::SeqCst),
        0,
        "the firing driver must deregister itself before panicking"
      );
      // Teardown inside the bounded window (see `join_within`).
      drop(executor);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => join_within(
        "the MT deadline-fire runner exits after executor teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => panic!("MT cooperative park deadline did not fire ({error})"),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_cooperative_park_deadline_resets_on_executor_progress() {
    // Shape (4), MT side of the progress reset: a legitimately slow wake under
    // an armed deadline must NOT fire while the executor's
    // metrics keep advancing. Topology: the sole worker is parked as a
    // cooperative driver (real pool thread, real DriverParker park); the test
    // injects progress ticks across several full deadline windows, then
    // delivers the late wake.
    //
    // Deadline/cadence ratio: one tick must land inside EVERY armed window,
    // so the window must dwarf the injector thread's worst-case scheduling
    // stall -- on starved CI hosts (GitHub macOS runners: ~3 heavily
    // oversubscribed cores) a 30ms sleep can overshoot past a 60ms window,
    // and a full window with zero progress IS a deadline fire by design.
    // Ticks every ~25ms against a 1s window tolerate a ~975ms stall while
    // still holding the park across multiple full windows, proving the
    // repeated RE-ARM rather than a single lucky first window.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let deadline = Duration::from_millis(1000);
      let metrics = Arc::new(RuntimeMetrics::default());
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "deadline-reset".to_string(),
        park_deadline: Some(deadline),
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor = Arc::new(MultiThreadExecutor::new(&options, Arc::clone(&metrics)).unwrap());

      // Park the sole worker as a cooperative driver awaiting a gate (same
      // topology as the miss-compensation test).
      let (gate_tx, gate_rx) = oneshot::channel::<usize>();
      let td_exec = Arc::clone(&executor);
      let completed = Arc::new(AtomicBool::new(false));
      let td_flag = Arc::clone(&completed);
      let td_body = async move {
        let mut inner = std::pin::pin!(async move {
          assert_eq!(gate_rx.await.unwrap(), 9);
        });
        td_exec.block_on(inner.as_mut());
        td_flag.store(true, Ordering::SeqCst);
      };
      let sched = Arc::clone(&executor);
      let (td_runnable, td_task) = async_task::spawn(td_body, move |r| sched.schedule(r));
      executor.schedule(td_runnable);
      wait_until("the sole driver parked", || {
        executor.parked_drivers.count.load(Ordering::SeqCst) == 1
      });

      // Outlive the armed deadline several times over, with every window
      // containing many injected progress ticks (the counter the reset
      // reads). Elapsed-based so an oversleeping iteration extends the hold
      // instead of thinning the tick supply, and the final tick lands at
      // most one iteration before the late wake below.
      let hold_until = Instant::now() + deadline * 5 / 2;
      while Instant::now() < hold_until {
        std::thread::sleep(Duration::from_millis(25));
        metrics.runnable_polls.fetch_add(1, Ordering::Relaxed);
      }
      assert!(
        !completed.load(Ordering::SeqCst),
        "the driver must still be parked awaiting its late wake"
      );
      gate_tx.send(9).unwrap();
      futures::executor::block_on(td_task);
      assert!(
        completed.load(Ordering::SeqCst),
        "the late wake must complete the parked driver"
      );
      // Teardown inside the bounded window (see `join_within`).
      drop(executor);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(30)) {
      Ok(()) => join_within(
        "the MT deadline-reset runner exits after executor teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => panic!(
        "an MT cooperative park with ongoing executor progress fired its deadline or lost its wake ({error})"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_foreign_block_on_long_park_is_excluded_from_deadline() {
    // Shape (5): the foreign/napi caller thread parks in
    // `futures::executor::block_on` for the ENTIRE build -- the normal
    // production shape. Even with an aggressively short deadline armed and
    // ZERO executor progress for many windows, that park must never fire.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 2,
        thread_name_prefix: "foreign-exempt".to_string(),
        park_deadline: Some(Duration::from_millis(40)),
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let (value_tx, value_rx) = oneshot::channel::<usize>();
      let waker_thread = std::thread::spawn(move || {
        // Well past several deadline windows, with zero executor progress.
        std::thread::sleep(Duration::from_millis(300));
        let _ = value_tx.send(7);
      });

      let started = Instant::now();
      let mut output = None;
      {
        let mut future = std::pin::pin!(async {
          output = Some(value_rx.await.unwrap());
        });
        // This (non-pool) thread takes the parking branch: exempt by design.
        executor.block_on(future.as_mut());
      }
      assert_eq!(output, Some(7));
      assert!(
        started.elapsed() >= Duration::from_millis(250),
        "the park must genuinely have outlived the 40ms deadline many times over"
      );
      waker_thread.join().unwrap();
      // Teardown inside the bounded window: this test was one of the silent
      // wedges on the Windows CI runners -- every assertion above had
      // passed, so the hang lived in the unbounded residue (executor drop /
      // thread teardown). Keep that phase inside the loud bounds.
      drop(executor);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => join_within(
        "the exempt foreign-park runner exits after executor teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => {
        panic!("the exempt foreign-thread whole-build park fired or lost its wake ({error})")
      }
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_wake_delivered_at_deadline_expiry_edge_is_not_reported_as_deadlock() {
    // Deadline-expiry wake race, pinned DETERMINISTICALLY via the expiry test
    // hook instead of a wall-clock lottery. Interleaving:
    //   (1) the cooperative park's deadline expires with genuinely zero
    //       progress (nothing else touches the executor before the park);
    //   (2) BEFORE the driver's expiry decision runs -- parker STILL
    //       REGISTERED -- a scheduler queues a blocking job; its `wake_one`
    //       pops this parker, stores the permit and reports the wake as
    //       DELIVERED (so no drainer is spawned). The wake was counted as
    //       delivered TO US, so the post-deregister permit re-check is the
    //       first-line catch; queued work and the enqueue counters in the
    //       fingerprint are further backstops;
    //   (3) the expiry decision runs. It must treat the permit as a wake, run
    //       the job (which sends the gate), and complete the awaited future
    //       instead of reporting `BlockOnDeadlock`.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "edge-wake".to_string(),
        park_deadline: Some(Duration::from_millis(40)),
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      // Until the racing job sends this gate, the awaited future is Pending.
      let (gate_tx, gate_rx) = oneshot::channel::<usize>();
      // (registered_before_wake, registered_after_wake) observed by the hook.
      let (hook_saw_tx, hook_saw_rx) = mpsc::channel::<(usize, usize)>();

      let hook_exec = Arc::clone(&executor);
      DEADLINE_EXPIRY_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          let before = hook_exec.parked_drivers.count.load(Ordering::SeqCst);
          // The racing schedule: pushes the job, then `wake_one` pops the
          // still-registered parker (permit stored, wake counted as
          // delivered, no drainer).
          let handle = hook_exec.schedule_blocking(move || {
            let _ = gate_tx.send(5usize);
            0usize
          });
          drop(handle); // result unobserved; the gate send is the signal
          let after = hook_exec.parked_drivers.count.load(Ordering::SeqCst);
          hook_saw_tx.send((before, after)).unwrap();
        }));
      });

      // The test-only on-pool marker runs the cooperative branch and its
      // thread-local hook on THIS thread.
      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let mut output = None;
      {
        let mut future = std::pin::pin!(async {
          output = Some(gate_rx.await.unwrap());
        });
        executor.block_on(future.as_mut());
      }
      // Clear the hook slot BEFORE any assert can panic: a hook left
      // installed captures an executor Arc, and dropping the last executor
      // Arc from a TLS destructor at thread exit is loader-lock hostile on
      // Windows (see the LOADER-LOCK RULE at `WorkerTlsDropAction`).
      DEADLINE_EXPIRY_TEST_HOOK.with(|slot| drop(slot.borrow_mut().take()));
      assert_eq!(
        output,
        Some(5),
        "the edge-delivered wake's job must have run and completed the future"
      );

      let (before, after) = hook_saw_rx.recv().expect("the expiry hook must have fired");
      assert_eq!(
        before, 1,
        "the hook must observe the parker STILL registered (race window)"
      );
      assert_eq!(
        after, 0,
        "the racing wake_one must have popped the parker (wake DELIVERED)"
      );
      // Teardown inside the bounded window (see `join_within`).
      drop(executor);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => join_within(
        "the expiry-edge-wake runner exits after executor teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => panic!(
        "a wake delivered at the deadline-expiry edge was reported as a deadlock or lost ({error})"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_blocking_enqueue_between_queue_recheck_and_verdict_is_not_reported_as_deadlock() {
    // Enqueue/fingerprint invariant: both runnable and blocking submissions
    // must advance the progress fingerprint at ENQUEUE. A blocking submission
    // landing after `has_queued_work()` but before the final fingerprint read
    // has already pushed deliverable work, while its wake targets an EMPTY
    // parked-driver registry. Only `blocking_tasks_scheduled` makes that work
    // visible to the verdict. DEADLINE_VERDICT_TEST_HOOK deterministically
    // fires in this window on the driver thread:
    //   * `active_drainers` is saturated so `ensure_drainer` cannot start the
    //     job on the real worker -- `blocking_tasks_started` provably cannot
    //     advance behind our back;
    //   * the enqueue counter must therefore save the healthy park.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "verdict-blocking".to_string(),
        park_deadline: Some(Duration::from_millis(40)),
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());
      executor
        .active_drainers
        .store(executor.max_drainers, Ordering::SeqCst);

      // Until the racing job sends this gate, the awaited future is Pending.
      let (gate_tx, gate_rx) = oneshot::channel::<usize>();
      // Registry size observed by the hook (must be 0: already deregistered,
      // so no permit can possibly be delivered for this enqueue).
      let (hook_saw_tx, hook_saw_rx) = mpsc::channel::<usize>();

      let hook_exec = Arc::clone(&executor);
      DEADLINE_VERDICT_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          let handle = hook_exec.schedule_blocking(move || {
            let _ = gate_tx.send(11usize);
            0usize
          });
          drop(handle); // result unobserved; the gate send is the signal
          hook_saw_tx
            .send(hook_exec.parked_drivers.count.load(Ordering::SeqCst))
            .unwrap();
        }));
      });

      // The test-only on-pool marker runs the cooperative branch and its
      // thread-local hook on THIS thread.
      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let mut output = None;
      {
        let mut future = std::pin::pin!(async {
          output = Some(gate_rx.await.unwrap());
        });
        executor.block_on(future.as_mut());
      }
      assert_eq!(
        output,
        Some(11),
        "the enqueued job must have been run by the surviving driver via run_one"
      );

      let registered_at_hook = hook_saw_rx
        .recv()
        .expect("the verdict hook must have fired");
      assert_eq!(
        registered_at_hook, 0,
        "the hook fires post-deregister: no permit can be delivered, only the fingerprint's          enqueue counter can catch this submission"
      );
      executor.active_drainers.store(0, Ordering::SeqCst);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "a blocking enqueue landing between the queue re-check and the verdict was reported as a deadlock or lost ({error})"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_cross_thread_publication_epoch_at_final_verdict_prevents_deadlock() {
    // Publish only through the deadlock-admission protocol after every legacy
    // final check. No runnable, blocking job, permit, timer, or metrics
    // fingerprint changes, so only the synchronized publication epoch can
    // prevent the false verdict. The future observes a separate test flag on
    // its next poll; that flag is deliberately not a scheduler wake source.
    use std::sync::mpsc;

    struct ReadyAfterPublication(Arc<AtomicBool>);

    impl Future for ReadyAfterPublication {
      type Output = ();

      fn poll(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if self.0.load(Ordering::SeqCst) {
          Poll::Ready(())
        } else {
          Poll::Pending
        }
      }
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let options = RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 1,
        max_blocking_tasks: 1,
        thread_name_prefix: "final-verdict-publication".to_string(),
        park_deadline: Some(Duration::from_millis(40)),
        drain_linger: DEFAULT_DRAIN_LINGER,
      };
      let executor =
        Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

      let ready = Arc::new(AtomicBool::new(false));
      let baseline_fingerprint = executor.metrics.progress_fingerprint();
      let baseline_publications = executor.deadlock_state.publications();
      let (hook_saw_tx, hook_saw_rx) = mpsc::channel::<(u64, bool, bool, bool, bool, usize)>();
      let hook_exec = Arc::clone(&executor);
      let hook_ready = Arc::clone(&ready);
      DEADLINE_FINAL_VERDICT_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          let publication_executor = Arc::clone(&hook_exec);
          std::thread::spawn(move || {
            let mut admission = publication_executor
              .begin_deadlock_admission()
              .expect("the deadline detector must enable admission accounting");
            hook_ready.store(true, Ordering::SeqCst);
            admission.mark_published();
          })
          .join()
          .unwrap();
          hook_saw_tx
            .send((
              hook_exec.deadlock_state.publications(),
              !hook_exec.has_queued_runnable(),
              hook_exec
                .blocking_queue
                .lock()
                .unwrap_or_else(std::sync::PoisonError::into_inner)
                .is_empty(),
              hook_exec.next_timer_deadline().is_none(),
              hook_exec.metrics.progress_fingerprint() == baseline_fingerprint,
              hook_exec.parked_drivers.count.load(Ordering::SeqCst),
            ))
            .unwrap();
        }));
      });

      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let mut future = std::pin::pin!(ReadyAfterPublication(ready));
      assert_eq!(
        executor.block_on(future.as_mut()),
        BlockOnOutcome::Completed,
        "the publication epoch must veto the first verdict and permit the next poll"
      );
      let (
        publications,
        runnable_queue_empty,
        blocking_queue_empty,
        timer_heap_empty,
        fingerprint_unchanged,
        parked_drivers,
      ) = hook_saw_rx
        .recv()
        .expect("the final-verdict hook must have fired");
      assert_eq!(
        publications,
        baseline_publications
          .checked_add(1)
          .expect("test publication epoch must not overflow"),
        "the cross-thread admission must publish exactly one epoch"
      );
      assert!(
        runnable_queue_empty,
        "the publication test must not queue a runnable"
      );
      assert!(
        blocking_queue_empty,
        "the publication test must not queue blocking work"
      );
      assert!(
        timer_heap_empty,
        "the publication test must not register a timer"
      );
      assert!(
        fingerprint_unchanged,
        "ordinary metrics progress must not veto the publication-only verdict"
      );
      assert_eq!(
        parked_drivers, 0,
        "the publication must land after the cooperative parker was deregistered"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "a publication-only cross-thread admission was not observed by the final verdict ({error})"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_selected_owner_handoff_before_unpark_vetoes_gated_deadlock() {
    // The exact owner lane is saturated and reserved while the cooperative
    // driver parks. At expiry, release selects that driver and publishes its
    // handoff, then pauses before unpark. The driver reaches the gated verdict
    // with no queue, timer, metric, or ordinary publication change. The
    // exact-owner publication boundary must serialize the final check. The
    // hook then consumes the ordinary permit and renews the lane reservation,
    // leaving only the pending-handoff predicate to veto the false deadlock.
    use std::sync::mpsc;

    let executor = multi_thread_executor(
      1,
      Some(Duration::from_millis(40)),
      "deadline-selected-handoff",
    );
    let owner = executor.fresh_owner_token();
    executor.active_blocking_owners.register(owner);
    executor
      .active_blocking
      .store(executor.max_blocking, Ordering::SeqCst);

    let ready = Arc::new(AtomicBool::new(false));
    let (reservation_ready_tx, reservation_ready_rx) = mpsc::channel();
    let (release_reservation_tx, release_reservation_rx) = mpsc::channel();
    let (selected_tx, selected_rx) = mpsc::channel();
    let (allow_unpark_tx, allow_unpark_rx) = mpsc::channel();
    let (released_tx, released_rx) = mpsc::channel();
    let (renewed_tx, renewed_rx) = mpsc::channel();
    let release_executor = Arc::clone(&executor);
    let renewal_executor = Arc::clone(&executor);
    let release_ready = Arc::clone(&ready);
    let releaser = std::thread::spawn(move || {
      let reservation =
        OwnerLaneReservation::try_acquire(&release_executor.active_blocking_owners, owner)
          .expect("the synthetic exact-owner lane must start reserved");
      reservation_ready_tx.send(()).unwrap();
      OWNER_HANDOFF_SELECTED_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          selected_tx.send(()).unwrap();
          allow_unpark_rx.recv().unwrap();
          let renewed = renewal_executor
            .active_blocking_owners
            .reserve(owner)
            .expect("the released exact-owner lane must be reservable before unpark");
          release_ready.store(true, Ordering::SeqCst);
          renewed_tx.send(renewed).unwrap();
        }));
      });
      release_reservation_rx.recv().unwrap();
      released_tx
        .send(release_executor.release_owner_lane_and_wake(reservation))
        .unwrap();
    });
    reservation_ready_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the exact-owner reservation must be established before the park");

    let baseline_fingerprint = executor.metrics.progress_fingerprint();
    let baseline_publications = executor.deadlock_state.publications();
    let expiry_executor = Arc::clone(&executor);
    DEADLINE_EXPIRY_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        release_reservation_tx.send(()).unwrap();
        selected_rx
          .recv_timeout(Duration::from_secs(2))
          .expect("reservation release must select the still-registered exact-owner driver");
        assert_eq!(
          expiry_executor.parked_drivers.count.load(Ordering::SeqCst),
          0,
          "handoff selection must remove the driver before pausing ahead of unpark"
        );
      }));
    });

    let verdict_executor = Arc::clone(&executor);
    let verdict_ready = Arc::clone(&ready);
    DEADLINE_SYNCHRONIZED_STOP_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        assert!(
          verdict_executor.active_blocking_owners.is_available(owner),
          "reservation release must publish lane availability before handoff selection"
        );
        assert!(!verdict_executor.has_queued_runnable());
        assert!(
          verdict_executor
            .blocking_queue
            .lock()
            .unwrap_or_else(std::sync::PoisonError::into_inner)
            .is_empty()
        );
        assert!(verdict_executor.next_timer_deadline().is_none());
        assert!(
          verdict_executor.metrics.progress_fingerprint() == baseline_fingerprint,
          "ordinary metrics progress must not save the selected-handoff verdict"
        );
        assert_eq!(
          verdict_executor.deadlock_state.publications(),
          baseline_publications
        );
        assert!(
          !verdict_ready.load(Ordering::SeqCst),
          "the selected handoff must still be paused before unpark at the gated verdict"
        );
        allow_unpark_tx.send(()).unwrap();
      }));
    });
    let exact_owner_executor = Arc::clone(&executor);
    DEADLINE_EXACT_OWNER_VERDICT_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move |parker| {
        assert!(
          parker.consume_permit(),
          "the selected handoff must unpark before exact-owner final predicates run"
        );
        assert!(
          parker.has_owner_handoff(),
          "consuming the ordinary permit must leave the exact-owner handoff pending"
        );
        assert!(
          !exact_owner_executor
            .active_blocking_owners
            .is_available(owner),
          "the renewed reservation must prevent lane availability from saving the verdict"
        );
      }));
    });

    {
      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let _owner = BlockingOwnerGuard::enter(Some(owner));
      let mut future = std::pin::pin!(ReadyAfterOwnerLanePublication {
        dependency: BlockingDependency {
          job: BlockingJobId(u64::MAX - 80),
          owner: Some(owner)
        },
        ready: Arc::clone(&ready),
      });
      assert_eq!(
        executor.block_on(future.as_mut()),
        BlockOnOutcome::Completed
      );
    }
    assert!(
      released_rx
        .recv_timeout(Duration::from_secs(2))
        .expect("the selected handoff publication must finish"),
      "reservation release must have selected the cooperative driver"
    );
    let renewed = renewed_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the selected handoff must renew the owner reservation before unpark");
    releaser.join().unwrap();

    executor.active_blocking_owners.release(owner, renewed);
    executor.active_blocking.store(0, Ordering::SeqCst);
    executor.active_blocking_owners.unregister(owner);
    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_owner_release_after_parker_deregistration_vetoes_gated_deadlock() {
    // Release begins only after the deadline path has deregistered its parker
    // and completed every legacy final check. No targeted wake or ordinary
    // scheduler publication can save the verdict; the synchronized exact-owner
    // availability predicate must observe the released lane.
    use std::sync::mpsc;

    let executor = multi_thread_executor(
      1,
      Some(Duration::from_millis(40)),
      "deadline-owner-no-parker",
    );
    let owner = executor.fresh_owner_token();
    executor.active_blocking_owners.register(owner);
    executor
      .active_blocking
      .store(executor.max_blocking, Ordering::SeqCst);

    let ready = Arc::new(AtomicBool::new(false));
    let (reservation_ready_tx, reservation_ready_rx) = mpsc::channel();
    let (release_reservation_tx, release_reservation_rx) = mpsc::channel();
    let (released_tx, released_rx) = mpsc::channel();
    let release_executor = Arc::clone(&executor);
    let release_ready = Arc::clone(&ready);
    let releaser = std::thread::spawn(move || {
      let reservation =
        OwnerLaneReservation::try_acquire(&release_executor.active_blocking_owners, owner)
          .expect("the synthetic exact-owner lane must start reserved");
      reservation_ready_tx.send(()).unwrap();
      release_reservation_rx.recv().unwrap();
      let woke = release_executor.release_owner_lane_and_wake(reservation);
      release_ready.store(true, Ordering::SeqCst);
      released_tx.send(woke).unwrap();
    });
    reservation_ready_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the exact-owner reservation must be established before the park");

    let baseline_fingerprint = executor.metrics.progress_fingerprint();
    let baseline_publications = executor.deadlock_state.publications();
    let verdict_executor = Arc::clone(&executor);
    DEADLINE_FINAL_VERDICT_TEST_HOOK.with(|slot| {
      *slot.borrow_mut() = Some(Box::new(move || {
        assert_eq!(
          verdict_executor.parked_drivers.count.load(Ordering::SeqCst),
          0,
          "the release must begin only after deadline deregistration"
        );
        release_reservation_tx.send(()).unwrap();
        assert!(
          !released_rx
            .recv_timeout(Duration::from_secs(2))
            .expect("the no-parker owner release must finish"),
          "no registered parker may receive the released owner lane"
        );
        assert!(verdict_executor.active_blocking_owners.is_available(owner));
        assert!(!verdict_executor.has_queued_runnable());
        assert!(
          verdict_executor
            .blocking_queue
            .lock()
            .unwrap_or_else(std::sync::PoisonError::into_inner)
            .is_empty()
        );
        assert!(verdict_executor.next_timer_deadline().is_none());
        assert!(
          verdict_executor.metrics.progress_fingerprint() == baseline_fingerprint,
          "ordinary metrics progress must not save the no-parker release verdict"
        );
        assert_eq!(
          verdict_executor.deadlock_state.publications(),
          baseline_publications
        );
      }));
    });

    {
      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let _owner = BlockingOwnerGuard::enter(Some(owner));
      let mut future = std::pin::pin!(ReadyAfterOwnerLanePublication {
        dependency: BlockingDependency {
          job: BlockingJobId(u64::MAX - 81),
          owner: Some(owner)
        },
        ready: Arc::clone(&ready),
      });
      assert_eq!(
        executor.block_on(future.as_mut()),
        BlockOnOutcome::Completed
      );
    }
    releaser.join().unwrap();

    executor.active_blocking.store(0, Ordering::SeqCst);
    executor.active_blocking_owners.unregister(owner);
    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_shutdown_stop_precedes_abort_wake_at_gated_deadlock_verdict() {
    // Pin the shutdown race after the final verdict gate has closed:
    //   1. an accepted task is pending, so shutdown abort must wake it;
    //   2. a cooperative block_on reaches its deadline and pauses while
    //      holding the closed verdict gate;
    //   3. shutdown publishes generation stop, transitions
    //      Running -> Stopping, then its abort wake blocks entering scheduler
    //      admission behind that gate;
    //   4. the gated final verdict must observe stop and return Stopped,
    //      reopening the gate so the abort wake and shutdown can finish.
    //
    // Before stop was published by the controller transition, step 3 blocked
    // inside abort before executor shutdown could set it. The driver then saw
    // empty queues and emitted a false BlockOnDeadlock.
    use std::sync::mpsc;

    let controller = Arc::new(RuntimeController::new());
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 1,
        thread_name_prefix: "shutdown-gated-verdict".to_string(),
        park_deadline: Some(Duration::from_millis(40)),
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("the shutdown race test configuration must be accepted");

    let backend = controller.backend();
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("the configured backend must be MultiThread");
    };
    let executor_id = executor.id;
    let weak_executor = Arc::downgrade(executor);
    drop(backend);

    let (task_polled_tx, task_polled_rx) = mpsc::channel();
    let task = controller
      .try_spawn(async move {
        task_polled_tx.send(()).unwrap();
        std::future::pending::<()>().await;
      })
      .unwrap_or_else(|_| panic!("the pending task must be accepted before shutdown"));
    task_polled_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the accepted task must publish an abortable pending waker");

    let (gate_closed_tx, gate_closed_rx) = mpsc::channel();
    let (release_verdict_tx, release_verdict_rx) = mpsc::channel();
    let (driver_result_tx, driver_result_rx) = mpsc::channel();
    let driver_controller = Arc::clone(&controller);
    let driver = std::thread::spawn(move || {
      DEADLINE_GATED_VERDICT_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          gate_closed_tx.send(()).unwrap();
          release_verdict_rx.recv().unwrap();
        }));
      });

      let _on_pool = OnPoolWorkerGuard::enter(executor_id);
      let mut pending = std::pin::pin!(NeverReady);
      let result = catch_unwind(AssertUnwindSafe(|| {
        driver_controller.block_on(pending.as_mut())
      }));
      let result = match result {
        Ok(outcome) => Ok(outcome),
        Err(payload) => {
          let was_deadlock = payload.downcast_ref::<BlockOnDeadlock>().is_some();
          discard_panic_payload(payload);
          Err(was_deadlock)
        }
      };
      driver_result_tx.send(result).unwrap();
    });

    gate_closed_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the cooperative driver must pause with the verdict gate closed");

    let (abort_blocked_tx, abort_blocked_rx) = mpsc::channel();
    let (shutdown_result_tx, shutdown_result_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      DEADLOCK_CLOSED_GATE_ADMISSION_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          abort_blocked_tx.send(()).unwrap();
        }));
      });
      shutdown_result_tx
        .send(shutdown_controller.shutdown())
        .unwrap();
    });

    abort_blocked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the accepted task's abort wake must reach the closed verdict gate");
    let lifecycle_is_stopping = {
      let state = controller
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      matches!(&state.lifecycle, RuntimeLifecycle::Stopping(_))
    };
    let stop_was_published = weak_executor
      .upgrade()
      .is_some_and(|executor| executor.stop.publication_guard().is_stopping());

    release_verdict_tx.send(()).unwrap();

    let driver_result = driver_result_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the gated driver must resolve after observing shutdown");
    let shutdown_result = shutdown_result_rx
      .recv_timeout(Duration::from_secs(5))
      .expect("shutdown must finish after the verdict gate reopens");
    // Both threads have sent their results; what remains is teardown (and on
    // the shutdown thread, the controller's `wait_for_all_workers` already
    // completed inside `shutdown()`). This test was one of the silent wedges
    // on the Windows CI runners -- bound the residue loudly.
    join_within(
      "the gated cooperative driver exits after teardown",
      driver,
      Duration::from_secs(30),
    );
    join_within(
      "the shutdown thread exits after teardown",
      shutdown,
      Duration::from_secs(30),
    );

    assert!(
      lifecycle_is_stopping,
      "the abort wake must occur after Running -> Stopping"
    );
    assert!(
      stop_was_published,
      "generation stop must be visible before shutdown invokes accepted-task aborts"
    );
    assert_eq!(
      driver_result,
      Ok(BlockOnOutcome::Stopped),
      "shutdown must not be reported as a gated BlockOnDeadlock"
    );
    shutdown_result.unwrap();
    assert!(
      futures::executor::block_on(task).is_err(),
      "the accepted pending task must resolve as cancelled"
    );
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn multi_thread_gated_verdict_linearizes_before_shutdown_publication() {
    // Complement the publication-wins race above. The verdict owns both its
    // admission gate and the stop-publication mutex before shutdown starts.
    // Shutdown reaches the lifecycle -> publication edge but cannot mutate
    // Running -> Stopping until the verdict finishes its synchronized checks.
    use std::sync::mpsc;

    let controller = Arc::new(RuntimeController::new());
    controller
      .configure(RuntimeOptions {
        flavor: RuntimeFlavor::MultiThread,
        worker_threads: 2,
        max_blocking_tasks: 1,
        thread_name_prefix: "verdict-before-shutdown".to_string(),
        park_deadline: Some(Duration::from_millis(40)),
        drain_linger: DEFAULT_DRAIN_LINGER,
      })
      .expect("the verdict-first test configuration must be accepted");

    let backend = controller.backend();
    let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
      panic!("the configured backend must be MultiThread");
    };
    let executor_id = executor.id;
    drop(backend);

    let (verdict_locked_tx, verdict_locked_rx) = mpsc::channel();
    let (release_verdict_tx, release_verdict_rx) = mpsc::channel();
    let (driver_result_tx, driver_result_rx) = mpsc::channel();
    let driver_controller = Arc::clone(&controller);
    let driver = std::thread::spawn(move || {
      DEADLINE_SYNCHRONIZED_STOP_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          verdict_locked_tx.send(()).unwrap();
          release_verdict_rx.recv().unwrap();
        }));
      });

      let _on_pool = OnPoolWorkerGuard::enter(executor_id);
      let mut pending = std::pin::pin!(NeverReady);
      let result = catch_unwind(AssertUnwindSafe(|| {
        driver_controller.block_on(pending.as_mut())
      }));
      let result = match result {
        Ok(outcome) => Ok(outcome),
        Err(payload) => {
          let was_deadlock = payload.downcast_ref::<BlockOnDeadlock>().is_some();
          discard_panic_payload(payload);
          Err(was_deadlock)
        }
      };
      driver_result_tx.send(result).unwrap();
    });

    verdict_locked_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the verdict must hold the synchronized stop-publication guard");

    let (shutdown_waiting_tx, shutdown_waiting_rx) = mpsc::channel();
    let (shutdown_result_tx, shutdown_result_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      BEFORE_GENERATION_STOP_PUBLICATION_LOCK_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          shutdown_waiting_tx.send(()).unwrap();
        }));
      });
      shutdown_result_tx
        .send(shutdown_controller.shutdown())
        .unwrap();
    });

    shutdown_waiting_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("shutdown must reach the lifecycle-to-publication lock edge");
    let early_shutdown = shutdown_result_rx
      .recv_timeout(Duration::from_millis(100))
      .ok();
    let shutdown_was_blocked = early_shutdown.is_none();
    release_verdict_tx.send(()).unwrap();

    let driver_result = driver_result_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the verdict-first driver must finish after release");
    let shutdown_result = early_shutdown.unwrap_or_else(|| {
      shutdown_result_rx
        .recv_timeout(Duration::from_secs(5))
        .expect("shutdown must finish after the verdict releases publication")
    });
    driver.join().unwrap();
    shutdown.join().unwrap();

    assert!(
      shutdown_was_blocked,
      "shutdown must not mutate and retire the Running lifecycle while the verdict owns publication"
    );
    assert_eq!(
      driver_result,
      Err(true),
      "a verdict that linearizes before shutdown must retain the typed deadlock"
    );
    shutdown_result.unwrap();
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn multi_thread_deadlock_panic_hook_can_submit_scheduler_work() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_DEADLOCK_PANIC_HOOK_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let executor =
        multi_thread_executor(1, Some(Duration::from_millis(40)), "deadlock-panic-hook");
      // Keep the synthetic cooperative driver from arming a Rayon drainer. The
      // hook only needs to prove that scheduler admission returns.
      executor
        .active_drainers
        .store(executor.max_drainers, Ordering::SeqCst);

      let hook_returned = Arc::new(AtomicBool::new(false));
      let hook_flag = Arc::clone(&hook_returned);
      let hook_executor = Arc::clone(&executor);
      let previous_hook = std::panic::take_hook();
      std::panic::set_hook(Box::new(move |_| {
        let handle = hook_executor.schedule_blocking(|| ());
        drop(handle);
        hook_flag.store(true, Ordering::SeqCst);
      }));

      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let result = catch_unwind(AssertUnwindSafe(|| {
        let mut pending = std::pin::pin!(std::future::pending::<()>());
        executor.block_on(pending.as_mut());
      }));
      std::panic::set_hook(previous_hook);

      let payload = result.expect_err("the synthetic cooperative park must reach its deadline");
      assert!(
        payload.downcast_ref::<BlockOnDeadlock>().is_some(),
        "the deadline must retain its structured diagnostic"
      );
      assert!(
        hook_returned.load(Ordering::SeqCst),
        "the panic hook's scheduler submission must return before unwind"
      );

      executor.active_drainers.store(0, Ordering::SeqCst);
      executor.begin_shutdown();
      executor.wait_until_scheduler_idle();
      return;
    }

    let mut child = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::multi_thread_deadlock_panic_hook_can_submit_scheduler_work")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .stdout(std::process::Stdio::piped())
      .stderr(std::process::Stdio::piped())
      .spawn()
      .expect("the panic-hook subprocess must start");
    let deadline = Instant::now() + Duration::from_secs(5);
    let status = loop {
      if let Some(status) = child
        .try_wait()
        .expect("the subprocess status must be readable")
      {
        break status;
      }
      if Instant::now() >= deadline {
        let _ = child.kill();
        let output = child
          .wait_with_output()
          .expect("the timed-out subprocess must be reaped");
        panic!(
          "a panic-hook scheduler submission deadlocked the verdict gate\nstdout={}\nstderr={}",
          String::from_utf8_lossy(&output.stdout),
          String::from_utf8_lossy(&output.stderr)
        );
      }
      std::thread::sleep(Duration::from_millis(10));
    };
    let output = child
      .wait_with_output()
      .expect("the completed subprocess output must be read");
    assert!(
      status.success(),
      "the panic-hook admission subprocess failed; status={:?}\nstdout={}\nstderr={}",
      status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  // The PARK_DEADLINE_ENV parse (unset/zero/garbage => disabled) lives in
  // the embedding host's env-resolution pipeline together with the read
  // itself; its tests live there.

  // ---- Timer facility: heap driver + timekeeper (MT), host delegation (CT) --
  // The tests cover both deadlock-detection interactions. All tests build
  // executors LOCALLY (never the global RUNTIME or the process-global host
  // driver) and run hang-prone workloads on a child thread bounded by
  // `recv_timeout`, so a regression fails loudly instead of wedging the suite.

  #[cfg(panic = "unwind")]
  #[test]
  fn contained_waker_separates_wake_and_drop_panics() {
    struct PanicWakeAndDrop;

    impl std::task::Wake for PanicWakeAndDrop {
      fn wake(self: Arc<Self>) {
        panic!("intentional consuming wake panic");
      }

      fn wake_by_ref(self: &Arc<Self>) {
        panic!("intentional borrowed wake panic");
      }
    }

    impl Drop for PanicWakeAndDrop {
      fn drop(&mut self) {
        panic!("intentional RawWaker destructor panic");
      }
    }

    wake_waker_contained(Waker::from(Arc::new(PanicWakeAndDrop)));
  }

  struct TestHostileRawWakerState {
    clones: AtomicUsize,
    drop_panics: AtomicUsize,
    panic_on_clone: Option<usize>,
  }

  struct TestHostileRawWakerToken {
    state: Arc<TestHostileRawWakerState>,
    panic_on_drop: bool,
  }

  unsafe fn clone_test_hostile_waker(data: *const ()) -> std::task::RawWaker {
    let token = unsafe { &*data.cast::<TestHostileRawWakerToken>() };
    let clone = token.state.clones.fetch_add(1, Ordering::SeqCst) + 1;
    assert_ne!(
      token.state.panic_on_clone,
      Some(clone),
      "intentional RawWaker clone panic"
    );
    let clone = Box::new(TestHostileRawWakerToken {
      state: Arc::clone(&token.state),
      panic_on_drop: true,
    });
    std::task::RawWaker::new(Box::into_raw(clone).cast(), &TEST_HOSTILE_RAW_WAKER_VTABLE)
  }

  unsafe fn wake_test_hostile_waker(data: *const ()) {
    unsafe { drop_test_hostile_waker(data) };
  }

  unsafe fn wake_test_hostile_waker_by_ref(_data: *const ()) {}

  unsafe fn drop_test_hostile_waker(data: *const ()) {
    let token = unsafe { Box::from_raw(data.cast_mut().cast::<TestHostileRawWakerToken>()) };
    if token.panic_on_drop {
      token.state.drop_panics.fetch_add(1, Ordering::SeqCst);
      panic!("intentional cloned RawWaker destructor panic");
    }
  }

  static TEST_HOSTILE_RAW_WAKER_VTABLE: std::task::RawWakerVTable = std::task::RawWakerVTable::new(
    clone_test_hostile_waker,
    wake_test_hostile_waker,
    wake_test_hostile_waker_by_ref,
    drop_test_hostile_waker,
  );

  fn test_hostile_waker(state: Arc<TestHostileRawWakerState>) -> Waker {
    let token = Box::new(TestHostileRawWakerToken {
      state,
      panic_on_drop: false,
    });
    let raw = std::task::RawWaker::new(Box::into_raw(token).cast(), &TEST_HOSTILE_RAW_WAKER_VTABLE);
    unsafe { Waker::from_raw(raw) }
  }

  /// Waker that only counts. For polling a raw `Sleep` without an executor.
  struct CountingWake(AtomicUsize);
  impl std::task::Wake for CountingWake {
    fn wake(self: Arc<Self>) {
      self.0.fetch_add(1, Ordering::SeqCst);
    }
  }

  /// One armed stub timer: the latest waker plus a cancellation flag.
  type StubTimerCell = Arc<(Mutex<Waker>, AtomicBool)>;

  /// Test-local host driver: fires each registered timer from a helper OS
  /// thread at its deadline (re-registration under the same id refreshes the
  /// waker without arming a second thread, per the `TimerDriver` contract).
  struct StubHostTimerDriver {
    timers: Mutex<FxHashMap<TimerId, StubTimerCell>>,
  }

  impl StubHostTimerDriver {
    fn new() -> Self {
      Self {
        timers: Mutex::new(FxHashMap::default()),
      }
    }
  }

  impl TimerDriver for StubHostTimerDriver {
    fn register(&self, id: TimerId, deadline: Instant, waker: Waker) {
      let mut timers = self.timers.lock().unwrap();
      if let Some(cell) = timers.get(&id) {
        *cell.0.lock().unwrap() = waker;
        return;
      }
      let cell = Arc::new((Mutex::new(waker), AtomicBool::new(false)));
      timers.insert(id, Arc::clone(&cell));
      std::thread::spawn(move || {
        let now = Instant::now();
        if deadline > now {
          std::thread::sleep(deadline - now);
        }
        if !cell.1.load(Ordering::SeqCst) {
          cell.0.lock().unwrap().wake_by_ref();
        }
      });
    }

    fn cancel(&self, id: TimerId) {
      let removed = self.timers.lock().unwrap().remove(&id);
      if let Some(cell) = removed {
        cell.1.store(true, Ordering::SeqCst);
      }
    }
  }

  /// Manual stub for registry-lifetime tests: records `register`/`cancel`
  /// calls, keeps the binding-shaped pending-waker bookkeeping (latest waker
  /// per timer id), never fires on its own, and reports the controllable
  /// `live` flag (a killed stub plays a driver whose owning host context --
  /// napi env in the binding -- was torn down).
  struct ManualStubDriver {
    live: AtomicBool,
    registers: Mutex<Vec<(TimerId, Instant)>>,
    cancels: Mutex<Vec<TimerId>>,
    pending: Mutex<FxHashMap<TimerId, Waker>>,
    swept: AtomicBool,
  }

  impl ManualStubDriver {
    fn new() -> Arc<Self> {
      Arc::new(Self {
        live: AtomicBool::new(true),
        registers: Mutex::new(Vec::new()),
        cancels: Mutex::new(Vec::new()),
        pending: Mutex::new(FxHashMap::default()),
        swept: AtomicBool::new(false),
      })
    }

    fn kill(&self) {
      self.live.store(false, Ordering::SeqCst);
    }
  }

  impl TimerDriver for ManualStubDriver {
    fn register(&self, id: TimerId, deadline: Instant, waker: Waker) {
      self.registers.lock().unwrap().push((id, deadline));
      self.pending.lock().unwrap().insert(id, waker);
    }

    fn cancel(&self, id: TimerId) {
      self.cancels.lock().unwrap().push(id);
      self.pending.lock().unwrap().remove(&id);
    }

    fn is_live(&self) -> bool {
      self.live.load(Ordering::SeqCst)
    }

    fn on_swept(&self) {
      // The binding shape: drain the pending map and wake everything armed
      // here so those sleeps re-poll onto the next live registrant.
      self.swept.store(true, Ordering::SeqCst);
      let wakers: Vec<Waker> = self
        .pending
        .lock()
        .unwrap()
        .drain()
        .map(|(_, w)| w)
        .collect();
      for waker in wakers {
        waker.wake();
      }
    }
  }

  struct PanickingTimerDriver {
    swept: AtomicBool,
  }

  impl TimerDriver for PanickingTimerDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {}

    fn cancel(&self, _id: TimerId) {}

    fn is_live(&self) -> bool {
      panic!("intentional timer-driver liveness panic");
    }

    fn on_swept(&self) {
      self.swept.store(true, Ordering::SeqCst);
      panic!("intentional timer-driver sweep panic");
    }
  }

  struct PanickingRegisterTimerDriver {
    registers: AtomicUsize,
    cancels: Mutex<Vec<TimerId>>,
    pending: Mutex<FxHashMap<TimerId, Waker>>,
  }

  impl PanickingRegisterTimerDriver {
    fn new() -> Arc<Self> {
      Arc::new(Self {
        registers: AtomicUsize::new(0),
        cancels: Mutex::new(Vec::new()),
        pending: Mutex::new(FxHashMap::default()),
      })
    }
  }

  impl TimerDriver for PanickingRegisterTimerDriver {
    fn register(&self, id: TimerId, _deadline: Instant, waker: Waker) {
      self.registers.fetch_add(1, Ordering::SeqCst);
      self.pending.lock().unwrap().insert(id, waker);
      panic!("intentional timer-driver register panic after arming");
    }

    fn cancel(&self, id: TimerId) {
      self.cancels.lock().unwrap().push(id);
      self.pending.lock().unwrap().remove(&id);
    }
  }

  struct PanicBeforeRetainingTimerDriver {
    registers: AtomicUsize,
  }

  impl TimerDriver for PanicBeforeRetainingTimerDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {
      self.registers.fetch_add(1, Ordering::SeqCst);
      panic!("intentional timer-driver register panic before retaining its waker");
    }

    fn cancel(&self, _id: TimerId) {}
  }

  struct PanickingCancelDropTimerDriver {
    cancels: Arc<AtomicUsize>,
    drops: Arc<AtomicUsize>,
  }

  impl TimerDriver for PanickingCancelDropTimerDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {}

    fn cancel(&self, _id: TimerId) {
      self.cancels.fetch_add(1, Ordering::SeqCst);
      panic!("intentional timer-driver cancel panic");
    }
  }

  impl Drop for PanickingCancelDropTimerDriver {
    fn drop(&mut self) {
      self.drops.fetch_add(1, Ordering::SeqCst);
      panic!("intentional timer-driver destructor panic");
    }
  }

  struct UnregisterLaterThenPanicTimerDriver {
    registry: Weak<TimerDriverRegistry>,
    later: Mutex<Option<TimerDriverId>>,
    registers: AtomicUsize,
  }

  impl TimerDriver for UnregisterLaterThenPanicTimerDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {
      self.registers.fetch_add(1, Ordering::SeqCst);
      let later = *self.later.lock().unwrap();
      if let (Some(registry), Some(later)) = (self.registry.upgrade(), later) {
        registry.unregister(later);
      }
      panic!("intentional earlier timer-driver panic after unregistering a later driver");
    }

    fn cancel(&self, _id: TimerId) {}
  }

  struct ReentrantLivenessDriver {
    registry: std::sync::Weak<TimerDriverRegistry>,
    registration: Mutex<Option<TimerDriverId>>,
  }

  impl TimerDriver for ReentrantLivenessDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {}

    fn cancel(&self, _id: TimerId) {}

    fn is_live(&self) -> bool {
      let registration = *self.registration.lock().unwrap();
      if let (Some(registry), Some(id)) = (self.registry.upgrade(), registration) {
        registry.unregister(id);
      }
      false
    }
  }

  struct ReentrantMultiUnregisterTimerDriver {
    registry: std::sync::Weak<TimerDriverRegistry>,
    registrations: Mutex<Vec<TimerDriverId>>,
  }

  impl TimerDriver for ReentrantMultiUnregisterTimerDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {}

    fn cancel(&self, _id: TimerId) {}

    fn is_live(&self) -> bool {
      if let Some(registry) = self.registry.upgrade() {
        for registration in self.registrations.lock().unwrap().iter().copied() {
          registry.unregister(registration);
        }
      }
      false
    }
  }

  struct ReentrantSweepTimerDriver {
    registry: std::sync::Weak<TimerDriverRegistry>,
    registration: Mutex<Option<TimerDriverId>>,
    sweeps: AtomicUsize,
    removed_before_sweep: AtomicBool,
  }

  impl TimerDriver for ReentrantSweepTimerDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {}

    fn cancel(&self, _id: TimerId) {}

    fn is_live(&self) -> bool {
      false
    }

    fn on_swept(&self) {
      self.sweeps.fetch_add(1, Ordering::SeqCst);
      let registration = self.registration.lock().unwrap().take();
      if let (Some(registry), Some(registration)) = (self.registry.upgrade(), registration) {
        let state = registry
          .state
          .try_lock()
          .expect("the sweep callback must run outside the timer-driver registry lock");
        assert!(
          !state.entries.contains_key(&registration),
          "the dead driver must be unlinked before its sweep callback runs"
        );
        self.removed_before_sweep.store(true, Ordering::SeqCst);
        drop(state);
        // Mirrors JsTimerHostInner::evict: the sweep already removed this
        // registration, so explicit host cleanup must remain a cheap no-op.
        registry.unregister(registration);
      }
    }
  }

  struct ReentrantDropDriver {
    registry: std::sync::Weak<TimerDriverRegistry>,
    fallback: TimerDriverId,
  }

  impl TimerDriver for ReentrantDropDriver {
    fn register(&self, _id: TimerId, _deadline: Instant, _waker: Waker) {}

    fn cancel(&self, _id: TimerId) {}
  }

  impl Drop for ReentrantDropDriver {
    fn drop(&mut self) {
      if let Some(registry) = self.registry.upgrade() {
        registry.unregister(self.fallback);
      }
    }
  }

  /// Waker whose `wake` just latches a flag -- observable evidence that a
  /// wake was DELIVERED (not merely that eviction bookkeeping ran).
  #[derive(Default)]
  struct WakeFlag(AtomicBool);

  impl std::task::Wake for WakeFlag {
    fn wake(self: Arc<Self>) {
      self.0.store(true, Ordering::SeqCst);
    }
  }

  #[cfg(napi_runtime_os_threads)]
  fn multi_thread_executor(
    workers: usize,
    park_deadline: Option<Duration>,
    prefix: &str,
  ) -> Arc<MultiThreadExecutor> {
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: workers,
      max_blocking_tasks: workers,
      thread_name_prefix: prefix.to_string(),
      park_deadline,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap())
  }

  /// Local driver registry holding exactly `driver` (the common single-host
  /// shape of the ported pre-registry tests).
  fn registry_with(driver: Arc<dyn TimerDriver>) -> Arc<TimerDriverRegistry> {
    let registry = Arc::new(TimerDriverRegistry::default());
    registry.register(driver);
    registry
  }

  #[cfg(napi_runtime_os_threads)]
  fn heap_sleep(executor: &Arc<MultiThreadExecutor>, deadline: Instant) -> Sleep {
    // The MultiThread arm never touches the driver registry; empty is fine.
    make_sleep(
      &RuntimeBackend::from_executor(RuntimeExecutor::MultiThread(Arc::clone(executor))),
      &Arc::new(TimerDriverRegistry::default()),
      deadline,
    )
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_timer_registration_holds_deadlock_admission_until_heap_publication() {
    use std::sync::mpsc;

    let executor = multi_thread_executor(
      1,
      Some(Duration::from_secs(1)),
      "timer-registration-admission",
    );
    let (entered_tx, entered_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let registration_executor = Arc::clone(&executor);
    let registration = std::thread::spawn(move || {
      TIMER_REGISTRATION_ADMISSION_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          entered_tx.send(()).unwrap();
          release_rx.recv().unwrap();
        }));
      });
      registration_executor.register_timer(
        1,
        Instant::now() + Duration::from_secs(60),
        futures::task::noop_waker(),
        &Arc::new(AtomicBool::new(false)),
      );
    });

    entered_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("timer registration must pause after entering verdict admission");
    let verdict = executor.try_begin_deadlock_verdict();
    let admission_blocked_verdict = verdict.is_none();
    drop(verdict);
    release_tx.send(()).unwrap();
    registration.join().unwrap();

    assert!(
      admission_blocked_verdict,
      "a timer registration must remain announced until its heap entry is visible"
    );
    assert!(
      executor.next_timer_deadline().is_some(),
      "the admitted registration must publish its timer after release"
    );
    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
  }

  #[cfg(napi_runtime_os_threads)]
  #[derive(Clone, Copy, Debug)]
  enum TimerFireAdmissionPath {
    Timekeeper,
    Cooperative,
    Shutdown,
  }

  #[cfg(napi_runtime_os_threads)]
  struct ScheduleAfterTimerWakeRelease {
    executor: Arc<MultiThreadExecutor>,
    runnable: Mutex<Option<Runnable>>,
    entered: std::sync::mpsc::Sender<()>,
    release: Mutex<std::sync::mpsc::Receiver<()>>,
    scheduled: std::sync::mpsc::Sender<()>,
  }

  #[cfg(napi_runtime_os_threads)]
  impl ScheduleAfterTimerWakeRelease {
    fn publish(&self) {
      self.entered.send(()).unwrap();
      self
        .release
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .recv()
        .unwrap();
      let runnable = self
        .runnable
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner)
        .take();
      if let Some(runnable) = runnable {
        self.executor.schedule(runnable);
      }
      self.scheduled.send(()).unwrap();
    }
  }

  #[cfg(napi_runtime_os_threads)]
  impl std::task::Wake for ScheduleAfterTimerWakeRelease {
    fn wake(self: Arc<Self>) {
      self.publish();
    }

    fn wake_by_ref(self: &Arc<Self>) {
      self.publish();
    }
  }

  #[cfg(napi_runtime_os_threads)]
  fn insert_timer_for_fire_admission_test(
    executor: &MultiThreadExecutor,
    id: TimerId,
    deadline: Instant,
    waker: Waker,
    fired: Arc<AtomicBool>,
  ) {
    let mut inner = executor
      .timers
      .inner
      .lock()
      .unwrap_or_else(std::sync::PoisonError::into_inner);
    inner.entries.insert(id, HeapTimerEntry { waker, fired });
    inner.queue.push(deadline, id);
  }

  #[cfg(napi_runtime_os_threads)]
  fn assert_timer_fire_path_holds_deadlock_admission(path: TimerFireAdmissionPath) {
    use std::sync::mpsc;

    let executor = multi_thread_executor(1, Some(Duration::from_secs(1)), "timer-fire-admission");
    let (runnable, task) = async_task::spawn(async {}, |_| {});
    task.detach();
    let (entered_tx, entered_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let (scheduled_tx, scheduled_rx) = mpsc::channel();
    let fired = Arc::new(AtomicBool::new(false));
    let waker = Waker::from(Arc::new(ScheduleAfterTimerWakeRelease {
      executor: Arc::clone(&executor),
      runnable: Mutex::new(Some(runnable)),
      entered: entered_tx,
      release: Mutex::new(release_rx),
      scheduled: scheduled_tx,
    }));

    let fire_thread = match path {
      TimerFireAdmissionPath::Timekeeper => {
        executor.register_timer(1, Instant::now() + Duration::from_millis(20), waker, &fired);
        None
      }
      TimerFireAdmissionPath::Cooperative => {
        insert_timer_for_fire_admission_test(
          &executor,
          1,
          Instant::now(),
          waker,
          Arc::clone(&fired),
        );
        let fire_executor = Arc::clone(&executor);
        Some(std::thread::spawn(move || fire_executor.fire_due_timers()))
      }
      TimerFireAdmissionPath::Shutdown => {
        insert_timer_for_fire_admission_test(
          &executor,
          1,
          Instant::now() + Duration::from_secs(60),
          waker,
          Arc::clone(&fired),
        );
        let fire_executor = Arc::clone(&executor);
        Some(std::thread::spawn(move || fire_executor.shutdown_timers()))
      }
    };

    // Hang detector on a guaranteed event that needs a freshly spawned
    // thread (timekeeper / fire thread) to get CPU -- generous for starved
    // CI runners.
    entered_rx
      .recv_timeout(Duration::from_secs(10))
      .unwrap_or_else(|error| panic!("{path:?} timer waker was not invoked: {error}"));
    assert!(
      executor.next_timer_deadline().is_none(),
      "{path:?} must exercise the remove-before-wake window"
    );
    assert!(
      executor.deadlock_state.admissions.load(Ordering::SeqCst) != 0,
      "{path:?} must retain admission while its waker is publishing"
    );
    let verdict = executor.try_begin_deadlock_verdict();
    let admission_blocked_verdict = verdict.is_none();
    drop(verdict);

    release_tx.send(()).unwrap();
    scheduled_rx
      .recv_timeout(Duration::from_secs(10))
      .unwrap_or_else(|error| panic!("{path:?} timer wake did not publish its runnable: {error}"));
    if let Some(fire_thread) = fire_thread {
      fire_thread.join().unwrap();
    }
    assert!(
      admission_blocked_verdict,
      "{path:?} allowed a final verdict while the timer was invisible and its wake unpublished"
    );

    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_timer_fire_paths_hold_deadlock_admission_through_wake_publication() {
    for path in [
      TimerFireAdmissionPath::Timekeeper,
      TimerFireAdmissionPath::Cooperative,
      TimerFireAdmissionPath::Shutdown,
    ] {
      assert_timer_fire_path_holds_deadlock_admission(path);
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_sleep_fires_from_foreign_block_on() {
    // The napi-caller shape: a NON-pool thread parks in
    // `futures::executor::block_on` awaiting a sleep. Nothing else runs on
    // the executor, so ONLY the dedicated timekeeper can fire the timer --
    // this is the timekeeper's existence test.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let executor = multi_thread_executor(2, None, "timer-foreign");
      let started = Instant::now();
      let mut future = std::pin::pin!(async {
        heap_sleep(&executor, Instant::now() + Duration::from_millis(80)).await;
      });
      executor.block_on(future.as_mut());
      assert!(
        started.elapsed() >= Duration::from_millis(80),
        "the sleep must not resolve before its deadline"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => {
        panic!("a sleep awaited from a foreign block_on never fired ({error}): no timekeeper")
      }
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn pending_timer_does_not_reduce_single_worker_scheduler_capacity() {
    // A long timer waits on the dedicated timer thread, leaving the sole
    // low-level test worker available for ordinary scheduler work.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let executor = multi_thread_executor(1, None, "timer-drainer");

      // Arm a long timer through a real spawned task so the sole worker
      // returns to rayon afterwards (the watch-idle Debouncing shape).
      let sleep_exec = Arc::clone(&executor);
      let sleep_done = Arc::new(AtomicBool::new(false));
      let sleep_flag = Arc::clone(&sleep_done);
      let sched = Arc::clone(&executor);
      let (sleep_runnable, sleep_task) = async_task::spawn(
        async move {
          heap_sleep(&sleep_exec, Instant::now() + Duration::from_secs(60)).await;
          sleep_flag.store(true, Ordering::SeqCst);
        },
        move |r| sched.schedule(r),
      );
      executor.schedule(sleep_runnable);
      wait_until("the timekeeper parked on the 60s deadline", || {
        executor
          .timers
          .inner
          .lock()
          .unwrap()
          .timekeeper_parker
          .is_some()
      });

      // Queued work must run NOW, not in 60s.
      let counter = Arc::new(AtomicUsize::new(0));
      let mut tasks = Vec::new();
      for _ in 0..32 {
        let counter = Arc::clone(&counter);
        let sched = Arc::clone(&executor);
        let (runnable, task) = async_task::spawn(
          async move {
            counter.fetch_add(1, Ordering::SeqCst);
          },
          move |r| sched.schedule(r),
        );
        executor.schedule(runnable);
        tasks.push(task);
      }
      for task in tasks {
        futures::executor::block_on(task);
      }
      assert_eq!(counter.load(Ordering::SeqCst), 32);
      assert!(
        !sleep_done.load(Ordering::SeqCst),
        "the 60s timer must still be pending: the work ran DURING the timer wait"
      );
      // Cancel the long sleep so the executor tears down promptly.
      executor.shutdown_timers();
      futures::executor::block_on(sleep_task);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(15)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => {
        panic!("queued work lost the only Rayon worker while a timer was pending ({error})")
      }
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_timekeeper_starts_only_after_a_timer_is_polled() {
    let executor = multi_thread_executor(2, None, "timer-lazy-start");
    assert!(
      executor.timers.thread.lock().unwrap().is_none(),
      "constructing a runtime without timers must not create an extra OS thread"
    );

    let mut sleep = heap_sleep(&executor, Instant::now() + Duration::from_secs(60));
    assert!(
      executor.timers.thread.lock().unwrap().is_none(),
      "an unpolled sleep has not registered a deadline"
    );
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    assert!(
      executor.timers.thread.lock().unwrap().is_some(),
      "the first timer registration must start the dedicated service"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn closed_timer_heap_does_not_wait_for_the_thread_handle_mutex() {
    use std::sync::mpsc;

    let executor = multi_thread_executor(1, None, "timer-closed-start");
    executor.shutdown_timers();
    let handle_guard = executor.timers.thread.lock().unwrap();
    let ensure_executor = Arc::clone(&executor);
    let (completed_tx, completed_rx) = mpsc::channel();
    let ensure = std::thread::spawn(move || {
      ensure_executor.timers.ensure_started().unwrap();
      completed_tx.send(()).unwrap();
    });

    // Hang detector on a freshly spawned thread getting CPU -- generous for
    // starved CI runners (a real regression blocks forever on the held lock).
    completed_rx.recv_timeout(Duration::from_secs(10)).expect(
      "ensure_started consulted or joined the timer handle before observing the closed heap",
    );
    drop(handle_guard);
    ensure.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cancelling_non_earliest_timers_keeps_the_deadline_heap_bounded() {
    const TIMERS: u64 = 4096;

    let executor = multi_thread_executor(1, None, "timer-indexed-cancel");
    let base = Instant::now() + Duration::from_secs(3600);
    for id in 0..TIMERS {
      executor.register_timer(
        id,
        base + Duration::from_secs(id),
        futures::task::noop_waker(),
        &Arc::new(AtomicBool::new(false)),
      );
    }
    {
      let inner = executor.timers.inner.lock().unwrap();
      assert_eq!(inner.queue.len(), usize::try_from(TIMERS).unwrap());
      assert_eq!(inner.queue.len(), inner.entries.len());
    }

    // Preserve the earliest node while removing every later node. A lazy
    // BinaryHeap would retain all 4095 tombstones until that first deadline.
    for id in 1..TIMERS {
      executor.cancel_timer(id);
    }
    {
      let inner = executor.timers.inner.lock().unwrap();
      assert_eq!(inner.entries.len(), 1);
      assert_eq!(inner.queue.len(), 1);
      assert_eq!(inner.queue.peek().map(|(_, id)| id), Some(0));
    }

    executor.cancel_timer(0);
    {
      let inner = executor.timers.inner.lock().unwrap();
      assert!(inner.entries.is_empty());
      assert!(inner.queue.is_empty());
    }
    executor.shutdown_timers();
    executor.timers.join();
  }

  #[cfg(all(napi_runtime_os_threads, panic = "unwind"))]
  #[test]
  fn timer_registration_is_transactional_when_timekeeper_start_fails() {
    let executor = multi_thread_executor(2, None, "timer-start-failure");
    executor
      .timers
      .fail_next_start
      .store(true, Ordering::SeqCst);

    let wake_count = Arc::new(CountingWake(AtomicUsize::new(0)));
    let waker = Waker::from(Arc::clone(&wake_count));
    let baseline_waker_refs = Arc::strong_count(&wake_count);
    let mut cx = Context::from_waker(&waker);
    let mut sleep = heap_sleep(&executor, Instant::now() + Duration::from_secs(60));

    let failure = catch_unwind(AssertUnwindSafe(|| Pin::new(&mut sleep).poll(&mut cx)));
    assert!(
      failure.is_err(),
      "the injected timer-thread start failure must panic the poll"
    );
    {
      let inner = executor.timers.inner.lock().unwrap();
      assert!(
        inner.entries.is_empty(),
        "a failed start must not retain a timer entry"
      );
      assert!(
        inner.queue.is_empty(),
        "a failed start must not retain a stale heap node"
      );
      assert!(
        inner.timekeeper_parker.is_none(),
        "a failed start must not publish a timekeeper parker"
      );
    }
    assert!(
      executor.timers.thread.lock().unwrap().is_none(),
      "a failed start must not retain a thread handle"
    );
    assert_eq!(
      Arc::strong_count(&wake_count),
      baseline_waker_refs,
      "a failed start must release the cloned timer waker"
    );

    assert!(
      Pin::new(&mut sleep).poll(&mut cx).is_pending(),
      "the same Sleep must be safely retryable after a transient start failure"
    );
    {
      let inner = executor.timers.inner.lock().unwrap();
      assert_eq!(
        inner.entries.len(),
        1,
        "the retry must publish exactly one timer entry"
      );
      assert_eq!(
        inner.queue.len(),
        1,
        "the retry must publish exactly one heap node"
      );
    }
    assert!(
      executor.timers.thread.lock().unwrap().is_some(),
      "the retry must start the dedicated timekeeper"
    );

    drop(sleep);
    assert!(
      executor.timers.inner.lock().unwrap().entries.is_empty(),
      "dropping the retried Sleep must cancel its registration"
    );
    executor.shutdown_timers();
    executor.wait_until_scheduler_idle();
    assert!(
      executor.timers.thread.lock().unwrap().is_none(),
      "shutdown after a recovered start failure must join the timekeeper"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn pending_timer_preserves_every_configured_rayon_worker() {
    use std::sync::mpsc;

    let executor = multi_thread_executor(2, None, "timer-rayon-capacity");
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);
    let mut sleep = heap_sleep(&executor, Instant::now() + Duration::from_secs(60));
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    wait_until("the dedicated timer thread to park", || {
      executor
        .timers
        .inner
        .lock()
        .unwrap()
        .timekeeper_parker
        .is_some()
    });

    let released = Arc::new((Mutex::new(false), Condvar::new()));
    let (started_tx, started_rx) = mpsc::channel();
    let (completed_tx, completed_rx) = mpsc::channel();
    for _ in 0..2 {
      let released = Arc::clone(&released);
      let started_tx = started_tx.clone();
      let completed_tx = completed_tx.clone();
      executor.pool.spawn(move || {
        started_tx.send(()).unwrap();
        let (lock, changed) = &*released;
        let mut released = lock
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner);
        while !*released {
          released = changed
            .wait(released)
            .unwrap_or_else(std::sync::PoisonError::into_inner);
        }
        completed_tx.send(()).unwrap();
      });
    }
    drop(started_tx);
    drop(completed_tx);

    let first = started_rx.recv_timeout(Duration::from_secs(2));
    let second = started_rx.recv_timeout(Duration::from_secs(2));
    {
      let (lock, changed) = &*released;
      *lock
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner) = true;
      changed.notify_all();
    }
    drop(sleep);
    for _ in 0..2 {
      completed_rx.recv_timeout(Duration::from_secs(2)).unwrap();
    }

    assert!(
      first.is_ok(),
      "the first configured Rayon worker did not start"
    );
    assert!(
      second.is_ok(),
      "a pending timer consumed one of the two configured Rayon workers"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn timekeeper_never_enters_a_blocking_closure() {
    use std::{
      sync::{Barrier, mpsc},
      time::Duration,
    };

    let executor = multi_thread_executor(1, None, "timer-blocking-isolation");
    let wake_count = Arc::new(CountingWake(AtomicUsize::new(0)));
    let waker = Waker::from(Arc::clone(&wake_count));
    let mut cx = Context::from_waker(&waker);
    let mut sleep = heap_sleep(&executor, Instant::now() + Duration::from_millis(100));
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    wait_until(
      "the timekeeper parked before blocking work was submitted",
      || {
        executor
          .timers
          .inner
          .lock()
          .unwrap()
          .timekeeper_parker
          .is_some()
      },
    );

    let release = Arc::new(Barrier::new(2));
    let blocker_release = Arc::clone(&release);
    let (started_tx, started_rx) = mpsc::sync_channel(1);
    let blocking = executor.schedule_blocking(move || {
      started_tx.send(()).unwrap();
      blocker_release.wait();
    });
    // Hang detector (the closure start needs a worker to get CPU) --
    // generous for starved CI runners.
    started_rx.recv_timeout(Duration::from_secs(10)).unwrap();

    wait_until(
      "the timer waker to fire while the Rayon worker is blocked",
      || wake_count.0.load(Ordering::SeqCst) != 0,
    );
    release.wait();
    futures::executor::block_on(blocking).unwrap();
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_ready());
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn nested_block_on_services_timer_wake_while_other_worker_is_blocked() {
    use std::sync::mpsc;

    struct PendingEntered(Option<mpsc::Sender<()>>);

    impl Future for PendingEntered {
      type Output = ();

      fn poll(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<()> {
        if let Some(entered) = self.0.take() {
          entered.send(()).unwrap();
        }
        Poll::Pending
      }
    }

    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 2,
      max_blocking_tasks: 1,
      thread_name_prefix: "nested-timer-wake".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor =
      Arc::new(MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default())).unwrap());

    let timer_exec = Arc::clone(&executor);
    let (timer_tx, timer_rx) = mpsc::channel();
    let timer_scheduler = Arc::clone(&executor);
    let (timer_runnable, timer_task) = async_task::spawn(
      async move {
        heap_sleep(&timer_exec, Instant::now() + Duration::from_millis(150)).await;
        timer_tx.send(()).unwrap();
      },
      move |runnable| timer_scheduler.schedule(runnable),
    );
    executor.schedule(timer_runnable);
    wait_until(
      "the dedicated timekeeper parked before nested block_on",
      || {
        executor
          .timers
          .inner
          .lock()
          .unwrap()
          .timekeeper_parker
          .is_some()
      },
    );

    let (entered_tx, entered_rx) = mpsc::channel();
    let nested_exec = Arc::clone(&executor);
    let nested_scheduler = Arc::clone(&executor);
    let (nested_runnable, nested_task) = async_task::spawn(
      async move {
        let mut pending = Box::pin(PendingEntered(Some(entered_tx)));
        let outcome = nested_exec.block_on(pending.as_mut());
        drop(pending);
        assert_eq!(
          outcome,
          BlockOnOutcome::Stopped,
          "shutdown must stop the raw nested block_on driver"
        );
      },
      move |runnable| nested_scheduler.schedule(runnable),
    );
    executor.schedule(nested_runnable);
    entered_rx.recv_timeout(Duration::from_secs(2)).unwrap();

    let (blocking_started_tx, blocking_started_rx) = mpsc::channel();
    let (release_tx, release_rx) = mpsc::channel();
    let blocking = executor.schedule_blocking(move || {
      blocking_started_tx.send(()).unwrap();
      release_rx.recv().unwrap();
    });
    blocking_started_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("a general worker must service blocking work");
    timer_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("the timer wake must reach the nested cooperative driver");

    release_tx.send(()).unwrap();
    futures::executor::block_on(blocking).unwrap();
    executor.begin_shutdown();
    assert_eq!(
      futures::executor::block_on(nested_task.fallible()),
      Some(())
    );
    futures::executor::block_on(timer_task);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_rearming_to_earlier_deadline_rewakes_timekeeper() {
    // Task requirement: a NEW earliest deadline (heap peek changes) must
    // re-arm the already-parked timekeeper. The 60s sentinel timer parks the
    // timekeeper far in the future; the 60ms timer must still fire on time.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let executor = multi_thread_executor(2, None, "timer-rearm");

      let long_exec = Arc::clone(&executor);
      let long_done = Arc::new(AtomicBool::new(false));
      let long_flag = Arc::clone(&long_done);
      let sched = Arc::clone(&executor);
      let (long_runnable, long_task) = async_task::spawn(
        async move {
          heap_sleep(&long_exec, Instant::now() + Duration::from_secs(60)).await;
          long_flag.store(true, Ordering::SeqCst);
        },
        move |r| sched.schedule(r),
      );
      executor.schedule(long_runnable);
      wait_until("the timekeeper parked on the 60s sentinel", || {
        executor
          .timers
          .inner
          .lock()
          .unwrap()
          .timekeeper_parker
          .is_some()
      });

      let started = Instant::now();
      let mut future = std::pin::pin!(async {
        heap_sleep(&executor, Instant::now() + Duration::from_millis(60)).await;
      });
      executor.block_on(future.as_mut());
      let elapsed = started.elapsed();
      assert!(
        elapsed >= Duration::from_millis(60),
        "fired before its deadline: {elapsed:?}"
      );
      assert!(
        !long_done.load(Ordering::SeqCst),
        "the 60s sentinel must still be pending: the short timer was fired by a re-armed \
         timekeeper, not by the sentinel expiring"
      );
      executor.shutdown_timers();
      futures::executor::block_on(long_task);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(15)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "a timer earlier than the parked timekeeper's deadline never fired ({error}): re-arm-to-earlier is broken"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_sleep_cancels_registration_on_drop() {
    // `tokio::select!` losing-arm semantics: dropping the Sleep must retire
    // its heap registration (no waker fired later, heap drains empty).
    let executor = multi_thread_executor(1, None, "timer-cancel");
    let wake_count = Arc::new(CountingWake(AtomicUsize::new(0)));
    let waker = Waker::from(Arc::clone(&wake_count));
    let mut cx = Context::from_waker(&waker);

    // The deadline's pre-poll budget is one statement; 250ms dwarfs it on a
    // starved runner (a past-due Sleep would resolve inline instead of
    // registering, failing the assert below for the wrong reason).
    let deadline = Instant::now() + Duration::from_millis(250);
    let mut sleep = heap_sleep(&executor, deadline);
    assert!(
      Pin::new(&mut sleep).poll(&mut cx).is_pending(),
      "must register, not resolve"
    );
    assert!(
      executor.next_timer_deadline().is_some(),
      "the registration must be in the heap"
    );
    drop(sleep);
    assert!(
      executor.next_timer_deadline().is_none(),
      "cancel-on-drop must retire the heap registration"
    );
    // Outlive the would-be deadline (event-exact, not a fixed sleep): the
    // cancelled timer must not wake. The negative assert is structural once
    // the heap is empty; waiting until the wall clock is genuinely past the
    // deadline keeps the ghost-fire probe honest.
    while Instant::now() < deadline + Duration::from_millis(25) {
      std::thread::sleep(Duration::from_millis(10));
    }
    executor.fire_due_timers();
    assert_eq!(
      wake_count.0.load(Ordering::SeqCst),
      0,
      "a dropped Sleep's waker must never fire"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn cancelling_last_timer_rearms_timekeeper_to_idle_immediately() {
    let executor = multi_thread_executor(2, None, "timer-cancel-retire");
    let waker = futures::task::noop_waker();
    let mut cx = Context::from_waker(&waker);
    let mut sleep = heap_sleep(&executor, Instant::now() + Duration::from_secs(60));

    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    wait_until(
      "the timekeeper parked on the timer that will be cancelled",
      || {
        executor
          .timers
          .inner
          .lock()
          .unwrap()
          .timekeeper_parker
          .is_some()
      },
    );

    drop(sleep);
    wait_until(
      "the cancelled timer's timekeeper returned to its idle wait",
      || {
        executor.next_timer_deadline().is_none()
          && executor
            .timers
            .inner
            .lock()
            .unwrap()
            .timekeeper_parker
            .is_none()
      },
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn timer_waker_replacement_drops_outside_heap_lock() {
    use std::sync::mpsc;

    struct DropOtherTimer(Mutex<Option<Sleep>>);

    #[expect(
      clippy::manual_noop_waker,
      reason = "the no-op wake type has a reentrant Drop used by this regression"
    )]
    impl std::task::Wake for DropOtherTimer {
      fn wake(self: Arc<Self>) {}
    }

    impl Drop for DropOtherTimer {
      fn drop(&mut self) {
        drop(self.0.lock().unwrap().take());
      }
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let executor = multi_thread_executor(1, None, "timer-waker-drop-lock");
      let deadline = Instant::now() + Duration::from_secs(120);
      let mut other = heap_sleep(&executor, deadline);
      let noop = futures::task::noop_waker();
      let mut noop_cx = Context::from_waker(&noop);
      assert!(Pin::new(&mut other).poll(&mut noop_cx).is_pending());

      let old = Waker::from(Arc::new(DropOtherTimer(Mutex::new(Some(other)))));
      let mut primary = heap_sleep(&executor, deadline);
      let mut old_cx = Context::from_waker(&old);
      assert!(Pin::new(&mut primary).poll(&mut old_cx).is_pending());
      drop(old);

      let replacement = futures::task::noop_waker();
      let mut replacement_cx = Context::from_waker(&replacement);
      assert!(
        Pin::new(&mut primary)
          .poll(&mut replacement_cx)
          .is_pending()
      );
      drop(primary);
      executor.shutdown_timers();
      done_tx.send(()).unwrap();
    });
    // Hang detector on a freshly spawned runner thread -- generous for
    // starved CI runners (a real regression deadlocks forever).
    done_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("RawWaker destruction re-entered cancellation while the heap lock was held");
    runner.join().unwrap();
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn timer_thread_can_drop_the_final_executor_arc_from_a_waker() {
    use std::sync::mpsc;

    struct DropFinalExecutorOnWake {
      executor: Mutex<Option<Arc<MultiThreadExecutor>>>,
      completed: mpsc::Sender<()>,
    }

    impl std::task::Wake for DropFinalExecutorOnWake {
      fn wake(self: Arc<Self>) {
        let executor = self
          .executor
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .take()
          .expect("the timer waker must own the final executor reference");
        assert_eq!(
          ON_TIMER_THREAD.with(std::cell::Cell::get),
          Some(executor.id),
          "the dedicated timer thread must deliver the timer wake"
        );
        drop(executor);
        self
          .completed
          .send(())
          .expect("the test receiver must outlive the timer-thread callback");
      }
    }

    let executor = multi_thread_executor(1, None, "timer-final-arc");
    let (completed_tx, completed_rx) = mpsc::channel();
    let mut sleep = heap_sleep(&executor, Instant::now() + Duration::from_millis(80));
    {
      let waker = Waker::from(Arc::new(DropFinalExecutorOnWake {
        executor: Mutex::new(Some(Arc::clone(&executor))),
        completed: completed_tx,
      }));
      let mut cx = Context::from_waker(&waker);
      assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    }
    wait_until(
      "the timer thread parked before owning the final executor Arc",
      || {
        executor
          .timers
          .inner
          .lock()
          .unwrap()
          .timekeeper_parker
          .is_some()
      },
    );

    // `Sleep` retains only a Weak reference. Once this local Arc is gone, the
    // heap waker owns the final direct executor Arc and releases it from the
    // timer thread while `TimerHeap::drop` still owns that thread's handle.
    drop(executor);
    // Hang detector: the fire needs the (already spawned) timer thread to
    // reach its 80ms deadline -- generous for starved CI runners.
    completed_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("dropping the final executor Arc on the timer thread attempted to join itself");
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn multi_thread_shutdown_with_pending_timers_drain_fires() {
    // Shutdown invariant: `shutdown()` with armed timers must drain-fire the
    // pending wakers -- a `watcher.close()` awaiting a
    // debounce sleep must complete, not hang. Also pins fire-on-register for
    // a Sleep polled after shutdown.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let controller = Arc::new(RuntimeController::new());
      // Default options: MultiThread on native.
      let backend = controller.backend();
      let RuntimeExecutor::MultiThread(executor) = &backend.executor else {
        panic!("default native backend must be MultiThread");
      };
      let executor = Arc::downgrade(executor);
      let mut late = heap_sleep(
        &executor
          .upgrade()
          .expect("the initial executor must be live"),
        Instant::now() + Duration::from_secs(120),
      );
      drop(backend);

      let (parked_tx, parked_rx) = mpsc::channel();
      let block_controller = Arc::clone(&controller);
      let block_exec = Weak::clone(&executor);
      let blocker = std::thread::spawn(move || {
        let mut future = std::pin::pin!(async {
          let executor = block_exec
            .upgrade()
            .expect("the runtime must remain live while blocking");
          let sleep = heap_sleep(&executor, Instant::now() + Duration::from_secs(120));
          drop(executor);
          parked_tx.send(()).unwrap();
          sleep.await;
        });
        block_controller.block_on(future.as_mut());
      });
      parked_rx.recv().unwrap();
      wait_until("the 120s sleep registered in the heap", || {
        executor
          .upgrade()
          .is_some_and(|executor| executor.next_timer_deadline().is_some())
      });

      // The acceptance surface: controller shutdown while a sleep is armed.
      controller
        .shutdown()
        .expect("runtime shutdown must succeed");
      blocker
        .join()
        .expect("the blocked sleep must be drain-fired by shutdown, not hang");

      // A Sleep polled AFTER shutdown resolves immediately instead of
      // registering with a dead heap.
      let waker = Waker::from(Arc::new(CountingWake(AtomicUsize::new(0))));
      let mut cx = Context::from_waker(&waker);
      assert!(
        Pin::new(&mut late).poll(&mut cx).is_ready(),
        "a Sleep polled after shutdown must fire early, never park a closing runtime"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => {
        panic!("shutdown with pending timers hung a blocked close ({error}): drain-fire missing")
      }
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_pending_timer_longer_than_park_deadline_does_not_panic() {
    // Timer-wait/deadline invariant: the park deadline is armed
    // SHORTER than the next timer deadline. The cooperative driver awaiting
    // the sleep sits with ZERO
    // executor progress for several full deadline windows -- a timer wait is
    // a legitimate park (guaranteed wall-clock wake), so it must NOT be
    // declared a BlockOnDeadlock; the timer must still fire. worker_threads=1
    // also allows the parked driver to race the dedicated timekeeper and fire
    // the timer itself, pinning the cooperative timer-bounded park.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let executor = multi_thread_executor(1, Some(Duration::from_millis(40)), "timer-vs-deadline");

      let task_exec = Arc::clone(&executor);
      let body = async move {
        let started = Instant::now();
        let mut inner = std::pin::pin!(async {
          heap_sleep(&task_exec, Instant::now() + Duration::from_millis(250)).await;
        });
        // Re-entrant block_on from the pool worker: the cooperative park.
        task_exec.block_on(inner.as_mut());
        assert!(started.elapsed() >= Duration::from_millis(250));
      };
      let sched = Arc::clone(&executor);
      let (runnable, task) = async_task::spawn(body, move |r| sched.schedule(r));
      executor.schedule(runnable);

      // A spurious BlockOnDeadlock panic would unwind the task body (swallowed
      // by run_runnable's catch_unwind), so the task would never complete and
      // the bounded harness below would report the failure.
      futures::executor::block_on(task);
      // Teardown inside the bounded window: this test was one of the silent
      // wedges on the Windows CI runners with every assertion already
      // passed. Its teardown includes `TimerHeap::drop`'s timekeeper JOIN
      // (a timer was polled, so the timekeeper thread is live) -- exactly
      // the kind of phase that must fail loudly rather than hang.
      drop(executor);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => join_within(
        "the timer-vs-deadline runner exits after executor (and timekeeper) teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => {
        panic!("the deadline-armed timer wait neither completed nor failed cleanly ({error})")
      }
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_timer_registered_at_verdict_edge_is_not_reported_as_deadlock() {
    // Timer-registration/verdict race, deterministic via the verdict hook: a
    // timer registered AFTER a deadline park was committed bumps no progress
    // counter by design, lands after the permit and queued-work re-checks, and
    // is invisible to the fingerprint. The heap re-check must recognize that
    // guaranteed future wake, veto the panic, and let the driver re-park
    // timer-bounded until the fire's task-wake completes the future.
    use std::sync::mpsc;

    // A raw Sleep the hook registers is woken by this waker, which releases
    // the awaited future's gate.
    struct GateWake {
      gate: Arc<Mutex<Option<oneshot::Sender<usize>>>>,
    }
    impl std::task::Wake for GateWake {
      fn wake(self: Arc<Self>) {
        let gate = self.gate.lock().unwrap().take();
        if let Some(gate) = gate {
          let _ = gate.send(23);
        }
      }
    }

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let executor = multi_thread_executor(1, Some(Duration::from_millis(40)), "timer-verdict");
      // Saturate drainer accounting so `wake_one` fallbacks cannot start a
      // replacement drainer behind our back; only the verdict's heap re-check
      // can save this park.
      executor
        .active_drainers
        .store(executor.max_drainers, Ordering::SeqCst);

      // Completion condition: the timer registered inside the hook fires and
      // its waker (the gate) releases the awaited future.
      let (gate_tx, gate_rx) = oneshot::channel::<usize>();
      let gate_tx = Arc::new(Mutex::new(Some(gate_tx)));

      let hook_exec = Arc::clone(&executor);
      let hook_gate = Arc::clone(&gate_tx);
      // The Sleep must outlive the hook (drop cancels): park it in a slot the
      // runner thread later cleans up.
      let parked_sleep: Arc<Mutex<Option<Sleep>>> = Arc::new(Mutex::new(None));
      let hook_sleep_slot = Arc::clone(&parked_sleep);
      DEADLINE_VERDICT_TEST_HOOK.with(|slot| {
        *slot.borrow_mut() = Some(Box::new(move || {
          let mut sleep = heap_sleep(&hook_exec, Instant::now() + Duration::from_millis(120));
          let waker = Waker::from(Arc::new(GateWake { gate: hook_gate }));
          let mut cx = Context::from_waker(&waker);
          assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
          *hook_sleep_slot.lock().unwrap() = Some(sleep);
        }));
      });

      // The test-only on-pool marker runs the cooperative branch and its
      // thread-local hook on THIS thread.
      let _on_pool = OnPoolWorkerGuard::enter(executor.id);
      let mut output = None;
      {
        let mut future = std::pin::pin!(async {
          output = Some(gate_rx.await.unwrap());
        });
        executor.block_on(future.as_mut());
      }
      // Clear the hook slot BEFORE any assert can panic: this hook captures
      // an executor Arc and THIS executor's timekeeper is live (a timer was
      // polled), so a leftover hook dropped by a TLS destructor would join
      // the timekeeper under the Windows loader lock (see the LOADER-LOCK
      // RULE at `WorkerTlsDropAction`).
      DEADLINE_VERDICT_TEST_HOOK.with(|slot| drop(slot.borrow_mut().take()));
      assert_eq!(
        output,
        Some(23),
        "the edge-registered timer must have fired and released the gate"
      );
      executor.active_drainers.store(0, Ordering::SeqCst);
      // Teardown inside the bounded window; includes the timekeeper join
      // (a timer was polled). See `join_within`.
      drop(executor);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => join_within(
        "the timer-verdict-edge runner exits after executor (and timekeeper) teardown",
        runner,
        Duration::from_secs(30),
      ),
      Err(error) => panic!(
        "a timer registered between the queued-work re-check and the verdict was reported as a deadlock or its fire was lost ({error})"
      ),
    }
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_sleep_without_host_driver_fails_loud() {
    // Missing-driver invariant: a CT runtime without a registered host driver
    // must fail LOUD with this exact diagnostic -- never a silent never-firing
    // debounce or a misleading certain-deadlock panic later.
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend = RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(executor));

    let payload = catch_unwind(AssertUnwindSafe(|| {
      let _sleep = make_sleep(
        &backend,
        &Arc::new(TimerDriverRegistry::default()),
        Instant::now() + Duration::from_millis(10),
      );
    }))
    .expect_err("sleep_until on CurrentThread without a driver must panic");
    let message = payload
      .downcast_ref::<String>()
      .cloned()
      .or_else(|| payload.downcast_ref::<&str>().map(|s| (*s).to_string()))
      .expect("panic payload must be a message");
    assert!(
      message.contains("CurrentThread runtime has no live timer driver registered"),
      "the diagnostic must name the missing driver, got: {message}"
    );
  }

  #[test]
  fn timer_driver_registry_selects_newest_live_and_evicts_dead() {
    // Registry semantics: all-live snapshots with newest-live compatibility
    // selection, dead entries swept on contact, explicit unregister, and a
    // dead-only registry reading as NO driver.
    let registry = TimerDriverRegistry::default();
    let a = ManualStubDriver::new();
    let b = ManualStubDriver::new();
    let a_id = registry.register(Arc::clone(&a) as Arc<dyn TimerDriver>);
    let b_id = registry.register(Arc::clone(&b) as Arc<dyn TimerDriver>);
    assert_ne!(a_id, b_id, "registration handles must be distinct");
    assert_eq!(
      registry.current().map(|(id, _)| id),
      Some(b_id),
      "newest live registrant serves"
    );
    assert!(registry.has_live_driver());

    // A dead newest (stub for: its owning env torn down) is skipped AND
    // swept; selection falls back to the older live registrant.
    b.kill();
    assert_eq!(
      registry.current().map(|(id, _)| id),
      Some(a_id),
      "dead newest must be skipped"
    );
    // The sweep is permanent: resurrecting the flag must not bring the
    // evicted registration back.
    b.live.store(true, Ordering::SeqCst);
    assert_eq!(
      registry.current().map(|(id, _)| id),
      Some(a_id),
      "swept entries stay gone"
    );

    // Explicit unregister (the binding's env-cleanup path) empties the
    // registry; empty and dead-only both read as NO live driver.
    registry.unregister(a_id);
    assert!(registry.current().is_none());
    assert!(
      !registry.has_live_driver(),
      "an emptied registry must not report a live driver"
    );
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn timer_driver_registry_contains_callback_panics_and_falls_back() {
    let registry = TimerDriverRegistry::default();
    let fallback = ManualStubDriver::new();
    let fallback_id = registry.register(Arc::clone(&fallback) as Arc<dyn TimerDriver>);
    let panicking = Arc::new(PanickingTimerDriver {
      swept: AtomicBool::new(false),
    });
    registry.register(Arc::clone(&panicking) as Arc<dyn TimerDriver>);

    assert_eq!(
      registry.current().map(|(id, _)| id),
      Some(fallback_id),
      "a panicking liveness callback must be treated as a dead driver"
    );
    assert!(
      panicking.swept.load(Ordering::SeqCst),
      "a panicking liveness callback must still run its contained sweep hook"
    );
    assert!(
      registry.has_live_driver(),
      "the healthy fallback must remain selectable"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn timer_driver_registry_callbacks_and_drops_run_outside_registry_lock() {
    use std::{sync::mpsc, time::Duration};

    let registry = Arc::new(TimerDriverRegistry::default());
    let fallback = ManualStubDriver::new();
    let fallback_id = registry.register(Arc::clone(&fallback) as Arc<dyn TimerDriver>);
    let reentrant = Arc::new(ReentrantLivenessDriver {
      registry: Arc::downgrade(&registry),
      registration: Mutex::new(None),
    });
    let reentrant_id = registry.register(Arc::clone(&reentrant) as Arc<dyn TimerDriver>);
    *reentrant.registration.lock().unwrap() = Some(reentrant_id);

    let (selection_tx, selection_rx) = mpsc::sync_channel(1);
    let selection_registry = Arc::clone(&registry);
    let selection_thread = std::thread::spawn(move || {
      selection_tx
        .send(selection_registry.current().map(|(id, _)| id))
        .unwrap();
    });
    assert_eq!(
      selection_rx
        .recv_timeout(Duration::from_secs(10))
        .expect("is_live re-entry deadlocked"),
      Some(fallback_id)
    );
    selection_thread.join().unwrap();

    let drop_driver: Arc<dyn TimerDriver> = Arc::new(ReentrantDropDriver {
      registry: Arc::downgrade(&registry),
      fallback: fallback_id,
    });
    let drop_id = registry.register(Arc::clone(&drop_driver));
    drop(drop_driver);

    let (drop_tx, drop_rx) = mpsc::sync_channel(1);
    let drop_registry = Arc::clone(&registry);
    let drop_thread = std::thread::spawn(move || {
      drop_registry.unregister(drop_id);
      drop_tx.send(()).unwrap();
    });
    drop_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("driver destructor re-entry deadlocked");
    drop_thread.join().unwrap();
    assert!(
      registry.current().is_none(),
      "the destructor must be able to unregister the fallback"
    );
  }

  #[test]
  fn timer_driver_registry_large_reentrant_sweep_preserves_keyed_order() {
    const DRIVER_PAIRS: usize = 2_048;

    let registry = Arc::new(TimerDriverRegistry::default());
    let mut dead = Vec::with_capacity(DRIVER_PAIRS + 1);
    let mut live = Vec::with_capacity(DRIVER_PAIRS);
    let mut live_ids = Vec::with_capacity(DRIVER_PAIRS);
    for _ in 0..DRIVER_PAIRS {
      let driver = Arc::new(ReentrantSweepTimerDriver {
        registry: Arc::downgrade(&registry),
        registration: Mutex::new(None),
        sweeps: AtomicUsize::new(0),
        removed_before_sweep: AtomicBool::new(false),
      });
      let id = registry.register(Arc::clone(&driver) as Arc<dyn TimerDriver>);
      *driver.registration.lock().unwrap() = Some(id);
      dead.push(driver);

      let driver = ManualStubDriver::new();
      live_ids.push(registry.register(Arc::clone(&driver) as Arc<dyn TimerDriver>));
      live.push(driver);
    }
    let dead_tail = Arc::new(ReentrantSweepTimerDriver {
      registry: Arc::downgrade(&registry),
      registration: Mutex::new(None),
      sweeps: AtomicUsize::new(0),
      removed_before_sweep: AtomicBool::new(false),
    });
    let dead_tail_id = registry.register(Arc::clone(&dead_tail) as Arc<dyn TimerDriver>);
    *dead_tail.registration.lock().unwrap() = Some(dead_tail_id);
    dead.push(dead_tail);

    let selection = registry.live();
    assert_eq!(
      selection
        .as_slice()
        .iter()
        .map(|(id, _)| *id)
        .collect::<Vec<_>>(),
      live_ids,
      "sweeping every interleaved dead host must retain live registration order"
    );
    drop(selection);
    assert!(
      dead.iter().all(|driver| {
        driver.sweeps.load(Ordering::SeqCst) == 1
          && driver.removed_before_sweep.load(Ordering::SeqCst)
          && driver.registration.lock().unwrap().is_none()
      }),
      "every dead host must be unlinked and run exactly one binding-shaped eviction hook"
    );

    {
      let state = registry
        .state
        .lock()
        .unwrap_or_else(std::sync::PoisonError::into_inner);
      assert_eq!(state.entries.len(), DRIVER_PAIRS);
      assert_eq!(state.oldest, live_ids.first().copied());
      assert_eq!(state.newest, live_ids.last().copied());
      assert_eq!(
        state
          .ordered_snapshot()
          .iter()
          .map(|(id, _)| *id)
          .collect::<Vec<_>>(),
        live_ids,
        "keyed removals must preserve the linked order of every live host"
      );
    }
    let second_selection = registry.live();
    assert_eq!(
      second_selection
        .as_slice()
        .iter()
        .map(|(id, _)| *id)
        .collect::<Vec<_>>(),
      live_ids,
      "a second selection must retain the same live order"
    );
    drop(second_selection);
    assert!(
      dead
        .iter()
        .all(|driver| driver.sweeps.load(Ordering::SeqCst) == 1),
      "permanently swept hosts must not receive repeated eviction callbacks"
    );
    assert_eq!(
      registry.current().map(|(id, _)| id),
      live_ids.last().copied(),
      "newest-live compatibility selection must survive the mass sweep"
    );

    drop(live);
    drop(dead);
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn timer_driver_registry_snapshot_contains_each_driver_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_TIMER_DRIVER_SNAPSHOT_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let registry = Arc::new(TimerDriverRegistry::default());
      let fallback = ManualStubDriver::new();
      let fallback_id = registry.register(Arc::clone(&fallback) as Arc<dyn TimerDriver>);
      let reentrant = Arc::new(ReentrantMultiUnregisterTimerDriver {
        registry: Arc::downgrade(&registry),
        registrations: Mutex::new(Vec::new()),
      });
      registry.register(Arc::clone(&reentrant) as Arc<dyn TimerDriver>);

      let first_cancels = Arc::new(AtomicUsize::new(0));
      let first_drops = Arc::new(AtomicUsize::new(0));
      let first = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::clone(&first_cancels),
        drops: Arc::clone(&first_drops),
      });
      let first_id = registry.register(Arc::clone(&first) as Arc<dyn TimerDriver>);
      drop(first);

      let second_cancels = Arc::new(AtomicUsize::new(0));
      let second_drops = Arc::new(AtomicUsize::new(0));
      let second = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::clone(&second_cancels),
        drops: Arc::clone(&second_drops),
      });
      let second_id = registry.register(Arc::clone(&second) as Arc<dyn TimerDriver>);
      drop(second);
      *reentrant.registrations.lock().unwrap() = vec![first_id, second_id];

      assert_eq!(
        registry.current().map(|(id, _)| id),
        Some(fallback_id),
        "selection must retry after reentrant removals and preserve the healthy fallback"
      );
      assert_eq!(first_cancels.load(Ordering::SeqCst), 0);
      assert_eq!(second_cancels.load(Ordering::SeqCst), 0);
      assert_eq!(first_drops.load(Ordering::SeqCst), 1);
      assert_eq!(second_drops.load(Ordering::SeqCst), 1);
      assert_eq!(
        registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .entries
          .len(),
        1
      );
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::timer_driver_registry_snapshot_contains_each_driver_drop")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile timer-driver snapshot subprocess test must start");
    assert!(
      output.status.success(),
      "reentrant liveness removal must not combine timer-driver destructor panics; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn timer_driver_registry_live_result_contains_each_driver_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_TIMER_DRIVER_LIVE_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let registry = TimerDriverRegistry::default();

      let first_cancels = Arc::new(AtomicUsize::new(0));
      let first_drops = Arc::new(AtomicUsize::new(0));
      let first = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::clone(&first_cancels),
        drops: Arc::clone(&first_drops),
      });
      let first_id = registry.register(Arc::clone(&first) as Arc<dyn TimerDriver>);
      drop(first);

      let second_cancels = Arc::new(AtomicUsize::new(0));
      let second_drops = Arc::new(AtomicUsize::new(0));
      let second = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::clone(&second_cancels),
        drops: Arc::clone(&second_drops),
      });
      let second_id = registry.register(Arc::clone(&second) as Arc<dyn TimerDriver>);
      drop(second);

      let live = registry.live();
      assert_eq!(live.len(), 2);
      registry.unregister(first_id);
      registry.unregister(second_id);
      drop(live);

      assert_eq!(first_cancels.load(Ordering::SeqCst), 0);
      assert_eq!(second_cancels.load(Ordering::SeqCst), 0);
      assert_eq!(first_drops.load(Ordering::SeqCst), 1);
      assert_eq!(second_drops.load(Ordering::SeqCst), 1);
      assert!(
        registry
          .state
          .lock()
          .unwrap_or_else(std::sync::PoisonError::into_inner)
          .entries
          .is_empty()
      );
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::timer_driver_registry_live_result_contains_each_driver_drop")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile live timer-driver snapshot subprocess test must start");
    assert!(
      output.status.success(),
      "a returned live snapshot must not combine final timer-driver destructor panics; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn timer_driver_registry_drop_contains_each_driver_destructor() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_TIMER_DRIVER_REGISTRY_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let first_drops = Arc::new(AtomicUsize::new(0));
      let second_drops = Arc::new(AtomicUsize::new(0));
      let registry = TimerDriverRegistry::default();
      let first = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::new(AtomicUsize::new(0)),
        drops: Arc::clone(&first_drops),
      });
      let second = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::new(AtomicUsize::new(0)),
        drops: Arc::clone(&second_drops),
      });
      registry.register(Arc::clone(&first) as Arc<dyn TimerDriver>);
      registry.register(Arc::clone(&second) as Arc<dyn TimerDriver>);
      drop(first);
      drop(second);

      drop(registry);

      assert_eq!(first_drops.load(Ordering::SeqCst), 1);
      assert_eq!(second_drops.load(Ordering::SeqCst), 1);
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::timer_driver_registry_drop_contains_each_driver_destructor")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile timer-driver registry drop subprocess test must start");
    assert!(
      output.status.success(),
      "registry drop must contain every driver destructor panic; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[test]
  fn host_sleep_reconciles_large_driver_sets_without_duplicate_arms() {
    const DRIVERS: usize = 512;

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
    let registry = Arc::new(TimerDriverRegistry::default());
    let drivers = (0..DRIVERS)
      .map(|_| {
        let driver = ManualStubDriver::new();
        registry.register(Arc::clone(&driver) as Arc<dyn TimerDriver>);
        driver
      })
      .collect::<Vec<_>>();
    let mut sleep = make_sleep(
      &backend,
      &registry,
      Instant::now() + Duration::from_secs(60),
    );
    let mut cx = Context::from_waker(Waker::noop());

    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    let timer_id = drivers[0].registers.lock().unwrap()[0].0;
    match &sleep.inner {
      SleepInner::Host(host) => assert_eq!(host.armed.len(), DRIVERS),
      #[cfg(napi_runtime_os_threads)]
      SleepInner::Heap(_) => panic!("CurrentThread sleep must use host timers"),
    }
    for driver in &drivers {
      assert_eq!(
        driver.registers.lock().unwrap().len(),
        2,
        "a re-poll must refresh each live driver exactly once"
      );
    }

    for driver in drivers.iter().step_by(2) {
      driver.kill();
    }
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    match &sleep.inner {
      SleepInner::Host(host) => assert_eq!(host.armed.len(), DRIVERS / 2),
      #[cfg(napi_runtime_os_threads)]
      SleepInner::Heap(_) => panic!("CurrentThread sleep must use host timers"),
    }
    for (index, driver) in drivers.iter().enumerate() {
      let registers = driver.registers.lock().unwrap().len();
      let cancels = driver.cancels.lock().unwrap().clone();
      if index % 2 == 0 {
        assert_eq!(registers, 2);
        assert_eq!(cancels, vec![timer_id]);
      } else {
        assert_eq!(registers, 3);
        assert!(cancels.is_empty());
      }
    }

    drop(sleep);
    for driver in drivers {
      assert_eq!(
        driver.cancels.lock().unwrap().as_slice(),
        &[timer_id],
        "every physical arm must be cancelled exactly once"
      );
    }
    assert_eq!(registry.pending_len(), 0);
    assert!(!executor.host_timers.has_pending());
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn host_sleep_register_unwind_preserves_every_possible_arm_for_cancellation() {
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
    let healthy = ManualStubDriver::new();
    let registry = registry_with(Arc::clone(&healthy) as Arc<dyn TimerDriver>);
    let deadline = Instant::now() + Duration::from_secs(60);
    let mut sleep = make_sleep(&backend, &registry, deadline);
    let mut cx = Context::from_waker(Waker::noop());

    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    let timer_id = healthy.registers.lock().unwrap()[0].0;

    let panicking = PanickingRegisterTimerDriver::new();
    registry.register(Arc::clone(&panicking) as Arc<dyn TimerDriver>);
    let result = catch_unwind(AssertUnwindSafe(|| {
      let _ = Pin::new(&mut sleep).poll(&mut cx);
    }));
    assert!(
      result.is_err(),
      "the hostile register panic must retain its normal propagation"
    );
    assert_eq!(
      healthy.registers.lock().unwrap().len(),
      2,
      "the previously armed driver must have completed its refresh before the later panic"
    );
    assert_eq!(panicking.registers.load(Ordering::SeqCst), 1);
    assert!(
      panicking.pending.lock().unwrap().contains_key(&timer_id),
      "the hostile driver must model an arm committed before it panics"
    );

    drop(sleep);
    assert_eq!(
      healthy.cancels.lock().unwrap().as_slice(),
      &[timer_id],
      "unwind must preserve cancellation ownership for the previously armed driver"
    );
    assert_eq!(
      panicking.cancels.lock().unwrap().as_slice(),
      &[timer_id],
      "unwind must preserve cancellation ownership for the driver that armed and then panicked"
    );
    assert!(panicking.pending.lock().unwrap().is_empty());
    assert_eq!(registry.pending_len(), 0);
    assert!(!executor.host_timers.has_pending());
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn host_sleep_register_unwind_contains_later_unregistered_driver_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_HOST_TIMER_SNAPSHOT_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let registry = Arc::new(TimerDriverRegistry::default());
      let earlier = Arc::new(UnregisterLaterThenPanicTimerDriver {
        registry: Arc::downgrade(&registry),
        later: Mutex::new(None),
        registers: AtomicUsize::new(0),
      });
      registry.register(Arc::clone(&earlier) as Arc<dyn TimerDriver>);

      let later_cancels = Arc::new(AtomicUsize::new(0));
      let later_drops = Arc::new(AtomicUsize::new(0));
      let later = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::clone(&later_cancels),
        drops: Arc::clone(&later_drops),
      });
      let later_id = registry.register(Arc::clone(&later) as Arc<dyn TimerDriver>);
      *earlier.later.lock().unwrap() = Some(later_id);
      drop(later);

      let mut sleep = make_sleep(
        &backend,
        &registry,
        Instant::now() + Duration::from_secs(60),
      );
      let mut cx = Context::from_waker(Waker::noop());
      let result = catch_unwind(AssertUnwindSafe(|| {
        let _ = Pin::new(&mut sleep).poll(&mut cx);
      }));

      assert!(
        result.is_err(),
        "the earlier driver's register panic must still propagate"
      );
      assert_eq!(earlier.registers.load(Ordering::SeqCst), 1);
      assert_eq!(
        later_drops.load(Ordering::SeqCst),
        0,
        "the complete live snapshot must enter Sleep cancellation ownership before callbacks"
      );

      drop(sleep);
      assert_eq!(
        later_cancels.load(Ordering::SeqCst),
        1,
        "the later driver must remain owned for cancellation despite its registry removal"
      );
      assert_eq!(
        later_drops.load(Ordering::SeqCst),
        1,
        "the later driver's final destructor must run once behind containment"
      );
      assert_eq!(registry.pending_len(), 0);
      assert!(!executor.host_timers.has_pending());
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg(
        "async_runtime::tests::host_sleep_register_unwind_contains_later_unregistered_driver_drop",
      )
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile host timer snapshot subprocess test must start");
    assert!(
      output.status.success(),
      "an earlier register panic must not combine with a later unregistered driver's destructor panic; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn host_sleep_cancel_contains_each_callback_and_driver_drop_independently() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_HOST_TIMER_CANCEL_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let cancels = Arc::new(AtomicUsize::new(0));
      let drops = Arc::new(AtomicUsize::new(0));
      let hostile = Arc::new(PanickingCancelDropTimerDriver {
        cancels: Arc::clone(&cancels),
        drops: Arc::clone(&drops),
      });
      let healthy = ManualStubDriver::new();
      let registry = Arc::new(TimerDriverRegistry::default());
      let hostile_id = registry.register(Arc::clone(&hostile) as Arc<dyn TimerDriver>);
      registry.register(Arc::clone(&healthy) as Arc<dyn TimerDriver>);
      let mut sleep = make_sleep(
        &backend,
        &registry,
        Instant::now() + Duration::from_secs(60),
      );
      let mut cx = Context::from_waker(Waker::noop());

      assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
      let timer_id = healthy.registers.lock().unwrap()[0].0;

      // Leave the Sleep's arm as the hostile driver's final Arc, so cleanup must
      // independently contain both its cancel panic and its destructor panic.
      registry.unregister(hostile_id);
      drop(hostile);
      drop(sleep);
      assert_eq!(cancels.load(Ordering::SeqCst), 1);
      assert_eq!(drops.load(Ordering::SeqCst), 1);
      assert_eq!(
        healthy.cancels.lock().unwrap().as_slice(),
        &[timer_id],
        "one hostile cancellation must not skip later armed drivers"
      );
      assert_eq!(registry.pending_len(), 0);
      assert!(!executor.host_timers.has_pending());
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg(
        "async_runtime::tests::host_sleep_cancel_contains_each_callback_and_driver_drop_independently",
      )
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile timer-driver cancellation subprocess test must start");
    assert!(
      output.status.success(),
      "host timer cancellation and driver destruction must not double-panic or skip later arms; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn host_sleep_first_poll_clone_and_drop_panics_do_not_double_panic() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_HOST_TIMER_WAKER_CLONE_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let driver = ManualStubDriver::new();
      let registry = registry_with(Arc::clone(&driver) as Arc<dyn TimerDriver>);
      let state = Arc::new(TestHostileRawWakerState {
        clones: AtomicUsize::new(0),
        drop_panics: AtomicUsize::new(0),
        panic_on_clone: Some(2),
      });

      let result = catch_unwind(AssertUnwindSafe(|| {
        let mut sleep = make_sleep(
          &backend,
          &registry,
          Instant::now() + Duration::from_secs(60),
        );
        let waker = test_hostile_waker(Arc::clone(&state));
        let mut cx = Context::from_waker(&waker);
        let _ = Pin::new(&mut sleep).poll(&mut cx);
      }));
      assert!(
        result.is_err(),
        "the original RawWaker clone panic must still propagate"
      );
      assert_eq!(state.clones.load(Ordering::SeqCst), 2);
      assert_eq!(
        state.drop_panics.load(Ordering::SeqCst),
        1,
        "the first clone must be destroyed once behind a contained boundary"
      );
      assert!(driver.registers.lock().unwrap().is_empty());
      assert_eq!(registry.pending_len(), 0);
      assert!(!executor.host_timers.has_pending());
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::host_sleep_first_poll_clone_and_drop_panics_do_not_double_panic")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile RawWaker subprocess test must start");
    assert!(
      output.status.success(),
      "host timer first-poll cleanup must not abort after clone and destructor panics; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[cfg(not(target_family = "wasm"))]
  #[test]
  fn host_sleep_register_unwind_contains_unretained_waker_drop() {
    const CHILD_ENV: &str = "NAPI_RUNTIME_TEST_HOST_TIMER_REGISTER_WAKER_DROP_PANIC_CHILD";

    if std::env::var_os(CHILD_ENV).is_some() {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let driver = Arc::new(PanicBeforeRetainingTimerDriver {
        registers: AtomicUsize::new(0),
      });
      let registry = registry_with(Arc::clone(&driver) as Arc<dyn TimerDriver>);
      let state = Arc::new(TestHostileRawWakerState {
        clones: AtomicUsize::new(0),
        drop_panics: AtomicUsize::new(0),
        panic_on_clone: None,
      });
      let mut sleep = make_sleep(
        &backend,
        &registry,
        Instant::now() + Duration::from_secs(60),
      );
      let waker = test_hostile_waker(Arc::clone(&state));
      let mut cx = Context::from_waker(&waker);

      let result = catch_unwind(AssertUnwindSafe(|| {
        let _ = Pin::new(&mut sleep).poll(&mut cx);
      }));
      assert!(
        result.is_err(),
        "the timer-driver register panic must still propagate"
      );
      assert_eq!(driver.registers.load(Ordering::SeqCst), 1);
      assert_eq!(state.clones.load(Ordering::SeqCst), 3);
      assert_eq!(
        state.drop_panics.load(Ordering::SeqCst),
        1,
        "the unretained register argument must be destroyed once behind the proxy boundary"
      );
      assert_eq!(registry.pending_len(), 1);
      assert!(executor.host_timers.has_pending());

      drop(sleep);
      assert_eq!(
        state.drop_panics.load(Ordering::SeqCst),
        3,
        "repoll and registry wakers must retain their existing contained cleanup"
      );
      assert_eq!(registry.pending_len(), 0);
      assert!(!executor.host_timers.has_pending());
      return;
    }

    let output = std::process::Command::new(std::env::current_exe().unwrap())
      .arg("--exact")
      .arg("async_runtime::tests::host_sleep_register_unwind_contains_unretained_waker_drop")
      .arg("--nocapture")
      .env(CHILD_ENV, "1")
      .output()
      .expect("the hostile register-waker subprocess test must start");
    assert!(
      output.status.success(),
      "timer-driver register unwind must not double-panic through its unretained waker; status={:?}\nstdout={}\nstderr={}",
      output.status.code(),
      String::from_utf8_lossy(&output.stdout),
      String::from_utf8_lossy(&output.stderr)
    );
  }

  #[test]
  fn host_sleep_rearms_on_next_live_driver_after_eviction() {
    // A sleep armed on a driver whose host dies must keep every remaining live
    // registrant armed with its remaining time preserved
    // (absolute deadline), keep the executor's wake-token accounting at
    // exactly one entry throughout, and cancel on the driver it is CURRENTLY
    // armed on when dropped.
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

    let a = ManualStubDriver::new();
    let b = ManualStubDriver::new();
    let registry = registry_with(Arc::clone(&a) as Arc<dyn TimerDriver>);
    let deadline = Instant::now() + Duration::from_secs(60);

    let (timer_id, b_id) = {
      let mut sleep = std::pin::pin!(make_sleep(&backend, &registry, deadline));
      let mut cx = Context::from_waker(Waker::noop());

      // First poll arms on A (the only registrant) and takes the wake-token.
      assert!(sleep.as_mut().poll(&mut cx).is_pending());
      let (timer_id, armed_deadline) = a.registers.lock().unwrap()[0];
      assert_eq!(armed_deadline, deadline);
      assert!(
        executor.host_timers.has_pending(),
        "first poll must arm the wake-token"
      );

      // A's host dies; a newer live registrant appears (the binding shape:
      // eviction wakes every pending sleep, which then re-polls -- here the
      // re-poll is driven manually).
      a.kill();
      let b_id = registry.register(Arc::clone(&b) as Arc<dyn TimerDriver>);
      assert!(sleep.as_mut().poll(&mut cx).is_pending());
      assert_eq!(
        b.registers.lock().unwrap().as_slice(),
        &[(timer_id, deadline)],
        "the re-poll must re-arm the SAME timer id at the SAME absolute deadline on the live driver"
      );
      assert_eq!(
        a.cancels.lock().unwrap().as_slice(),
        &[timer_id],
        "the dead driver gets a best-effort cancel for the old arm"
      );
      assert_eq!(
        registry.current().map(|(id, _)| id),
        Some(b_id),
        "the dead driver was evicted"
      );
      assert!(
        executor.host_timers.has_pending(),
        "the wake-token survives the re-arm (still exactly this sleep's entry)"
      );
      (timer_id, b_id)
    };

    // Drop (the pin! scope ended): cancel goes to the CURRENT driver, and the
    // wake-token retires.
    let _ = b_id;
    assert_eq!(b.cancels.lock().unwrap().as_slice(), &[timer_id]);
    assert!(
      !executor.host_timers.has_pending(),
      "drop must retire the wake-token"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn host_sleep_races_live_timer_drivers_and_cancels_the_starved_arm() {
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
    let responsive = Arc::new(StubHostTimerDriver::new());
    let starved = ManualStubDriver::new();
    let registry = Arc::new(TimerDriverRegistry::default());
    registry.register(Arc::clone(&responsive) as Arc<dyn TimerDriver>);
    // Newest-live-only selection would arm exclusively on this host and never
    // receive a wake. The responsive older host must be raced in parallel.
    registry.register(Arc::clone(&starved) as Arc<dyn TimerDriver>);

    let wake_count = Arc::new(CountingWake(AtomicUsize::new(0)));
    let waker = Waker::from(Arc::clone(&wake_count));
    let mut cx = Context::from_waker(&waker);
    // This deadline's pre-fire budget covers only `make_sleep` plus the very
    // next poll (a past-due Sleep completes inline and would bypass the
    // racing-arm machinery under test); 500ms dwarfs those two statements on
    // a starved runner without dragging the fire wait out.
    let deadline = Instant::now() + Duration::from_millis(500);
    let mut sleep = make_sleep(&backend, &registry, deadline);
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());

    let responsive_timer = *responsive
      .timers
      .lock()
      .unwrap()
      .keys()
      .next()
      .expect("responsive timer must be armed");
    assert_eq!(
      starved.registers.lock().unwrap().as_slice(),
      &[(responsive_timer, deadline)],
      "every live host must receive the same timer identity and absolute deadline"
    );

    // Event-based fire wait (this was a fixed 140ms sleep, which required
    // the responsive stub's freshly spawned fire thread to get CPU inside
    // ~80ms on a starved CI host). The wait is structurally sound: the
    // starved ManualStubDriver has NO fire path (it only records), so the
    // one-and-only wake can come from the responsive host -- the bound is a
    // pure hang detector.
    let fire_bound = Instant::now() + Duration::from_secs(30);
    while wake_count.0.load(Ordering::SeqCst) == 0 {
      assert!(
        Instant::now() < fire_bound,
        "the responsive host must wake a sleep whose newest host is live but starved"
      );
      std::thread::sleep(Duration::from_millis(10));
    }
    // The stub fires at (or after) the shared absolute deadline, so the wall
    // clock is past `deadline` here and the poll completes.
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_ready());
    assert_eq!(
      starved.cancels.lock().unwrap().as_slice(),
      &[responsive_timer],
      "completion through the winning host must cancel the starved losing arm"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn host_sleep_repolls_all_pending_timers_onto_a_late_registered_driver() {
    use std::sync::mpsc;

    struct ReentrantTimerRegistrationWake {
      registry: Weak<TimerDriverRegistry>,
      wakes: AtomicUsize,
      reentered: AtomicBool,
    }

    impl std::task::Wake for ReentrantTimerRegistrationWake {
      fn wake(self: Arc<Self>) {
        self.wakes.fetch_add(1, Ordering::SeqCst);
        if let Some(registry) = self.registry.upgrade() {
          let _ = registry.has_live_driver();
          self.reentered.store(true, Ordering::SeqCst);
        }
      }
    }

    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
    let registry = Arc::new(TimerDriverRegistry::default());
    let starved = ManualStubDriver::new();
    registry.register(Arc::clone(&starved) as Arc<dyn TimerDriver>);

    // The whole pre-fire phase (four polls plus a registration-thread round
    // trip) must finish while the wall clock is still BEFORE this shared
    // deadline: a past-due `Sleep` completes inline at poll
    // (`Instant::now() >= deadline`) and bypasses the repoll machinery under
    // test. 2s dwarfs the phase's worst observed CI overhead (tens of ms on
    // a starved GitHub macOS runner) without dragging the fire wait out.
    let deadline = Instant::now() + Duration::from_secs(2);
    let mut first = make_sleep(&backend, &registry, deadline);
    let mut second = make_sleep(&backend, &registry, deadline);
    let first_wake = Arc::new(ReentrantTimerRegistrationWake {
      registry: Arc::downgrade(&registry),
      wakes: AtomicUsize::new(0),
      reentered: AtomicBool::new(false),
    });
    let second_wake = Arc::new(ReentrantTimerRegistrationWake {
      registry: Arc::downgrade(&registry),
      wakes: AtomicUsize::new(0),
      reentered: AtomicBool::new(false),
    });
    let first_waker = Waker::from(Arc::clone(&first_wake));
    let second_waker = Waker::from(Arc::clone(&second_wake));
    let mut first_cx = Context::from_waker(&first_waker);
    let mut second_cx = Context::from_waker(&second_waker);

    assert!(Pin::new(&mut first).poll(&mut first_cx).is_pending());
    assert!(Pin::new(&mut second).poll(&mut second_cx).is_pending());
    let initial = starved.registers.lock().unwrap().clone();
    let first_id = initial[0].0;
    let second_id = initial[1].0;
    assert_ne!(first_id, second_id);
    assert_eq!(
      registry.pending_len(),
      2,
      "one stable repoll entry is retained per sleep"
    );

    let responsive = Arc::new(StubHostTimerDriver::new());
    let (registered_tx, registered_rx) = mpsc::sync_channel(1);
    let registration_registry = Arc::clone(&registry);
    let registration_driver = Arc::clone(&responsive);
    let registration = std::thread::spawn(move || {
      let id = registration_registry.register(registration_driver as Arc<dyn TimerDriver>);
      registered_tx.send(id).unwrap();
    });
    // Hang detector only (the regression it pins is a PERMANENT deadlock:
    // `register` re-entering the repoll callback), so the bound is generous
    // rather than a latency assertion a starved runner could trip.
    registered_rx
      .recv_timeout(Duration::from_secs(10))
      .expect("late driver registration or repoll callback re-entry deadlocked");
    registration.join().unwrap();

    assert_eq!(first_wake.wakes.load(Ordering::SeqCst), 1);
    assert_eq!(second_wake.wakes.load(Ordering::SeqCst), 1);
    assert!(first_wake.reentered.load(Ordering::SeqCst));
    assert!(second_wake.reentered.load(Ordering::SeqCst));
    assert!(
      responsive.timers.lock().unwrap().is_empty(),
      "registration requests bounded re-polls instead of invoking driver callbacks inline"
    );

    // Both sleeps must still be PENDING when they re-arm on the late driver;
    // see the deadline-margin note above. Fail with a diagnosis instead of a
    // misleading Pending-assert failure if a pathological stall consumed the
    // whole margin anyway.
    assert!(
      Instant::now() < deadline,
      "test overhead consumed the entire pre-fire deadline margin before the repoll phase; \
       this runner is starved beyond the margin this test budgets for"
    );
    assert!(Pin::new(&mut first).poll(&mut first_cx).is_pending());
    assert!(Pin::new(&mut second).poll(&mut second_cx).is_pending());
    let responsive_ids = responsive
      .timers
      .lock()
      .unwrap()
      .keys()
      .copied()
      .collect::<FxHashSet<_>>();
    assert_eq!(
      responsive_ids,
      FxHashSet::from_iter([first_id, second_id]),
      "every pending sleep must re-arm its existing identity on the new driver"
    );
    assert_eq!(
      starved
        .registers
        .lock()
        .unwrap()
        .iter()
        .filter(|(id, _)| *id == first_id)
        .count(),
      2,
      "the old host receives only the normal waker refresh on the one re-poll"
    );
    assert_eq!(
      starved
        .registers
        .lock()
        .unwrap()
        .iter()
        .filter(|(id, _)| *id == second_id)
        .count(),
      2,
      "the old host receives only the normal waker refresh on the one re-poll"
    );
    assert_eq!(
      registry.pending_len(),
      2,
      "late registration must not duplicate pending state"
    );

    // Event-based fire wait instead of a fixed sleep: the starved host has
    // NO fire path by construction (ManualStubDriver only records), so the
    // second wake per sleep can only come from the late responsive host --
    // "while the original host remains starved" is structural, not a
    // wall-clock race. The bound is purely a hang detector, generous enough
    // for a starved runner to schedule the stub's two fire threads.
    let fire_bound = Instant::now() + Duration::from_secs(30);
    while first_wake.wakes.load(Ordering::SeqCst) < 2
      || second_wake.wakes.load(Ordering::SeqCst) < 2
    {
      assert!(
        Instant::now() < fire_bound,
        "the late responsive host must fire both timers while the original host remains starved"
      );
      std::thread::sleep(Duration::from_millis(10));
    }
    assert!(Pin::new(&mut first).poll(&mut first_cx).is_ready());
    assert!(Pin::new(&mut second).poll(&mut second_cx).is_ready());

    let mut cancelled = starved.cancels.lock().unwrap().clone();
    cancelled.sort_unstable();
    let mut expected = vec![first_id, second_id];
    expected.sort_unstable();
    assert_eq!(
      cancelled, expected,
      "completion must cancel both losing starved-host arms"
    );
    assert_eq!(
      registry.pending_len(),
      0,
      "completion retires every repoll entry"
    );
    assert!(!executor.host_timers.has_pending());
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn host_sleep_panics_loud_when_every_driver_dies_mid_flight() {
    // With NO live registrant left mid-flight there is nothing to re-arm on:
    // the poll must fail LOUD with the typed diagnostic, never park a wake-less
    // sleep silently.
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

    let a = ManualStubDriver::new();
    let registry = registry_with(Arc::clone(&a) as Arc<dyn TimerDriver>);
    let mut sleep = std::pin::pin!(make_sleep(
      &backend,
      &registry,
      Instant::now() + Duration::from_secs(60)
    ));
    let mut cx = Context::from_waker(Waker::noop());
    assert!(sleep.as_mut().poll(&mut cx).is_pending());

    a.kill();
    let payload = catch_unwind(AssertUnwindSafe(|| {
      let _ = sleep.as_mut().poll(&mut cx);
    }))
    .expect_err("a sleep with every driver dead must panic, not pend silently");
    let message = payload
      .downcast_ref::<String>()
      .cloned()
      .or_else(|| payload.downcast_ref::<&str>().map(|s| (*s).to_string()))
      .expect("panic payload must be a message");
    assert!(
      message.contains("lost every live timer driver mid-sleep"),
      "the diagnostic must name the mid-flight driver loss, got: {message}"
    );
  }

  #[test]
  fn registry_sweep_wakes_sleeps_pending_on_the_swept_driver() {
    // Sweep-eviction invariant: the registry's selection sweep can be the
    // FIRST layer to notice a dead driver, before the owner's env-cleanup hook
    // or any call failure. A retain-only sweep would strand every sleep whose
    // armed waker lives in the swept driver's pending map. The sweep must call
    // `on_swept` outside the registry lock so the driver wakes those sleeps
    // into re-selection.
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));

    let a = ManualStubDriver::new();
    let b = ManualStubDriver::new();
    let registry = registry_with(Arc::clone(&a) as Arc<dyn TimerDriver>);
    let mut sleep = std::pin::pin!(make_sleep(
      &backend,
      &registry,
      Instant::now() + Duration::from_secs(60)
    ));

    // Arm on A with an observable waker.
    let flag = Arc::new(WakeFlag::default());
    let waker = Waker::from(Arc::clone(&flag));
    let mut cx = Context::from_waker(&waker);
    assert!(sleep.as_mut().poll(&mut cx).is_pending());
    assert!(!flag.0.load(Ordering::SeqCst));

    // A's host dies; a DIFFERENT selection (any registry touch -- here a
    // liveness query, in production another sleep's poll) sweeps it.
    a.kill();
    registry.register(Arc::clone(&b) as Arc<dyn TimerDriver>);
    let _ = registry.has_live_driver();

    assert!(
      a.swept.load(Ordering::SeqCst),
      "the sweep must notify the swept driver"
    );
    assert!(
      flag.0.load(Ordering::SeqCst),
      "a sleep armed on the swept driver must be woken into re-selection, not stranded"
    );

    // The woken sleep's re-poll lands on the live registrant.
    assert!(sleep.as_mut().poll(&mut cx).is_pending());
    assert_eq!(
      b.registers.lock().unwrap().len(),
      1,
      "the re-poll must re-arm on the live driver"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_sleep_fires_through_stub_host_driver() {
    // CT delegation: a registered host driver's fire must complete a sleep
    // awaited through the CT `block_on` drive loop.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let driver: Arc<dyn TimerDriver> = Arc::new(StubHostTimerDriver::new());

      let started = Instant::now();
      let mut future = std::pin::pin!(async {
        make_sleep(
          &backend,
          &registry_with(driver),
          Instant::now() + Duration::from_millis(60),
        )
        .await;
      });
      executor.block_on(future.as_mut());
      assert!(started.elapsed() >= Duration::from_millis(60));
      assert!(
        !executor.host_timers.has_pending(),
        "a completed sleep must retire its pending-registry entry"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!("a CT sleep through the host driver never fired ({error})"),
    }
  }

  #[test]
  fn current_thread_timer_shutdown_retires_pending_repoll_state() {
    let metrics = Arc::new(RuntimeMetrics::default());
    let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, false, None));
    let backend =
      RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
    let drivers = Arc::new(TimerDriverRegistry::default());
    let driver = ManualStubDriver::new();
    drivers.register(Arc::clone(&driver) as Arc<dyn TimerDriver>);
    let mut sleep = make_sleep(&backend, &drivers, Instant::now() + Duration::from_secs(60));
    let mut cx = Context::from_waker(Waker::noop());

    assert!(Pin::new(&mut sleep).poll(&mut cx).is_pending());
    let timer_id = driver.registers.lock().unwrap()[0].0;
    assert_eq!(drivers.pending_len(), 1);

    executor.host_timers.shutdown();
    assert_eq!(
      drivers.pending_len(),
      0,
      "shutdown must retire the registration-repoll index before the Sleep is dropped"
    );
    assert!(Pin::new(&mut sleep).poll(&mut cx).is_ready());
    assert_eq!(driver.cancels.lock().unwrap().as_slice(), &[timer_id]);
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_shutdown_drain_fires_active_host_timer_block_on() {
    use std::sync::mpsc;

    let controller = Arc::new(current_thread_controller("host-timer-shutdown"));
    let backend = controller.backend();
    let drivers = Arc::new(TimerDriverRegistry::default());
    let driver = ManualStubDriver::new();
    drivers.register(Arc::clone(&driver) as Arc<dyn TimerDriver>);
    let sleep = make_sleep(
      &backend,
      &drivers,
      Instant::now() + Duration::from_secs(120),
    );
    drop(backend);

    let (polled_tx, polled_rx) = mpsc::channel();
    let block_controller = Arc::clone(&controller);
    let blocker = std::thread::spawn(move || {
      let mut announced = false;
      let mut sleep = std::pin::pin!(sleep);
      let mut future = std::pin::pin!(futures::future::poll_fn(move |cx| {
        let poll = sleep.as_mut().poll(cx);
        if !announced {
          announced = true;
          polled_tx.send(()).unwrap();
        }
        poll
      }));
      block_controller.block_on(future.as_mut());
    });
    polled_rx.recv_timeout(Duration::from_secs(2)).unwrap();

    let (shutdown_tx, shutdown_rx) = mpsc::channel();
    let shutdown_controller = Arc::clone(&controller);
    let shutdown = std::thread::spawn(move || {
      shutdown_tx.send(shutdown_controller.shutdown()).unwrap();
    });
    shutdown_rx
      .recv_timeout(Duration::from_secs(2))
      .expect("shutdown must drain-fire host timers and wake CurrentThread block_on")
      .unwrap();
    shutdown.join().unwrap();
    blocker.join().unwrap();
    assert_eq!(driver.cancels.lock().unwrap().len(), 1);
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_threadless_park_with_pending_host_timer_is_still_certain_deadlock() {
    // Threadless pending-timer invariant: on a
    // THREADLESS build a pending host timer is NOT a wake-token source -- the
    // host event loop's `setTimeout` relay can only run on the very thread
    // that is about to park, so it can never fire while `block_on` holds it.
    // The certain check must panic with the typed diagnostic anyway (the
    // timer-backed kind, so the message names the shape), never fall through
    // to the park -- on the real wasip1 target that park is an untyped
    // "condvar wait not supported" abort. A native helper thread can fire the
    // timer in this test harness, but that concurrency cannot exist on the
    // threadless target and must not rescue the park.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      // Native stand-in for the threadless wasm build; the stub driver would
      // play the host loop from a helper thread, but the panic must land at
      // the first park decision, long before its 60ms fire.
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, true, None));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let driver: Arc<dyn TimerDriver> = Arc::new(StubHostTimerDriver::new());

      let payload = catch_unwind(AssertUnwindSafe(|| {
        let mut future = std::pin::pin!(async {
          make_sleep(
            &backend,
            &registry_with(driver),
            Instant::now() + Duration::from_millis(60),
          )
          .await;
        });
        executor.block_on(future.as_mut());
      }))
      .expect_err("a threadless park must self-detect even while a host timer is pending");
      let diagnostic = payload
        .downcast_ref::<BlockOnDeadlock>()
        .expect("the panic payload must be the typed BlockOnDeadlock diagnostic");
      assert_eq!(
        diagnostic.kind,
        BlockOnDeadlockKind::CurrentThreadCertainTimerBacked
      );
      assert_eq!(
        diagnostic.park_deadline, None,
        "the certain case carries no deadline"
      );
      let message = diagnostic.to_string();
      assert!(
        message.contains("host timer") && message.contains("block_on") && message.contains("JS"),
        "the diagnostic must name the pending host timer and the block_on-awaiting-JS hazard, got: {message}"
      );
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "a pending host timer suppressed the threadless certain-deadlock diagnostic -- block_on parked (or completed via a helper-thread fire that cannot exist on the real target) instead of panicking ({error})"
      ),
    }
  }

  #[cfg(panic = "unwind")]
  #[test]
  fn current_thread_threadless_certain_check_ignores_unpolled_sleep() {
    // Unpolled-sleep invariant: the registry entry only exists once the host
    // timer is ARMED (first poll runs `driver.register`), never at `Sleep`
    // creation. A created-but-never-polled Sleep has no host callback behind
    // it, and on a parked single thread nothing can ever poll it into
    // arming -- it is provably NOT a future wake source. Counting it would
    // mislabel the certain diagnostic as timer-backed. (The armed twin above
    // pins the polled side: a POLLED pending timer still certain-panics, just
    // with the timer-backed kind.)
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      let executor = Arc::new(CurrentThreadExecutor::with_detection(metrics, true, None));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let driver: Arc<dyn TimerDriver> = Arc::new(StubHostTimerDriver::new());

      // Created and held across the park decision, but NEVER polled: no host
      // timer armed, no wake source.
      let _unpolled = make_sleep(
        &backend,
        &registry_with(driver),
        Instant::now() + Duration::from_secs(60),
      );

      let payload = catch_unwind(AssertUnwindSafe(|| {
        let mut future = std::pin::pin!(NeverReady);
        executor.block_on(future.as_mut());
      }))
      .expect_err("a threadless park holding only an unpolled Sleep must still self-detect");
      let diagnostic = payload
        .downcast_ref::<BlockOnDeadlock>()
        .expect("the panic payload must be the typed BlockOnDeadlock diagnostic");
      assert_eq!(diagnostic.kind, BlockOnDeadlockKind::CurrentThreadCertain);
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(10)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => panic!(
        "an unpolled Sleep suppressed the threadless certain-deadlock diagnostic -- block_on parked forever instead of panicking (the silent-hang class) ({error})"
      ),
    }
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_park_deadline_with_live_host_timer_does_not_panic() {
    // CurrentThread timer/deadline invariant: deadline armed (30ms) shorter than a pending
    // host timer (200ms). Waiting out a LIVE host timer with zero progress is
    // legitimate (the wake is scheduled on the host loop); the deadline
    // verdict must not fire. Once the timer fires, the sleep completes.
    use std::sync::mpsc;

    let (done_tx, done_rx) = mpsc::channel();
    let runner = std::thread::spawn(move || {
      let metrics = Arc::new(RuntimeMetrics::default());
      // Deadline/grace ratio: the armed park deadline doubles as the
      // `has_live_wait` GRACE -- once the host timer is past due by more
      // than one deadline window without firing, the veto stops holding BY
      // DESIGN (that is the frozen-JS-loop signature). With a 30ms window
      // the stub host's freshly spawned fire thread had to get CPU within
      // ~230ms of test start or the verdict fired -- the starved-CI failure.
      // A 2s window keeps the invariant identical (a LIVE host-timer wait
      // with zero progress must not be declared dead) while tolerating
      // multi-second scheduling stalls of the fire thread: the veto holds
      // until deadline+2s, and the expiry checks land on 2s boundaries, so
      // the fire has >4s before a verdict could stick.
      let executor = Arc::new(CurrentThreadExecutor::with_detection(
        metrics,
        false,
        Some(Duration::from_secs(2)),
      ));
      let backend =
        RuntimeBackend::from_executor(RuntimeExecutor::CurrentThread(Arc::clone(&executor)));
      let driver: Arc<dyn TimerDriver> = Arc::new(StubHostTimerDriver::new());

      let started = Instant::now();
      let mut future = std::pin::pin!(async {
        make_sleep(
          &backend,
          &registry_with(driver),
          Instant::now() + Duration::from_millis(200),
        )
        .await;
      });
      executor.block_on(future.as_mut());
      assert!(started.elapsed() >= Duration::from_millis(200));
      let _ = done_tx.send(());
    });

    match done_rx.recv_timeout(Duration::from_secs(30)) {
      Ok(()) => runner.join().unwrap(),
      Err(error) => {
        panic!("a CT park waiting out a live host timer fired the armed deadline or hung ({error})")
      }
    }
  }

  #[test]
  fn host_timer_unrepresentable_grace_remains_live() {
    let registry = HostTimerRegistry::default();
    let fired = Arc::new(AtomicBool::new(false));
    let drivers = Arc::new(TimerDriverRegistry::default());
    let repoll = Arc::new(HostTimerRepoll::default());
    assert!(
      Instant::now().checked_add(Duration::MAX).is_none(),
      "Duration::MAX must exercise the unrepresentable-grace path"
    );
    assert!(
      registry.register(
        1,
        Instant::now(),
        futures::task::noop_waker(),
        &fired,
        &drivers,
        &repoll,
      ),
      "the open registry must accept the timer"
    );

    assert!(
      registry.has_live_wait(Duration::MAX),
      "an unrepresentable grace deadline is effectively unbounded"
    );
    registry.remove(1);
  }

  // `BlockOnDeadlock::multi_thread_cooperative` only exists where the
  // MultiThread machinery is compiled in.
  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn block_on_deadlock_panic_payload_surfaces_through_join_error() {
    // A deadline firing inside a spawned task's poll unwinds into the spawn
    // wrapper's catch_unwind and becomes a JoinError; the typed diagnostic's
    // message must survive that trip (JoinError::from_panic downcasts it), or
    // the build error would read "async runtime task panicked" with no clue.
    let diagnostic = BlockOnDeadlock::multi_thread_cooperative(Duration::from_millis(75));
    let expected = diagnostic.to_string();
    let payload: Box<dyn Any + Send> = Box::new(diagnostic);
    assert_eq!(JoinError::from_panic(&*payload).to_string(), expected);
  }
  // --- wasm32-wasip1-threads ------------------------------------------------
  //
  // `rustc --print cfg` is identical for the two WASI targets, so these pin
  // what the build script's cfgs are supposed to mean. They run only where
  // `napi_runtime_wasi_threads` holds; the threadless complement is pinned by
  // `threadless_wasm_still_rejects_multi_thread` below.

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_reports_a_thread_capable_worker_ceiling() {
    // Rayon's `THREADS_BITS` is 8 on 32-bit, so its ceiling is 255 and the
    // production cap of 256 never binds here. The `>= 2` half is what
    // `validate()` needs to accept MultiThread at all.
    let ceiling = crate::max_async_runtime_worker_threads();
    assert_eq!(
      ceiling, 255,
      "the threaded WASI target must report Rayon's realizable ceiling"
    );
    assert!(
      ceiling >= 2,
      "a ceiling below two would make MultiThread unconfigurable"
    );
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_default_flavor_is_still_current_thread() {
    // Availability is not a default. Selecting MultiThread on a wasm target
    // stays an explicit host act, so a host that changes nothing sees no
    // change at all.
    assert_eq!(
      RuntimeOptions::default().flavor,
      RuntimeFlavor::CurrentThread,
      "the threaded WASI target must not silently default to MultiThread"
    );
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_multi_thread_validates_to_the_two_worker_minimum() {
    // `available_parallelism()` returns Ok(1) under a WASI host, so a host
    // that flips only the flavor gets MultiThread's truthful minimum -- two
    // workers, one blocking lane -- rather than an error or a pool worth
    // having. Hosts that want parallelism must pass a worker count they got
    // from JavaScript.
    let validated = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      ..RuntimeOptions::default()
    }
    .validate()
    .expect("MultiThread must validate on the threaded WASI target");
    assert_eq!(validated.worker_threads, 2);
    assert_eq!(validated.max_blocking_tasks, 1);
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn threadless_build_is_false_on_the_threads_target() {
    // `THREADLESS_BUILD` and `napi_runtime_os_threads` are orthogonal cfgs
    // that must agree on this one target, or the CurrentThread park logic and
    // the MultiThread machinery would disagree about whether a second thread
    // can deliver a wake.
    assert!(
      !THREADLESS_BUILD,
      "the threaded WASI target has real OS threads"
    );
    assert!(
      cfg!(napi_runtime_os_threads),
      "the threaded WASI target must build the OS-thread machinery"
    );
  }

  // Memory-size refresh at scheduler handoffs (`on_thread_handoff`). This
  // napi-free binary links no allocator wrappers, so only `grow_zero` and the
  // hook ever set a thread's `local_pages`. Each test grows the memory on
  // another thread and publishes the new size, as napi's allocator does after
  // dlmalloc grows it, then reads `local_pages` inside the work under test.
  // Every thread that has not refreshed since is below that size, so a
  // reading at or above it proves the hook at that site ran; without the hook
  // each test fails its assertion.

  /// Grow the memory by one page on a new thread and publish the new size,
  /// which this returns.
  #[cfg(napi_runtime_wasi_threads)]
  fn grow_one_page_elsewhere() -> usize {
    std::thread::spawn(|| {
      let old = core::arch::wasm32::memory_grow::<0>(1);
      assert_ne!(old, usize::MAX, "the WASI host must let the memory grow");
      napi_sys::wasi_heap_sync::grow_zero()
    })
    .join()
    .expect("the growing thread must finish")
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_multi_thread_task_polls_refresh_the_memory_size() {
    // `MultiThreadExecutor::run_runnable`: a pool worker polls a task spawned
    // after another thread grew the memory.
    let controller = multi_thread_controller("wasi-handoff-task", 2, 1);
    let pages = grow_one_page_elsewhere();
    let refreshes = napi_sys::wasi_heap_sync::handoff_refreshes();
    let seen = futures::executor::block_on(
      controller.spawn(async { napi_sys::wasi_heap_sync::local_pages() }),
    )
    .expect("the task must finish");
    assert!(
      seen >= pages,
      "the worker polled with a stale memory size: {seen} < {pages} pages"
    );
    assert!(
      napi_sys::wasi_heap_sync::handoff_refreshes() > refreshes,
      "the handoff refresh must be counted"
    );
    controller.shutdown().expect("runtime must stop");
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_current_thread_task_polls_refresh_the_memory_size() {
    // The free `run_runnable`: the thread driving a host turn polls a task
    // after another thread grew the memory.
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::new(Arc::new(
      RuntimeMetrics::default(),
    )));
    let (seen_tx, seen_rx) = mpsc::channel();
    let wake_executor = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        let _ = seen_tx.send(napi_sys::wasi_heap_sync::local_pages());
      },
      move |runnable| wake_executor.schedule(runnable),
    );
    executor.schedule(runnable);
    let pages = grow_one_page_elsewhere();
    executor.drive_host_turn();
    let seen = seen_rx
      .try_recv()
      .expect("one host turn must poll the task");
    futures::executor::block_on(task);
    assert!(
      seen >= pages,
      "the host turn polled with a stale memory size: {seen} < {pages} pages"
    );
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_block_on_polls_refresh_the_memory_size() {
    // `CurrentThreadExecutor::block_on` and
    // `MultiThreadExecutor::parking_block_on`: the caller polls after another
    // thread grew the memory.
    for controller in [
      current_thread_controller("wasi-handoff-block-on"),
      multi_thread_controller("wasi-handoff-parking-block-on", 2, 1),
    ] {
      let pages = grow_one_page_elsewhere();
      let mut seen = 0;
      {
        let mut future = std::pin::pin!(async {
          seen = napi_sys::wasi_heap_sync::local_pages();
        });
        assert_eq!(
          controller.block_on(future.as_mut()),
          BlockOnOutcome::Completed
        );
      }
      assert!(
        seen >= pages,
        "block_on polled with a stale memory size: {seen} < {pages} pages"
      );
      controller.shutdown().expect("runtime must stop");
    }
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_blocking_closures_refresh_the_memory_size() {
    // `RegisteredBlockingFunction::run`: a pool worker starts a closure
    // submitted after another thread grew the memory. Inside it,
    // `cooperative_block_on`: the same worker polls after a second grow.
    let controller = Arc::new(multi_thread_controller("wasi-handoff-blocking", 2, 1));
    let pages = grow_one_page_elsewhere();
    let block_on_controller = Arc::clone(&controller);
    let (start_seen, block_on_pages, block_on_seen) =
      futures::executor::block_on(controller.spawn_blocking(move || {
        let start_seen = napi_sys::wasi_heap_sync::local_pages();
        let block_on_pages = grow_one_page_elsewhere();
        let mut block_on_seen = 0;
        {
          let mut future = std::pin::pin!(async {
            block_on_seen = napi_sys::wasi_heap_sync::local_pages();
          });
          assert_eq!(
            block_on_controller.block_on(future.as_mut()),
            BlockOnOutcome::Completed
          );
        }
        (start_seen, block_on_pages, block_on_seen)
      }))
      .expect("the blocking closure must finish");
    assert!(
      start_seen >= pages,
      "the blocking closure started with a stale memory size: {start_seen} < {pages} pages"
    );
    assert!(
      block_on_seen >= block_on_pages,
      "the cooperative block_on polled with a stale memory size: \
       {block_on_seen} < {block_on_pages} pages"
    );
    controller.shutdown().expect("runtime must stop");
  }

  #[cfg(napi_runtime_wasi_threads)]
  #[test]
  fn wasi_threads_inline_blocking_refreshes_the_memory_size() {
    // The CurrentThread inline blocking path: the submitting thread runs the
    // closure itself, after another thread grew the memory.
    let controller = current_thread_controller("wasi-handoff-inline-blocking");
    let pages = grow_one_page_elsewhere();
    let seen =
      futures::executor::block_on(controller.spawn_blocking(napi_sys::wasi_heap_sync::local_pages))
        .expect("the inline blocking closure must finish");
    assert!(
      seen >= pages,
      "the inline blocking closure ran with a stale memory size: {seen} < {pages} pages"
    );
    controller.shutdown().expect("runtime must stop");
  }

  // `not(napi_runtime_os_threads)` is exactly "wasm and not the threaded WASI
  // target": the build script sets the cfg for every non-wasm target plus
  // `wasm32-wasip1-threads`.
  #[cfg(not(napi_runtime_os_threads))]
  #[test]
  fn threadless_wasm_still_rejects_multi_thread() {
    let error = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      ..RuntimeOptions::default()
    }
    .validate()
    .expect_err("threadless WebAssembly cannot run the multi-thread runtime");
    let message = error.to_string();
    assert!(
      message.contains("threadless"),
      "the rejection must name the property that causes it, not the family: {message}"
    );
    assert!(
      message.contains("wasm32-wasip1-threads"),
      "the rejection must name the target that does work: {message}"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn multi_thread_pool_starts_and_joins_every_worker() {
    // The disposal order the WASI loader depends on, as a unit test: every
    // worker is joined BEFORE anything tears the environment down, so no
    // thread can still be running over memory that is about to disappear.
    let options = RuntimeOptions {
      flavor: RuntimeFlavor::MultiThread,
      worker_threads: 3,
      max_blocking_tasks: 2,
      thread_name_prefix: "rd-os-threads-join".to_string(),
      park_deadline: None,
      drain_linger: DEFAULT_DRAIN_LINGER,
    };
    let executor = Arc::new(
      MultiThreadExecutor::new(&options, Arc::new(RuntimeMetrics::default()))
        .expect("a three-worker pool must build"),
    );
    assert_eq!(executor.pool.current_num_threads(), 3);

    let ran = Arc::new(AtomicBool::new(false));
    let task_ran = Arc::clone(&ran);
    let (runnable, task) = async_task::spawn(
      async move {
        task_ran.store(true, Ordering::SeqCst);
      },
      |_| {},
    );
    executor.schedule(runnable);
    futures::executor::block_on(task);
    assert!(
      ran.load(Ordering::SeqCst),
      "the pool must run scheduled work"
    );

    let lifecycle = Arc::clone(&executor.worker_lifecycle);
    executor.begin_shutdown();
    executor.wait_until_scheduler_idle();
    // A drainer's Rayon job decrements `active_drainers` before its closure
    // is dropped, so the last reference can lag the idle barrier by a moment.
    // Spin for it under a deadline: taking the value out is what proves the
    // pool really goes away here, and turns a leaked reference into a
    // failure rather than a hang in the join below.
    let deadline = Instant::now() + Duration::from_secs(10);
    while Arc::strong_count(&executor) > 1 && Instant::now() < deadline {
      std::thread::yield_now();
    }
    let executor = Arc::into_inner(executor)
      .expect("no drainer may outlive `wait_until_scheduler_idle` for long");
    drop(executor);
    lifecycle.wait_for_all_workers();
    assert_eq!(
      lifecycle.remaining(),
      0,
      "every physical worker must have exited before the join returns"
    );
  }

  #[cfg(napi_runtime_os_threads)]
  #[test]
  fn current_thread_queues_concurrent_blocking_admission() {
    // A second OS thread submitting `spawn_blocking` while the lane owner
    // runs, carrying no `ambient_owner`. The gate that decides this used to
    // read `target_family = "wasm"` while its comment argued "threadless", so
    // on a threaded wasm build the closure was dropped and the handle
    // resolved to "the async runtime stopped before the blocking task could
    // start". It must be QUEUED and serviced on a later host turn.
    use std::sync::mpsc;

    let executor = Arc::new(CurrentThreadExecutor::new(Arc::new(
      RuntimeMetrics::default(),
    )));
    let work = GenerationWork::new();
    let (outcome_tx, outcome_rx) = mpsc::channel();

    let owner_registration = work
      .try_register_work()
      .expect("the lane owner's blocking job must be accepted");
    let concurrent_work = Arc::clone(&work);
    let concurrent_executor = Arc::clone(&executor);
    let task_executor = Arc::clone(&executor);
    let wake_executor = Arc::clone(&executor);
    let (runnable, task) = async_task::spawn(
      async move {
        let concurrent = task_executor
          .schedule_blocking(
            move || {
              std::thread::spawn(move || {
                let registration = concurrent_work
                  .try_register_work()
                  .expect("the concurrent blocking job must be accepted");
                concurrent_executor.schedule_blocking(|| 7usize, registration)
              })
              .join()
              .expect("the concurrent submitter thread must finish")
            },
            owner_registration,
          )
          .await
          .expect("the lane owner's blocking job must finish");
        let _ = outcome_tx.send(concurrent.await);
      },
      move |runnable| wake_executor.schedule(runnable),
    );

    executor.schedule(runnable);
    let mut turns = 0usize;
    let outcome = loop {
      executor.drive_host_turn();
      if let Ok(outcome) = outcome_rx.try_recv() {
        break outcome;
      }
      turns += 1;
      assert!(
        turns <= 8,
        "queued blocking admission must make bounded host-turn progress"
      );
    };
    futures::executor::block_on(task);
    assert_eq!(
      outcome.expect("a concurrent blocking submission must be queued, not rejected"),
      7
    );
  }
}