diff --git a/Cargo.toml b/Cargo.toml
index 43299cc..e85464b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,9 +13,13 @@ categories = ["concurrency", "science"]
 
 [features]
 default = ["parallel"]
-# Run entries on a private Rayon pool. Without it the same types exist, every
-# pool has width 1 and every entry runs inline on the calling thread.
-parallel = ["dep:rayon"]
+# Run entries on the pool's own worker threads (docs/design/own-threads.md).
+# Without it the same types exist, every pool has width 1 and every entry runs
+# inline on the calling thread.
+parallel = []
+# Opt-in Rayon interop: `Exec::external_rayon` runs a callback inside a private
+# Rayon pool of the token's width. Not needed by anything else.
+rayon = ["parallel", "dep:rayon"]
 # Test support: per-root live-task ledger and entry counters. Zero cost when off.
 ledger = []
 # Test support: hooks that pause threads inside the park/wake handshake and
@@ -45,6 +49,8 @@ libc = "0.2"
 
 [dev-dependencies]
 libc = "0.2"
+# The Rayon reference rows of benches/wait_scenarios.rs.
+rayon = "1.10"
 
 [[bench]]
 name = "team_dispatch"
@@ -83,3 +89,8 @@ unexpected_cfgs = { level = "warn", check-cfg = ['cfg(loom)'] }
 [[bench]]
 name = "cost_lookup"
 harness = false
+
+[[bench]]
+name = "wait_scenarios"
+harness = false
+required-features = ["parallel"]
diff --git a/README.md b/README.md
index efd0948..a919e8f 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,16 @@ that starts tasks: kernels take an `Exec` token and split it, and no scheduler
 type appears in any public signature.
 
 Used by strided-rs, tcontract-rs, cpueinsum-rs, tlinalg-rs and tenferro-rs.
-Design record: [`docs/design/placement.md`](docs/design/placement.md).
+Design records: [`docs/design/placement.md`](docs/design/placement.md) (the token),
+[`docs/design/own-threads.md`](docs/design/own-threads.md) (the worker threads),
+[`docs/design/waiting.md`](docs/design/waiting.md) (how they wait).
+
+The workers are threadteam's own `std::thread`s. A pool leases them from a
+process-wide reserve and gives them back when dropped, so a pool built after another
+one was dropped reuses running threads (faer's `with_team` builds one per call);
+a pool with a thread name, a start hook, a stack size or a QoS of its own gets
+dedicated workers that its drop joins. Rayon is not used unless the opt-in `rayon`
+feature asks for `Exec::external_rayon`.
 
 ## Usage
 
@@ -58,8 +67,9 @@ the token to kernels by value. Kernels never store a token and never mint one.
 | `Exec::team(f)` / `team_with(over, f)` | reserve `budget - 1` awake pool members for a scope and run barrier-bearing sections through `TeamExec` (`run`, `run_with`, `split`, `fork`, `reborrow`), or `Err(Refused::Unavailable)`; see the design record |
 | `Pool::into_team(width)` -> `Team` (owns the pool; `IntoTeamError` gives it back), `Team::exec(budget)` / `try_exec`, `Team::pool`, `Team::into_pool` | persistent reservation for an engine that owns its pool (`Pool` is not `Clone`); minted tokens are ordinary `Exec`s whose `fork`, `for_ranges`, `broadcast`, `team` dispatch on the reserved members; one leader at a time (`exec` blocks, `try_exec` -> `Refused::Busy`); idle members park while reserved |
 | `PoolBuilder::qos(Qos)`, `raise_current_thread_qos(Qos)` | worker QoS on macOS (default `UserInitiated`); raise the leading thread without ever lowering it |
-| `PoolBuilder::idle_spin`, `idle_runs_rayon`, `acquire_timeout`; `Pool::release_idle` | waiting policy of idle team members; a reserved member spins with one PAUSE per poll (never `sched_yield`), parks after the delay, and parks after a short spin in a root scope that has more participants than the caller's CPUs |
-| `PoolBuilder::pin_participants(bool)`, `Pool::pin_participants()` | opt-in placement of the **members** of a root team scope (Linux; off by default, which is consistent with the rule it protects): member `k` (participant `k >= 1`) pins itself onto the `k`-th CPU of the calling thread's affinity set, `S[0]` is left to the leader, and a member restores its own mask before it returns to Rayon or serves foreign work. **The leader is never pinned**, because a vendor library creates its thread team from the calling thread and a one-CPU caller would confine the whole provider team; a member that calls such a library directly inside a share does confine it, so use `Exec::external` (which restores the member's mask first) or leave pinning off. For tensor4all/faer#107; give each team its own CPU set (`taskset -c`), there is no CPU allocator |
+| `PoolBuilder::idle_spin`, `idle_runs_rayon`, `acquire_timeout`; `Pool::release_idle` | waiting policy of idle team members (an idle member spins for the spin budget unless `idle_spin` is zero, then sleeps; `idle_runs_rayon` has no effect and is kept for compatibility) |
+| `PoolBuilder::spin_polls`, `Pool::spin_polls` | spin budget of every team wait, in polls (the shape of libgomp's `GOMP_SPINCOUNT`): a reserved member waiting for work, the leader in a join and a participant in a barrier spin that many polls, yield a few times, then sleep until woken; throttled to 100 polls in an oversubscribed scope or after a waiter was descheduled ([`docs/design/waiting.md`](docs/design/waiting.md)) |
+| `PoolBuilder::pin_participants(bool)`, `Pool::pin_participants()` | opt-in placement of the **members** of a root team scope (Linux; off by default, which is consistent with the rule it protects): member `k` (participant `k >= 1`) pins itself onto the `k`-th CPU of the calling thread's affinity set, `S[0]` is left to the leader, and a member restores its own mask before it serves the pool's queue, leaves the pool, or serves foreign work. **The leader is never pinned**, because a vendor library creates its thread team from the calling thread and a one-CPU caller would confine the whole provider team; a member that calls such a library directly inside a share does confine it, so use `Exec::external` (which restores the member's mask first) or leave pinning off. For tensor4all/faer#107; give each team its own CPU set (`taskset -c`), there is no CPU allocator |
 | `DispatchCosts`, `WidthCosts`, `PoolBuilder::dispatch_costs`, `Exec::dispatch_cost(width)`, `TeamExec::dispatch_cost(width)` | cost of one parallel section per kind of token (team, in pool, outside), steady state; one row per `HostClass` (`HostClass::detect()`, keyed by kernel dispatch: `x86_64-avx512`, `x86_64-avx2`, `x86_64-scalar`, `aarch64-apple`, `aarch64`, `generic`), `DispatchCosts::for_class(class)`; measured rows for `x86_64-avx512` (team anchors at widths 2, 4, 6 and 8) and `aarch64-apple`, a measured Zen2 team row for `x86_64-avx2` (anchors at ten widths from 2 to 64; its plain kinds stay generic), every other class takes the conservative `generic` row (3 / 15 / 40 us at the anchors 2, 4, 6); a row holds measured anchors (`WidthCosts::new`, `WidthCosts::flat`, or `WidthCosts::from_anchors` for measured anchors up to 64 and beyond), interpolates between them and grows linearly above the largest one, so a width above the anchors is never charged the cost of the largest anchor; `DispatchCosts::host_default()` is the detected class's row; `Duration::MAX` when serial; override per pool |
 | `pays_at(est, sections, cost)`, `Exec::pays(est, sections, width)`, `Exec::width_for(est, sections)`, `width_for_by`, `PAYS` | the one rule: parallel iff `est >= PAYS * sections * D(width)`; `width_for` minimises `sections * D(k) + est / k` |
 | `Exec::external(f)` | enter the pool once and hand the budget as a plain width to an outside library (faer, a vendor BLAS); how it divides the width is that library's concern |
@@ -72,11 +82,13 @@ the token to kernels by value. Kernels never store a token and never mint one.
   once is at most its budget at every nesting depth. A parent waiting for its
   children keeps no slot.
 * **Lazy and inline.** A serial token, budget one, or one task runs inline on the
-  calling thread and makes no scheduler call, so the process-global Rayon pool is
-  never started implicitly.
-* **Placement by caller.** A worker of the target pool spawns into the current
-  scope without installing; a plain thread or a worker of another pool enters the
-  target pool once and waits. No thread-local state exists in the crate.
+  calling thread and makes no scheduler call; no worker starts before a pool is
+  built, and Rayon's process-global pool is never started.
+* **Placement by caller.** A worker of the target pool runs its own batch's
+  tasks itself and serves the pool while it waits; a worker of another pool
+  publishes on the target pool and serves its own pool while it waits (so
+  chains between pools always make progress); a plain thread publishes and
+  sleeps until its tasks finished. No thread-local state exists in the crate.
 * **`broadcast`** refuses with `Refused::ForkChild` for a token derived from
   `fork` (through `reborrow` or `limit` too), and with `Refused::CallerInPool`
   when the caller is a worker of the same pool. Roots, and their `reborrow`s and
@@ -86,11 +98,14 @@ the token to kernels by value. Kernels never store a token and never mint one.
   blocking work of another token on those workers delays the broadcast.
   `can_broadcast` applies the same rule through one private helper, so the two
   cannot disagree.
-* **Deterministic shutdown.** Dropping a `Pool` joins every worker thread: when
-  `drop` returns, all workers have exited and their thread-local destructors
-  (including state created in an `on_start` hook) have run. A pool dropped from
-  one of its own workers cannot join itself, so that drop only signals shutdown
-  and returns without joining. Without `parallel` there is nothing to join.
+* **Shutdown.** Dropping a `Pool` detaches every worker and waits until each
+  one acknowledged; after that no worker touches the pool. Dedicated workers (a
+  pool with a thread name, an `on_start` hook, a stack size or a QoS of its own)
+  are then joined: their thread-local destructors, including state created in
+  an `on_start` hook, have run when `drop` returns. Shared workers go back to the
+  process-wide reserve, asleep, for the next pool. A pool dropped from one of its
+  own workers does not wait for or join that worker, which acknowledges and
+  leaves after its task returns. Without `parallel` there is nothing to join.
 * **No scheduler type is public.** There is no constructor from, and no accessor
   returning, a scheduler pool. `scripts/check-no-public-rayon.sh` runs
   `cargo public-api -p threadteam` (when installed) and fails if `rayon::`
@@ -100,12 +115,58 @@ the token to kernels by value. Kernels never store a token and never mint one.
 
 | Feature | Effect |
 | --- | --- |
-| `parallel` (default) | run on a private pool. Without it the same types exist, `PoolBuilder::build` returns a width-1 pool and every entry runs inline |
+| `parallel` (default) | run on the pool's own worker threads. Without it the same types exist, `PoolBuilder::build` returns a width-1 pool and every entry runs inline |
+| `rayon` | opt-in Rayon interop: `Exec::external_rayon(f)` runs `f(width)` inside a private Rayon pool of the pool's width (separate threads, built on first use) |
 | `ledger` | test support: `ledger::max_live(root)`, `live`, `installs`, and `Exec::ledger_root`. Records live tasks per root token and pool installs; compiled out when off |
 
 Consumers assert `ledger::max_live(root) <= budget` in their own tests, and keep
-a test binary that runs serial and pooled work and then checks that
-`rayon::ThreadPoolBuilder::new().build_global()` still succeeds.
+a test binary that runs serial and pooled work and then checks
+`ledger::global_pool_unstarted()` (with the `rayon` feature it checks that Rayon's
+process-global pool was never started).
+
+## Wait benchmarks
+
+`benches/wait_scenarios.rs` measures how team threads wait, the way callers use them; the design
+is in [`docs/design/waiting.md`](docs/design/waiting.md). A change to the waits is judged by running
+it on the base and on the head of the change, on a quiet host and on a many-core shared host.
+
+| scenario | a call is | reports |
+| --- | --- | --- |
+| `sections` | 200 sections of 5, 20 or 50 µs, team held | per call, and the overhead over `sections * work` |
+| `gaps` | 10 sections of 5 µs, the caller sleeps 0 / 100 µs / 1 ms / 10 ms between calls | the first section (wake latency) and the call |
+| `acquire` | 50 sections of 20 µs: the team held (a token per call), the pool held (members acquired per call), a new pool per call | per call; for a new pool also the total from build to drop |
+| `nested` | 100 splits of the team into pairs, each pair one 20 µs section | per call |
+
+Each scenario runs at width = all CPUs of the affinity set and at three quarters of them, on
+threadteam and on a Rayon `scope`; `benches/omp/wait_omp.c` runs `sections` and `gaps` on libgomp
+(one `omp parallel` region per section, runtime defaults). `--load K:P` adds `K` child processes,
+each busy `P` % of every 10 ms, for the whole run: the stand-in for another user's processes.
+
+```sh
+# one checkout, both passes (quiet, then 8 processes at 10 %), rows appended to
+# docs/design/waiting-data/<host>.csv
+scripts/bench-waits.sh <label>                 # e.g. main-4c73c2b, then the PR head
+scripts/bench-waits.sh <label> 64,48 8:10      # explicit widths and load
+cargo bench --bench wait_scenarios -- --scenario gaps --widths 8   # one scenario; options in the file header
+```
+
+* **evo** (quiet): `scripts/bench-waits.sh <label> "" none` on the base and on the head. The
+  acceptance check is that `sections` and `gaps` do not regress.
+* **broccoli** (64 CPUs, shared): `taskset -c 0-63 scripts/bench-waits.sh <label> 64,48 8:10` on the
+  base and on the head, plus the faer#107 arms of `acquire_probe_107` (tensor4all/faer branch
+  `probe/107-acquire-per-call`). The acceptance check is that width 64 under load is no longer
+  slow and width 48 does not regress.
+
+To compare two commits on a shared host, `scripts/bench-ab.sh <base-rev> <head-rev> <rounds>
+[bench args]` builds both and alternates them, so a drift of other users' load falls on both sides;
+`HEAD_VARIANTS='--spin-polls 300000;--own-hold-ms 100'` adds head runs with tuning flags (this
+version only), and `OMP=1` runs the libgomp driver in every round with the same scenario, widths,
+calls and load (`acquire` is libgomp's held team). The base of the waits change is its bench commit `a3a9320` (the bench on the 0.1.3
+waits). Under every threadteam row, a `waits per call` line counts join and barrier sleeps, member
+parks and the preemptions waiters saw.
+
+Results are committed as CSV under [`docs/design/waiting-data/`](docs/design/waiting-data/), one
+file per host, with the label naming the commit; the summary tables live in `waiting.md`.
 
 ## License
 
diff --git a/benches/omp/wait_omp.c b/benches/omp/wait_omp.c
new file mode 100644
index 0000000..f8db67c
--- /dev/null
+++ b/benches/omp/wait_omp.c
@@ -0,0 +1,169 @@
+/* The libgomp reference for benches/wait_scenarios.rs (docs/design/waiting.md).
+ *
+ * The same work as the Rust bench: a section is one `omp parallel` region in which every thread
+ * busy-waits `work` microseconds on the clock; a call is a run of sections. Prints rows in the
+ * Rust bench's format and appends them to a CSV file when one is given.
+ *
+ * Build and run with scripts/bench-waits.sh or scripts/bench-ab.sh (OMP=1), or:
+ *   gcc -O2 -fopenmp benches/omp/wait_omp.c -o target/wait_omp
+ *   target/wait_omp <width> <calls> [csv] [label]
+ * The OpenMP runtime runs with its defaults (no OMP_WAIT_POLICY, no GOMP_SPINCOUNT, no binding)
+ * unless the caller sets them.
+ *
+ * Environment:
+ *   WAIT_OMP_SCENARIO  all (default) | sections | gaps | acquire
+ *   WAIT_OMP_LOAD      K:P, foreign load: K child processes each busy P % of every 10 ms
+ *
+ * `acquire` / `held_team` is libgomp's counterpart of the Rust bench's held team: calls of 50
+ * sections of 20 us on the same (hot) team, back to back.
+ */
+#define _GNU_SOURCE
+#include <omp.h>
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <signal.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static double now_us(void) {
+  struct timespec t;
+  clock_gettime(CLOCK_MONOTONIC, &t);
+  return t.tv_sec * 1e6 + t.tv_nsec / 1e3;
+}
+
+static inline void relax(void) {
+#if defined(__x86_64__) || defined(__i386__)
+  __builtin_ia32_pause();
+#elif defined(__aarch64__)
+  __asm__ __volatile__("yield");
+#endif
+}
+
+static void busy(double us) {
+  double end = now_us() + us;
+  while (now_us() < end) relax();
+}
+
+static int cmp(const void *a, const void *b) {
+  double x = *(const double *)a, y = *(const double *)b;
+  return (x > y) - (x < y);
+}
+
+static FILE *csv;
+static char prefix[512];
+
+static void row(const char *scenario, int width, const char *param, const char *metric, double *v,
+                int n, double ideal) {
+  qsort(v, n, sizeof *v, cmp);
+  double med = v[n / 2], p90 = v[(n * 9 / 10) < n ? n * 9 / 10 : n - 1], max = v[n - 1];
+  printf("%-9s %-10s %5d %-22s %-7s %11.1f %11.1f %11.1f %10.1f\n", scenario, "libgomp", width,
+         param, metric, med, p90, max, med - ideal);
+  if (csv)
+    fprintf(csv, "%s,%s,libgomp,%d,%s,%s,%.2f,%.2f,%.2f,%.2f\n", prefix, scenario, width, param,
+            metric, med, p90, max, med - ideal);
+}
+
+/* One call: the time of the first section and of the whole call, in us. */
+static void call(int width, int sections, double work, double *first, double *whole) {
+  double t0 = now_us();
+  for (int s = 0; s < sections; s++) {
+#pragma omp parallel num_threads(width)
+    busy(work);
+    if (s == 0) *first = now_us() - t0;
+  }
+  *whole = now_us() - t0;
+}
+
+static pid_t load_children[256];
+static int load_n;
+
+/* Foreign load: K children each busy P % of every 10 ms, until killed. */
+static void load_start(const char *spec) {
+  int k = 0, p = 0;
+  if (!spec || sscanf(spec, "%d:%d", &k, &p) != 2) return;
+  for (int i = 0; i < k && i < 256; i++) {
+    pid_t c = fork();
+    if (c == 0) {
+      for (;;) {
+        double t = now_us();
+        while (now_us() - t < 100.0 * p) relax();
+        usleep((useconds_t)(10000 - 100 * p > 0 ? 10000 - 100 * p : 0));
+      }
+    }
+    if (c > 0) load_children[load_n++] = c;
+  }
+  usleep(200000);
+}
+
+static void load_stop(void) {
+  for (int i = 0; i < load_n; i++) {
+    kill(load_children[i], SIGKILL);
+    waitpid(load_children[i], NULL, 0);
+  }
+}
+
+static int want(const char *s) {
+  const char *w = getenv("WAIT_OMP_SCENARIO");
+  return !w || !strcmp(w, "all") || !strcmp(w, s);
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3) {
+    fprintf(stderr, "usage: wait_omp <width> <calls> [csv] [label]\n");
+    return 2;
+  }
+  int width = atoi(argv[1]), calls = atoi(argv[2]);
+  cpu_set_t set;
+  int cpus = sched_getaffinity(0, sizeof set, &set) == 0 ? CPU_COUNT(&set) : 0;
+  char host[256] = "";
+  gethostname(host, sizeof host - 1);
+  const char *label = argc > 4 ? argv[4] : "";
+  const char *load_spec = getenv("WAIT_OMP_LOAD");
+  char load_text[64];
+  int lk = 0, lp = 0;
+  if (load_spec && sscanf(load_spec, "%d:%d", &lk, &lp) == 2)
+    snprintf(load_text, sizeof load_text, "%dx%d%%", lk, lp);
+  else
+    snprintf(load_text, sizeof load_text, "%s",
+             getenv("WAIT_BENCH_LOAD") ? getenv("WAIT_BENCH_LOAD") : "none");
+  const char *load = load_text;
+  snprintf(prefix, sizeof prefix, "%s,%s,%d,%s", host, label, cpus, load);
+  if (argc > 3) {
+    int fresh = access(argv[3], F_OK) != 0;
+    csv = fopen(argv[3], "a");
+    if (csv && fresh)
+      fprintf(csv, "host,label,cpus,load,scenario,impl,width,param,metric,median_us,p90_us,max_us,overhead_us\n");
+  }
+  double *a = malloc(sizeof(double) * calls), *b = malloc(sizeof(double) * calls);
+  char param[64];
+  load_start(load_spec);
+  /* warm the hot team */
+  for (int i = 0; i < 10; i++) call(width, 10, 5, a, b);
+
+  int works[3] = {5, 20, 50};
+  for (int k = 0; k < 3 && want("sections"); k++) {
+    for (int i = 0; i < calls; i++) call(width, 200, works[k], &a[i], &b[i]);
+    snprintf(param, sizeof param, "work=%dus,sections=200", works[k]);
+    row("sections", width, param, "call", b, calls, 200.0 * works[k]);
+  }
+  int gaps[4] = {0, 100, 1000, 10000};
+  for (int k = 0; k < 4 && want("gaps"); k++) {
+    for (int i = 0; i < calls / 2; i++) {
+      if (gaps[k]) usleep(gaps[k]);
+      call(width, 10, 5, &a[i], &b[i]);
+    }
+    snprintf(param, sizeof param, "gap=%dus", gaps[k]);
+    row("gaps", width, param, "first", a, calls / 2, 5);
+    row("gaps", width, param, "call", b, calls / 2, 50);
+  }
+  if (want("acquire")) {
+    for (int i = 0; i < calls / 2; i++) call(width, 50, 20, &a[i], &b[i]);
+    row("acquire", width, "held_team", "call", b, calls / 2, 1000);
+  }
+  load_stop();
+  if (csv) fclose(csv);
+  return 0;
+}
diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
new file mode 100644
index 0000000..c9be341
--- /dev/null
+++ b/benches/wait_scenarios.rs
@@ -0,0 +1,581 @@
+//! How team threads wait, measured the way callers use them (`docs/design/waiting.md`).
+//!
+//! `cargo bench --bench wait_scenarios -- [options]` prints one table row per cell and, with
+//! `--csv <file>`, appends the same rows to a CSV file (`docs/design/waiting-data/`). Every cell
+//! repeats a *call* and reports the median, the 90th percentile and the maximum per call.
+//!
+//! A section is `width` participants each busy-waiting `work` microseconds on the clock, so the
+//! ideal time of a call is `sections * work`; the `overhead` column is the median minus that.
+//!
+//! Scenarios (`--scenario`, default `all`):
+//! * `sections`: a call is 200 sections of 5, 20 or 50 µs, on a team held across calls;
+//! * `gaps`: a call is 10 sections of 5 µs, the caller sleeps 0 / 100 µs / 1 ms / 10 ms between
+//!   calls; reports the first section of each call (wake latency + 5 µs) and the whole call;
+//! * `acquire`: a call is 50 sections of 20 µs, with the team held and a token minted per call
+//!   (`held_team`, as tenferro's `CpuEngine`), with the pool held and the members acquired per
+//!   call (`held_pool`, `Exec::new(..).team(..)`), and with a new pool per call (`fresh_pool`, as
+//!   faer's `with_team`; `total` times the build, the acquisition, the call and the drop, and
+//!   `build`, `acquire`, `release` and `drop` time those phases one by one);
+//! * `nested`: a call is 100 splits of the team into pairs, each pair running one 20 µs
+//!   section: many child leaders join at once (they share one sleeping place in the pool).
+//!
+//! Every scenario runs at the widths given by `--widths` (default: all CPUs of the affinity set,
+//! and three quarters of them), on threadteam and, as a reference, on a Rayon `scope` of the same
+//! width (`--impl threadteam,rayon`). The libgomp reference is `benches/omp/wait_omp.c` (README,
+//! "Wait benchmarks").
+//!
+//! Foreign load (`--load K:P`): `K` child processes of this binary, each busy `P` % of every 10 ms
+//! period, unpinned, for the whole run. They stand for another user's processes on a shared host.
+//!
+//! Options: `--scenario sections|gaps|acquire|nested|all`, `--widths 64,48`, `--impl threadteam,rayon`,
+//! `--load K:P`, `--calls N` (default 200; `gaps` and `acquire` use N/2), `--csv <file>`,
+//! `--label <text>` (the version or commit, written to the CSV), `--spin-polls N` (the pool's
+//! spin budget, this version only). Under each threadteam row a `waits per call` line counts join
+//! and barrier sleeps and member parks.
+
+use std::io::Write;
+use std::time::{Duration, Instant};
+use threadteam::{Pool, Team, WaitCounters};
+
+fn busy(us: u64) {
+    let end = Instant::now() + Duration::from_micros(us);
+    while Instant::now() < end {
+        std::hint::spin_loop();
+    }
+}
+
+fn cpus() -> usize {
+    #[cfg(target_os = "linux")]
+    unsafe {
+        let mut set: libc::cpu_set_t = std::mem::zeroed();
+        if libc::sched_getaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &mut set) == 0 {
+            let n = libc::CPU_COUNT(&set) as usize;
+            if n > 0 {
+                return n;
+            }
+        }
+    }
+    std::thread::available_parallelism().map_or(1, |n| n.get())
+}
+
+fn load_average() -> f64 {
+    let mut l = [0f64; 3];
+    unsafe { libc::getloadavg(l.as_mut_ptr(), 3) };
+    l[0]
+}
+
+fn host() -> String {
+    let mut buf = [0u8; 256];
+    unsafe { libc::gethostname(buf.as_mut_ptr().cast(), buf.len()) };
+    let end = buf.iter().position(|&b| b == 0).unwrap_or(buf.len());
+    String::from_utf8_lossy(&buf[..end]).into_owned()
+}
+
+/// Child processes that burn a share of a CPU each until dropped.
+struct Load(Vec<std::process::Child>);
+
+impl Load {
+    fn start(spec: Option<(usize, u64)>) -> Self {
+        let Some((k, pct)) = spec else {
+            return Load(Vec::new());
+        };
+        let exe = std::env::current_exe().expect("own path");
+        Load(
+            (0..k)
+                .map(|_| {
+                    std::process::Command::new(&exe)
+                        .args(["--load-child", &pct.to_string()])
+                        .spawn()
+                        .expect("a load child")
+                })
+                .collect(),
+        )
+    }
+}
+
+impl Drop for Load {
+    fn drop(&mut self) {
+        for c in &mut self.0 {
+            let _ = c.kill();
+            let _ = c.wait();
+        }
+    }
+}
+
+fn load_child(pct: u64) -> ! {
+    let period = Duration::from_millis(10);
+    let on = period * pct.min(100) as u32 / 100;
+    loop {
+        let t = Instant::now();
+        while t.elapsed() < on {
+            std::hint::spin_loop();
+        }
+        if let Some(rest) = period.checked_sub(t.elapsed()) {
+            std::thread::sleep(rest);
+        }
+    }
+}
+
+struct Stats {
+    median: f64,
+    p90: f64,
+    max: f64,
+}
+
+fn stats(mut v: Vec<f64>) -> Stats {
+    v.sort_by(|a, b| a.partial_cmp(b).unwrap());
+    Stats {
+        median: v[v.len() / 2],
+        p90: v[(v.len() * 9 / 10).min(v.len() - 1)],
+        max: v[v.len() - 1],
+    }
+}
+
+/// The pool's spin budget from the command line (`--spin-polls`); `None` keeps the default.
+static SPIN_POLLS: std::sync::OnceLock<Option<u32>> = std::sync::OnceLock::new();
+
+fn pool(width: usize) -> Pool {
+    let mut b = Pool::builder()
+        .threads(width)
+        .acquire_timeout(Duration::from_secs(30));
+    if let Some(Some(n)) = SPIN_POLLS.get() {
+        b = b.spin_polls(*n);
+    }
+    b.build().expect("a pool")
+}
+
+/// Counters of the waits between two snapshots.
+fn waits_between(a: WaitCounters, b: WaitCounters) -> WaitCounters {
+    WaitCounters {
+        join_sleeps: b.join_sleeps - a.join_sleeps,
+        barrier_sleeps: b.barrier_sleeps - a.barrier_sleeps,
+        member_parks: b.member_parks - a.member_parks,
+    }
+}
+
+fn waits_sum(a: WaitCounters, b: WaitCounters) -> WaitCounters {
+    WaitCounters {
+        join_sleeps: a.join_sleeps + b.join_sleeps,
+        barrier_sleeps: a.barrier_sleeps + b.barrier_sleeps,
+        member_parks: a.member_parks + b.member_parks,
+    }
+}
+
+fn snap(t: &Option<Team>) -> WaitCounters {
+    t.as_ref()
+        .map(|t| t.pool().wait_counters())
+        .unwrap_or_default()
+}
+
+/// Prints what the waits of the cell just reported did (stdout only).
+fn waits_line(c: WaitCounters, calls: usize) {
+    let per = |n: u64| n as f64 / calls.max(1) as f64;
+    println!(
+        "          waits per call: join sleeps {:.1}, barrier sleeps {:.1}, member parks {:.1}",
+        per(c.join_sleeps),
+        per(c.barrier_sleeps),
+        per(c.member_parks)
+    );
+}
+
+fn team(width: usize) -> Team {
+    pool(width).into_team(width).expect("an idle pool")
+}
+
+/// One call of `sections` sections of `work` µs on a team; the time of the first section and of
+/// the whole call, in µs.
+fn call_team(team: &Team, width: usize, sections: usize, work: u64) -> (f64, f64) {
+    let mut exec = team.exec(width);
+    exec.team(|mut t| {
+        let t0 = Instant::now();
+        t.reborrow().run(|_, _| busy(work));
+        let first = t0.elapsed().as_secs_f64() * 1e6;
+        for _ in 1..sections {
+            t.reborrow().run(|_, _| busy(work));
+        }
+        (first, t0.elapsed().as_secs_f64() * 1e6)
+    })
+    .expect("a team token")
+}
+
+/// One call of `splits` splits of the team into pairs, each pair running one section of
+/// `work` µs; the time of the call in µs.
+fn call_nested(team: &Team, width: usize, splits: usize, work: u64) -> f64 {
+    let mut exec = team.exec(width);
+    exec.team(|mut t| {
+        let pairs = vec![2usize; t.size().get() / 2];
+        let t0 = Instant::now();
+        for _ in 0..splits {
+            t.reborrow()
+                .split(&pairs, |_, child| child.run(|_, _| busy(work)))
+                .expect("a split into pairs");
+        }
+        t0.elapsed().as_secs_f64() * 1e6
+    })
+    .expect("a team token")
+}
+
+/// One call that acquires its members from a held pool (`Exec::new(..).team(..)`); the time of
+/// the acquisition and the call, in µs.
+fn call_pool(pool: &Pool, width: usize, sections: usize, work: u64) -> f64 {
+    let t0 = Instant::now();
+    threadteam::Exec::new(pool, width)
+        .expect("a token")
+        .team(|mut t| {
+            for _ in 0..sections {
+                t.reborrow().run(|_, _| busy(work));
+            }
+        })
+        .expect("members for the scope");
+    t0.elapsed().as_secs_f64() * 1e6
+}
+
+/// The same call on a Rayon pool: one `scope` per section, `width - 1` spawned shares and one on
+/// the caller.
+fn call_rayon(pool: &rayon::ThreadPool, width: usize, sections: usize, work: u64) -> (f64, f64) {
+    pool.install(|| {
+        let t0 = Instant::now();
+        let mut first = 0.0;
+        for s in 0..sections {
+            rayon::scope(|sc| {
+                for _ in 1..width {
+                    sc.spawn(|_| busy(work));
+                }
+                busy(work);
+            });
+            if s == 0 {
+                first = t0.elapsed().as_secs_f64() * 1e6;
+            }
+        }
+        (first, t0.elapsed().as_secs_f64() * 1e6)
+    })
+}
+
+struct Row<'a> {
+    scenario: &'a str,
+    imp: &'a str,
+    width: usize,
+    param: String,
+    metric: &'a str,
+    s: Stats,
+    ideal_us: f64,
+}
+
+struct Out {
+    csv: Option<std::fs::File>,
+    prefix: String,
+}
+
+impl Out {
+    fn row(&mut self, r: Row<'_>) {
+        println!(
+            "{:<9} {:<10} {:>5} {:<22} {:<7} {:>11.1} {:>11.1} {:>11.1} {:>10.1}",
+            r.scenario,
+            r.imp,
+            r.width,
+            r.param,
+            r.metric,
+            r.s.median,
+            r.s.p90,
+            r.s.max,
+            r.s.median - r.ideal_us
+        );
+        if let Some(f) = &mut self.csv {
+            writeln!(
+                f,
+                "{},{},{},{},{},{},{:.2},{:.2},{:.2},{:.2}",
+                self.prefix,
+                r.scenario,
+                r.imp,
+                r.width,
+                r.param,
+                r.metric,
+                r.s.median,
+                r.s.p90,
+                r.s.max,
+                r.s.median - r.ideal_us
+            )
+            .expect("csv write");
+        }
+    }
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let value = |name: &str| {
+        args.iter()
+            .position(|a| a == name)
+            .and_then(|i| args.get(i + 1).cloned())
+    };
+    if let Some(pct) = value("--load-child") {
+        load_child(pct.parse().expect("--load-child <percent>"));
+    }
+    let scenario = value("--scenario").unwrap_or_else(|| "all".into());
+    let n = cpus();
+    let widths: Vec<usize> = value("--widths")
+        .map(|v| v.split(',').map(|w| w.parse().expect("--widths")).collect())
+        .unwrap_or_else(|| {
+            let mut w = vec![n, (n * 3 / 4).max(1)];
+            w.dedup();
+            w
+        });
+    let imps: Vec<String> = value("--impl")
+        .unwrap_or_else(|| "threadteam,rayon".into())
+        .split(',')
+        .map(String::from)
+        .collect();
+    let load_spec = value("--load").map(|v| {
+        let (k, p) = v.split_once(':').expect("--load K:P");
+        (k.parse().expect("--load K"), p.parse().expect("--load P"))
+    });
+    let calls: usize = value("--calls").map_or(200, |v| v.parse().expect("--calls"));
+    let label = value("--label").unwrap_or_default();
+    let spin = value("--spin-polls").map(|v| v.parse().expect("--spin-polls"));
+    SPIN_POLLS.get_or_init(|| spin);
+    let load_text = load_spec.map_or("none".into(), |(k, p)| format!("{k}x{p}%"));
+
+    let csv = value("--csv").map(|path| {
+        let fresh = !std::path::Path::new(&path).exists();
+        let mut f = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&path)
+            .expect("csv file");
+        if fresh {
+            writeln!(
+                f,
+                "host,label,cpus,load,scenario,impl,width,param,metric,median_us,p90_us,max_us,overhead_us"
+            )
+            .expect("csv header");
+        }
+        f
+    });
+    let mut out = Out {
+        csv,
+        prefix: format!("{},{label},{n},{load_text}", host()),
+    };
+
+    let _load = Load::start(load_spec);
+    if load_spec.is_some() {
+        std::thread::sleep(Duration::from_millis(200));
+    }
+    println!(
+        "host {} cpus {n} load average {:.2} foreign load {load_text} label {label}",
+        host(),
+        load_average()
+    );
+    println!(
+        "{:<9} {:<10} {:>5} {:<22} {:<7} {:>11} {:>11} {:>11} {:>10}",
+        "scenario", "impl", "width", "param", "metric", "median us", "p90 us", "max us", "overhead"
+    );
+
+    let want = |s: &str| scenario == "all" || scenario == s;
+    for &w in &widths {
+        let rayon_pool = imps.iter().any(|i| i == "rayon").then(|| {
+            rayon::ThreadPoolBuilder::new()
+                .num_threads(w)
+                .build()
+                .expect("a rayon pool")
+        });
+        let mut held = imps.iter().any(|i| i == "threadteam").then(|| team(w));
+
+        if want("sections") {
+            for work in [5u64, 20, 50] {
+                let sections = 200;
+                let param = format!("work={work}us,sections={sections}");
+                let ideal = (sections as u64 * work) as f64;
+                if let Some(t) = &held {
+                    let c0 = snap(&held);
+                    let v = (0..calls)
+                        .map(|_| call_team(t, w, sections, work).1)
+                        .collect();
+                    out.row(Row {
+                        scenario: "sections",
+                        imp: "threadteam",
+                        width: w,
+                        param: param.clone(),
+                        metric: "call",
+                        s: stats(v),
+                        ideal_us: ideal,
+                    });
+                    waits_line(waits_between(c0, snap(&held)), calls);
+                }
+                if let Some(p) = &rayon_pool {
+                    let v = (0..calls)
+                        .map(|_| call_rayon(p, w, sections, work).1)
+                        .collect();
+                    out.row(Row {
+                        scenario: "sections",
+                        imp: "rayon",
+                        width: w,
+                        param,
+                        metric: "call",
+                        s: stats(v),
+                        ideal_us: ideal,
+                    });
+                }
+            }
+        }
+
+        if want("gaps") {
+            for gap_us in [0u64, 100, 1_000, 10_000] {
+                let (sections, work) = (10, 5u64);
+                let param = format!("gap={gap_us}us");
+                let gap = Duration::from_micros(gap_us);
+                let run = |f: &mut dyn FnMut() -> (f64, f64)| {
+                    let mut first = Vec::new();
+                    let mut whole = Vec::new();
+                    for _ in 0..calls / 2 {
+                        if !gap.is_zero() {
+                            std::thread::sleep(gap);
+                        }
+                        let (a, b) = f();
+                        first.push(a);
+                        whole.push(b);
+                    }
+                    (stats(first), stats(whole))
+                };
+                if let Some(t) = &held {
+                    let c0 = snap(&held);
+                    let (a, b) = run(&mut || call_team(t, w, sections, work));
+                    let c = waits_between(c0, snap(&held));
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "threadteam",
+                        width: w,
+                        param: param.clone(),
+                        metric: "first",
+                        s: a,
+                        ideal_us: work as f64,
+                    });
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "threadteam",
+                        width: w,
+                        param: param.clone(),
+                        metric: "call",
+                        s: b,
+                        ideal_us: (sections as u64 * work) as f64,
+                    });
+                    waits_line(c, calls / 2);
+                }
+                if let Some(p) = &rayon_pool {
+                    let (a, b) = run(&mut || call_rayon(p, w, sections, work));
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "rayon",
+                        width: w,
+                        param: param.clone(),
+                        metric: "first",
+                        s: a,
+                        ideal_us: work as f64,
+                    });
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "rayon",
+                        width: w,
+                        param,
+                        metric: "call",
+                        s: b,
+                        ideal_us: (sections as u64 * work) as f64,
+                    });
+                }
+            }
+        }
+
+        if want("nested") && w >= 4 {
+            if let Some(t) = &held {
+                let (splits, work) = (100, 20u64);
+                let c0 = snap(&held);
+                let v = (0..calls / 2)
+                    .map(|_| call_nested(t, w, splits, work))
+                    .collect();
+                out.row(Row {
+                    scenario: "nested",
+                    imp: "threadteam",
+                    width: w,
+                    param: "pairs,splits=100,work=20us".into(),
+                    metric: "call",
+                    s: stats(v),
+                    ideal_us: (splits as u64 * work) as f64,
+                });
+                waits_line(waits_between(c0, snap(&held)), calls / 2);
+            }
+        }
+
+        if want("acquire") && imps.iter().any(|i| i == "threadteam") {
+            // No other team of this process stays reserved while these arms run.
+            drop(held.take());
+            let (sections, work) = (50, 20u64);
+            let ideal = (sections as u64 * work) as f64;
+            let mut row = |param: &str, metric: &'static str, v: Vec<f64>| {
+                out.row(Row {
+                    scenario: "acquire",
+                    imp: "threadteam",
+                    width: w,
+                    param: param.into(),
+                    metric,
+                    s: stats(v),
+                    ideal_us: ideal,
+                })
+            };
+            {
+                let t = team(w);
+                let c0 = t.pool().wait_counters();
+                let v = (0..calls / 2)
+                    .map(|_| call_team(&t, w, sections, work).1)
+                    .collect();
+                row("held_team", "call", v);
+                waits_line(waits_between(c0, t.pool().wait_counters()), calls / 2);
+            }
+            {
+                let p = pool(w);
+                let c0 = p.wait_counters();
+                let v = (0..calls / 2)
+                    .map(|_| call_pool(&p, w, sections, work))
+                    .collect();
+                row("held_pool", "call", v);
+                waits_line(waits_between(c0, p.wait_counters()), calls / 2);
+            }
+            // The phases of a pool built for one call: build, acquisition of its
+            // members, the call, the release of the team and the drop of the pool.
+            let (mut build, mut acquire, mut call, mut release, mut drop_pool, mut total) = (
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+            );
+            let us = |a: Instant, b: Instant| (b - a).as_secs_f64() * 1e6;
+            let mut c = WaitCounters::default();
+            for _ in 0..calls / 2 {
+                let t0 = Instant::now();
+                let p = pool(w);
+                let t1 = Instant::now();
+                let t = p.into_team(w).expect("an idle pool");
+                let t2 = Instant::now();
+                let c0 = t.pool().wait_counters();
+                call.push(call_team(&t, w, sections, work).1);
+                c = waits_sum(c, waits_between(c0, t.pool().wait_counters()));
+                let t3 = Instant::now();
+                let p = t.into_pool();
+                let t4 = Instant::now();
+                drop(p);
+                let t5 = Instant::now();
+                build.push(us(t0, t1));
+                acquire.push(us(t1, t2));
+                release.push(us(t3, t4));
+                drop_pool.push(us(t4, t5));
+                total.push(us(t0, t5));
+            }
+            row("fresh_pool", "call", call);
+            row("fresh_pool", "total", total);
+            row("fresh_pool", "build", build);
+            row("fresh_pool", "acquire", acquire);
+            row("fresh_pool", "release", release);
+            row("fresh_pool", "drop", drop_pool);
+            waits_line(c, calls / 2);
+        }
+    }
+}
diff --git a/docs/design/own-threads.md b/docs/design/own-threads.md
new file mode 100644
index 0000000..897c75c
--- /dev/null
+++ b/docs/design/own-threads.md
@@ -0,0 +1,162 @@
+# Own worker threads (threadteam-rs#15)
+
+threadteam stops running on a private Rayon `ThreadPool`. Its workers are `std::thread`s kept in a process-wide **reserve**; a `Pool` leases a fixed number of them and returns them when it is dropped. The waits stay libgomp's (`waiting.md`). Rayon becomes an opt-in interop layer.
+
+Design inputs:
+- pi-council, plan mode (GPT-6-astra chair, DeepSeek critic, GLM minimalist). The brief and the synthesis are in the shinaoka-advisor run directory `work/runs/threadteam-own/`.
+- The runtime sources read for it, without copying code: libgomp, LLVM libomp, oneTBB.
+- The measurements of threadteam-rs#14, which stays a draft as their record.
+
+## Why: the one-call pool
+
+faer's `with_team` builds a `Pool`, and with it 64 fresh threads, per call. On a 64-CPU set under foreign load those threads start stacked: the scheduler places a new thread before it knows its load. The team's spinning waiters then never leave a CPU idle that could pull one over, and every 20 µs section of the call waits for a descheduled member (faer#107).
+
+The structural difference is the spawn, not the waiting. In one broccoli run (faer#107, 13:10Z, 0.1.3, 64 threads, `gemm128`), the same acquisition path at the same width gave:
+
+| arm | what happens per call | median call |
+| --- | --- | --- |
+| `into_team_per_call` | the pool is held; members are acquired and released per call | 0.03 ms |
+| `fresh_pool` | a new pool, so 64 new threads, per call | 15.99 ms |
+
+On #14, no waiting policy fixed the fresh pool and kept held teams at libgomp's speed at the same time:
+- the pool-wide throttle fixed (a) but cost (c);
+- libgomp's waits met (b) and (c) but left the fresh pool at 11 ms;
+- a wall-clock window could not tell the two apart.
+
+libgomp creates its threads once per process (per master thread) and reuses them for every region, docked on a futex between regions. TBB's RML server owns one process-wide set of workers that every arena reuses, each sleeping on its own monitor when idle.
+
+The answer to question (i) of #15 is therefore (ii): if no `Pool` spawns threads, there is no fresh-thread stacking to detect.
+
+**Caveat.** The first pool of a process still spawns its workers. The acceptance criterion (a) judges a process by its median call over 50, so one cold first call does not make it slow, and the benchmarks report the cold first call separately.
+
+## Decisions
+
+### Reserve and lease
+- **One process-wide reserve: a list of idle workers.** It is created by the first explicit `Pool::build` that wants shared workers. Serial, budget-one and one-task entries never reach it, and no API submits work to it without a pool, so "no implicit global pool" holds.
+- **Compatibility.** A worker of the reserve was spawned with the default stack (16 MiB), the platform's default QoS and no hooks. A pool with any `thread_name`, `on_start`, a different stack size or a QoS gets **dedicated** workers: spawned for it and joined when it is dropped, exactly as before. tcontract's C API names its workers and sets a thread-local in `on_start`; it keeps today's semantics.
+- **`Pool::build`.** It takes `width` idle workers from the reserve and spawns the missing ones; a spawn failure is a build error. A worker learns its pool and its index when leased.
+- **`Pool` drop (shared workers).** Every worker is told to detach. Each one finishes, restores its own affinity mask (a pinned member) and acknowledges. Only then is the worker back in the reserve. The drop waits for all acknowledgements (quiescence) and does not join.
+  - The reserve keeps at most `C` idle workers (pre-review resolution 6 sets `C`); a worker beyond the cap exits.
+  - A pool dropped from one of its own workers (a worker running a task that owns the pool) cannot wait for itself: it detaches the others, and that worker detaches when its task returns.
+- **Contract change.** "Dropping a `Pool` joins every worker thread" now holds for dedicated workers only; a shared worker outlives the pool, parked in the reserve.
+
+### The worker loop
+Each leased worker runs one native loop over its member slot, the slot of the existing team machinery (`awake.rs`). The slot's state word and its transitions are pre-review resolution 3 (`RESERVED`, `LENT`, `BUSY`, `DETACH`; free is `0`).
+
+Work, in the order the loop looks for it:
+1. A **broadcast share** for this worker in the pool's broadcast list (pre-review resolution 2).
+2. A **task** from the pool's queue.
+3. Otherwise the staged wait: spin, yield, then park on its slot's `Parker`, until the queue generation, the broadcast generation, or the state changes.
+
+The `ABSENT` state, the claim jobs (`claim_cold`) and the `YIELD` state of the Rayon design disappear: every leased worker is always in its loop.
+
+### Plain tokens: `fork`, `for_ranges`, `external`
+- **A call publishes a stack-allocated batch.** The batch holds the task function, the next unclaimed index, the task count and a completion counter (`Completion`). It is linked into the pool's queue: an intrusive list under a `std::sync::Mutex`, so nothing is allocated.
+- **Claiming and freeing.**
+  - A worker claims an index **under the queue lock**, and the claim that takes the last index unlinks the batch.
+  - The batch's owner frees it only after the completion counter reaches zero.
+  - So no worker can reach a batch after it was unlinked, and an unlinked batch is gone only after all of its tasks finished.
+- **The caller.**
+  - A caller that is a worker of the pool claims its own batch's remaining indices before it waits.
+  - A caller from outside the pool waits (staged; it sleeps on the pool's `sync` parker, woken by the last completion), as "a plain thread enters the pool once and waits" says today.
+- **No deadlock.** Every unclaimed task is claimable by its owner, and an owner that waits only waits for tasks that are already running. A running task blocks only on its own children, which it can run itself. So no cycle of waits is possible; the worst case is a nested fork that runs its children on its own thread.
+- **Budget conservation.** The structure is unchanged: a batch has at most its token's budget of tasks, and the shares of `fork` sum to the budget.
+- **`external`.**
+  - A plain token: the callback runs on a pool worker, as a one-task batch, or inline when the caller is a worker of the pool.
+  - A team token: its members are lent to the pool's queue for the call, and serve tasks the callback's code publishes to the same pool.
+
+### Broadcast
+- Broadcasts go into the pool's ordered broadcast list (pre-review resolution 2, which replaced a first draft's whole-broadcast lock and per-slot mailboxes). The caller is never a worker of the pool (`CallerInPool` refusal). Every worker runs the broadcasts that target it in publication order.
+- The caller waits for all `budget` shares, as today; a reserved member serves no broadcast, again as today.
+
+### Identity without thread-locals
+Each slot records its worker's `ThreadId` when leased. "Is the caller a worker of this pool, and which one" is a scan of the pool's slots (`width` comparisons), done at entry points only, never on the team dispatch path.
+
+### Rayon interop: opt-in
+The Rayon lending of `external` has no production caller (downstream use: tests and benchmarks). It becomes a non-default feature, `rayon`: `Exec::external_rayon(f)` runs `f` inside `install` on a private Rayon pool of the token's width, built lazily per pool. Those are separate threads, which the feature documents. Without the feature, Rayon is not a dependency at all.
+
+### Unchanged
+- **The team machinery:** sections, `Completion`, `Barrier`, `Parker`, pinning, root-scope oversubscription, `Team`/`TeamExec` and the spare worker. A pool of `w` workers gives a team of `w` participants with an outside leader, so one worker always stays free for the queue and for `external`. threadteam-rs#12 stays open.
+- **The waits** (`waiting.md`): 300000 polls, 16 yields, futex; 100 polls in a statically oversubscribed scope.
+
+### Public semantics that change (for the maintainer)
+
+| item | before (Rayon) | now |
+| --- | --- | --- |
+| `Pool` drop | joins every worker | dedicated workers: joins. Shared workers: waits for every worker to detach, then returns them to the reserve |
+| `idle_runs_rayon` | an idle member runs queued Rayon jobs | no effect: an idle worker always serves the pool's queue (kept for compatibility) |
+| `idle_spin` | how long an unreserved member spins before returning to Rayon | how long an unreserved worker may spin before it sleeps; the spin budget bounds it as well |
+| `release_idle` | idle members return to Rayon | idle workers stop spinning and sleep now |
+| `resident_members` | members in a member loop (reserved or idle) | workers reserved by a team, or idle and awake |
+| `external` on a team token | lends members to Rayon | lends members to the pool's queue; Rayon lending is `external_rayon` under the `rayon` feature |
+| feature `parallel` | pulls Rayon | pulls nothing; `rayon` is a separate opt-in |
+
+## Pre-review resolutions
+
+The gpt-6.1-sol pre-review (`work/runs/threadteam-own/pre.out`) found one deadlock and seven gaps in the first draft. The design above is amended as follows.
+
+1. **Cross-pool liveness (A → B → A).**
+   - **The problem.** A worker of pool A that waits for a batch it published on pool B must not just sleep. If every worker of A does so, and B's tasks publish back on A, nobody runs A's queue.
+   - **The rule.** A waiting worker of any pool keeps serving **its own pool's queue** (and its broadcast sequence) until its batch completes.
+   - **The wake.** The batch records who to wake: the waiting worker's own slot parker, or the target pool's `sync` parker for a plain outside thread. That waiter sleeps on a predicate that covers both its batch and its pool's work.
+   - **Same pool.** A worker caller of the same pool still claims its own batch's indices first.
+2. **Broadcast.**
+   - **Publication only.** The pool's broadcast lock covers publication, not completion.
+   - **Ordering.** Broadcasts are numbered in publication order and linked into the pool's broadcast list. Each worker runs the broadcasts that target it in sequence order, skipping the others. A broadcast stays linked, and alive on its caller's stack, until all of its targets have finished; its caller unlinks it.
+   - **No lock held while waiting**, so a cooperative waiter re-entering a broadcast cannot block on a lock held lower on its own stack.
+3. **One state word per slot.** Bits `RESERVED`, `LENT`, `BUSY`, `DETACH`.
+   - A team claims a slot only from `0` (compare-and-swap).
+   - A free worker takes work only by winning `0 → BUSY`, and a lent member only by winning `RESERVED|LENT → RESERVED|LENT|BUSY`. Both happen before it removes a task from the queue; a failed compare-and-swap leaves the task unclaimed.
+   - Releasing a reservation clears `RESERVED|LENT` only. A worker still running a lent task stays `BUSY`, so it is not claimable until it finishes.
+   - Detach sets `DETACH`. Finishing a task clears `BUSY` only, so it cannot erase `DETACH`.
+   - Nested execution (a waiting worker helping its queue) keeps `BUSY`.
+   - These transitions are a small type (`SlotState`) that `loom` checks directly.
+4. **Lease state and self-drop.**
+   - **Ownership.** Every leased worker holds an `Arc` of the pool's shared state through its epilogue. Its detach acknowledgement is its last access to that state.
+   - **Drop.** `Pool` drop marks every slot `DETACH`, wakes the workers and waits for the acknowledgements of all workers but itself.
+   - **Self-drop from a worker.** It does not wait for the dropping worker, which acknowledges after its task returns. The other workers cannot be running work of this pool, because any such work borrows the pool, so their acknowledgements come promptly.
+   - **Locks.** No reserve lock is held while waiting.
+   - **Workers above the cap.** They exit, and their handles are detached; only dedicated workers are joined.
+5. **Affinity on lease.** `Pool::build` reads the calling thread's affinity mask, and every reused (shared) worker applies it to itself when it is leased (Linux), as a newly spawned thread would inherit it. A dedicated worker was spawned by that caller and inherited it already; it keeps whatever its `on_start` hook set (post-review 5). A worker whose pin restore failed is not returned to the reserve; it exits.
+6. **Reserve cap.** The cap is the largest of the available parallelism and every width leased so far. So repeated wide pools (faer's per-call `with_team`) keep reusing their workers, whatever the first caller's affinity was.
+7. **Panics.**
+   - Every claimed task and broadcast share runs under `catch_unwind` and always reaches its completion. The first payload is kept on the batch.
+   - The owner waits for completion (all claimed tasks, including tasks still unclaimed, which it runs itself) before it resumes the first panic.
+   - A broadcast share is unlinked by its caller only after completion; a worker never clears a share after signalling it.
+   - `Completion::finish`'s rule holds: nothing touches a batch after its final decrement.
+8. **Verification.**
+   - The loom list grows to the transitions above: state word, queue claim against reserve, last completion against reclamation, broadcast sequence, detach against task end, and lease attach against first publication.
+   - The allocation test of the plain paths drops its Rayon-era minimum-window exemption and counts strictly after warm-up.
+
+Kept against the review's delete list: the opt-in Rayon layer, which the maintainer asked for ("Rayon との相互運用が要る機能は opt-in の層として残す"), and `idle_runs_rayon`, as a documented no-op, so the public API does not break.
+
+## Post-review resolutions
+
+The gpt-6.1-sol post-review of the implementation (`work/runs/threadteam-own/post.out`) found three deadlocks, an endless wake-up and an affinity regression. Each fix has a regression test that fails (or hangs) with the fix undone.
+
+1. **Attachment against the first section.** A worker marked its slot claimable before it read the slot's section generation; a leader that reserved it in between published a section the worker then took as already seen, and both waited forever. `serve` now reads the generation first and marks the slot attached after it. (The window is a few instructions wide; no test forces it.)
+2. **Nested helping.** A wait that runs a task which waits in turn cleared the outer wait's `helping` flag on return, so `wake_for_work` skipped a worker still waiting, and A → B → A could hang. The flag is now saved and restored (`a_nested_wait_keeps_the_outer_wait_wakeable`).
+3. **A later broadcast above an unfinished one.** A broadcast share that waits on another pool helps its own pool meanwhile; it could start a later broadcast's share, whose shares meet at a barrier, while the earlier broadcast's other share waited at its own barrier for this worker. A worker with a broadcast share on its stack now takes queued tasks but no further share (`a_waiting_broadcast_share_does_not_start_a_later_broadcast`).
+4. **Cursor past unlinked broadcasts.** A worker outside a broadcast's budget that looked only after the broadcast was unlinked kept its cursor before it; `has_after` stayed true, so the worker never parked. The cursor now moves past every publication when nothing is left for the worker (`a_cursor_moves_past_a_broadcast_unlinked_before_it_looked`).
+5. **Dedicated workers and `on_start` pinning.** The lease reset a dedicated worker's mask to the caller's, undoing a hook's pin. Only reused workers take the caller's mask now (`a_dedicated_worker_keeps_the_pin_of_its_start_hook`).
+6. **Docs.** `Pool`'s and `Team`'s shutdown docs distinguish shared and dedicated workers, as the README does. The unused `shutdown` flag and `acquire`'s unused pool argument are gone.
+
+## Verification
+- **loom, new paths, small models:**
+  - a batch published with one owner and two claimers, the owner asleep until completion;
+  - an idle worker's wait on the queue generation, the broadcast generation and its state, against a publish and a detach;
+  - the detach handshake of a pool drop.
+- **The existing tests:** alloc-free (the plain paths and the team paths, warm), ledger, compile-fail, no-public-rayon, and the feature matrix.
+- **New tests:**
+  - reuse: thread creation counted; a second pool of the same width spawns none;
+  - quiescence at drop; dedicated pools keep join-on-drop;
+  - nested forks; a worker caller running its own batch;
+  - concurrent broadcasts; a pinned member restoring its mask on detach.
+- **Benchmarks:** `scripts/bench-ab.sh` against the base (`a3a9320`) and libgomp (`OMP=1`), and faer's `acquire_probe_107` (all arms), on broccoli and evo. The `fresh_pool` rows (`build`, `acquire`, `call`, `release`, `drop`) show the reuse, and the cold first call is reported separately.
+
+## Acceptance
+As on #14:
+- **(a)** faer#107 slow mode zero in every arm;
+- **(b)** quiet hosts within 10 % of 0.1.3 (`held_team`, `held_pool`, gaps 0-1 ms);
+- **(c)** under foreign load no worse than libgomp;
+- **(d)** the 10 ms gap governed by the spin budget.
diff --git a/docs/design/placement.md b/docs/design/placement.md
index 7d489ee..d07150d 100644
--- a/docs/design/placement.md
+++ b/docs/design/placement.md
@@ -6,6 +6,14 @@ cpueinsum-rs, tlinalg-rs and tenferro-rs; the cross-repository rules are in
 tensor4all/tensor4all-meta#41 (`docs/design/core-boundary-and-execution-ownership.md`,
 "Where placement is decided").
 
+
+> **Workers (2026-10-30).** threadteam no longer runs on a private Rayon pool.
+> Its workers are its own threads, leased from a process-wide reserve; see
+> [`own-threads.md`](own-threads.md). Where this record describes Rayon jobs,
+> installs or claim jobs, read the native queue, the cooperative waits and the
+> compare-and-swap reservation described there. The token contracts here are
+> unchanged.
+
 ## Problem
 
 The CPU stack places work with **four** mechanisms at once:
@@ -326,11 +334,10 @@ closure, the participant count, a padded completion counter, a sense-reversing
 barrier, a cancellation flag and an atomic cell for the first panic payload.
 The leader stores the section address and the participant index into each
 member slot and bumps its `gen` counter with release ordering; members poll
-`gen` and `state` with one PAUSE per poll (`spin_loop`, no `sched_yield`) and
-run their share and decrement the completion counter. After the reservation's
-park delay (the effective `idle_spin`, or zero in an oversubscribed root scope,
-see below) without work, a member parks (see below). The leader runs
-share 0, then waits for the counter, polling the same way. Nothing is allocated and nobody is woken
+`gen` and `state`, run their share and decrement the completion counter. The
+leader runs share 0, then waits for the counter. Every one of these waits
+(a member waiting for work, the leader's join, a barrier) is a staged episode,
+spin, a few yields, then sleep, described in [`waiting.md`](waiting.md). Nothing is allocated, and a dispatch wakes only members that are asleep
 (`tests/team_alloc_free.rs`; acquisition allocates a small `Vec` and, for
 members not already awake, the claim jobs).
 
@@ -406,36 +413,35 @@ release it when they return, so a caller that needs the team across several
 entries keeps the token and lends it with `reborrow`. No thread-local state is
 involved (the owner's thread id is stored in the team).
 
-**Parking.** A reserved member that finds no new section for the park delay
-(the effective `idle_spin` of the reservation: the pool default or the
-`reserve_with` / `team_with` override) parks and stays reserved. All parked
-members of a pool wait on one condition variable (`park_lock`, `park_cv`), with
-a counter `parked` of members inside or entering the wait. The protocol:
+**Parking.** A reserved member that finds no new section within its staged
+wait (spin budget, a few yields; [`waiting.md`](waiting.md)) parks and stays
+reserved. Each member slot has its own `Parker`, and a leader wakes only
+the slots it changed (a publish, a release, a lend); the joins and barriers
+sleep on one pool-wide `Parker`. The protocol of every `Parker`:
 
-* A member raises `parked` (acquire-release increment), takes the lock,
-  re-checks `gen`, `state` and `lent` and waits only while none changed; it
+* A sleeper raises `parked` (acquire-release increment), takes the lock,
+  re-checks the state it waits on and waits only while it is unchanged; it
   lowers `parked` when it leaves.
-* A leader changes the state a member waits on (bumps `gen`, stores `IDLE`,
-  sets `lent`), then reads `parked` with an acquire-release `fetch_add(0)`. If it
-  is nonzero, the leader takes and drops the lock and calls `notify_all`. Either the member sees the changed
-  state after raising `parked`, or the leader sees `parked` (both are read-modify-writes of one atomic, so the
-  argument needs only its modification order and release sequences, not a total
-  order of SeqCst accesses, which `loom` does not model); and because the
-  leader takes the lock before notifying, the notification cannot fall between a
-  member's check and its wait (the usual condition-variable handshake).
-* With nobody parked a dispatch pays one uncontended atomic read-modify-write.
-  A broadcast also wakes parked members of other teams of the same pool, which
-  re-check and sleep again; the leader pays one syscall, not one per member.
-* Spurious wake-ups loop. There is no per-member wake state: every parked member
-  waits on the one condition variable, so no wake-up depends on the order in
-  which a leader publishes to individual members.
+* A waker changes the state (SeqCst), then reads `parked` with an
+  acquire-release `fetch_add(0)`. If it is nonzero, it takes and drops the lock
+  and calls `notify_all`. Either the sleeper sees the changed state after
+  raising `parked`, or the waker sees `parked` (both are read-modify-writes of
+  one atomic, so the argument needs only its modification order and release
+  sequences, not a total order of SeqCst accesses, which `loom` does not
+  model); and because the waker takes the lock before notifying, the
+  notification cannot fall between a sleeper's check and its wait.
+* With nobody asleep a wake costs one uncontended atomic read-modify-write.
+  Spurious wake-ups loop. Which parker each wait uses, and when it sleeps, is
+  in [`waiting.md`](waiting.md).
 
 The handshake is the small `Parker` type in `src/park.rs`, built on a `sync`
 shim (`std`, or `loom` under `--cfg loom`), and checked three ways:
 
 * **Model check.** `tests/loom_park.rs` runs the real `Parker` under `loom` with
-  one leader and two members: a published section, a released reservation, and a
-  member that parks twice. The correctness argument therefore uses only what loom
+  one leader and two members: a published section, a released reservation, a
+  member that parks twice, and per-slot parkers; and the exact join and barrier
+  code (`Completion`, `Barrier`): a leader asleep in a join, consecutive
+  barrier rounds, and a cancellation waking a sleeper. The correctness argument therefore uses only what loom
   models (modification order and release sequences of `parked`). CI job `loom`:
   `RUSTFLAGS="--cfg loom" cargo test --release --test loom_park`.
 * **Forced interleavings.** With the feature `test-hooks`, `test_hooks` lets a
@@ -454,63 +460,12 @@ with a zero idle spin and broadcasts, so the members return to Rayon at once.
 
 ### How a reserved member and a joining leader wait
 
-Two waits exist, both allocation-free and both unchanged in the handshake:
-
-* **Reserved members polling `gen`, and a leader in `Section::join` or
-  `Section::barrier`, in a scope that is not oversubscribed**: one
-  `std::hint::spin_loop()` per poll (PAUSE on x86, YIELD/ISB on aarch64), never
-  a `yield_now`. A thread that only issues PAUSE stays runnable but does not
-  re-enter the scheduler on every poll, so a pair the scheduler stacked on one
-  CPU can be separated instead of preempting each other in a yield loop, and a
-  share does not pay a syscall per poll. This is libgomp's shape. A reserved
-  member still parks after its park delay, which is what ends the spin; nothing
-  else wakes it.
-* **Acquisition, the cold claim, and the `IDLE` / leaving states**: `backoff`
-  as before (a bounded pure spin, then one `yield_now` per poll). Those threads
-  are not reserved yet or are on their way out, so they must cooperate to make
-  progress on a loaded host.
-
-**Oversubscription.** A root team scope is oversubscribed when its participants
-number more than the CPUs in the **entering thread's** affinity mask (on
-non-Linux targets: `std::thread::available_parallelism()`). It is decided at
-root-scope entry on that thread, whether or not participant pinning is on: at
-`Exec::team_with` (acquisition path and the carried path of a root token minted
-by a `Team`), and for a `Team` also when its root token is minted
-(`Team::exec`/`try_exec`), which is the pressure a token used without a team
-scope reports. Because the scope entry repeats it, a token minted on one CPU set
-and used on another is paced and placed by the set of the thread that enters the
-scope, never by the one it was minted on. The result is carried into
-`TeamExec`, team-carrying `Exec` tokens, `reborrow`, `limit`, `split` and `fork`
-children and every `Section`, so a nested section of an oversubscribed root
-knows it too; it is never recomputed from a child's size. The members' park
-delay is written to their slots at the same entry. In such a scope:
-
-* the park delay of the reserved members is **zero**, so a member that finds no
-  section spins one short episode (64 polls) and parks instead of holding a CPU
-  for the whole `idle_spin`. `polls` and `spins` are reset at the start of each
-  idle episode, so the episode is counted afresh;
-* `Section::join` and `Section::barrier` spin about 100 times and then
-  `yield_now` per poll, the shape libomp takes when it detects more threads than
-  CPUs, so the waiting participants do not hold every CPU while their peers are
-  queued behind them.
-
-The flag is per scope and per root; overlapping teams or pools are the caller's
-business (see the placement warning below). This is the behaviour libgomp
-throttles to about 100 spins when oversubscribed; measured on broccoli, parking
-alone did not remove the tensor4all/faer#107 slow mode, so the zero park delay is
-about the CPU a member burns, not about the mode.
-
-**Quality of service.** `PoolBuilder::qos(Qos)` sets the class of each worker
-when it starts (`pthread_set_qos_class_self_np` on Apple targets, nothing
-elsewhere; no platform type is public). The default is `UserInitiated` on
-macOS. `threadteam` never changes the caller's class, but the calling thread
-leads every section, so `raise_current_thread_qos(Qos)` raises the calling
-thread to at least the given class and never lowers it (the current class is
-read first); an engine calls it once for its leading thread. In the wake probe
-the class (builder default, explicit `Default`, `UserInteractive`) made no
-measurable difference to the wake latency on this host. Dropping the
-team stores `IDLE` with a zero idle spin and wakes them, so the members return to
-Rayon at once.
+Replaced by [`waiting.md`](waiting.md): every team wait spins for the pool's
+spin budget in polls, yields a few times, then sleeps; the leader's join and
+the barriers sleep on a pool-wide parker; a descheduled waiter throttles the
+pool's waits. The earlier design (PAUSE-only spin with a wall-time park delay
+for members and no sleep at all in joins and barriers) is in the history of
+this file.
 
 ### Participant placement (opt-in)
 
@@ -591,69 +546,13 @@ How it works:
 
 ### Waiting policy
 
-`PoolBuilder::idle_spin` (default 200 ms, may be zero) and
-`PoolBuilder::idle_runs_rayon` (default `false`) set `WaitPolicy` defaults; an
-oversubscribed root scope overrides the park delay with zero for its own
-reservation only;
-`acquire_timeout` is separate. `WaitOverride` (partial policy) applies to one
-operation: `Exec::team_with` for a root reservation, `TeamExec::with_wait` for a
-scope. Children inherit the effective policy and may override it for their own
-scope. The root reservation's effective policy is stored in its members' slots
-when it ends and governs the idle interval that follows; the interval starts
-when the reservation ends, not when the member last computed. A reserved member
-never leaves on a timeout and never runs an unrelated Rayon job (it parks, still
-reserved, after the park delay), whatever the policy, so an override cannot weaken a reservation, and a child's override
-expires when the child returns and cannot release its parent's members.
-With `idle_runs_rayon`, an idle member calls `rayon::yield_now`, whose job runs
-to completion before the member is claimable again. Without it, an idle member
-leaves its worker out of Rayon service for up to `idle_spin`; a following
-`broadcast` or a Rayon job that needs every worker then waits for them, so a
-caller that alternates with such work sets a short spin or calls
-`Pool::release_idle`.
-
-**Idle clock and the default delay.** The park delay of a reserved member is
-measured on a clock that belongs to that member alone: it starts when the
-member first finds nothing to do after its own last share (or after it started,
-or was taken back from a lend), and it restarts with every share the member
-runs. A share of another member does not move it, and neither does anything the
-leader does between sections. When the clock exceeds the delay the member
-parks. Consequences:
-
-* A team that runs no section costs CPU for the delay after the team is built
-  (or after its last section), then nothing: members that spin beyond that are a
-  bug.
-* Sections less than the delay apart keep every participating member spinning
-  the whole time. That is the intended behaviour, not a leak: it is what makes a
-  dispatch cost one atomic store and no syscall (about 0.3 us, against some tens of
-  us after a park on the reference M5, see `benches/spin_grid.rs`).
-* A CPU measurement over a window of sequential work therefore depends on where
-  the window sits relative to the last section (or the construction of the team):
-  a window inside the first 200 ms reads about `width - 1` extra cores, a window
-  after it reads one. Measure CPU after a settle time longer than the delay, or
-  say what the window contains.
-
-The default is 200 ms, the same as the default blocktime of the LLVM and Intel
-OpenMP runtimes (`KMP_BLOCKTIME`): long enough that a loop of small parallel
-regions with serial work between them never pays a wake-up, short enough that a
-program that stops using the team goes quiet within a fifth of a second. The
-sweep in `benches/spin_grid.rs` (6 participants) shows the trade: with a 200 ms
-delay a dispatch after a 100 ms gap costs 12 us (members still spinning, 4.9
-cores); with a zero delay it costs 37 us after any gap and members use no CPU.
-Callers with sparse sections set a shorter delay with `idle_spin` or
-`team_with`.
-
-The clock is explicit in the code (`last_work` in `member_loop`) and visible
-with the feature `trace`, which stamps every member transition (enter, share
-begin and end, park enter and exit, lend, leave) into a preallocated ring; the
-bench `idle_trace` prints each member's spin, park and run time per phase and
-`tests/idle_clock.rs` checks that a member parks neither before the delay since
-its own last share nor never.
-
-`Pool::release_idle` bumps an epoch: idle members leave at once, reserved
-members leave when their reservation ends. It never revokes a live token and
-does not wait, so it may be called inside a reservation. Dropping the pool
-signals shutdown, which idle members honour. `Pool::resident_members` reports
-the number of awake members (diagnostic).
+`PoolBuilder::idle_spin` (default 200 ms, may be zero) and `idle_runs_rayon`
+govern an *unreserved* idle member, the state a member is in after a scoped
+team (`Exec::team`) ended: it stays claimable without a Rayon wake-up until
+`idle_spin` passes or it has polled for the pool's spin budget, whichever
+comes first, then returns to Rayon. `WaitOverride` overrides them per scope.
+Reserved members do not use `idle_spin` any more; their waits, and the joins
+and barriers, follow [`waiting.md`](waiting.md).
 
 ### Unwind
 
diff --git a/docs/design/waiting-data/README.md b/docs/design/waiting-data/README.md
new file mode 100644
index 0000000..4db405e
--- /dev/null
+++ b/docs/design/waiting-data/README.md
@@ -0,0 +1,6 @@
+# Wait benchmark results
+
+One CSV per host, written by `scripts/bench-waits.sh` (columns: host, label, cpus, load, scenario,
+impl, width, param, metric, median_us, p90_us, max_us, overhead_us). `label` names the commit or
+version measured; `load` is the foreign load of that pass (`none` or `KxP%`). Times are per call in
+microseconds; `overhead_us` is the median minus the ideal `sections * work`.
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
new file mode 100644
index 0000000..d1d52d8
--- /dev/null
+++ b/docs/design/waiting.md
@@ -0,0 +1,161 @@
+# How team threads wait
+
+This record covers how the threads of a team wait:
+- a reserved member, between sections and between calls;
+- the leader, in `Section::join`;
+- every participant, in `Section::barrier`.
+
+It replaces the waits of 0.1.3 with the shape of the OpenMP runtimes: a bounded spin, then a short yield phase, then a sleep on a futex. Maintainer decision, 2026-10-29: 「threadteam の待ち方を OpenMP に近づけるのがいいと思う」. The trigger is tensor4all/faer#107.
+
+## What 0.1.3 does, and why it stacks
+
+| wait | 0.1.3 |
+| --- | --- |
+| reserved member polling `gen` (between sections and between calls) | one PAUSE per poll; parks after `idle_spin` of **wall time** (200 ms), or after 64 polls when the scope is oversubscribed |
+| leader in `Section::join` | one PAUSE per poll, **never sleeps**; when oversubscribed, ~100 PAUSEs, then `yield_now` per poll |
+| participant in `Section::barrier` | same as `join` |
+| unreserved `IDLE` member | `backoff` (2^14 PAUSEs, then `yield_now`) for `idle_spin` of wall time, then returns to Rayon |
+
+"Oversubscribed" means more participants than CPUs in the caller's affinity set. Foreign load is not counted.
+
+faer#107, broccoli, 64 threads on 64 CPUs with another user's processes at 5-13 %:
+- a fresh pool per call is slow in 20/20 processes (gemm 128: a fixed 16 ms against 0.02 ms);
+- chol 2048 is slow in 10/10 processes even with the pool held;
+- at width 48 on 64 CPUs the slow mode disappears (0.02 ms, 0 % stacked).
+
+The mechanism:
+- At width = CPUs, every CPU holds a participant that is either working or spinning, so no CPU is ever idle.
+- Linux moves a runnable thread from a busy CPU to another CPU mainly when that CPU goes idle (newidle balancing). Periodic balancing has nothing to gain from a 2-to-1 move.
+- So once a member shares a CPU with another runnable thread (a peer, the spare worker, or a foreign process), the pair stays put. Every section then waits for the descheduled member's next time slice.
+- `yield_now` does not help: it hands the CPU to a thread that is already on it, and it leaves no CPU idle.
+
+The only wait that frees a CPU is a sleep.
+
+## What the OpenMP runtimes do (read from their sources; no code is taken)
+
+**libgomp** (gcc `libgomp/config/linux/wait.h`, `bar.c`, `team.c`, `env.c`):
+- **Wait.** `do_wait` polls the futex word up to `gomp_spin_count_var` times, with one `cpu_relax` (PAUSE) per poll, then calls `futex_wait`.
+- **Spin count.** The count is in polls, not in time. The default without `OMP_WAIT_POLICY` is 300000, "a rough estimation of 100000 spins per msec", so about 3 ms, "e.g. 5 times longer or 5 times shorter" depending on the CPU. It is 0 under `PASSIVE`, 3·10^10 under `ACTIVE`, and 1 on x86 hybrid CPUs (`config/linux/x86/spincount.h`).
+- **Throttling.** When libgomp's own threads outnumber the available CPUs (`gomp_managed_threads > gomp_available_cpus`), the count drops to `gomp_throttled_spin_count_var`: 100 by default, 1000 under `ACTIVE`.
+- **Foreign load.** It is not considered.
+- **Barriers.** A barrier is a generation word. The last arriving thread bumps it and calls `futex_wake(INT_MAX)`; the others `do_wait` on it.
+- **Region start.** Pool threads wait between regions on the `threads_dock` simple barrier, and the master's arrival releases them. That barrier covers the whole team, because a region always uses the whole team.
+
+**LLVM libomp** (`openmp/runtime/src/kmp_wait_release.h`, `kmp.h`, `kmp_global.cpp`, `kmp_runtime.cpp`):
+- **Wait.** `__kmp_wait_template` spins with `KMP_CPU_PAUSE` (TPAUSE where available). It yields only when the runtime's own threads exceed the available processors (`KMP_OVERSUBSCRIBED`, `__kmp_use_yield`). It suspends once `KMP_BLOCKTIME` is exhausted.
+- **Blocktime.** The blocktime is **wall time**, checked against `rdtsc` (`KMP_BLOCKING`). The default is 200 ms (`KMP_DEFAULT_BLOCKTIME`), and 0 on hybrid CPUs. With `KMP_ADJUST_BLOCKTIME`, it drops to 0 when there are more threads than processors.
+- **Library mode.** The default `KMP_LIBRARY=throughput` keeps the blocktime. `turnaround` yields only when oversubscribed.
+- **Hot teams.** A team's threads are kept across parallel regions and wait in the fork barrier under the same blocktime rule.
+- **Foreign load.** It is not considered either.
+
+**Implications for threadteam:**
+1. Both runtimes eventually sleep in **every** wait, and neither leaves a waiter spinning forever. That is what lets an idle CPU appear and pull a stacked thread.
+2. libgomp counts **polls**, and libomp counts **time**. A count is consumed only while the waiter runs, so a waiter that is descheduled behind a peer on the same CPU does not use up its budget by waiting in the run queue. A time budget expires there too, and makes the waiter sleep for the wrong reason. threadteam 0.1.3 uses time, like libomp, but 200 ms is far longer than any gap that matters.
+3. Neither runtime reads foreign load. threadteam does, below, because the faer#107 configuration (width = CPUs, foreign processes) is exactly where the static participants-against-CPUs test says "not oversubscribed".
+
+## Design
+
+### Waits
+
+Every wait is an episode of three phases.
+
+1. **Spin.** Poll the condition with one PAUSE (YIELD on aarch64) per poll, for at most `spin_polls` polls. The budget is a count, so it is consumed only while the waiter runs.
+2. **Yield.** Then `yield_now` between polls, for at most `YIELD_POLLS = 16` polls. A peer queued on the same CPU then gets the CPU without paying a futex round trip.
+3. **Sleep.** Then sleep on a `Parker`, until the condition changes or the episode is ended for that waiter.
+
+| wait | condition | sleeps on |
+| --- | --- | --- |
+| reserved member | `gen` changed, the reservation ended, or the member was lent | its slot's `Parker` (unchanged: the leader wakes only the slots it changed) |
+| leader in `join` | `remaining == 0` | the pool's `sync` `Parker`, woken by the member that brings `remaining` to 0 |
+| participant in `barrier` | `epoch` changed, or the section was cancelled | the pool's `sync` `Parker`, woken by the last arrival and by `fail` |
+| unreserved `IDLE` member (after a scoped `Exec::team` ended) | claimed, released, `idle_spin` elapsed, **or the spin budget of polls spent** | returns to Rayon (whose idle worker sleeps after 33 rounds); a team released between calls no longer keeps its members polling for the whole `idle_spin` |
+| acquisition (`acquire`, `claim_cold`) | unchanged (`backoff`) | — |
+
+The `sync` parker is **one per pool** (in `Awake`), not one per section:
+- Sections are stack objects on the hot path. A `Parker` is touched once when it is built (some platforms allocate lazily), so building one per section would cost on every section.
+- A member may touch the parker after its final decrement of `remaining`. By then the leader may have returned and freed the section, but the pool outlives every member loop.
+
+Every leader on a pool shares the parker: two teams on one pool, and also the child leaders of one team's `split` and `fork`, which join at the same time. A wake wakes every sleeper, and each re-checks its own condition. That is correct, and it is not rare: a split of 64 participants into 32 pairs can have 32 child leaders asleep at once. It is kept simple until a measurement shows the broad wake costs something; the `nested` bench scenario (100 splits into pairs per call) is that measurement.
+
+Both new wake points follow the existing `Parker` protocol, which `loom` already models:
+1. change the state with SeqCst: the final `remaining` decrement, the epoch bump, the `cancelled` store;
+2. then call `Parker::wake`, one `fetch_add(0)` that is enough when nobody is parked.
+
+The last member of a section therefore pays one extra uncontended read-modify-write. It reads the pool's parker before its final decrement and never touches the section after it (the leader may free the section as soon as it sees zero); the pool outlives every member loop. The join and the barrier are small types in `src/park.rs` (`Completion`, `Barrier`) that the sections use and that `tests/loom_park.rs` checks as they are: the last of two members waking a sleeping leader, two consecutive barrier rounds, and a cancellation waking a sleeper. Each model fails (deadlock) when its wake is removed.
+
+### Budget
+
+- **A count, as in libgomp.** The budget is `PoolBuilder::spin_polls`, a number of polls (one PAUSE, or YIELD on aarch64, per poll). A waiter that is descheduled does not spend it while it waits for its CPU.
+- **Default: 300000 polls on x86-64**, libgomp's `GOMP_SPINCOUNT` ("about 3 ms"; about 7 ms at the 24 ns per poll measured on Zen 3). 2^21 on aarch64, not measured yet.
+  - 12288 polls (about 300 µs) made the first section after a 1 ms or 10 ms gap 2.3x and 10.8x slower than 0.1.3 on a quiet host (evo): the members had gone to sleep. 131072 closed the 1 ms gap; 300000 also closes the 10 ms gap (evo, `d430347` runs), and is accepted as the OpenMP default (criterion d).
+  - libomp keeps 200 ms (`KMP_BLOCKTIME`); 0.1.3 kept 200 ms of wall time for members and never slept in joins.
+- **No calibration.** Converting a time to polls at pool build was considered and dropped (pre-review): a calibration taken while the CPU is contended yields too few polls, and a bare PAUSE loop is not the real poll anyway. The count is approximate in time, as libgomp's is.
+- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed.
+
+### Scheduling pressure: none (libgomp's waits)
+
+Nothing detects preemption: every wait spins its budget, yields and sleeps, as libgomp's waits do. #14 tried several detectors on the Rayon base, and each traded one acceptance criterion for another (broccoli, threadteam-rs#14):
+
+| detection | quiet held teams | held teams under load | fresh pool |
+| --- | --- | --- | --- |
+| a pool-wide throttle on one preemption | 4x slower than 0.1.3 | — | fixed |
+| a pool-wide throttle on 4 preemptions within 100 ms (`c0c024b`) | within 10 % | 3.5-4x libgomp | fixed |
+| a per-thread 100 ms throttle (`2773c36`) | 1.2-1.8x slower | — | fixed |
+| none (`e76036c` variant) | within 10 % | about libgomp | collapsed (87.6 ms) |
+| detection during a 200 ms warm-up (`1f2145b`) | `held_pool` 2.2x | 3.3x libgomp | collapsed (11 ms) |
+
+The one configuration that met (b) and (c), no detection, failed only on the pool built per call. That pool's collapse comes from spawning fresh threads per call, not from waiting. With threadteam's own threads (`own-threads.md`) a pool reuses the reserve's running workers, so the waits stay libgomp's and the detection, the warm-up and their knobs are gone.
+
+### Start of a section: no arrival barrier
+
+A section starts when its members observe their `gen`. There is no barrier in which every participant first announces itself. libgomp's region start is a whole-team dock barrier, because a region always uses the whole team. threadteam sections can be narrower than the team (faer narrows regions to the width that pays), and waking or waiting for members a section does not use would make narrow sections pay for the whole team.
+
+A member that slept is woken by the leader's publish on its slot. That wake only makes it runnable; no arrival acknowledgement is needed for a section's correctness, because the reservation's acknowledgement at acquisition already put every member on its own thread, and the section's publication and completion protect its storage. The join at the end of the section is the only barrier. `Section::barrier` inside a share is unchanged in meaning and gains the sleep phase.
+
+### The spare worker (threadteam-rs#12): not in this change
+
+A pool of `w` workers gives a team of at most `w` participants: the leader counts as one, and `w - 1` workers are reserved, so one worker is a spare that only Rayon uses. Letting `into_team(width)` reach `w + 1` from an outside thread would reserve every worker. The pre-review found that this breaks `Exec::external` on a team token:
+- `external` lends the token's `budget - 1` members and installs the callback on a pool worker.
+- Today the spare is the worker that hosts it. Without a spare, the callback occupies one of the lent members, so a callback that waits for `width` Rayon jobs at once deadlocks, and a full-width token advertises `w + 1` threads to a pool of `w`.
+
+Removing the spare therefore needs a new contract for `external`'s width and lending, covering full-width and narrowed tokens. broccoli also showed that the spare is not what separates the slow arms (faer#107, 13:10Z): `team_per_call` runs the same 65 threads and is fast. The spare stays, and threadteam-rs#12 carries the `external` constraint.
+
+## Evaluation
+
+`benches/wait_scenarios.rs` (README, "Wait benchmarks"), run on the base and on the head of the change:
+- `sections`: many short sections per call (5-50 µs of work, 200 sections);
+- `gaps`: the wake latency after a gap of 0 / 100 µs / 1 ms / 10 ms between calls;
+- `acquire`: a pool held with a team per call, against a new pool per call;
+- `nested`: 100 splits into pairs per call (the shared parker under many child leaders);
+- width = CPUs against width < CPUs;
+- with and without a foreign-load generator: child processes that each burn a few % of a CPU;
+- the same work under libgomp (`benches/omp/wait_omp.c`, when `gcc -fopenmp` is available) and under a Rayon `scope`.
+
+The change is accepted when (criteria set by the monitor, 2026-10-30):
+- **(a)** the faer#107 slow mode is zero in every arm of `acquire_probe_107` (tensor4all/faer branch `probe/107-acquire-per-call-wait`);
+- **(b)** on quiet hosts (evo, an unloaded broccoli), `held_team`, `held_pool` and `gaps` (0-1 ms) are within 10 % of the base;
+- **(c)** under foreign load (`--load 8:10`), the same scenarios are no worse than libgomp's. The base is not the reference there: it keeps its spinners on CPUs that other processes need;
+- **(d)** the 10 ms gap is tuned with the spin budget; if 300000 polls closes it, that is accepted as the OpenMP default.
+
+The comparison is `scripts/bench-ab.sh` with `OMP=1`, which runs libgomp's counterpart (`acquire`/`held_team`: calls of 50 sections of 20 µs on the same hot team) in every round, with and without load.
+
+**First reading, primerose (not an acceptance run).** EPYC 7713P, 64 CPUs, saturated by other users (load average 61-63). Width 6 on `taskset -c 0-5`, 40 calls, threadteam only. Base = the bench commit on 0.1.3; head = this change. Median µs per call:
+
+| scenario | param | base | head | ideal |
+| --- | --- | --- | --- | --- |
+| sections | 5 µs × 200 | 775 725 | 14 497 | 1 000 |
+| sections | 20 µs × 200 | 978 060 | 21 991 | 4 000 |
+| sections | 50 µs × 200 | 1 462 996 | 39 042 | 10 000 |
+| gaps (first section) | 0 | 10 972 | 19 | 5 |
+| gaps (first section) | 1 ms | 10 895 | 47 | 5 |
+| gaps (first section) | 10 ms | 12 003 | 1 033 | 5 |
+| gaps (call) | 10 ms | 124 883 | 9 832 | 50 |
+| nested | pairs, 100 × 20 µs | 741 969 | 37 894 | 2 000 |
+| acquire | team held, token per call | 16 055 | 9 551 | 1 000 |
+| acquire | pool held, members per call | 245 584 | 2 501 | 1 000 |
+| acquire | new pool per call (call) | 393 990 | 61 622 | 1 000 |
+| acquire | new pool per call (build to drop) | 408 038 | 67 548 | 1 000 |
+
+Empty-section dispatch (`benches/team_dispatch.rs`, same host, median ns): width 2, 519 (base) against 530 (head); width 6, 767 against 862; the load average moved from 64 to 74 between the two runs, so this bounds a regression only coarsely.
+
+On a host whose CPUs are all busy, 0.1.3's spinning waiters stack and stay stacked, and calls take hundreds of times their work. The staged waits bring them within about 2-10x of the ideal, the cost of sharing CPUs with other users' processes. A quiet host and broccoli decide the acceptance; these numbers only show the mechanism.
diff --git a/scripts/bench-ab.sh b/scripts/bench-ab.sh
new file mode 100755
index 0000000..095f63e
--- /dev/null
+++ b/scripts/bench-ab.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Interleaved A/B of the wait benchmarks (docs/design/waiting.md): builds `benches/wait_scenarios.rs`
+# at two commits (the base is the bench commit a3a9320, which runs the bench on the 0.1.3 waits) and runs them alternately, so slow drifts of a shared host (other users' jobs)
+# fall on both sides. Rows go to $CSV (default docs/design/waiting-data/<host>-ab.csv), labelled
+# `<name>#<round>`; the `waits per call` lines go to $LOG.
+#
+#   scripts/bench-ab.sh <base-rev> <head-rev> <rounds> [bench args...]
+#
+# Example, the held-pool arms at width 64 (threadteam-rs#14, broccoli):
+#   taskset -c 0-63 scripts/bench-ab.sh a3a9320 feat/wait-openmp 20 \
+#     --scenario acquire --widths 64 --calls 40 --impl threadteam
+#
+# HEAD_VARIANTS adds head runs with extra arguments in every round, `;`-separated, each named by
+# its arguments, e.g. HEAD_VARIANTS='--spin-polls 300000;--own-hold-ms 100;--pressure-events 0'.
+# OMP=1 also runs the libgomp driver (benches/omp/wait_omp.c) in every round, with the same
+# --scenario (sections, gaps or acquire = libgomp's held team), --widths, --calls and --load.
+set -euo pipefail
+base=${1:?base rev}; head=${2:?head rev}; rounds=${3:?rounds}; shift 3
+host=$(hostname -s)
+csv=${CSV:-docs/design/waiting-data/$host-ab.csv}
+log=${LOG:-docs/design/waiting-data/$host-ab.log}
+mkdir -p "$(dirname "$csv")"
+work=$(mktemp -d)
+trap 'git worktree remove --force "$work/base" 2>/dev/null; git worktree remove --force "$work/head" 2>/dev/null; rm -rf "$work"' EXIT
+build() { # $1 = rev, $2 = dir name; prints the bench binary
+  git worktree add -q --detach "$work/$2" "$1"
+  (cd "$work/$2" && cargo build -j "${JOBS:-4}" --release --bench wait_scenarios >/dev/null 2>&1)
+  ls -t "$work/$2"/target/release/deps/wait_scenarios-* | grep -v '\.d$' | head -1
+}
+bin_base=$(build "$base" base)
+bin_head=$(build "$head" head)
+omp=""
+if [[ ${OMP:-0} == 1 ]]; then
+  gcc -O2 -fopenmp "$work/head/benches/omp/wait_omp.c" -o "$work/wait_omp"
+  omp="$work/wait_omp"
+fi
+arg() { # value of bench option $1 in "$@" after it, or $2
+  local name=$1 def=$2; shift 2
+  while [[ $# -gt 0 ]]; do [[ $1 == "$name" ]] && { echo "$2"; return; }; shift; done
+  echo "$def"
+}
+omp_scenario=$(arg --scenario all "$@"); omp_widths=$(arg --widths "$(nproc)" "$@")
+omp_calls=$(arg --calls 200 "$@"); omp_load=$(arg --load "" "$@")
+IFS=';' read -r -a variants <<<"${HEAD_VARIANTS:-}"
+echo "base $(git rev-parse --short "$base")  head $(git rev-parse --short "$head")  rounds $rounds  args $*" | tee -a "$log"
+for r in $(seq 1 "$rounds"); do
+  order=(base head); (( r % 2 == 0 )) && order=(head base)
+  for side in "${order[@]}"; do
+    if [[ $side == base ]]; then
+      "$bin_base" --label "base#$r" --csv "$csv" "$@" >>"$log"
+    else
+      "$bin_head" --label "head#$r" --csv "$csv" "$@" >>"$log"
+      if [[ -n $omp ]]; then
+        for w in ${omp_widths//,/ }; do
+          WAIT_OMP_SCENARIO=$omp_scenario WAIT_OMP_LOAD=$omp_load \
+            "$omp" "$w" "$omp_calls" "$csv" "libgomp#$r" >>"$log"
+        done
+      fi
+      for v in "${variants[@]}"; do
+        [[ -z $v ]] && continue
+        # shellcheck disable=SC2086
+        "$bin_head" --label "head[$v]#$r" --csv "$csv" "$@" $v >>"$log"
+      done
+    fi
+  done
+done
+echo "rows in $csv, waits in $log"
+python3 - "$csv" <<'PY'
+import collections, statistics, sys
+# `param` may hold commas (`work=5us,sections=200`), unquoted: the fields around it are fixed.
+cells = collections.defaultdict(list)
+for line in open(sys.argv[1]).read().splitlines()[1:]:
+    f = line.split(",")
+    host, label, cpus, load, scenario, impl, width = f[:7]
+    metric, median = f[-5], f[-4]
+    param = ",".join(f[7:-5])
+    name = label.split("#")[0]
+    if impl not in ("threadteam", "libgomp"):
+        name = f"{name} ({impl})"
+    cells[(scenario, width, param, metric, name)].append(float(median))
+print(f"{'scenario':<9} {'width':>5} {'param':<24} {'metric':<6} {'side':<40} {'n':>3} {'median of medians us':>21}")
+for k in sorted(cells):
+    v = cells[k]
+    print(f"{k[0]:<9} {k[1]:>5} {k[2]:<24} {k[3]:<6} {k[4]:<40} {len(v):>3} {statistics.median(v):>21.1f}")
+PY
diff --git a/scripts/bench-waits.sh b/scripts/bench-waits.sh
new file mode 100755
index 0000000..3abfe24
--- /dev/null
+++ b/scripts/bench-waits.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Runs the wait benchmarks (docs/design/waiting.md, README "Wait benchmarks") for one checkout:
+# the Rust bench (threadteam and Rayon) and, when `gcc -fopenmp` works, the libgomp driver, with
+# and without foreign load. Rows are appended to $CSV.
+#
+#   scripts/bench-waits.sh <label> [widths] [load K:P]
+#
+# label   the version or commit under test, written to every row (e.g. `main-4c73c2b`)
+# widths  comma separated (default: all CPUs of the affinity set and three quarters of them)
+# load    foreign load for the second pass (default 8:10, eight processes at 10 % each);
+#         `none` skips the loaded pass
+# CSV     output file (default docs/design/waiting-data/<host>.csv)
+set -euo pipefail
+label=${1:?label}
+widths=${2:-}
+load=${3:-8:10}
+host=$(hostname -s)
+csv=${CSV:-docs/design/waiting-data/$host.csv}
+mkdir -p "$(dirname "$csv")"
+cargo build -j "${JOBS:-4}" --release --bench wait_scenarios >/dev/null
+bench=$(ls -t target/release/deps/wait_scenarios-* | grep -v '\.d$' | head -1)
+wargs=()
+[[ -n $widths ]] && wargs=(--widths "$widths")
+
+omp=""
+if echo 'int main(void){return 0;}' | gcc -fopenmp -x c - -o /dev/null 2>/dev/null; then
+  gcc -O2 -fopenmp benches/omp/wait_omp.c -o target/wait_omp
+  omp=target/wait_omp
+else
+  echo "gcc -fopenmp not available: libgomp reference skipped" >&2
+fi
+cpus=$(nproc)
+ws=${widths:-$cpus,$((cpus * 3 / 4))}
+
+run_pass() { # $1 = load spec or none
+  local largs=()
+  [[ $1 != none ]] && largs=(--load "$1")
+  "$bench" --label "$label" --csv "$csv" "${wargs[@]}" "${largs[@]}"
+  if [[ -n $omp ]]; then
+    local pids=()
+    if [[ $1 != none ]]; then
+      for _ in $(seq "${1%%:*}"); do "$bench" --load-child "${1##*:}" & pids+=($!); done
+      sleep 0.2
+    fi
+    for w in ${ws//,/ }; do WAIT_BENCH_LOAD=$([[ $1 == none ]] && echo none || echo "${1%%:*}x${1##*:}%") \
+      "$omp" "$w" 200 "$csv" "$label"; done
+    [[ ${#pids[@]} -gt 0 ]] && kill "${pids[@]}" 2>/dev/null; wait 2>/dev/null || true
+  fi
+}
+run_pass none
+[[ $load != none ]] && run_pass "$load"
+echo "rows appended to $csv"
diff --git a/src/awake.rs b/src/awake.rs
index b6f2faf..1e626b5 100644
--- a/src/awake.rs
+++ b/src/awake.rs
@@ -1,21 +1,17 @@
-//! Reserved awake members: per-member dispatch slots, sections, acquisition.
+//! The workers of a pool: their slots, the native loop, sections, acquisition.
 //!
-//! A *member* is a worker of the pool that runs a long-lived loop as one
-//! Rayon job. While the loop runs, the worker serves no other Rayon job.
-//! Each worker index owns one cache-line padded [`Slot`]:
+//! Every leased worker runs [`serve`] for its slot until the pool detaches it
+//! (`docs/design/own-threads.md`). A slot's state word ([`crate::park::SlotState`])
+//! has the bits `RESERVED`, `LENT`, `BUSY`, `DETACH`:
 //!
-//! ```text
-//! ABSENT --claim job--> RESERVED <--claim (CAS)-- IDLE
-//!    ^                     |  release (store)      ^ |
-//!    +---- idle timeout ---+-----------------------+ +-- YIELD (inside a Rayon job)
-//! ```
-//!
-//! * `ABSENT`: no loop on this worker.
-//! * `RESERVED`: owned by one leader; the member spins on `gen` and runs the
-//!   section the leader published. It neither runs Rayon jobs nor leaves.
-//! * `IDLE`: loop alive but unreserved; spins for the policy's idle time, then
-//!   leaves (`ABSENT`). Claimable by a compare-and-swap, with no waiting.
-//! * `YIELD`: an idle member inside `rayon::yield_now`; not claimable.
+//! * `0`: free. The worker serves the pool's broadcast shares and queued tasks
+//!   (winning `BUSY` before it takes one) and otherwise waits (spin, yield,
+//!   park). A team claims it by a compare-and-swap from `0`.
+//! * `RESERVED`: a team member. It waits for `gen` (spin, yield, park) and runs
+//!   the sections its leader publishes; it serves nothing else.
+//! * `RESERVED|LENT`: a member lent to the pool's queue (`Exec::external`).
+//! * `BUSY`: running a task or a share; not claimable.
+//! * `DETACH`: the pool is being dropped; the worker acknowledges and leaves.
 //!
 //! A leader publishes a [`Section`] (a stack object) by writing its address
 //! and an argument into the member's slot and bumping `gen`; the member runs
@@ -27,11 +23,12 @@
 //! futex round per section that grew with the number of unused members).
 //!
 //! No thread-local state is used: a member's identity is its slot index.
+#![cfg_attr(not(feature = "parallel"), allow(dead_code))]
 
 use crate::error::Refused;
 use crate::park::Parker;
 use crate::policy::WaitPolicy;
-use core::sync::atomic::{AtomicBool, AtomicPtr, AtomicU64, AtomicUsize, Ordering};
+use core::sync::atomic::{AtomicBool, AtomicPtr, AtomicU32, AtomicU64, AtomicUsize, Ordering};
 use std::any::Any;
 use std::time::Duration;
 
@@ -44,23 +41,17 @@ macro_rules! trace {
     };
 }
 
-const ABSENT: usize = 0;
-const IDLE: usize = 1;
-#[cfg_attr(not(feature = "parallel"), allow(dead_code))]
-const YIELD: usize = 2;
-const RESERVED: usize = 3;
-
-/// Alignment that keeps a hot atomic on its own cache line pair (128 bytes
-/// covers Apple Silicon and adjacent-line prefetch on x86).
-#[repr(align(128))]
-pub(crate) struct Padded<T>(pub(crate) T);
+#[cfg(feature = "parallel")]
+use crate::park::{BUSY, DETACH};
+use crate::park::{LENT, RESERVED};
 
 /// Pure spin for a while, then yield the CPU between polls.
 ///
 /// Used where progress needs cooperation with other threads on the same CPUs:
 /// `acquire`, the cold claim, and the loops that are not reserved dispatch
-/// polls (`IDLE`, and the states a loop is leaving). Reserved members and a
-/// leader waiting on a section poll with [`spin_wait`] instead.
+/// polls (`IDLE`, and the states a loop is leaving). Reserved members, and a
+/// leader or participant waiting on a section, wait in staged episodes instead
+/// ([`crate::park::Waiter`]).
 #[inline]
 #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
 pub(crate) fn backoff(spins: &mut u32) {
@@ -72,89 +63,97 @@ pub(crate) fn backoff(spins: &mut u32) {
     }
 }
 
-/// One PAUSE per poll (YIELD on aarch64), never a yield.
-///
-/// The wait of a reserved member polling `gen`, and of a leader in
-/// `Section::join` / `Section::barrier`, in a scope that is not oversubscribed:
-/// a thread that only spins with PAUSE stays runnable but does not repeatedly
-/// re-enter the scheduler, so a stacked pair can be separated and a share does
-/// not pay for a `sched_yield` on every poll. A parked member is woken by the
-/// leader through [`Parker`].
-#[inline]
-pub(crate) fn spin_wait() {
-    std::hint::spin_loop();
-}
-
-/// How many polls a joined section spins before it yields, in an oversubscribed
-/// scope (more participants than CPUs in the caller's set).
-const OVERSUBSCRIBED_SPINS: u32 = 100;
-
-/// One poll of a leader waiting on a section.
-///
-/// Not oversubscribed: [`spin_wait`]. Oversubscribed: about
-/// [`OVERSUBSCRIBED_SPINS`] PAUSE spins, then one `yield_now` per poll, so the
-/// waiting participants do not hold every CPU while their peers are queued
-/// behind them (the shape libomp takes when it detects oversubscription).
-#[inline]
-fn wait_poll(over: bool, polls: &mut u32) {
-    if !over {
-        spin_wait();
-        return;
-    }
-    if *polls >= OVERSUBSCRIBED_SPINS {
-        std::thread::yield_now();
-    } else {
-        *polls += 1;
-        std::hint::spin_loop();
-    }
-}
-
-/// One member's dispatch slot.
+/// One worker's slot: its state word, its team-member dispatch state, and
+/// where it sleeps.
 #[repr(align(128))]
-struct Slot {
-    state: AtomicUsize,
+pub(crate) struct Slot {
+    /// `RESERVED`/`LENT`/`BUSY`/`DETACH` (see [`crate::park::SlotState`]).
+    pub(crate) state: crate::park::SlotState,
     /// Bumped by the current leader per published section.
     gen: AtomicUsize,
     ptr: AtomicPtr<Section>,
     arg: AtomicUsize,
-    /// Idle policy written by the releasing leader before `IDLE` is stored.
+    /// Idle policy written by the releasing leader before the slot is freed.
     idle_spin_ns: AtomicU64,
-    idle_yield: AtomicBool,
-    /// How long a reserved member spins without work before it parks.
-    park_ns: AtomicU64,
-    /// Set by the leader while the member's thread is lent to Rayon
-    /// (`Exec::external` on a team token).
-    lent: AtomicBool,
-    /// The mask this member saved before pinning itself; only the member thread
-    /// of this slot touches it (see [`crate::pin::SavedMask`]).
+    /// Spin budget, in polls, of this reserved member's waits for work (see
+    /// `docs/design/waiting.md`); written by the leader at root-scope entry.
+    spin_budget: AtomicU32,
+    /// The mask this member saved before pinning itself; only the worker
+    /// thread of this slot touches it (see [`crate::pin::SavedMask`]).
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
-    saved: crate::pin::SavedMask,
-    /// Where this member sleeps once its park delay has passed; woken by the
-    /// leader after it changed `gen`, `state` or `lent` of this slot.
-    park: Parker,
+    pub(crate) saved: crate::pin::SavedMask,
+    /// Where this worker sleeps: idle, as a member between sections, or while
+    /// it waits for a batch (`help_while`). An `Arc`, so that a completion can
+    /// keep it alive across its final decrement.
+    pub(crate) park: std::sync::Arc<Parker>,
+    /// The worker thread leased to this slot (set when it attaches).
+    pub(crate) thread: std::sync::OnceLock<std::thread::ThreadId>,
+    /// The worker's broadcast cursor (only the worker touches it).
+    bseq: AtomicU64,
+    /// Set while the worker waits for a batch and serves its pool meanwhile.
+    pub(crate) helping: AtomicBool,
+    /// Broadcast shares on this worker's stack (only the worker touches it).
+    /// While one runs, the worker takes no other share: a later broadcast run
+    /// above an unfinished one could wait at its barrier for a worker that
+    /// waits at the earlier one's.
+    in_bcast: AtomicUsize,
+    /// A released member that has not gone to sleep since (it still spins,
+    /// claimable without a wake): what `Pool::resident_members` counts besides
+    /// reserved members.
+    lingering: AtomicBool,
+    /// The worker attached to its lease / acknowledged its detach.
+    pub(crate) attached: AtomicBool,
+    pub(crate) acked: AtomicBool,
 }
 
 impl Slot {
     fn new() -> Self {
         Slot {
-            state: AtomicUsize::new(ABSENT),
+            state: crate::park::SlotState::new(),
             gen: AtomicUsize::new(0),
             ptr: AtomicPtr::new(core::ptr::null_mut()),
             arg: AtomicUsize::new(0),
-            idle_spin_ns: AtomicU64::new(0),
-            idle_yield: AtomicBool::new(false),
-            park_ns: AtomicU64::new(u64::MAX),
-            lent: AtomicBool::new(false),
+            idle_spin_ns: AtomicU64::new(u64::MAX),
+            spin_budget: AtomicU32::new(crate::park::THROTTLED_POLLS),
             saved: crate::pin::SavedMask::new(),
-            park: Parker::new(),
+            park: std::sync::Arc::new(Parker::new()),
+            thread: std::sync::OnceLock::new(),
+            bseq: AtomicU64::new(0),
+            helping: AtomicBool::new(false),
+            in_bcast: AtomicUsize::new(0),
+            lingering: AtomicBool::new(false),
+            attached: AtomicBool::new(false),
+            acked: AtomicBool::new(false),
         }
     }
 }
 
+/// The waiting state of one pool (`docs/design/waiting.md`).
+pub(crate) struct Waits {
+    /// Where leaders sleep in `join` and participants in `barrier`. One per
+    /// pool: a member may wake it after its last decrement, when the section
+    /// may already be gone, and the pool outlives every member loop. Also
+    /// where a plain outside thread waits for a batch of this pool.
+    pub(crate) sync: std::sync::Arc<Parker>,
+    /// Spin budget of a wait, in polls (`PoolBuilder::spin_polls`).
+    pub(crate) spin_polls: u32,
+    /// Diagnostics (`Pool::wait_counters`): sleeps of leaders in joins, of
+    /// participants in barriers, and parks of members waiting for work.
+    pub(crate) join_sleeps: AtomicU64,
+    pub(crate) barrier_sleeps: AtomicU64,
+    pub(crate) member_parks: AtomicU64,
+}
+
 /// Shared state of the awake members of one pool.
 pub(crate) struct Awake {
-    slots: Box<[Slot]>,
-    pub(crate) shutdown: AtomicBool,
+    pub(crate) slots: Box<[Slot]>,
+    /// The pool's queue of task batches (plain `fork`, `for_ranges`, `external`).
+    pub(crate) queue: crate::park::Queue,
+    /// The pool's broadcasts.
+    pub(crate) bcast: crate::park::BroadcastList,
+    /// What the joins and barriers of this pool's sections sleep on, and the
+    /// pool's spin budget (`docs/design/waiting.md`).
+    pub(crate) waits: Waits,
     /// Bumped by `Pool::release_idle`; members that started earlier leave when idle.
     pub(crate) release_epoch: AtomicUsize,
     pub(crate) defaults: WaitPolicy,
@@ -174,10 +173,19 @@ impl Awake {
         acquire_timeout: Duration,
         costs: crate::cost::DispatchCosts,
         pin: bool,
+        spin_polls: u32,
     ) -> Self {
         Awake {
             slots: (0..width).map(|_| Slot::new()).collect(),
-            shutdown: AtomicBool::new(false),
+            queue: crate::park::Queue::new(),
+            bcast: crate::park::BroadcastList::new(),
+            waits: Waits {
+                sync: std::sync::Arc::new(Parker::new()),
+                spin_polls,
+                join_sleeps: AtomicU64::new(0),
+                barrier_sleeps: AtomicU64::new(0),
+                member_parks: AtomicU64::new(0),
+            },
             release_epoch: AtomicUsize::new(0),
             defaults,
             costs,
@@ -188,36 +196,51 @@ impl Awake {
         }
     }
 
-    /// Workers currently running a member loop, reserved or idle.
+    /// Members kept awake for teams: reserved ones, and released ones that
+    /// have not gone to sleep since.
     pub(crate) fn resident(&self) -> usize {
         self.slots
             .iter()
-            .filter(|s| s.state.load(Ordering::Acquire) != ABSENT)
+            .filter(|s| s.state.load() & RESERVED != 0 || s.lingering.load(Ordering::Acquire))
             .count()
     }
 
-    /// Hands members back: they become idle under `policy`.
+    /// Hands members back: they become free under `policy`.
     pub(crate) fn release(&self, ids: &[usize], policy: WaitPolicy) {
         let ns = u64::try_from(policy.idle_spin().as_nanos()).unwrap_or(u64::MAX);
         for &id in ids {
             let s = &self.slots[id];
             s.idle_spin_ns.store(ns, Ordering::Relaxed);
-            s.idle_yield
-                .store(policy.idle_runs_rayon(), Ordering::Relaxed);
-            s.state.store(IDLE, Ordering::SeqCst);
+            s.lingering.store(true, Ordering::Release);
+            s.state.release();
             s.park.wake();
         }
     }
 
-    /// Sets the park delay of the given reserved members, in nanoseconds.
+    /// Spin budget, in polls, of a wait in a root scope: the pool's budget, or
+    /// the throttled one when the scope is oversubscribed.
+    pub(crate) fn spin_budget(&self, over: bool) -> u32 {
+        if over {
+            crate::park::THROTTLED_POLLS.min(self.waits.spin_polls)
+        } else {
+            self.waits.spin_polls
+        }
+    }
+
+    /// The spin budget a member slot currently has (tests).
+    #[cfg(all(test, feature = "parallel", target_os = "linux"))]
+    pub(crate) fn slot_spin_budget(&self, id: usize) -> u32 {
+        self.slots[id].spin_budget.load(Ordering::Relaxed)
+    }
+
+    /// Sets the spin budget of the given reserved members' waits for work.
     ///
-    /// A root team scope writes it once at entry: zero (park after the short
-    /// spin) when the scope is oversubscribed, the effective `idle_spin`
-    /// otherwise. Nothing else changes it, so a member keeps the value of the
+    /// A root team scope writes it once at entry ([`Self::spin_budget`] of
+    /// whether it is oversubscribed). Nothing else changes it, so a member keeps the value of the
     /// scope it was reserved for.
-    pub(crate) fn set_park_ns(&self, ids: &[usize], ns: u64) {
+    pub(crate) fn set_spin_budget(&self, ids: &[usize], polls: u32) {
         for &id in ids {
-            self.slots[id].park_ns.store(ns, Ordering::Relaxed);
+            self.slots[id].spin_budget.store(polls, Ordering::Relaxed);
         }
     }
 
@@ -270,71 +293,89 @@ impl Awake {
         trace!(self, None, Publish);
     }
 
-    /// Lends (or takes back) the members' threads to Rayon: while lent, a
-    /// reserved member runs the pool's jobs instead of idling.
+    /// Lends (or takes back) the members' threads to the pool's queue: while
+    /// lent, a reserved member runs the pool's tasks instead of idling. Taking
+    /// it back lets a task it is running finish; the member serves its team
+    /// again after that.
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
     pub(crate) fn lend(&self, ids: &[usize], on: bool) {
         for &id in ids {
             let s = &self.slots[id];
-            s.lent.store(on, Ordering::SeqCst);
-            if on {
+            s.state.set_lent(on);
+            s.park.wake();
+        }
+    }
+
+    /// Wakes the workers that can take work of the queue or a broadcast: free
+    /// ones, lent members and workers helping while they wait.
+    pub(crate) fn wake_for_work(&self) {
+        for s in &*self.slots {
+            let st = s.state.load();
+            if st == 0 || st == RESERVED | LENT || s.helping.load(Ordering::SeqCst) {
                 s.park.wake();
             }
         }
     }
 
-    /// Reserves `need` members, or refuses without waiting for a Rayon job.
-    ///
-    /// Idle resident members are claimed with a compare-and-swap. Missing ones
-    /// are requested with claim jobs; the leader waits at most the pool's
-    /// acquisition timeout for *idle workers to wake up*, never for a worker
-    /// that is busy: when the members are not all there by then the claim is
-    /// closed, every tentative member is released and `Unavailable` returned.
+    /// The slot of the calling thread in this pool, if it is one of its
+    /// workers (a scan of the slots: entry points only).
+    pub(crate) fn slot_of_current(&self) -> Option<usize> {
+        let me = std::thread::current().id();
+        self.slots.iter().position(|s| s.thread.get() == Some(&me))
+    }
+
+    /// Reserves `need` free workers by compare-and-swap, waiting at most the
+    /// pool's acquisition timeout for busy ones to become free; on a shortfall
+    /// every tentative member is released and `Unavailable` returned. A worker
+    /// that runs a task is not free, so a reservation never shares a thread
+    /// with a running task.
     pub(crate) fn acquire(
         self: &std::sync::Arc<Self>,
-        pool: &crate::pool::Pool,
         need: usize,
         policy: WaitPolicy,
-        park_spin: Duration,
+        spin_budget: u32,
     ) -> Result<Reservation, Refused> {
         let mut ids = Vec::with_capacity(need);
-        // Idle members are claimed with a compare-and-swap. A member that is
-        // inside `yield_now` is not claimable at that instant, but it is only
-        // polling unless it found a job; retry for at most the timeout while
-        // such members exist, instead of treating them as busy at once.
+        let me = self.slot_of_current();
         let started = std::time::Instant::now();
+        let mut spins = 0u32;
         loop {
-            let mut yielding = false;
-            for (i, s) in self.slots.iter().enumerate() {
+            // Members of an earlier team that are still awake first (warm,
+            // claimable without a wake-up), then any other free worker.
+            let order = self
+                .slots
+                .iter()
+                .enumerate()
+                .filter(|(_, s)| s.lingering.load(Ordering::Acquire))
+                .chain(
+                    self.slots
+                        .iter()
+                        .enumerate()
+                        .filter(|(_, s)| !s.lingering.load(Ordering::Acquire)),
+                );
+            for (i, s) in order {
                 if ids.len() == need {
                     break;
                 }
-                match s
-                    .state
-                    .compare_exchange(IDLE, RESERVED, Ordering::AcqRel, Ordering::Relaxed)
+                if Some(i) != me
+                    && !ids.contains(&i)
+                    && s.attached.load(Ordering::Acquire)
+                    && s.state.try_reserve()
                 {
-                    Ok(_) => ids.push(i),
-                    Err(YIELD) => yielding = true,
-                    Err(_) => {}
+                    s.lingering.store(false, Ordering::Release);
+                    ids.push(i);
                 }
             }
-            if ids.len() == need || !yielding || started.elapsed() >= self.acquire_timeout {
+            if ids.len() == need || started.elapsed() >= self.acquire_timeout {
                 break;
             }
-            std::hint::spin_loop();
-        }
-        let missing = need - ids.len();
-        if missing > 0 {
-            self.claim_cold(pool, missing, &mut ids);
-            if ids.len() < need {
-                self.release(&ids, policy);
-                return Err(Refused::Unavailable);
-            }
+            backoff(&mut spins);
         }
-        let ns = u64::try_from(park_spin.as_nanos()).unwrap_or(u64::MAX);
-        for &id in &ids {
-            self.slots[id].park_ns.store(ns, Ordering::Relaxed);
+        if ids.len() < need {
+            self.release(&ids, policy);
+            return Err(Refused::Unavailable);
         }
+        self.set_spin_budget(&ids, spin_budget);
         Ok(Reservation {
             awake: std::sync::Arc::clone(self),
             ids,
@@ -342,46 +383,81 @@ impl Awake {
         })
     }
 
+    /// Runs one broadcast share or one queued task on worker `id`, if there is
+    /// one; the caller holds the right to run work (it won `BUSY`, or it is a
+    /// worker waiting for a batch). `true` when something ran.
     #[cfg(feature = "parallel")]
-    fn claim_cold(
-        self: &std::sync::Arc<Self>,
-        pool: &crate::pool::Pool,
-        missing: usize,
-        ids: &mut Vec<usize>,
-    ) {
-        use std::sync::Arc;
-        use std::time::Instant;
-        let acq = Arc::new(Acq::new(missing));
-        for _ in 0..missing {
-            let (aw, a) = (Arc::clone(self), Arc::clone(&acq));
-            pool.inner.spawn(move || claim_job(&aw, &a));
-        }
-        let deadline = Instant::now() + self.acquire_timeout;
-        let mut spins = 0;
-        while acq.joined() < missing && Instant::now() < deadline {
-            backoff(&mut spins);
-        }
-        let n = acq.close();
-        for pos in 0..n {
-            let mut spins = 0;
-            loop {
-                let id = acq.ids[pos].load(Ordering::Acquire);
-                if id != usize::MAX {
-                    ids.push(id);
-                    break;
-                }
-                backoff(&mut spins);
+    pub(crate) fn run_one(&self, id: usize) -> bool {
+        let slot = &self.slots[id];
+        let mut seq = slot.bseq.load(Ordering::Relaxed);
+        if slot.in_bcast.load(Ordering::Relaxed) == 0 && self.bcast.has_after(seq) {
+            let next = self.bcast.next_for(id, &mut seq);
+            slot.bseq.store(seq, Ordering::Relaxed);
+            if let Some(b) = next {
+                slot.in_bcast.fetch_add(1, Ordering::Relaxed);
+                // SAFETY: a linked broadcast that targets `id`; its caller
+                // keeps it alive until this share completed. `run_share`
+                // catches a panic of the share.
+                unsafe { crate::park::Broadcast::run_share(b, id) };
+                slot.in_bcast.fetch_sub(1, Ordering::Relaxed);
+                return true;
             }
         }
+        if let Some((b, i)) = self.queue.claim() {
+            // SAFETY: index `i` of `b` was claimed here.
+            unsafe { crate::park::Batch::run_claimed(b, i) };
+            return true;
+        }
+        false
     }
 
-    #[cfg(not(feature = "parallel"))]
-    fn claim_cold(
-        self: &std::sync::Arc<Self>,
-        _pool: &crate::pool::Pool,
-        _missing: usize,
-        _ids: &mut Vec<usize>,
-    ) {
+    /// Whether worker `id` has work it could run now (a hint).
+    #[cfg(feature = "parallel")]
+    fn work_for(&self, id: usize) -> bool {
+        let slot = &self.slots[id];
+        self.queue.has_work()
+            || (slot.in_bcast.load(Ordering::Relaxed) == 0
+                && self.bcast.has_after(slot.bseq.load(Ordering::Relaxed)))
+    }
+
+    /// A free worker or a lent member takes one piece of work: it wins `BUSY`
+    /// first, so a team cannot reserve it meanwhile, then runs it.
+    #[cfg(feature = "parallel")]
+    fn try_work(&self, id: usize) -> bool {
+        if !self.work_for(id) {
+            return false;
+        }
+        let slot = &self.slots[id];
+        if !slot.state.try_take() {
+            return false;
+        }
+        let ran = self.run_one(id);
+        slot.state.end_busy();
+        ran
+    }
+
+    /// Waits until `done` reports completion. A worker of this pool (`me`)
+    /// serves this pool's queue and broadcasts meanwhile, so nested and
+    /// cross-pool waits always make progress; it sleeps on its own parker,
+    /// which the batch's completion and new work of this pool wake.
+    #[cfg(feature = "parallel")]
+    pub(crate) fn help_while(&self, me: usize, done: impl Fn() -> bool) {
+        let slot = &self.slots[me];
+        // Waits nest (a task run while helping waits in turn): the outer wait
+        // stays wakeable after the inner one returns.
+        let outer = slot.helping.swap(true, Ordering::SeqCst);
+        let mut waiter = crate::park::Waiter::new(self.waits.spin_polls);
+        while !done() {
+            if self.run_one(me) {
+                waiter = crate::park::Waiter::new(self.waits.spin_polls);
+                continue;
+            }
+            if waiter.step() == crate::park::Step::Sleep {
+                slot.park.park_while(|| !done() && !self.work_for(me));
+                waiter = crate::park::Waiter::new(self.waits.spin_polls);
+            }
+        }
+        slot.helping.store(outer, Ordering::SeqCst);
     }
 }
 
@@ -400,238 +476,137 @@ impl Drop for Reservation {
     }
 }
 
-/// One acquisition: how many claim jobs found a worker, and which.
-#[cfg(feature = "parallel")]
-struct Acq {
-    joined: AtomicUsize,
-    ids: Vec<AtomicUsize>,
-}
-
-#[cfg(feature = "parallel")]
-impl Acq {
-    const CLOSED: usize = 1 << (usize::BITS - 1);
-
-    fn new(capacity: usize) -> Self {
-        Acq {
-            joined: AtomicUsize::new(0),
-            ids: (0..capacity)
-                .map(|_| AtomicUsize::new(usize::MAX))
-                .collect(),
-        }
-    }
-
-    fn joined(&self) -> usize {
-        self.joined.load(Ordering::Acquire) & !Self::CLOSED
-    }
-
-    /// A claim job asks for a position; `None` when closed or full.
-    fn join(&self) -> Option<usize> {
-        let mut cur = self.joined.load(Ordering::Acquire);
-        loop {
-            if cur & Self::CLOSED != 0 || cur >= self.ids.len() {
-                return None;
-            }
-            match self.joined.compare_exchange_weak(
-                cur,
-                cur + 1,
-                Ordering::AcqRel,
-                Ordering::Acquire,
-            ) {
-                Ok(_) => return Some(cur),
-                Err(now) => cur = now,
-            }
-        }
-    }
-
-    /// Closes the claim; later jobs do nothing. Returns the joined count.
-    fn close(&self) -> usize {
-        self.joined.fetch_or(Self::CLOSED, Ordering::AcqRel) & !Self::CLOSED
-    }
-}
-
-/// Runs on a pool worker: becomes a member for the acquisition, or does nothing.
-#[cfg(feature = "parallel")]
-fn claim_job(aw: &std::sync::Arc<Awake>, acq: &std::sync::Arc<Acq>) {
-    let Some(w) = rayon::current_thread_index() else {
-        return;
-    };
-    let Some(slot) = aw.slots.get(w) else {
-        return;
-    };
-    if slot
-        .state
-        .compare_exchange(ABSENT, RESERVED, Ordering::AcqRel, Ordering::Relaxed)
-        .is_err()
-    {
-        // Stolen by a resident member that is serving Rayon (idle_runs_rayon):
-        // its thread cannot host a second loop. Hand the job back to the pool
-        // unless the acquisition is already over.
-        if acq.joined.load(Ordering::Acquire) & Acq::CLOSED == 0 {
-            let (aw, acq) = (std::sync::Arc::clone(aw), std::sync::Arc::clone(acq));
-            rayon::spawn(move || claim_job(&aw, &acq));
-        }
-        return;
-    }
-    let seen = slot.gen.load(Ordering::Acquire);
-    let epoch = aw.release_epoch.load(Ordering::Relaxed);
-    match acq.join() {
-        Some(pos) => {
-            acq.ids[pos].store(w, Ordering::Release);
-            member_loop(aw, w, seen, epoch);
-        }
-        None => slot.state.store(ABSENT, Ordering::Release),
-    }
-}
-
-/// The member loop. Returns when the idle policy, `release_idle` or shutdown
-/// returns the thread to Rayon.
+/// The native loop of worker `id` of a pool, from its attachment until the
+/// pool detaches it (`DETACH`, while it is not busy). See
+/// `docs/design/own-threads.md` and `docs/design/waiting.md`.
+///
+/// * Reserved (and not lent): a team member. It waits for its slot's `gen`
+///   in staged episodes (spin for the slot's budget, yield, park) and runs the
+///   sections its leader publishes; it serves nothing else.
+/// * Free, or a lent member: it takes broadcast shares and queued tasks,
+///   winning `BUSY` before it removes anything, and otherwise waits in a staged
+///   episode (the policy's idle spin) and parks until work, a reservation or a
+///   detach arrives.
 ///
-/// Idle clock of a reserved member: `last_work` is the instant at which this
-/// member first found nothing to do after its last share (or after it started,
-/// or was taken back from Rayon). It belongs to the member alone, a share of
-/// another member does not move it, and it is read only while polling. When it
-/// is older than the member's park delay the member parks and stays reserved;
-/// a member whose team runs no section therefore costs CPU for the park delay
-/// at most, then nothing. The delay is zero in an oversubscribed root scope, so
-/// `polls` and `spins` are reset at the start of each idle episode there: the
-/// member then spins one short episode of `polls` and parks.
+/// A member restores its own affinity mask when it stops being reserved, and
+/// before it serves foreign work as a lent member.
 #[cfg(feature = "parallel")]
-fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
-    use std::time::Instant;
+pub(crate) fn serve(aw: &Awake, id: usize) {
+    use crate::park::{Step, Waiter};
     let slot = &aw.slots[id];
-    let mut idle_since: Option<Instant> = None;
-    let mut last_work: Option<Instant> = None;
+    let mut seen = slot.gen.load(Ordering::Acquire);
+    // Claimable only from now on: a leader that reserves this slot publishes
+    // its first section after the baseline above.
+    slot.attached.store(true, Ordering::SeqCst);
+    let mut waiter: Option<Waiter> = None;
     let mut was_lent = false;
-    let mut reserved = true;
-    let mut spins = 0u32;
-    let mut polls = 0u32;
+    let mut reserved = false;
+    let mut epoch = aw.release_epoch.load(Ordering::Relaxed);
+    // Whether the last iteration served as a member; a wait episode does not
+    // carry over between the member's and the free worker's waits.
+    let mut as_member = false;
     trace!(aw, Some(id), Enter);
     loop {
-        let state = slot.state.load(Ordering::Acquire);
-        // Pinning ends with the reservation, and it ends on this thread: a
-        // member restores its own mask before it leaves `RESERVED` and before
-        // it serves Rayon work (a lend restores it below).
-        if state == RESERVED {
+        let st = slot.state.load();
+        // Pinning ends with the reservation, and it ends on this thread.
+        if st & RESERVED != 0 {
             reserved = true;
         } else if reserved {
             reserved = false;
             slot.saved.restore();
         }
-        match state {
-            RESERVED if slot.lent.load(Ordering::Acquire) => {
-                if !was_lent {
-                    was_lent = true;
-                    // The thread serves the pool's jobs now: undo our pin first.
-                    slot.saved.restore();
-                    trace!(aw, Some(id), LentBegin);
-                }
-                idle_since = None;
-                last_work = None;
-                // Serve the pool's jobs; resume team service when taken back.
-                if !matches!(rayon::yield_now(), Some(rayon::Yield::Executed)) {
-                    for _ in 0..32 {
-                        std::hint::spin_loop();
-                    }
-                }
+        if st & DETACH != 0 && st & BUSY == 0 {
+            trace!(aw, Some(id), Leave);
+            return;
+        }
+        if st & RESERVED != 0 && st & LENT == 0 {
+            if !as_member {
+                as_member = true;
+                waiter = None;
             }
-            RESERVED => {
-                if was_lent {
-                    was_lent = false;
-                    trace!(aw, Some(id), LentEnd);
-                }
-                idle_since = None;
-                let g = slot.gen.load(Ordering::Acquire);
-                if g == seen {
-                    let fresh = last_work.is_none();
-                    let since = *last_work.get_or_insert_with(Instant::now);
-                    if fresh {
-                        // A new idle episode: the park check counts from here.
-                        spins = 0;
-                        polls = 0;
-                    }
-                    spin_wait();
-                    polls = polls.wrapping_add(1);
-                    if polls & 0x3F == 0 {
-                        let park_ns = slot.park_ns.load(Ordering::Relaxed);
-                        if since.elapsed().as_nanos() >= u128::from(park_ns) {
-                            trace!(aw, Some(id), ParkEnter);
-                            park_member(slot, seen);
-                            trace!(aw, Some(id), ParkExit);
-                            last_work = None;
-                            spins = 0;
-                            polls = 0;
-                        }
-                    }
-                } else {
-                    seen = g;
-                    spins = 0;
-                    polls = 0;
-                    last_work = None;
-                    let ptr = slot.ptr.load(Ordering::Relaxed);
-                    let arg = slot.arg.load(Ordering::Relaxed);
-                    // SAFETY: the leader keeps the section alive until its
-                    // completion counter reaches zero, which happens only
-                    // after the call below decremented it.
-                    if unsafe { (*ptr).pin } {
-                        // A pin section: this member saves its previous mask
-                        // here, before it pins itself in its share.
-                        slot.saved.save_if_unpinned();
-                    }
-                    trace!(aw, Some(id), SectionBegin);
-                    // SAFETY: as above.
-                    unsafe { Section::execute_member(ptr, arg) };
-                    trace!(aw, Some(id), SectionEnd);
-                }
+            if was_lent {
+                was_lent = false;
+                waiter = None;
+                trace!(aw, Some(id), LentEnd);
             }
-            IDLE => {
-                let since = *idle_since.get_or_insert_with(Instant::now);
-                let spin_ns = slot.idle_spin_ns.load(Ordering::Relaxed);
-                let leave = aw.shutdown.load(Ordering::Relaxed)
-                    || aw.release_epoch.load(Ordering::Relaxed) != epoch
-                    || since.elapsed().as_nanos() >= u128::from(spin_ns);
-                if leave {
-                    if slot
-                        .state
-                        .compare_exchange(IDLE, ABSENT, Ordering::AcqRel, Ordering::Relaxed)
-                        .is_ok()
-                    {
-                        trace!(aw, Some(id), Leave);
-                        return;
-                    }
-                    continue; // claimed meanwhile
+            let g = slot.gen.load(Ordering::Acquire);
+            if g == seen {
+                let w = waiter
+                    .get_or_insert_with(|| Waiter::new(slot.spin_budget.load(Ordering::Relaxed)));
+                if w.step() == Step::Sleep {
+                    aw.waits.member_parks.fetch_add(1, Ordering::Relaxed);
+                    trace!(aw, Some(id), ParkEnter);
+                    park_member(slot, seen);
+                    trace!(aw, Some(id), ParkExit);
+                    waiter = None;
                 }
-                if slot.idle_yield.load(Ordering::Relaxed)
-                    && slot
-                        .state
-                        .compare_exchange(IDLE, YIELD, Ordering::AcqRel, Ordering::Relaxed)
-                        .is_ok()
-                {
-                    let ran = rayon::yield_now();
-                    slot.state.store(IDLE, Ordering::Release);
-                    if !matches!(ran, Some(rayon::Yield::Executed)) {
-                        // Nothing to run: stay claimable for a moment.
-                        for _ in 0..64 {
-                            std::hint::spin_loop();
-                        }
-                    }
-                } else {
-                    backoff(&mut spins);
+            } else {
+                seen = g;
+                waiter = None;
+                let ptr = slot.ptr.load(Ordering::Relaxed);
+                let arg = slot.arg.load(Ordering::Relaxed);
+                // SAFETY: the leader keeps the section alive until its
+                // completion counter reaches zero, which happens only after
+                // the call below decremented it.
+                if unsafe { (*ptr).pin } {
+                    // A pin section: save the previous mask before pinning.
+                    slot.saved.save_if_unpinned();
                 }
+                trace!(aw, Some(id), SectionBegin);
+                // SAFETY: as above; `aw` outlives this loop, so the wake after
+                // the last decrement does not touch the section.
+                unsafe { Section::execute_member(ptr, arg) };
+                trace!(aw, Some(id), SectionEnd);
             }
-            _ => backoff(&mut spins),
+            continue;
+        }
+        // Free (`0`) or lent (`RESERVED|LENT`): serve the pool.
+        if as_member {
+            as_member = false;
+            waiter = None;
+        }
+        if st & LENT != 0 && !was_lent {
+            was_lent = true;
+            // The thread serves foreign work now: undo our pin first.
+            slot.saved.restore();
+            trace!(aw, Some(id), LentBegin);
+        }
+        if aw.try_work(id) {
+            waiter = None;
+            continue;
+        }
+        let now = aw.release_epoch.load(Ordering::Relaxed);
+        if now != epoch {
+            // `Pool::release_idle`: stop spinning now.
+            epoch = now;
+            waiter = Some(Waiter::new(0));
+        }
+        let w = waiter.get_or_insert_with(|| {
+            let idle = slot.idle_spin_ns.load(Ordering::Relaxed);
+            Waiter::new(if idle == 0 { 0 } else { aw.waits.spin_polls })
+        });
+        if w.step() == Step::Sleep {
+            slot.lingering.store(false, Ordering::Release);
+            let qgen = aw.queue.gen();
+            let bgen = aw.bcast.gen();
+            slot.park.park_while(|| {
+                slot.state.load() == st
+                    && aw.queue.gen() == qgen
+                    && aw.bcast.gen() == bgen
+                    && !aw.work_for(id)
+            });
+            waiter = None;
         }
     }
 }
 
-/// Sleeps (still reserved) until a section is published, the reservation ends
-/// or the thread is lent. The handshake lives in [`Parker`].
+/// Sleeps (still reserved) until a section is published, the reservation ends,
+/// the member is lent, or the pool detaches it. The handshake lives in
+/// [`Parker`].
 #[cfg(feature = "parallel")]
 fn park_member(slot: &Slot, seen: usize) {
-    slot.park.park_while(|| {
-        slot.gen.load(Ordering::SeqCst) == seen
-            && slot.state.load(Ordering::SeqCst) == RESERVED
-            && !slot.lent.load(Ordering::SeqCst)
-    });
+    slot.park
+        .park_while(|| slot.gen.load(Ordering::SeqCst) == seen && slot.state.load() == RESERVED);
 }
 
 /// A unit of dispatched work, living on the leader's stack.
@@ -654,19 +629,22 @@ pub(crate) struct Section {
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
     pin: bool,
     /// Dispatched participants that have not finished.
-    remaining: Padded<AtomicUsize>,
-    arrived: Padded<AtomicUsize>,
-    epoch: Padded<AtomicUsize>,
-    cancelled: AtomicBool,
+    done: crate::park::Completion,
+    barrier: crate::park::Barrier,
+    cancelled: crate::sync::AtomicBool,
+    /// The pool's waiting state; null when the section has no pool (nothing is
+    /// dispatched, and its single participant never waits).
+    waits: *const Waits,
     /// First panic payload, boxed twice so that it fits an `AtomicPtr`.
     /// (A `Mutex` would allocate on first use on some platforms.)
     panic: AtomicPtr<Box<dyn Any + Send>>,
 }
 
-// SAFETY: `data` points to a `Sync` closure that outlives the section; every
-// other field is an atomic, a plain flag written before the section is
-// published (and read only after a member observed the publishing `gen` with
-// acquire ordering), or a function pointer.
+// SAFETY: `data` points to a `Sync` closure that outlives the section; `waits`
+// points to the pool's `Waits` (in `Awake`, which outlives every section and
+// member loop) and is only read; every other field is an atomic, a plain flag
+// written before the section is published (and read only after a member
+// observed the publishing `gen` with acquire ordering), or a function pointer.
 unsafe impl Sync for Section {}
 
 /// The geometry of a section: its shares, its participants, and the flags of
@@ -690,6 +668,7 @@ impl Section {
         slot_of: unsafe fn(*const (), usize) -> usize,
         slot_data: *const (),
         geometry: Geometry,
+        waits: Option<&Waits>,
     ) -> Self {
         let Geometry {
             dispatched,
@@ -706,10 +685,10 @@ impl Section {
             slot_data,
             over,
             pin,
-            remaining: Padded(AtomicUsize::new(dispatched)),
-            arrived: Padded(AtomicUsize::new(0)),
-            epoch: Padded(AtomicUsize::new(0)),
-            cancelled: AtomicBool::new(false),
+            done: crate::park::Completion::new(dispatched),
+            barrier: crate::park::Barrier::new(size),
+            cancelled: crate::sync::AtomicBool::new(false),
+            waits: waits.map_or(core::ptr::null(), |w| w as *const Waits),
             panic: AtomicPtr::new(core::ptr::null_mut()),
         }
     }
@@ -738,17 +717,48 @@ impl Section {
     /// decrement.
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
     unsafe fn execute_member(ptr: *const Section, arg: usize) {
-        let sec = &*ptr;
-        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| sec.call_here(arg)));
-        if let Err(p) = r {
-            sec.fail(p);
+        // The pool's waiting state outlives the section: read it now, use it
+        // after the decrement that may let the leader free the section.
+        let waits = (*ptr).waits;
+        {
+            let sec = &*ptr;
+            let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| sec.call_here(arg)));
+            if let Err(p) = r {
+                sec.fail(p);
+            }
+        }
+        crate::park::Completion::finish(
+            core::ptr::addr_of!((*ptr).done),
+            waits.as_ref().map(|w| &*w.sync),
+        );
+    }
+
+    /// The pool's waiting state, if the section has a pool.
+    fn waits(&self) -> Option<&Waits> {
+        // SAFETY: `waits` is null or points into the pool's `Awake`, which
+        // outlives the section.
+        unsafe { self.waits.as_ref() }
+    }
+
+    /// A wait episode of this section's join or barrier.
+    fn waiter(&self) -> crate::park::Waiter {
+        match self.waits() {
+            Some(w) => crate::park::Waiter::new(if self.over {
+                crate::park::THROTTLED_POLLS.min(w.spin_polls)
+            } else {
+                w.spin_polls
+            }),
+            None => crate::park::Waiter::new(u32::MAX),
         }
-        (*ptr).remaining.0.fetch_sub(1, Ordering::Release);
     }
 
     /// Records a participant's panic and cancels barriers.
     pub(crate) fn fail(&self, payload: Box<dyn Any + Send>) {
-        self.cancelled.store(true, Ordering::Release);
+        // SeqCst, then wake: barrier waiters may sleep on the pool's parker.
+        self.cancelled.store(true, Ordering::SeqCst);
+        if let Some(w) = self.waits() {
+            w.sync.wake();
+        }
         let fresh = Box::into_raw(Box::new(payload));
         if self
             .panic
@@ -780,42 +790,36 @@ impl Section {
         self.cancelled.load(Ordering::Acquire)
     }
 
-    /// Waits until every dispatched participant has finished.
-    ///
-    /// Polls with [`spin_wait`] (one PAUSE, no yield) unless the root scope is
-    /// oversubscribed, where it spins about 100 times and then yields per poll.
+    /// Waits until every dispatched participant has finished: a staged wait
+    /// (spin, yield, then sleep on the pool's parker until the last member's
+    /// decrement wakes it), throttled when the root scope is oversubscribed.
     pub(crate) fn join(&self) {
-        let mut polls = 0;
-        while self.remaining.0.load(Ordering::Acquire) != 0 {
-            wait_poll(self.over, &mut polls);
+        if self.done.is_done() {
+            return;
+        }
+        let mut waiter = self.waiter();
+        self.done.wait(self.waits().map(|w| &*w.sync), &mut waiter);
+        if waiter.slept() {
+            if let Some(w) = self.waits() {
+                w.join_sleeps.fetch_add(1, Ordering::Relaxed);
+            }
         }
     }
 
     /// Sense-reversing barrier over the section's participants; `false` when
-    /// a participant failed, so that peers can leave instead of waiting.
+    /// a participant failed, so that peers can leave instead of waiting. Waits
+    /// like [`Self::join`].
     pub(crate) fn barrier(&self) -> bool {
-        if self.is_cancelled() {
-            return false;
-        }
-        if self.size == 1 {
-            return true;
-        }
-        let epoch = self.epoch.0.load(Ordering::Acquire);
-        if self.arrived.0.fetch_add(1, Ordering::AcqRel) + 1 == self.size {
-            self.arrived.0.store(0, Ordering::Relaxed);
-            self.epoch.0.store(epoch.wrapping_add(1), Ordering::Release);
-            return true;
-        }
-        let mut polls = 0;
-        loop {
-            if self.epoch.0.load(Ordering::Acquire) != epoch {
-                return true;
-            }
-            if self.is_cancelled() {
-                return false;
+        let mut waiter = self.waiter();
+        let passed =
+            self.barrier
+                .arrive(&self.cancelled, self.waits().map(|w| &*w.sync), &mut waiter);
+        if waiter.slept() {
+            if let Some(w) = self.waits() {
+                w.barrier_sleeps.fetch_add(1, Ordering::Relaxed);
             }
-            wait_poll(self.over, &mut polls);
         }
+        passed
     }
 }
 
diff --git a/src/exec.rs b/src/exec.rs
index e568933..9a76549 100644
--- a/src/exec.rs
+++ b/src/exec.rs
@@ -637,9 +637,10 @@ impl<'p> Exec<'p> {
     /// This is the only place a bare width exists. The token is consumed, the
     /// pool is entered once (inline when the token is serial, has a budget of
     /// one, or the caller already is a worker of the pool) and `f` receives the
-    /// budget, for example to build `faer::Par::rayon(width)` or to set a vendor
-    /// BLAS thread count. Whatever the library schedules with that width runs on
-    /// this pool, never on an ambient one. How the library divides the width is
+    /// budget, for example to set a vendor BLAS thread count. The callback runs
+    /// on a worker of this pool (inline when the caller is one); a library that
+    /// schedules with Rayon needs `external_rayon`
+    /// (feature `rayon`) instead. How the library divides the width is
     /// its own responsibility. Without the `parallel` feature, `f` runs inline
     /// and receives a width of one.
     ///
@@ -667,7 +668,7 @@ impl<'p> Exec<'p> {
                 let width = self.budget;
                 let _released = self.track.release();
                 // A team token lends its reserved members to the pool for the
-                // call: the library's Rayon work runs on them as well.
+                // call: tasks the callback queues on this pool run on them too.
                 let _lent = self.team.map(|t| LendGuard::new(t.awake, t.ids));
                 // The calling thread may itself be a pinned participant of this
                 // pool (the member that leads a `fork` child, or a token used
@@ -680,20 +681,48 @@ impl<'p> Exec<'p> {
         f(NonZeroUsize::MIN)
     }
 
+    /// Runs `f(width)` inside a private Rayon pool of this pool's width, so that
+    /// a callback whose library parallelizes with Rayon (`rayon::join`,
+    /// parallel iterators) gets `width` threads without starting Rayon's
+    /// process-global pool. The opt-in Rayon interop layer (feature `rayon`;
+    /// `docs/design/own-threads.md`): the Rayon pool's threads are separate
+    /// from this pool's workers, built once per pool when first needed.
+    /// A serial or budget-one token calls `f(1)` inline.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # #[cfg(feature = "rayon")] {
+    /// let pool = threadteam::Pool::builder().threads(2).build().unwrap();
+    /// let w = threadteam::Exec::new(&pool, 2).unwrap().external_rayon(|w| w.get());
+    /// assert_eq!(w, 2);
+    /// # }
+    /// ```
+    #[cfg(feature = "rayon")]
+    pub fn external_rayon<R: Send>(self, f: impl FnOnce(NonZeroUsize) -> R + Send) -> R {
+        match self.pool {
+            Some(pool) if self.budget.get() > 1 => {
+                let width = self.budget;
+                let _released = self.track.release();
+                pool.rayon().install(move || f(width))
+            }
+            _ => f(NonZeroUsize::MIN),
+        }
+    }
+
     /// Reserves `budget - 1` pool members for the scope of `f` and hands `f`
     /// the exclusive [`TeamExec`] authority over them and the calling thread.
     ///
     /// The calling thread is participant 0 (the leader); the members are
-    /// pool workers that stay reserved, spinning and serving no Rayon job,
+    /// pool workers that stay reserved, spinning and serving no other task,
     /// until `f` returns (or unwinds). A serial or budget-one token yields a
     /// team of one without touching the pool.
     ///
-    /// Acquisition never waits for a Rayon job that is already running. Idle
-    /// members of an earlier team (see [`WaitPolicy`]) are claimed with a
-    /// compare-and-swap; missing ones are requested from the pool, and the
-    /// call waits at most the pool's acquisition timeout
+    /// Acquisition never takes a worker that runs a task: free workers are
+    /// claimed with a compare-and-swap, and the call waits at most the pool's
+    /// acquisition timeout
     /// ([`PoolBuilder::acquire_timeout`](crate::PoolBuilder::acquire_timeout))
-    /// for idle workers to wake. If not all members are there by then, every
+    /// for busy ones to become free. If not all members are there by then, every
     /// tentative claim is released and nothing runs. Before `f` is called,
     /// every participant has acknowledged on its own thread.
     ///
@@ -765,17 +794,14 @@ impl<'p> Exec<'p> {
             // child, a reborrow or a sub-team re-pins nothing of its own.
             if self._leader.is_some() {
                 // Root-scope entry, on the executing thread: the root pressure
-                // and the members' park delay are decided by *this* thread's CPU
+                // and the members' spin budget are decided by *this* thread's CPU
                 // set. A token minted on another thread (or another mask) is
                 // paced by the thread that enters the scope, exactly as its pin
                 // section is placed by that thread. Descendants inherit it.
                 let oversubscribed = crate::pin::oversubscribed(team.size().get());
                 team.over = oversubscribed;
                 if let Some(awake) = team.awake {
-                    awake.set_park_ns(
-                        team.ids,
-                        crate::pin::park_delay(team.policy, oversubscribed),
-                    );
+                    awake.set_spin_budget(team.ids, awake.spin_budget(oversubscribed));
                 }
                 if let Some(auth) = self.team.as_mut() {
                     auth.over = oversubscribed;
@@ -804,14 +830,11 @@ impl<'p> Exec<'p> {
         // placement of the participants and whether the scope is
         // oversubscribed, whatever the pool's pinning setting.
         let oversubscribed = crate::pin::oversubscribed(self.budget.get());
-        let park_spin = if oversubscribed {
-            Duration::ZERO
-        } else {
-            policy.idle_spin()
-        };
-        let reservation = pool
-            .awake
-            .acquire(pool, self.budget.get() - 1, policy, park_spin)?;
+        let reservation = pool.awake.acquire(
+            self.budget.get() - 1,
+            policy,
+            pool.awake.spin_budget(oversubscribed),
+        )?;
         let mut team = TeamExec {
             awake: Some(&pool.awake),
             ids: &reservation.ids,
diff --git a/src/ledger.rs b/src/ledger.rs
index 20ba8ad..8af7edc 100644
--- a/src/ledger.rs
+++ b/src/ledger.rs
@@ -145,14 +145,16 @@ pub fn installs(root: u64) -> usize {
 /// assert!(ledger::global_pool_unstarted());
 /// ```
 pub fn global_pool_unstarted() -> bool {
-    #[cfg(feature = "parallel")]
+    // threadteam starts no Rayon pool at all unless the opt-in `rayon` feature
+    // is on; then the process-global one must still be unstarted.
+    #[cfg(feature = "rayon")]
     {
         rayon::ThreadPoolBuilder::new()
             .num_threads(1)
             .build_global()
             .is_ok()
     }
-    #[cfg(not(feature = "parallel"))]
+    #[cfg(not(feature = "rayon"))]
     {
         true
     }
diff --git a/src/lib.rs b/src/lib.rs
index 286262f..ddbfe7c 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -9,12 +9,16 @@
 //! * [`Exec::new`] mints a token from a pool; [`Exec::serial`] needs none.
 //! * A token is not `Clone`/`Copy`; entries consume it; splits conserve slots.
 //! * Serial, budget-one and one-task entries run inline and never reach any
-//!   scheduler, so the process-global Rayon pool is never started implicitly.
+//!   scheduler; no worker thread starts before a pool is built, and Rayon is
+//!   not used at all unless the opt-in `rayon` feature is on.
 //!
 //! # Features
 //!
-//! * `parallel` (default): run on a private pool. Without it the same types
-//!   exist, every pool has width 1 and every entry runs inline.
+//! * `parallel` (default): run on the pool's own worker threads, leased from a
+//!   process-wide reserve (`docs/design/own-threads.md`). Without it the same
+//!   types exist, every pool has width 1 and every entry runs inline.
+//! * `rayon` (opt-in): `Exec::external_rayon`, a private Rayon pool per pool
+//!   for callbacks that parallelize with Rayon.
 //! * `ledger`: test support, see the `ledger` module (compiled only with this feature).
 //!
 //! # Examples
@@ -60,6 +64,11 @@ pub mod test_hooks;
 #[cfg(feature = "trace")]
 pub mod trace;
 mod track;
+#[cfg(feature = "parallel")]
+mod worker;
+#[cfg(feature = "parallel")]
+#[doc(hidden)]
+pub use worker::spawned_workers;
 
 pub use cost::{pays_at, width_for_by, DispatchCosts, DispatchKind, HostClass, WidthCosts, PAYS};
 pub use error::{Error, Refused};
@@ -67,7 +76,12 @@ pub use exec::Exec;
 #[cfg(loom)]
 #[doc(hidden)]
 pub use park::Parker;
+#[cfg(loom)]
+#[doc(hidden)]
+pub use park::{Barrier, Batch, Broadcast, BroadcastList, Completion, Queue, SlotState, Waiter};
 pub use policy::{raise_current_thread_qos, Qos, WaitOverride, WaitPolicy};
+#[doc(hidden)]
+pub use pool::WaitCounters;
 pub use pool::{Pool, PoolBuilder};
 pub use reserve::{IntoTeamError, Team};
 pub use team::{Cancelled, Participant, TeamExec};
diff --git a/src/park.rs b/src/park.rs
index 2d58fc7..f59f87a 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -19,8 +19,9 @@
 //! sequences, not a total order of SeqCst accesses, because `loom` does not model
 //! the latter and the exact code is model-checked. With nobody parked a wake is
 //! one uncontended atomic read-modify-write.
+#![cfg_attr(not(feature = "parallel"), allow(dead_code))]
 
-use crate::sync::{AtomicUsize, Condvar, Mutex, Ordering};
+use crate::sync::{AtomicBool, AtomicUsize, Condvar, Mutex, Ordering};
 
 /// Places where a test can pause a thread (feature `test-hooks`).
 #[doc(hidden)]
@@ -142,3 +143,691 @@ impl Parker {
         }
     }
 }
+
+// ---------------------------------------------------------------------------
+// Staged waits (`docs/design/waiting.md`): libgomp's waits. A bounded spin of
+// polls, a few yields, then a sleep on a `Parker`. The join and the barrier of
+// a section use them through [`Completion`] and [`Barrier`], which are the
+// exact code `loom` checks.
+
+/// Spin budget, in polls, of a wait in a statically oversubscribed scope (more
+/// participants than CPUs in the caller's set). libgomp's throttled spin count
+/// has the same value.
+pub(crate) const THROTTLED_POLLS: u32 = 100;
+
+/// Yields between the spin and the sleep. Each lets a thread queued on the same
+/// CPU run without a futex round trip.
+const YIELD_POLLS: u32 = if cfg!(loom) { 0 } else { 16 };
+
+/// What a waiting thread does after one [`Waiter::step`].
+#[doc(hidden)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Step {
+    /// It polled (spun or yielded); poll the condition again.
+    Poll,
+    /// The spin and the yields are spent: sleep until woken.
+    Sleep,
+}
+
+/// One wait episode: up to `budget` spin polls (one PAUSE, or YIELD on
+/// aarch64, each), then [`YIELD_POLLS`] yields, then sleep.
+///
+/// The budget is a count, as libgomp's `GOMP_SPINCOUNT`: a waiter that is
+/// descheduled does not spend it while it waits for its CPU. Nothing in the
+/// poll loop reads a clock.
+#[doc(hidden)]
+pub struct Waiter {
+    budget: u32,
+    polls: u32,
+    yields: u32,
+    slept: bool,
+}
+
+impl Waiter {
+    /// A wait episode with a spin of `budget` polls.
+    pub fn new(budget: u32) -> Self {
+        Waiter {
+            budget,
+            polls: 0,
+            yields: 0,
+            slept: false,
+        }
+    }
+
+    /// Whether the episode reached its sleep phase.
+    pub fn slept(&self) -> bool {
+        self.slept
+    }
+
+    /// One poll of the episode; [`Step::Sleep`] once the spin and the yields
+    /// are spent (and on every call after that).
+    #[inline]
+    pub fn step(&mut self) -> Step {
+        if self.polls < self.budget {
+            self.polls += 1;
+            std::hint::spin_loop();
+            return Step::Poll;
+        }
+        if self.yields < YIELD_POLLS {
+            self.yields += 1;
+            std::thread::yield_now();
+            return Step::Poll;
+        }
+        self.slept = true;
+        Step::Sleep
+    }
+}
+
+#[repr(align(128))]
+struct Pad<T>(T);
+
+/// The dispatched shares of a section that have not finished. The leader's
+/// join waits on it; the member that finishes the last share wakes the leader.
+#[doc(hidden)]
+pub struct Completion {
+    remaining: Pad<AtomicUsize>,
+}
+
+impl Completion {
+    /// `n` shares outstanding.
+    pub fn new(n: usize) -> Self {
+        Completion {
+            remaining: Pad(AtomicUsize::new(n)),
+        }
+    }
+
+    /// Whether every share has finished.
+    pub fn is_done(&self) -> bool {
+        self.remaining.0.load(Ordering::Acquire) == 0
+    }
+
+    /// Whether every share has finished, read with the ordering of the
+    /// `Parker` protocol (for predicates evaluated under its lock).
+    pub fn is_done_now(&self) -> bool {
+        self.remaining.0.load(Ordering::SeqCst) == 0
+    }
+
+    /// One share finished; the last one wakes a sleeping leader through `sync`.
+    ///
+    /// # Safety
+    ///
+    /// `this` is valid when called. It is not dereferenced after the decrement,
+    /// because the leader may free it as soon as it observes zero; `sync` must
+    /// outlive the call independently of `this`.
+    pub unsafe fn finish(this: *const Completion, sync: Option<&Parker>) {
+        // SeqCst: the state change of the `Parker` protocol (rule 2).
+        if (*this).remaining.0.fetch_sub(1, Ordering::SeqCst) == 1 {
+            if let Some(sync) = sync {
+                sync.wake();
+            }
+        }
+    }
+
+    /// Waits until every share has finished: spin, yield, then sleep on `sync`.
+    pub fn wait(&self, sync: Option<&Parker>, waiter: &mut Waiter) {
+        while !self.is_done() {
+            if waiter.step() == Step::Sleep {
+                match sync {
+                    Some(sync) => sync.park_while(|| self.remaining.0.load(Ordering::SeqCst) != 0),
+                    None => std::hint::spin_loop(),
+                }
+            }
+        }
+    }
+}
+
+/// The sense-reversing barrier of a section's participants.
+#[doc(hidden)]
+pub struct Barrier {
+    size: usize,
+    arrived: Pad<AtomicUsize>,
+    epoch: Pad<AtomicUsize>,
+}
+
+impl Barrier {
+    /// A barrier over `size` participants.
+    pub fn new(size: usize) -> Self {
+        Barrier {
+            size,
+            arrived: Pad(AtomicUsize::new(0)),
+            epoch: Pad(AtomicUsize::new(0)),
+        }
+    }
+
+    /// Waits until all `size` participants arrived, or `cancelled` is raised
+    /// (then `false`). The last arrival opens the barrier and wakes sleepers
+    /// through `sync`; whoever raises `cancelled` must wake `sync` too.
+    pub fn arrive(
+        &self,
+        cancelled: &AtomicBool,
+        sync: Option<&Parker>,
+        waiter: &mut Waiter,
+    ) -> bool {
+        if cancelled.load(Ordering::Acquire) {
+            return false;
+        }
+        if self.size == 1 {
+            return true;
+        }
+        let epoch = self.epoch.0.load(Ordering::Acquire);
+        if self.arrived.0.fetch_add(1, Ordering::AcqRel) + 1 == self.size {
+            self.arrived.0.store(0, Ordering::Relaxed);
+            // SeqCst: the state change of the `Parker` protocol (rule 2).
+            self.epoch.0.store(epoch.wrapping_add(1), Ordering::SeqCst);
+            if let Some(sync) = sync {
+                sync.wake();
+            }
+            return true;
+        }
+        loop {
+            if self.epoch.0.load(Ordering::Acquire) != epoch {
+                return true;
+            }
+            if cancelled.load(Ordering::Acquire) {
+                return false;
+            }
+            if waiter.step() == Step::Sleep {
+                match sync {
+                    Some(sync) => sync.park_while(|| {
+                        self.epoch.0.load(Ordering::SeqCst) == epoch
+                            && !cancelled.load(Ordering::SeqCst)
+                    }),
+                    None => std::hint::spin_loop(),
+                }
+            }
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// The native scheduler's shared state (`docs/design/own-threads.md`): a slot's
+// state word, the pool's queue of stack batches, and its broadcast list. The
+// exact code is what `loom` checks.
+
+/// The slot is reserved by a team.
+pub(crate) const RESERVED: usize = 1;
+/// The reserved member is lent to the pool's queue (`Exec::external`).
+pub(crate) const LENT: usize = 2;
+/// The worker runs a task or a broadcast share.
+pub(crate) const BUSY: usize = 4;
+/// The pool is being dropped: the worker acknowledges and leaves.
+pub(crate) const DETACH: usize = 8;
+
+/// The state word of one worker slot: bits [`RESERVED`], [`LENT`], [`BUSY`],
+/// [`DETACH`]. A team reserves a slot only from `0`; a worker takes work only
+/// from `0` (free) or `RESERVED|LENT` (lent), before it removes anything from a
+/// queue; ending work clears `BUSY` only, releasing clears `RESERVED|LENT`
+/// only, so neither erases the other's bits or `DETACH`.
+#[doc(hidden)]
+pub struct SlotState(AtomicUsize);
+
+impl Default for SlotState {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl SlotState {
+    /// A free slot.
+    pub fn new() -> Self {
+        SlotState(AtomicUsize::new(0))
+    }
+
+    /// The current bits.
+    pub fn load(&self) -> usize {
+        self.0.load(Ordering::Acquire)
+    }
+
+    /// Reserves a free, idle slot for a team (`0 -> RESERVED`).
+    pub fn try_reserve(&self) -> bool {
+        self.0
+            .compare_exchange(0, RESERVED, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+    }
+
+    /// The worker takes work: `0 -> BUSY`, or `RESERVED|LENT -> RESERVED|LENT|BUSY`.
+    pub fn try_take(&self) -> bool {
+        let cur = self.0.load(Ordering::Acquire);
+        if cur != 0 && cur != RESERVED | LENT {
+            return false;
+        }
+        self.0
+            .compare_exchange(cur, cur | BUSY, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+    }
+
+    /// The worker finished its work (clears `BUSY` only).
+    pub fn end_busy(&self) {
+        self.0.fetch_and(!BUSY, Ordering::SeqCst);
+    }
+
+    /// The team releases the slot (clears `RESERVED|LENT` only); a worker still
+    /// running a lent task stays `BUSY` and is claimable only once it finishes.
+    pub fn release(&self) {
+        self.0.fetch_and(!(RESERVED | LENT), Ordering::SeqCst);
+    }
+
+    /// Lends a reserved member to the pool's queue, or takes it back.
+    pub fn set_lent(&self, on: bool) {
+        if on {
+            self.0.fetch_or(LENT, Ordering::SeqCst);
+        } else {
+            self.0.fetch_and(!LENT, Ordering::SeqCst);
+        }
+    }
+
+    /// The pool is being dropped.
+    pub fn detach(&self) {
+        self.0.fetch_or(DETACH, Ordering::SeqCst);
+    }
+}
+
+/// A batch of `tasks` tasks published on a pool's [`Queue`]: a stack object of
+/// its owner, linked into the queue until its last index is claimed, alive
+/// until its last task completed (the owner waits for that).
+#[doc(hidden)]
+pub struct Batch {
+    run: unsafe fn(*const (), usize),
+    data: *const (),
+    tasks: usize,
+    /// Next unclaimed index; read and written under the queue lock only.
+    next: AtomicUsize,
+    /// Next batch in the queue; under the queue lock only.
+    link: core::cell::Cell<*const Batch>,
+    /// Tasks not yet completed.
+    pub done: Completion,
+    /// Whom the last completion wakes (the owner's own parker, or the pool's).
+    waker: *const std::sync::Arc<Parker>,
+    /// First panic payload, boxed twice so that it fits an `AtomicPtr`.
+    panic: core::sync::atomic::AtomicPtr<Box<dyn std::any::Any + Send>>,
+}
+
+// SAFETY: `data` points to a `Sync` closure of the owner that outlives the
+// batch's tasks; `waker` points to an `Arc` the owner keeps alive while it
+// waits; `link` is touched under the queue lock only.
+unsafe impl Sync for Batch {}
+unsafe impl Send for Batch {}
+
+impl Batch {
+    /// A batch of `tasks` calls `run(data, index)`, waking `waker` when the
+    /// last one completes.
+    ///
+    /// # Safety
+    ///
+    /// `run` and `data` belong together and stay valid until the batch is
+    /// done; `waker` outlives the owner's wait for the batch.
+    pub unsafe fn new(
+        run: unsafe fn(*const (), usize),
+        data: *const (),
+        tasks: usize,
+        waker: *const std::sync::Arc<Parker>,
+    ) -> Self {
+        Batch {
+            run,
+            data,
+            tasks,
+            next: AtomicUsize::new(0),
+            link: core::cell::Cell::new(core::ptr::null()),
+            done: Completion::new(tasks),
+            waker,
+            panic: core::sync::atomic::AtomicPtr::new(core::ptr::null_mut()),
+        }
+    }
+
+    /// Runs claimed task `index` and completes it; a panic is caught and kept.
+    ///
+    /// # Safety
+    ///
+    /// `this` is a batch whose task `index` the caller claimed. It is not
+    /// dereferenced after the final decrement.
+    pub unsafe fn run_claimed(this: *const Batch, index: usize) {
+        let b = &*this;
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| (b.run)(b.data, index)));
+        if let Err(p) = r {
+            let fresh = Box::into_raw(Box::new(p));
+            if b.panic
+                .compare_exchange(
+                    core::ptr::null_mut(),
+                    fresh,
+                    core::sync::atomic::Ordering::AcqRel,
+                    core::sync::atomic::Ordering::Acquire,
+                )
+                .is_err()
+            {
+                drop(Box::from_raw(fresh));
+            }
+        }
+        // Keep the waker alive across the final decrement: after it the owner
+        // may return and free the batch.
+        let waker = std::sync::Arc::clone(&*b.waker);
+        Completion::finish(core::ptr::addr_of!((*this).done), Some(&waker));
+    }
+
+    /// The first panic of a task, once the batch is done.
+    pub fn take_panic(&self) -> Option<Box<dyn std::any::Any + Send>> {
+        let p = self
+            .panic
+            .swap(core::ptr::null_mut(), core::sync::atomic::Ordering::AcqRel);
+        // SAFETY: a non-null value was stored by `run_claimed` from
+        // `Box::into_raw` and `swap` hands it to exactly one taker.
+        (!p.is_null()).then(|| *unsafe { Box::from_raw(p) })
+    }
+}
+
+impl Drop for Batch {
+    fn drop(&mut self) {
+        drop(self.take_panic());
+    }
+}
+
+/// A pool's queue of [`Batch`]es: an intrusive list under a lock, newest
+/// first. Claims happen under the lock, and the claim of a batch's last index
+/// unlinks it, so nobody reaches a batch after it was unlinked; its owner frees
+/// it only once all of its tasks completed.
+#[doc(hidden)]
+pub struct Queue {
+    head: Mutex<QueueHead>,
+    /// Bumped (SeqCst) on every publication: what sleeping workers watch.
+    gen: AtomicUsize,
+    /// Linked batches, for a lock-free emptiness hint.
+    linked: AtomicUsize,
+}
+
+struct QueueHead(*const Batch);
+// SAFETY: the pointer is only dereferenced under the lock (see `Queue`).
+unsafe impl Send for QueueHead {}
+
+impl Default for Queue {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Queue {
+    /// An empty queue. The lock is touched once here: some platforms allocate
+    /// it lazily, and no later operation should allocate.
+    pub fn new() -> Self {
+        let q = Queue {
+            head: Mutex::new(QueueHead(core::ptr::null())),
+            gen: AtomicUsize::new(0),
+            linked: AtomicUsize::new(0),
+        };
+        drop(q.head.lock().unwrap_or_else(|e| e.into_inner()));
+        q
+    }
+
+    /// The publication counter.
+    pub fn gen(&self) -> usize {
+        self.gen.load(Ordering::SeqCst)
+    }
+
+    /// Whether any batch has unclaimed tasks (a hint).
+    pub fn has_work(&self) -> bool {
+        self.linked.load(Ordering::Acquire) != 0
+    }
+
+    /// Links `b` (with at least one task); the caller then wakes the workers.
+    pub fn publish(&self, b: &Batch) {
+        debug_assert!(b.tasks > 0);
+        let mut head = self.head.lock().unwrap_or_else(|e| e.into_inner());
+        b.link.set(head.0);
+        head.0 = b as *const Batch;
+        self.linked.fetch_add(1, Ordering::AcqRel);
+        drop(head);
+        self.gen.fetch_add(1, Ordering::SeqCst);
+    }
+
+    /// Claims the next index of the newest batch; the caller must run it with
+    /// [`Batch::run_claimed`].
+    pub fn claim(&self) -> Option<(*const Batch, usize)> {
+        let mut head = self.head.lock().unwrap_or_else(|e| e.into_inner());
+        let b = head.0;
+        if b.is_null() {
+            return None;
+        }
+        // SAFETY: a linked batch is alive (see `Queue`).
+        let batch = unsafe { &*b };
+        let i = batch.next.load(Ordering::Relaxed);
+        batch.next.store(i + 1, Ordering::Relaxed);
+        if i + 1 == batch.tasks {
+            head.0 = batch.link.get();
+            self.linked.fetch_sub(1, Ordering::AcqRel);
+        }
+        Some((b, i))
+    }
+
+    /// Claims the next index of the caller's own batch `b`, wherever it is in
+    /// the list; `None` once all of its indices are claimed.
+    pub fn claim_own(&self, b: &Batch) -> Option<usize> {
+        let mut head = self.head.lock().unwrap_or_else(|e| e.into_inner());
+        let i = b.next.load(Ordering::Relaxed);
+        if i >= b.tasks {
+            return None;
+        }
+        b.next.store(i + 1, Ordering::Relaxed);
+        if i + 1 == b.tasks {
+            // Unlink `b`: walk the (short) list to its predecessor.
+            let me = b as *const Batch;
+            if head.0 == me {
+                head.0 = b.link.get();
+            } else {
+                let mut cur = head.0;
+                // SAFETY: linked batches are alive; `b` is linked (it still
+                // had unclaimed indices).
+                unsafe {
+                    while (*cur).link.get() != me {
+                        cur = (*cur).link.get();
+                    }
+                    (*cur).link.set(b.link.get());
+                }
+            }
+            self.linked.fetch_sub(1, Ordering::AcqRel);
+        }
+        Some(i)
+    }
+}
+
+/// A broadcast published on a pool's [`BroadcastList`]: share `i` for every
+/// worker `i < budget`. A stack object of its caller, linked until its caller
+/// unlinks it after all shares completed.
+#[doc(hidden)]
+pub struct Broadcast {
+    run: unsafe fn(*const (), usize),
+    data: *const (),
+    budget: usize,
+    /// Publication number; written under the list lock before linking.
+    seq: core::cell::Cell<u64>,
+    link: core::cell::Cell<*const Broadcast>,
+    /// Shares not yet completed.
+    pub done: Completion,
+    waker: *const std::sync::Arc<Parker>,
+    panic: core::sync::atomic::AtomicPtr<Box<dyn std::any::Any + Send>>,
+}
+
+// SAFETY: as for `Batch`; `seq` and `link` are touched under the list lock.
+unsafe impl Sync for Broadcast {}
+unsafe impl Send for Broadcast {}
+
+impl Broadcast {
+    /// A broadcast of `run(data, i)` to workers `0..budget`.
+    ///
+    /// # Safety
+    ///
+    /// As [`Batch::new`].
+    pub unsafe fn new(
+        run: unsafe fn(*const (), usize),
+        data: *const (),
+        budget: usize,
+        waker: *const std::sync::Arc<Parker>,
+    ) -> Self {
+        Broadcast {
+            run,
+            data,
+            budget,
+            seq: core::cell::Cell::new(0),
+            link: core::cell::Cell::new(core::ptr::null()),
+            done: Completion::new(budget),
+            waker,
+            panic: core::sync::atomic::AtomicPtr::new(core::ptr::null_mut()),
+        }
+    }
+
+    /// Runs worker `i`'s share and completes it; a panic is caught and kept.
+    ///
+    /// # Safety
+    ///
+    /// `this` is a linked broadcast that targets `i` and whose share `i` the
+    /// caller took; it is not dereferenced after the final decrement.
+    pub unsafe fn run_share(this: *const Broadcast, i: usize) {
+        let b = &*this;
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| (b.run)(b.data, i)));
+        if let Err(p) = r {
+            let fresh = Box::into_raw(Box::new(p));
+            if b.panic
+                .compare_exchange(
+                    core::ptr::null_mut(),
+                    fresh,
+                    core::sync::atomic::Ordering::AcqRel,
+                    core::sync::atomic::Ordering::Acquire,
+                )
+                .is_err()
+            {
+                drop(Box::from_raw(fresh));
+            }
+        }
+        let waker = std::sync::Arc::clone(&*b.waker);
+        Completion::finish(core::ptr::addr_of!((*this).done), Some(&waker));
+    }
+
+    /// The first panic of a share, once the broadcast is done.
+    pub fn take_panic(&self) -> Option<Box<dyn std::any::Any + Send>> {
+        let p = self
+            .panic
+            .swap(core::ptr::null_mut(), core::sync::atomic::Ordering::AcqRel);
+        // SAFETY: as in `Batch::take_panic`.
+        (!p.is_null()).then(|| *unsafe { Box::from_raw(p) })
+    }
+}
+
+impl Drop for Broadcast {
+    fn drop(&mut self) {
+        drop(self.take_panic());
+    }
+}
+
+/// A pool's broadcasts in publication order. Every worker runs the broadcasts
+/// that target it in that order (its own sequence cursor), so concurrent
+/// broadcasts reach every worker in the same order. Publication and unlinking
+/// take the lock; completion does not, so nobody waits while holding it.
+#[doc(hidden)]
+pub struct BroadcastList {
+    inner: Mutex<BroadcastHead>,
+    /// Bumped (SeqCst) on every publication.
+    gen: AtomicUsize,
+}
+
+struct BroadcastHead {
+    head: *const Broadcast,
+    tail: *const Broadcast,
+    next_seq: u64,
+}
+// SAFETY: the pointers are only dereferenced under the lock.
+unsafe impl Send for BroadcastHead {}
+
+impl Default for BroadcastList {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl BroadcastList {
+    /// An empty list (the lock is touched once, as in [`Queue::new`]).
+    pub fn new() -> Self {
+        let l = BroadcastList {
+            inner: Mutex::new(BroadcastHead {
+                head: core::ptr::null(),
+                tail: core::ptr::null(),
+                next_seq: 0,
+            }),
+            gen: AtomicUsize::new(0),
+        };
+        drop(l.inner.lock().unwrap_or_else(|e| e.into_inner()));
+        l
+    }
+
+    /// The publication counter.
+    pub fn gen(&self) -> usize {
+        self.gen.load(Ordering::SeqCst)
+    }
+
+    /// Appends `b`; the caller then wakes the workers.
+    pub fn publish(&self, b: &Broadcast) {
+        let mut l = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+        b.seq.set(l.next_seq);
+        l.next_seq += 1;
+        b.link.set(core::ptr::null());
+        let me = b as *const Broadcast;
+        if l.tail.is_null() {
+            l.head = me;
+        } else {
+            // SAFETY: linked broadcasts are alive.
+            unsafe { (*l.tail).link.set(me) };
+        }
+        l.tail = me;
+        drop(l);
+        self.gen.fetch_add(1, Ordering::SeqCst);
+    }
+
+    /// The next broadcast for worker `i` at or after its cursor `seq`, which
+    /// moves past every broadcast it inspects (past every publication so far
+    /// when none is left for `i`). The caller runs the returned
+    /// share with [`Broadcast::run_share`].
+    pub fn next_for(&self, i: usize, seq: &mut u64) -> Option<*const Broadcast> {
+        let l = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+        let mut cur = l.head;
+        while !cur.is_null() {
+            // SAFETY: linked broadcasts are alive.
+            let b = unsafe { &*cur };
+            if b.seq.get() >= *seq {
+                *seq = b.seq.get() + 1;
+                if i < b.budget {
+                    return Some(cur);
+                }
+            }
+            cur = b.link.get();
+        }
+        // Broadcasts published before and already unlinked are past too, or
+        // `has_after` would keep reporting them.
+        *seq = (*seq).max(l.next_seq);
+        None
+    }
+
+    /// Whether a broadcast at or after `seq` exists (a hint, lock-free reads
+    /// of the counter only).
+    pub fn has_after(&self, seq: u64) -> bool {
+        (self.gen.load(Ordering::Acquire) as u64) > seq
+    }
+
+    /// Unlinks `b` once all of its shares completed.
+    pub fn unlink(&self, b: &Broadcast) {
+        let mut l = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+        let me = b as *const Broadcast;
+        let mut prev: *const Broadcast = core::ptr::null();
+        let mut cur = l.head;
+        while cur != me {
+            prev = cur;
+            // SAFETY: `b` is linked, so the walk reaches it; links are alive.
+            cur = unsafe { (*cur).link.get() };
+        }
+        let next = b.link.get();
+        if prev.is_null() {
+            l.head = next;
+        } else {
+            // SAFETY: as above.
+            unsafe { (*prev).link.set(next) };
+        }
+        if l.tail == me {
+            l.tail = prev;
+        }
+    }
+}
diff --git a/src/pin.rs b/src/pin.rs
index 53a2ddb..28c81d4 100644
--- a/src/pin.rs
+++ b/src/pin.rs
@@ -22,7 +22,7 @@
 //! The same CPU set decides whether a root scope is *oversubscribed* (see
 //! [`available`]): a team of more participants than the caller's mask has CPUs
 //! parks its members early instead of spinning (see `awake.rs`), and
-//! [`oversubscribed`] and [`park_delay`] are what the root-scope entries use.
+//! [`oversubscribed`] is what the root-scope entries use.
 
 use core::sync::atomic::{AtomicBool, Ordering};
 
@@ -61,17 +61,6 @@ pub(crate) fn oversubscribed(participants: usize) -> bool {
     participants > available()
 }
 
-/// The park delay of the reserved members of a root scope, in nanoseconds:
-/// zero when the scope is oversubscribed (park after the short spin), the
-/// scope's policy delay otherwise.
-pub(crate) fn park_delay(policy: crate::policy::WaitPolicy, oversubscribed: bool) -> u64 {
-    if oversubscribed {
-        0
-    } else {
-        u64::try_from(policy.idle_spin().as_nanos()).unwrap_or(u64::MAX)
-    }
-}
-
 /// Pins the calling thread onto the `k`-th CPU of `set` (wrapping).
 ///
 /// Called by a member for itself (`k >= 1`); the leader never calls it. Best
@@ -137,6 +126,11 @@ impl SavedMask {
         }
     }
 
+    /// Whether a pin is still in effect (a restore failed or is pending).
+    pub(crate) fn is_pinned(&self) -> bool {
+        self.pinned.load(Ordering::Relaxed)
+    }
+
     /// Restores the saved mask on the calling thread, if this member is pinned.
     ///
     /// Best effort: when the kernel refuses the saved mask (a cpuset changed
diff --git a/src/policy.rs b/src/policy.rs
index 39623fc..08112c7 100644
--- a/src/policy.rs
+++ b/src/policy.rs
@@ -4,22 +4,19 @@ use core::time::Duration;
 
 /// How an idle member behaves after its reservation ended.
 ///
-/// A member that is *reserved* neither runs unrelated Rayon jobs nor leaves
+/// A member that is *reserved* neither runs unrelated tasks nor leaves
 /// on a timeout, whatever the policy says: a policy only governs the idle
 /// interval after the root reservation of a team ends. The interval is
 /// measured from that moment, not from the last time the member computed.
 ///
-/// * `idle_spin`: how long an idle member keeps spinning, ready to be claimed
-///   again without a Rayon wake-up, before it returns its thread to Rayon.
-///   Zero returns it immediately.
-/// * `idle_runs_rayon`: whether the spinning member runs queued Rayon jobs in
-///   the meantime. When it does, a job it picked up runs to completion
-///   (including nested work) before the member is claimable again, and an
-///   acquisition that finds the member in such a job refuses instead of
-///   waiting for it.
-///
-/// While a member spins with `idle_runs_rayon == false`, its thread serves no
-/// Rayon job of the pool for up to `idle_spin`.
+/// * `idle_spin`: whether an idle member keeps spinning, ready to be claimed
+///   again without a wake-up, before it sleeps. Zero puts it to sleep at once;
+///   any other value lets it spin for the pool's spin budget of polls
+///   ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)).
+/// * `idle_runs_rayon`: **no effect** since threadteam runs its own worker
+///   threads (`docs/design/own-threads.md`): an idle worker always serves the
+///   pool's queued tasks, and a worker that runs one is not claimable until it
+///   finishes. Kept so that existing code compiles.
 ///
 /// # Examples
 ///
@@ -42,7 +39,7 @@ pub struct WaitPolicy {
 }
 
 impl WaitPolicy {
-    /// The pool default: spin for 200 ms, run no Rayon jobs while idle.
+    /// The pool default: an idle spin of 200 ms (bounded by the spin budget).
     pub const DEFAULT: WaitPolicy = WaitPolicy {
         idle_spin: Duration::from_millis(200),
         idle_runs_rayon: false,
@@ -56,12 +53,12 @@ impl WaitPolicy {
         }
     }
 
-    /// Spin time of an unreserved idle member before it returns to Rayon.
+    /// Spin time of an unreserved idle member before it sleeps.
     pub const fn idle_spin(&self) -> Duration {
         self.idle_spin
     }
 
-    /// Whether an unreserved idle member runs Rayon jobs while it spins.
+    /// The `idle_runs_rayon` setting (no effect; see [`WaitPolicy`]).
     pub const fn idle_runs_rayon(&self) -> bool {
         self.idle_runs_rayon
     }
@@ -120,7 +117,7 @@ impl WaitOverride {
         self
     }
 
-    /// Overrides whether idle members run Rayon jobs.
+    /// Overrides `idle_runs_rayon` (no effect; see [`WaitPolicy`]).
     #[must_use]
     pub const fn idle_runs_rayon(mut self, on: bool) -> Self {
         self.idle_runs_rayon = Some(on);
diff --git a/src/pool.rs b/src/pool.rs
index 4b177a0..9658d30 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -31,6 +31,20 @@ const DEFAULT_ACQUIRE_TIMEOUT: Duration = Duration::from_millis(2);
 /// pool.
 const PIN_PARTICIPANTS_DEFAULT: bool = false;
 
+/// Default spin budget of a wait, in polls (one PAUSE, or YIELD on aarch64,
+/// per poll); see `docs/design/waiting.md`. 300000 on x86-64, libgomp's default
+/// `GOMP_SPINCOUNT` ("about 3 ms"; about 7 ms at the 24 ns per poll measured on
+/// Zen 3, EPYC 7713P; longer on Intel cores whose PAUSE is slower). With it a
+/// team called again 10 ms later on a quiet host starts as fast as 0.1.3
+/// (evo); 12288 polls (about 300 µs) made that first section 10.8x slower,
+/// because the members had gone to sleep. On aarch64 a YIELD is much cheaper
+/// than a PAUSE; 2^21 aims at the same order of time and is not measured yet.
+const SPIN_POLLS_DEFAULT: u32 = if cfg!(target_arch = "aarch64") {
+    1 << 21
+} else {
+    300_000
+};
+
 /// A fixed set of worker threads that [`Exec`](crate::Exec) tokens place work on.
 ///
 /// `Pool` is the only way to make a pool. It wraps the scheduler privately: no
@@ -47,16 +61,20 @@ const PIN_PARTICIPANTS_DEFAULT: bool = false;
 /// caller), where each call acquires its members with
 /// [`Exec::team`](crate::Exec::team) or uses plain tokens.
 ///
-/// Dropping a `Pool` (or the `Team` that owns it) shuts its workers down and
-/// joins them: when `drop` returns, every worker thread has exited, so the
-/// thread-local destructors of the workers (including state set up by an
-/// [`on_start`](PoolBuilder::on_start) hook) have already run. Without the
-/// `parallel` feature there are no workers and nothing is joined.
+/// Dropping a `Pool` (or the `Team` that owns it) detaches its workers and
+/// waits until each one acknowledged; after that no worker touches the pool.
+/// Workers of a pool with default thread settings are *shared*: they go back,
+/// asleep, to a process-wide reserve that the next pool reuses, so their
+/// threads keep running. A pool with a [`thread_name`](PoolBuilder::thread_name),
+/// an [`on_start`](PoolBuilder::on_start) hook, a stack size or a QoS of its
+/// own has *dedicated* workers, which `drop` joins: when it returns, their
+/// thread-local destructors (including state set up by the hook) have run.
+/// Without the `parallel` feature there are no workers and nothing is joined.
 ///
 /// A pool dropped from one of its own workers cannot wait for itself: that drop
-/// signals shutdown and returns without joining, so the workers exit shortly
-/// after instead of before the return. Drop the pool from a plain thread when
-/// the guarantee matters.
+/// neither waits for nor joins the calling worker, which acknowledges and leaves
+/// after its task returns. Drop the pool from a plain thread when the guarantee
+/// matters.
 ///
 /// # Examples
 ///
@@ -68,14 +86,30 @@ const PIN_PARTICIPANTS_DEFAULT: bool = false;
 /// # Ok::<(), threadteam::Error>(())
 /// ```
 pub struct Pool {
-    // Field order matters: `inner` is dropped (shutdown signalled) before
-    // `joiner` waits for the threads.
+    /// The leased workers (`docs/design/own-threads.md`).
     #[cfg(feature = "parallel")]
-    pub(crate) inner: rayon::ThreadPool,
+    workers: Vec<Arc<crate::worker::WorkerCtl>>,
+    /// Join handles of dedicated workers (empty for shared ones).
     #[cfg(feature = "parallel")]
-    _joiner: Joiner,
+    joins: std::sync::Mutex<Vec<std::thread::JoinHandle<()>>>,
     pub(crate) width: NonZeroUsize,
     pub(crate) awake: Arc<Awake>,
+    /// The private Rayon pool of `Exec::external_rayon` (feature `rayon`).
+    #[cfg(feature = "rayon")]
+    rayon: std::sync::OnceLock<rayon::ThreadPool>,
+}
+
+#[cfg(feature = "rayon")]
+impl Pool {
+    /// This pool's private Rayon pool, built on first use.
+    pub(crate) fn rayon(&self) -> &rayon::ThreadPool {
+        self.rayon.get_or_init(|| {
+            rayon::ThreadPoolBuilder::new()
+                .num_threads(self.width.get())
+                .build()
+                .expect("a private Rayon pool for external_rayon")
+        })
+    }
 }
 
 impl Pool {
@@ -125,10 +159,10 @@ impl Pool {
         self.awake.defaults
     }
 
-    /// Asks idle team members to return their threads to Rayon now.
+    /// Asks idle team members to stop spinning and sleep now.
     ///
-    /// Members that are idle leave at once; members that are reserved leave
-    /// when their reservation ends, so this never revokes a live
+    /// Members that are idle sleep at once; members that are reserved stop
+    /// spinning after their reservation ends, so this never revokes a live
     /// [`TeamExec`](crate::TeamExec). The call does not wait for anything,
     /// so it is safe to make from inside a reservation. A team acquired later
     /// starts its members afresh.
@@ -172,8 +206,27 @@ impl Pool {
         self.awake.pin
     }
 
+    /// The spin budget of this pool's team waits, in polls
+    /// ([`PoolBuilder::spin_polls`]).
+    pub fn spin_polls(&self) -> u32 {
+        self.awake.waits.spin_polls
+    }
+
+    /// How often this pool's waits slept since the pool was built: diagnostics
+    /// for the wait benchmarks (`docs/design/waiting.md`).
+    #[doc(hidden)]
+    pub fn wait_counters(&self) -> WaitCounters {
+        use core::sync::atomic::Ordering::Relaxed;
+        let w = &self.awake.waits;
+        WaitCounters {
+            join_sleeps: w.join_sleeps.load(Relaxed),
+            barrier_sleeps: w.barrier_sleeps.load(Relaxed),
+            member_parks: w.member_parks.load(Relaxed),
+        }
+    }
+
     /// Number of workers currently kept awake as team members, reserved or
-    /// idle. Zero once idle members returned to Rayon. A diagnostic: the value
+    /// idle and still awake. Zero once released members went to sleep. A diagnostic: the value
     /// can change at any moment.
     ///
     /// # Examples
@@ -190,32 +243,37 @@ impl Pool {
 
 impl Drop for Pool {
     fn drop(&mut self) {
-        // Idle members leave their loops so that the workers can be joined.
-        self.awake.shutdown.store(true, Ordering::Release);
-    }
-}
-
-/// The worker threads of a pool, joined when it is dropped.
-#[cfg(feature = "parallel")]
-struct Joiner {
-    handles: std::sync::Arc<std::sync::Mutex<Vec<std::thread::JoinHandle<()>>>>,
-}
-
-#[cfg(feature = "parallel")]
-impl Drop for Joiner {
-    fn drop(&mut self) {
-        let handles = match self.handles.lock() {
-            Ok(mut guard) => std::mem::take(&mut *guard),
-            Err(poisoned) => std::mem::take(&mut *poisoned.into_inner()),
-        };
-        let me = std::thread::current().id();
-        // A worker of this pool cannot join itself: skip joining entirely.
-        if handles.iter().any(|h| h.thread().id() == me) {
-            return;
-        }
-        for handle in handles {
-            // A worker that panicked has still exited; nothing to report.
-            let _ = handle.join();
+        #[cfg(feature = "parallel")]
+        {
+            // Detach every worker, then wait for their acknowledgements: after
+            // its acknowledgement a worker touches nothing of this pool. A
+            // worker of this pool that drops it (its own task owned the pool)
+            // acknowledges once that task returns; nobody waits for it.
+            for s in &*self.awake.slots {
+                s.state.detach();
+                s.park.wake();
+            }
+            let me = self.awake.slot_of_current();
+            for (i, s) in self.awake.slots.iter().enumerate() {
+                // A worker that has not attached yet (a dedicated one still in
+                // its start hook) attaches, sees `DETACH` and acknowledges too.
+                if Some(i) == me {
+                    continue;
+                }
+                self.awake
+                    .waits
+                    .sync
+                    .park_while(|| !s.acked.load(Ordering::SeqCst));
+            }
+            let joins = std::mem::take(&mut *self.joins.lock().unwrap_or_else(|e| e.into_inner()));
+            let my_thread = std::thread::current().id();
+            for j in joins {
+                if j.thread().id() != my_thread {
+                    // A worker that panicked has still exited.
+                    let _ = j.join();
+                }
+            }
+            drop(core::mem::take(&mut self.workers));
         }
     }
 }
@@ -252,6 +310,7 @@ pub struct PoolBuilder {
     qos: Option<Qos>,
     costs: DispatchCosts,
     pin_participants: bool,
+    spin_polls: u32,
 }
 
 impl PoolBuilder {
@@ -266,6 +325,7 @@ impl PoolBuilder {
             qos: None,
             costs: DispatchCosts::host_default(),
             pin_participants: PIN_PARTICIPANTS_DEFAULT,
+            spin_polls: SPIN_POLLS_DEFAULT,
         }
     }
 
@@ -338,8 +398,9 @@ impl PoolBuilder {
         self
     }
 
-    /// Default spin time of an unreserved idle team member before it returns
-    /// its thread to Rayon. Defaults to 200 ms; zero returns it immediately.
+    /// Default idle spin of an unreserved team member before it sleeps.
+    /// Defaults to 200 ms; zero puts it to sleep immediately. Any nonzero value
+    /// lets it spin for the pool's spin budget ([`spin_polls`](Self::spin_polls)).
     ///
     /// Operations may override it with [`WaitOverride`](crate::WaitOverride).
     /// A reserved member never leaves on a timeout.
@@ -359,11 +420,9 @@ impl PoolBuilder {
         self
     }
 
-    /// Default for whether unreserved idle members run Rayon jobs while they
-    /// spin. Defaults to `false`: native team execution keeps them for the
-    /// next reservation. `true` is the compatibility mode in which an idle
-    /// member serves Rayon work (an acquisition then refuses a member that is
-    /// inside such a job instead of waiting for it).
+    /// **No effect** since threadteam runs its own worker threads
+    /// (`docs/design/own-threads.md`): an idle worker always serves the pool's
+    /// queued tasks. Kept so that existing code compiles.
     ///
     /// # Examples
     ///
@@ -472,7 +531,8 @@ impl PoolBuilder {
     /// coordinating thread, so that thread must keep its CPU set.
     ///
     /// A member saves its previous mask in its own slot and restores it
-    /// *itself* before it stops being reserved: before it returns to Rayon, and
+    /// *itself* before it stops being reserved: before it serves the pool's
+    /// queue again, before it leaves the pool, and
     /// before its thread serves work that is not its team's — while it is lent
     /// by [`Exec::external`](crate::Exec::external), and when it runs such work
     /// itself (a member that leads a `fork` child and calls `external`). No
@@ -531,6 +591,28 @@ impl PoolBuilder {
         self
     }
 
+    /// Spin budget of a team wait, in polls of one PAUSE (YIELD on aarch64):
+    /// how long a reserved member waiting for work, a leader in a section's
+    /// join, or a participant in a barrier spins before it yields a few times
+    /// and then sleeps until woken (`docs/design/waiting.md`; the shape of
+    /// libgomp's `GOMP_SPINCOUNT`). A count, so a waiter that is descheduled
+    /// does not spend it while it waits for its CPU. Zero sleeps after the
+    /// yields. An oversubscribed scope uses at most 100 polls. It also bounds
+    /// how long an idle worker keeps polling before it sleeps.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// let pool = threadteam::Pool::builder().threads(2).spin_polls(4096).build()?;
+    /// assert_eq!(pool.spin_polls(), 4096);
+    /// # Ok::<(), threadteam::Error>(())
+    /// ```
+    #[must_use]
+    pub fn spin_polls(mut self, polls: u32) -> Self {
+        self.spin_polls = polls;
+        self
+    }
+
     /// Starts the workers.
     ///
     /// Without the `parallel` feature no thread is started and the pool has
@@ -560,60 +642,56 @@ impl PoolBuilder {
         let n = self
             .threads
             .unwrap_or_else(|| std::thread::available_parallelism().map_or(1, NonZeroUsize::get));
-        let handles = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
-        let sink = std::sync::Arc::clone(&handles);
-        let qos = self.qos.or(Qos::PLATFORM_DEFAULT);
-        let mut builder = rayon::ThreadPoolBuilder::new()
-            .num_threads(n)
-            .stack_size(self.stack_size)
-            .spawn_handler(move |thread| {
-                let mut b = std::thread::Builder::new();
-                if let Some(name) = thread.name() {
-                    b = b.name(name.to_owned());
-                }
-                if let Some(size) = thread.stack_size() {
-                    b = b.stack_size(size);
-                }
-                let handle = b.spawn(move || {
-                    if let Some(q) = qos {
-                        q.apply_to_current_thread();
-                    }
-                    thread.run()
-                })?;
-                match sink.lock() {
-                    Ok(mut guard) => guard.push(handle),
-                    Err(poisoned) => poisoned.into_inner().push(handle),
-                }
-                Ok(())
+        // Workers of the reserve have the default stack, the platform's QoS
+        // and no hooks; any other setting gets dedicated workers.
+        let shared = self.thread_name.is_none()
+            && self.on_start.is_none()
+            && self.stack_size == DEFAULT_STACK_BYTES
+            && self.qos.is_none();
+        let on_start: Option<Arc<dyn Fn(usize) + Send + Sync>> = self.on_start.map(Arc::from);
+        let how = crate::worker::Spawn {
+            stack: self.stack_size,
+            name: self.thread_name.as_deref(),
+            on_start,
+            qos: self.qos,
+            shared,
+        };
+        let (workers, joins) =
+            crate::worker::obtain(n, &how).map_err(|e| Error::PoolBuild(e.to_string()))?;
+        let width = NonZeroUsize::new(n).unwrap_or(NonZeroUsize::MIN);
+        let awake = Arc::new(Awake::new(
+            width.get(),
+            self.wait,
+            self.acquire_timeout,
+            self.costs,
+            self.pin_participants,
+            self.spin_polls,
+        ));
+        // A reused worker takes the caller's CPU set, as a thread it spawned
+        // would. A dedicated worker was spawned by this caller and inherited
+        // it already; resetting it would undo the pinning of an `on_start` hook.
+        let mask = if shared {
+            crate::pin::read_here()
+        } else {
+            None
+        };
+        for (id, w) in workers.iter().enumerate() {
+            w.assign(crate::worker::Lease {
+                aw: Arc::clone(&awake),
+                id,
+                mask,
             });
-        if let Some(name) = self.thread_name {
-            builder = builder.thread_name(name);
         }
-        if let Some(hook) = self.on_start {
-            builder = builder.start_handler(hook);
-        }
-        // On failure `builder` drops its handler, but threads already started
-        // are signalled by rayon and detached; join them here for determinism.
-        let built = builder.build();
-        let inner = match built {
-            Ok(inner) => inner,
-            Err(e) => {
-                drop(Joiner { handles });
-                return Err(Error::PoolBuild(e.to_string()));
-            }
-        };
-        let width = NonZeroUsize::new(inner.current_num_threads()).unwrap_or(NonZeroUsize::MIN);
+        // Workers attach on their own (after a start hook, for dedicated
+        // ones); until then a slot is not claimable by a team, and queued work
+        // waits for them.
         Ok(Pool {
-            inner,
-            _joiner: Joiner { handles },
+            workers,
+            joins: std::sync::Mutex::new(joins),
             width,
-            awake: Arc::new(Awake::new(
-                width.get(),
-                self.wait,
-                self.acquire_timeout,
-                self.costs,
-                self.pin_participants,
-            )),
+            awake,
+            #[cfg(feature = "rayon")]
+            rayon: std::sync::OnceLock::new(),
         })
     }
 
@@ -627,6 +705,7 @@ impl PoolBuilder {
                 self.acquire_timeout,
                 self.costs,
                 self.pin_participants,
+                self.spin_polls,
             )),
         })
     }
@@ -651,22 +730,135 @@ mod tests {
     use std::time::Duration;
 
     /// The last reference is dropped on a worker of the pool itself: the drop
-    /// must not wait for its own thread.
+    /// must not wait for its own thread (it detaches the others, waits for
+    /// their acknowledgements and skips itself; the worker acknowledges and
+    /// leaves after its task). Public entries always borrow the pool while
+    /// their tasks run, so the task here is published on the pool's queue
+    /// directly, as the Rayon version used `spawn`.
     #[test]
     fn drop_from_a_worker_of_the_pool_does_not_hang() {
-        let pool = Arc::new(Pool::builder().threads(2).build().unwrap());
-        let last = Arc::clone(&pool);
-        let (gate_tx, gate_rx) = mpsc::channel::<()>();
+        for shared in [true, false] {
+            let mut b = Pool::builder().threads(2);
+            if !shared {
+                b = b.thread_name(|i| format!("self-drop-{i}"));
+            }
+            let pool = Arc::new(b.build().unwrap());
+            let aw = Arc::clone(&pool.awake);
+            let last = std::sync::Mutex::new(Some(Arc::clone(&pool)));
+            let task = |_: usize| {
+                // The last reference: runs `Pool::drop` on this worker.
+                drop(last.lock().unwrap().take());
+            };
+            unsafe fn call<F: Fn(usize)>(data: *const (), i: usize) {
+                (*data.cast::<F>())(i)
+            }
+            fn call_of<F: Fn(usize)>(_: &F) -> unsafe fn(*const (), usize) {
+                call::<F>
+            }
+            // SAFETY: `task` and the waker (held by `aw`) outlive the batch,
+            // which this test waits for before they go out of scope.
+            let batch = unsafe {
+                crate::park::Batch::new(
+                    call_of(&task),
+                    (&task as *const _ as *const ()).cast(),
+                    1,
+                    &aw.waits.sync,
+                )
+            };
+            aw.queue.publish(&batch);
+            aw.wake_for_work();
+            drop(pool);
+            let (tx, rx) = mpsc::channel::<()>();
+            std::thread::scope(|s| {
+                s.spawn(|| {
+                    let mut w = crate::park::Waiter::new(0);
+                    batch.done.wait(Some(&aw.waits.sync), &mut w);
+                    tx.send(()).unwrap();
+                });
+                rx.recv_timeout(Duration::from_secs(10))
+                    .expect("drop on a worker hung");
+            });
+            assert!(
+                last.lock().unwrap().is_none(),
+                "the pool was dropped by its worker"
+            );
+        }
+    }
+
+    /// Waits nest: an inner wait that returns leaves the outer one wakeable
+    /// for new work of the pool (`wake_for_work` looks at `helping`).
+    #[test]
+    fn a_nested_wait_keeps_the_outer_wait_wakeable() {
+        let pool = Pool::builder().threads(1).build().unwrap();
+        let aw = &pool.awake;
+        let helping = || aw.slots[0].helping.load(Ordering::SeqCst);
+        // Both conditions hold at once, so neither wait runs work of slot 0
+        // (whose worker serves it meanwhile).
+        aw.help_while(0, || {
+            aw.help_while(0, || true);
+            assert!(helping(), "the inner wait cleared the outer one's flag");
+            true
+        });
+        assert!(!helping());
+    }
+
+    /// A broadcast that completed and was unlinked before a worker outside
+    /// its budget looked: that worker's cursor still moves past it, so it
+    /// does not see pending work forever (and never parks).
+    #[test]
+    fn a_cursor_moves_past_a_broadcast_unlinked_before_it_looked() {
+        unsafe fn nothing(_: *const (), _: usize) {}
+        let waker = Arc::new(crate::park::Parker::new());
+        let list = crate::park::BroadcastList::new();
+        // SAFETY: `waker` outlives the broadcast; `nothing` reads no data.
+        let b = unsafe { crate::park::Broadcast::new(nothing, core::ptr::null(), 2, &waker) };
+        list.publish(&b);
+        for i in 0..2 {
+            let mut seq = 0;
+            let share = list.next_for(i, &mut seq).expect("a share for i");
+            // SAFETY: linked, alive, and targets `i`.
+            unsafe { crate::park::Broadcast::run_share(share, i) };
+        }
+        list.unlink(&b);
+        let mut seq = 0;
+        assert!(list.has_after(seq));
+        assert!(list.next_for(2, &mut seq).is_none());
+        assert!(!list.has_after(seq), "the cursor stayed before it");
+    }
+
+    /// A pool built, used and dropped inside a task of another pool: the drop
+    /// waits for the inner pool's workers only, never for the outer worker it
+    /// runs on (a pool cannot be dropped from one of its own workers: every
+    /// task's caller borrows the pool).
+    #[test]
+    fn a_pool_dropped_inside_a_task_of_another_pool_does_not_hang() {
+        let outer = Pool::builder().threads(2).build().unwrap();
         let (done_tx, done_rx) = mpsc::channel::<()>();
-        pool.inner.spawn(move || {
-            gate_rx.recv().unwrap();
-            drop(last); // the last reference: runs `Pool::drop` on this worker
-            done_tx.send(()).unwrap();
+        let done_tx = std::sync::Mutex::new(Some(done_tx));
+        crate::Exec::new(&outer, 2).unwrap().fork(2, |i, _| {
+            if i == 0 {
+                let inner = Arc::new(Pool::builder().threads(2).build().unwrap());
+                crate::Exec::new(&inner, 2).unwrap().fork(2, |_, _| {});
+                drop(inner);
+                if let Some(tx) = done_tx.lock().unwrap().take() {
+                    tx.send(()).unwrap();
+                }
+            }
         });
-        drop(pool);
-        gate_tx.send(()).unwrap();
         done_rx
             .recv_timeout(Duration::from_secs(10))
-            .expect("drop on a worker hung");
+            .expect("a drop inside another pool's task hung");
     }
 }
+
+/// Counters of [`Pool::wait_counters`] (a diagnostic for the wait benchmarks).
+#[doc(hidden)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct WaitCounters {
+    /// Leaders that slept in a section's join.
+    pub join_sleeps: u64,
+    /// Participants that slept in a barrier.
+    pub barrier_sleeps: u64,
+    /// Reserved members that parked waiting for work.
+    pub member_parks: u64,
+}
diff --git a/src/reserve.rs b/src/reserve.rs
index 4ec6b96..b5253d7 100644
--- a/src/reserve.rs
+++ b/src/reserve.rs
@@ -36,23 +36,24 @@ impl Drop for LeaderGuard<'_> {
 /// [`exec`](Team::exec). A minted token is an ordinary [`Exec`] that carries
 /// the team's authority:
 ///
-/// * `fork` and `for_ranges` dispatch as team sections: no Rayon entry, no
+/// * `fork` and `for_ranges` dispatch as team sections: no queue entry, no
 ///   wake-up, no allocation. Children of `fork` carry the sub-team of their
 ///   share, so nested forks stay on reserved members.
 /// * `broadcast` runs on the reserved members (a `fork` child may broadcast
 ///   too: its members are its own); `can_broadcast` is always true.
 /// * `team` returns the carried (sub)team at once, without acquisition.
 /// * `external` hands the width as on any token and **lends the token's
-///   members to the pool for the call**: they run the pool's Rayon jobs (the
-///   library's work) instead of idling, and resume team service when the call
-///   returns. A lent job that is still running delays the next section until it
-///   finishes.
+///   members to the pool for the call**: they run the pool's queued tasks
+///   instead of idling, and resume team service when the call returns. A lent
+///   task that is still running delays the next section until it finishes.
 ///
-/// Reserved members spin for the reservation's `idle_spin`, then **park**
-/// while staying reserved: they do not return to Rayon until the `Team` is
-/// dropped. The next dispatch wakes them with one condition-variable broadcast,
-/// which costs a syscall on the first dispatch after a park
-/// (`benches/wake_probe.rs`) and one atomic load for a warm one.
+/// Reserved members wait for work in staged episodes: they spin for the pool's
+/// spin budget ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)),
+/// yield a few times, then **park** while staying reserved; they serve nothing
+/// else until the `Team` is dropped (`docs/design/waiting.md`). The next
+/// dispatch wakes a parked member through its slot's parker, which costs a
+/// syscall on the first dispatch after a park (`benches/wake_probe.rs`) and one
+/// atomic read-modify-write for a warm one.
 ///
 /// # Serialization of callers
 ///
@@ -66,8 +67,8 @@ impl Drop for LeaderGuard<'_> {
 /// A `Team` **owns** its [`Pool`] and has no lifetime: an engine stores a `Team`
 /// (or a plain `Pool` when it wants no team). `Pool` is not `Clone`, no method
 /// hands out a second handle, and [`pool`](Team::pool) only borrows. Dropping
-/// the `Team` releases the members and then drops the pool, which joins the
-/// workers; [`into_pool`](Team::into_pool) releases the members and gives the
+/// the `Team` releases the members and then drops the pool (see [`Pool`] for
+/// what that does to its workers); [`into_pool`](Team::into_pool) releases the members and gives the
 /// pool back instead. Tokens borrow the `Team`, so none outlives it.
 ///
 /// # Examples
@@ -149,9 +150,9 @@ impl Pool {
     /// long as it lives.
     ///
     /// `width` counts the leader and is clamped to the pool width; zero is
-    /// treated as one. Acquisition never waits for a running Rayon job (see
-    /// [`Exec::team`](crate::Exec::team)). Members park after the pool's
-    /// `idle_spin` without work.
+    /// treated as one. Acquisition never takes a worker that runs a task (see
+    /// [`Exec::team`](crate::Exec::team)). Members park after the pool's spin
+    /// budget without work ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)).
     ///
     /// # Errors
     ///
@@ -174,8 +175,10 @@ impl Pool {
         self.into_team_with(width, WaitOverride::new())
     }
 
-    /// [`into_team`](Pool::into_team) with an override of the park delay
-    /// (`idle_spin`) of the reserved members.
+    /// [`into_team`](Pool::into_team) with an override of the wait policy of
+    /// the reservation. The reserved members' waits for work use the pool's spin
+    /// budget, not `idle_spin` (`docs/design/waiting.md`); the override is kept
+    /// for the policy the team reports.
     ///
     /// # Errors
     ///
@@ -185,13 +188,14 @@ impl Pool {
         let policy = self.wait_policy().with(over);
         // On drop the members leave at once.
         let release = WaitPolicy::new(Duration::ZERO, false);
-        let reservation = match self
-            .awake
-            .acquire(&self, width - 1, release, policy.idle_spin())
-        {
-            Ok(r) => r,
-            Err(reason) => return Err(IntoTeamError { pool: self, reason }),
-        };
+        let reservation =
+            match self
+                .awake
+                .acquire(width - 1, release, self.awake.spin_budget(false))
+            {
+                Ok(r) => r,
+                Err(reason) => return Err(IntoTeamError { pool: self, reason }),
+            };
         let team = Team {
             reservation,
             policy,
@@ -306,15 +310,14 @@ impl Team {
         let ids = &self.reservation.ids[..budget - 1];
         // Root-scope entry of the token: `exec` is serialized (one leader at a
         // time), so the calling thread's CPU set decides here whether the scope
-        // is oversubscribed. When it is, the members park after their short
-        // spin instead of spinning for the whole park delay; otherwise they get
-        // the policy's delay. `Exec::team_with` on the minted token repeats
+        // is oversubscribed. When it is, the members' waits get the throttled
+        // spin budget; otherwise the pool's. `Exec::team_with` on the minted token repeats
         // this on the thread that enters each scope, so a token that travels to
         // a thread with a different CPU set is paced by that set.
         let oversubscribed = crate::pin::oversubscribed(budget);
         self.pool
             .awake
-            .set_park_ns(ids, crate::pin::park_delay(self.policy, oversubscribed));
+            .set_spin_budget(ids, self.pool.awake.spin_budget(oversubscribed));
         let auth = TeamAuth {
             awake: &self.pool.awake,
             ids,
diff --git a/src/sched.rs b/src/sched.rs
index b1f8a21..efa275f 100644
--- a/src/sched.rs
+++ b/src/sched.rs
@@ -10,7 +10,7 @@ use crate::track::Track;
 /// Whether the calling thread is a worker of `pool`.
 #[cfg(feature = "parallel")]
 pub(crate) fn in_pool(pool: &Pool) -> bool {
-    pool.inner.current_thread_index().is_some()
+    pool.awake.slot_of_current().is_some()
 }
 
 #[cfg(not(feature = "parallel"))]
@@ -31,42 +31,108 @@ pub(crate) fn in_pool(_pool: &Pool) -> bool {
 /// re-pins at the next pin section.
 #[cfg(feature = "parallel")]
 pub(crate) fn unpin_worker(pool: &Pool) {
-    if let Some(worker) = pool.inner.current_thread_index() {
+    if let Some(worker) = pool.awake.slot_of_current() {
         pool.awake.unpin_member(worker);
     }
 }
 
-/// Runs `task(0..tasks)` concurrently on `pool` and waits for all of them.
+/// Who waits for a batch of `pool`, and how (`docs/design/own-threads.md`).
+#[cfg(feature = "parallel")]
+enum Waiter {
+    /// A worker of `pool` itself (slot index): it runs its own batch's tasks
+    /// first, then serves the pool while it waits.
+    Own(usize),
+    /// A worker of another pool: it serves its own pool while it waits, so a
+    /// cross-pool chain (A -> B -> A) always makes progress.
+    Foreign(std::sync::Arc<crate::awake::Awake>, usize),
+    /// A plain thread: it sleeps on the pool's parker.
+    Outside,
+}
+
+#[cfg(feature = "parallel")]
+fn waiter_of(pool: &Pool) -> Waiter {
+    if let Some(i) = pool.awake.slot_of_current() {
+        Waiter::Own(i)
+    } else if let Some((aw, i)) = crate::worker::current_worker() {
+        Waiter::Foreign(aw, i)
+    } else {
+        Waiter::Outside
+    }
+}
+
+#[cfg(feature = "parallel")]
+impl Waiter {
+    /// The parker the last completion wakes.
+    fn parker<'a>(&'a self, pool: &'a Pool) -> &'a std::sync::Arc<crate::park::Parker> {
+        match self {
+            Waiter::Own(i) => &pool.awake.slots[*i].park,
+            Waiter::Foreign(aw, i) => &aw.slots[*i].park,
+            Waiter::Outside => &pool.awake.waits.sync,
+        }
+    }
+
+    /// Waits until `done` holds.
+    fn wait(&self, pool: &Pool, done: &crate::park::Completion) {
+        match self {
+            Waiter::Own(i) => pool.awake.help_while(*i, || done.is_done_now()),
+            Waiter::Foreign(aw, i) => aw.help_while(*i, || done.is_done_now()),
+            Waiter::Outside => {
+                let mut w = crate::park::Waiter::new(pool.awake.waits.spin_polls);
+                done.wait(Some(&pool.awake.waits.sync), &mut w);
+            }
+        }
+    }
+}
+
+/// Runs `task(0..tasks)` on `pool` and waits for all of them.
 ///
-/// The tasks form a recursive binary `rayon::join` tree, whose jobs live on the
-/// stack, so a steady-state call allocates nothing.
+/// The tasks form one batch on the caller's stack, published on the pool's
+/// queue, so a steady-state call allocates nothing.
 ///
-/// * Caller is a worker of `pool`: the tree runs directly on the caller.
-///   Nothing is installed.
-/// * Caller is a plain thread or a worker of another pool: one
-///   `ThreadPool::install` (a stack job) around the tree; every task runs on a
-///   worker of `pool` and the caller waits.
+/// * Caller is a worker of `pool`: it runs the batch's unclaimed tasks itself,
+///   then serves the pool until the others finish.
+/// * Caller is a worker of another pool: the pool's workers run the tasks; the
+///   caller serves its own pool meanwhile.
+/// * Caller is a plain thread: every task runs on a worker of `pool` and the
+///   caller sleeps until the last one finishes.
 ///
-/// `rayon::join` is only reached on a worker of `pool` (inside `install`, or
-/// when the caller already is one), so it never touches the global registry.
+/// A panicking task does not stop the others; the first panic is resumed once
+/// all of them finished.
 #[cfg(feature = "parallel")]
 pub(crate) fn run_tasks<F: Fn(usize) + Sync>(pool: &Pool, tasks: usize, track: &Track, task: F) {
-    if in_pool(pool) {
-        join_tree(0, tasks, &task);
-    } else {
+    if tasks == 0 {
+        return;
+    }
+    unsafe fn call<F: Fn(usize)>(data: *const (), i: usize) {
+        // SAFETY: `data` is the `&F` of `run_tasks`, alive until the batch is done.
+        (*data.cast::<F>())(i)
+    }
+    let waiter = waiter_of(pool);
+    if !matches!(waiter, Waiter::Own(_)) {
         track.note_install();
-        pool.inner.install(|| join_tree(0, tasks, &task));
     }
-}
-
-/// Runs `task(lo..hi)` as a balanced join tree. Must run on a pool worker.
-#[cfg(feature = "parallel")]
-fn join_tree<F: Fn(usize) + Sync>(lo: usize, hi: usize, task: &F) {
-    if hi - lo == 1 {
-        task(lo);
-    } else {
-        let mid = lo + (hi - lo) / 2;
-        rayon::join(|| join_tree(lo, mid, task), || join_tree(mid, hi, task));
+    // SAFETY: `call::<F>` and `task` belong together; both outlive the batch,
+    // which this function waits for; the waker is kept alive by `waiter` (or
+    // the pool) until the wait below returns.
+    let batch = unsafe {
+        crate::park::Batch::new(
+            call::<F>,
+            (&task as *const F).cast(),
+            tasks,
+            waiter.parker(pool),
+        )
+    };
+    pool.awake.queue.publish(&batch);
+    pool.awake.wake_for_work();
+    if let Waiter::Own(_) = waiter {
+        while let Some(k) = pool.awake.queue.claim_own(&batch) {
+            // SAFETY: index `k` of our own batch was claimed here.
+            unsafe { crate::park::Batch::run_claimed(&batch, k) };
+        }
+    }
+    waiter.wait(pool, &batch.done);
+    if let Some(payload) = batch.take_panic() {
+        std::panic::resume_unwind(payload);
     }
 }
 
@@ -77,32 +143,88 @@ pub(crate) fn run_tasks<F: Fn(usize) + Sync>(_pool: &Pool, tasks: usize, _track:
     }
 }
 
-/// Runs `f` on a worker of `pool`, installing only when the caller is not one.
+/// Runs `f` on a worker of `pool`: inline when the caller is one, otherwise as
+/// a one-task batch while the caller waits.
 #[cfg(feature = "parallel")]
 pub(crate) fn enter<R: Send>(pool: &Pool, track: &Track, f: impl FnOnce() -> R + Send) -> R {
     if in_pool(pool) {
-        f()
-    } else {
-        track.note_install();
-        pool.inner.install(f)
+        return f();
     }
+    // No lock: a `Mutex` allocates on its first lock on some platforms
+    // (macOS), and this runs on every call.
+    let job = Handoff(core::cell::UnsafeCell::new(Some(f)));
+    let out = Handoff(core::cell::UnsafeCell::new(None));
+    run_tasks(pool, 1, track, |_| {
+        // SAFETY: the batch has one index, claimed exactly once (under the
+        // queue lock), so this body runs once; the caller reads `out` only
+        // after the batch's completion, which orders this write before it.
+        let f = unsafe { job.take() };
+        if let Some(f) = f {
+            let r = f();
+            // SAFETY: as above.
+            unsafe { out.put(r) };
+        }
+    });
+    let r = out.0.into_inner();
+    r.expect("the task ran")
 }
 
-/// Runs `f(i)` for every worker index `i < budget` at once, or reports that the
-/// caller already is a worker of `pool`.
+/// A value passed into and out of the single task of [`enter`]'s batch: that
+/// task is its only user until the batch completes.
+#[cfg(feature = "parallel")]
+struct Handoff<T>(core::cell::UnsafeCell<Option<T>>);
+
+// SAFETY: one thread at a time touches the value: the task while it runs, the
+// caller after the batch completed (see `enter`); `T: Send` lets it move.
+#[cfg(feature = "parallel")]
+unsafe impl<T: Send> Sync for Handoff<T> {}
+
+#[cfg(feature = "parallel")]
+impl<T> Handoff<T> {
+    /// # Safety
+    /// No other thread accesses the value meanwhile.
+    unsafe fn take(&self) -> Option<T> {
+        (*self.0.get()).take()
+    }
+
+    /// # Safety
+    /// As [`take`](Self::take).
+    unsafe fn put(&self, v: T) {
+        *self.0.get() = Some(v);
+    }
+}
+
+/// Runs `f(i)` for every worker index `i < budget` at once, each on worker
+/// `i` of `pool`. The caller is never a worker of `pool` (`Exec::broadcast`
+/// refuses that); it waits, serving its own pool if it is a worker of one.
 #[cfg(feature = "parallel")]
 pub(crate) fn broadcast(pool: &Pool, track: &Track, budget: usize, f: impl Fn(usize) + Sync) {
-    // No gate is needed: rayon pushes the per-worker jobs of one broadcast
-    // under a single lock, so every worker sees concurrent broadcasts in the
-    // same order and two of them cannot each hold part of the workers. A gate
-    // would deadlock a foreign-pool caller that steals a second broadcast onto
-    // its own stack while waiting.
     track.note_install();
-    pool.inner.broadcast(|ctx| {
-        let i = ctx.index();
-        if i < budget {
-            let _live = track.task();
-            f(i);
-        }
-    });
+    let task = |i: usize| {
+        let _live = track.task();
+        f(i);
+    };
+    unsafe fn call<F: Fn(usize)>(data: *const (), i: usize) {
+        // SAFETY: `data` is the `&F` of `broadcast`, alive until it is done.
+        (*data.cast::<F>())(i)
+    }
+    fn data_of<F>(f: &F) -> *const () {
+        (f as *const F).cast()
+    }
+    fn call_of<F: Fn(usize)>(_: &F) -> unsafe fn(*const (), usize) {
+        call::<F>
+    }
+    let waiter = waiter_of(pool);
+    // SAFETY: as in `run_tasks`; the broadcast is unlinked below, after all of
+    // its shares completed and before it goes out of scope.
+    let b = unsafe {
+        crate::park::Broadcast::new(call_of(&task), data_of(&task), budget, waiter.parker(pool))
+    };
+    pool.awake.bcast.publish(&b);
+    pool.awake.wake_for_work();
+    waiter.wait(pool, &b.done);
+    pool.awake.bcast.unlink(&b);
+    if let Some(payload) = b.take_panic() {
+        std::panic::resume_unwind(payload);
+    }
 }
diff --git a/src/sync.rs b/src/sync.rs
index 5567a42..f368192 100644
--- a/src/sync.rs
+++ b/src/sync.rs
@@ -3,11 +3,11 @@
 
 #[cfg(loom)]
 pub(crate) use loom::sync::{
-    atomic::{AtomicUsize, Ordering},
+    atomic::{AtomicBool, AtomicUsize, Ordering},
     Condvar, Mutex,
 };
 #[cfg(not(loom))]
 pub(crate) use std::sync::{
-    atomic::{AtomicUsize, Ordering},
+    atomic::{AtomicBool, AtomicUsize, Ordering},
     Condvar, Mutex,
 };
diff --git a/src/team.rs b/src/team.rs
index 9bac2b4..bcb7fde 100644
--- a/src/team.rs
+++ b/src/team.rs
@@ -79,13 +79,15 @@ impl Participant<'_> {
 ///   `budget - 1` pool workers. Before any section runs, every participant
 ///   acknowledged on its own thread (a rendezvous), so barriers inside
 ///   sections cannot deadlock for lack of threads.
-/// * Reserved members spin with one PAUSE per poll, then park once the park
-///   delay (`idle_spin`) has passed since their own last share; they run no
-///   unrelated Rayon job and do not leave on a timeout, also between sections
-///   and during a long serial phase of the leader. They are returned when the
-///   scope ends. In a root scope with more participants than CPUs in the
-///   caller's affinity mask the delay is zero, so they park after a short spin
-///   instead of holding a CPU.
+/// * Every wait of a team is a staged episode (`docs/design/waiting.md`): a
+///   reserved member waiting for work, the leader in a section's join, and a
+///   participant in a barrier spin with one PAUSE per poll for the pool's spin
+///   budget ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)), yield
+///   a few times, then sleep until woken. Members run no unrelated task and
+///   do not leave on a timeout, also between sections and during a long serial
+///   phase of the leader; they are returned when the scope ends. In a root scope
+///   with more participants than CPUs in the caller's affinity mask, the spin
+///   is throttled to 100 polls, so waiters free their CPUs quickly.
 /// * If the pool pins members
 ///   ([`PoolBuilder::pin_participants`](crate::PoolBuilder::pin_participants)),
 ///   member `k` of a root scope (participant `k >= 1`) runs on the `k`-th CPU of
@@ -294,7 +296,7 @@ impl<'team> TeamExec<'team> {
     /// The same authority with `over` applied to the scoped policy.
     ///
     /// Children inherit the effective policy. An override never weakens a
-    /// reservation: members stay reserved and run no unrelated Rayon job
+    /// reservation: members stay reserved and run no unrelated task
     /// whatever the policy says. The policy of the *root* reservation governs
     /// the idle interval after it ends; a child's override expires when the
     /// child returns and cannot release the parent's members.
@@ -571,6 +573,7 @@ where
         slot_call::<S>,
         (slot_of as *const S).cast(),
         geometry,
+        awake.map(|a| &a.waits),
     );
     let dispatched = geometry.dispatched;
     let guard = JoinGuard(&sec);
diff --git a/src/tests/mod.rs b/src/tests/mod.rs
index ea7a00b..6e9b33c 100644
--- a/src/tests/mod.rs
+++ b/src/tests/mod.rs
@@ -1,3 +1,4 @@
 #[cfg(all(feature = "parallel", target_os = "linux"))]
 mod placement;
 mod split;
+mod waiting;
diff --git a/src/tests/placement.rs b/src/tests/placement.rs
index 5678605..16bf618 100644
--- a/src/tests/placement.rs
+++ b/src/tests/placement.rs
@@ -72,6 +72,7 @@ fn a_section_carries_the_oversubscription_flag_it_was_built_with() {
         slot_of,
         std::ptr::null(),
         geometry(false),
+        None,
     );
     assert!(!quiet.over);
     let crowded = Section::new(
@@ -80,6 +81,7 @@ fn a_section_carries_the_oversubscription_flag_it_was_built_with() {
         slot_of,
         std::ptr::null(),
         geometry(true),
+        None,
     );
     assert!(crowded.over);
 }
@@ -178,3 +180,50 @@ fn a_team_scope_takes_the_oversubscription_from_the_thread_that_enters_it() {
     );
     assert!(scoped.1, "a fork child inherits the root's pressure");
 }
+
+/// The budget a root scope chooses at entry: the throttled one when its
+/// participants outnumber the caller's CPUs, the pool's otherwise; and a
+/// persistent team's token does the same at every root-scope entry.
+#[test]
+fn a_root_scope_chooses_the_throttled_spin_budget_when_oversubscribed() {
+    use crate::park::THROTTLED_POLLS;
+    let budget = 50_000;
+    let pool = |width| {
+        Pool::builder()
+            .threads(width)
+            .spin_polls(budget)
+            .acquire_timeout(Duration::from_secs(10))
+            .build()
+            .unwrap()
+    };
+    on_two_cpus(|| {
+        let crowded = pool(4);
+        let mut exec = Exec::new(&crowded, 4).unwrap();
+        exec.team(|team| {
+            let awake = team.awake.expect("a pool");
+            assert!(!team.ids.is_empty());
+            for &id in team.ids {
+                assert_eq!(awake.slot_spin_budget(id), THROTTLED_POLLS);
+            }
+        })
+        .expect("an idle pool");
+        drop(exec);
+        let team = crowded.into_team(4).expect("an idle pool");
+        let mut exec = team.exec(4);
+        exec.team(|t| {
+            for &id in t.ids {
+                assert_eq!(t.awake.unwrap().slot_spin_budget(id), THROTTLED_POLLS);
+            }
+        })
+        .expect("a team token opens its scope");
+
+        let fits = pool(2);
+        let mut exec = Exec::new(&fits, 2).unwrap();
+        exec.team(|team| {
+            for &id in team.ids {
+                assert_eq!(team.awake.unwrap().slot_spin_budget(id), budget);
+            }
+        })
+        .expect("an idle pool");
+    });
+}
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
new file mode 100644
index 0000000..ef5cc9d
--- /dev/null
+++ b/src/tests/waiting.rs
@@ -0,0 +1,36 @@
+//! The staged wait of `crate::park::Waiter` (`docs/design/waiting.md`).
+
+use crate::park::{Step, Waiter};
+
+/// Steps until the waiter says sleep; the number of `Poll` steps before it.
+fn polls_until_sleep(w: &mut Waiter) -> u32 {
+    let mut n = 0;
+    while w.step() == Step::Poll {
+        n += 1;
+        assert!(n < 10_000_000, "never sleeps");
+    }
+    n
+}
+
+#[test]
+fn a_wait_spins_its_budget_then_yields_sixteen_times_then_sleeps() {
+    for budget in [0u32, 1, 63, 64, 1000] {
+        let mut w = Waiter::new(budget);
+        assert_eq!(polls_until_sleep(&mut w), budget + 16, "budget {budget}");
+        assert!(w.slept());
+        // It stays asleep-ready: every further step says sleep.
+        assert_eq!(w.step(), Step::Sleep);
+    }
+}
+
+#[test]
+fn a_descheduled_spinner_keeps_its_budget() {
+    // Nothing reads a clock: a waiter that was off its CPU for a while spins
+    // exactly as many polls as one that was not (libgomp's waits).
+    let mut w = Waiter::new(1_000);
+    for _ in 0..64 {
+        assert_eq!(w.step(), Step::Poll);
+    }
+    std::thread::sleep(std::time::Duration::from_millis(2));
+    assert_eq!(polls_until_sleep(&mut w), 1_000 - 64 + 16);
+}
diff --git a/src/worker.rs b/src/worker.rs
new file mode 100644
index 0000000..e5ed338
--- /dev/null
+++ b/src/worker.rs
@@ -0,0 +1,266 @@
+//! The worker threads and the process-wide reserve (`docs/design/own-threads.md`).
+//!
+//! A worker is a `std::thread` that serves one pool at a time: a [`Lease`]
+//! names the pool's shared state and the worker's slot in it. Between leases a
+//! *shared* worker waits, asleep, in the process-wide reserve, so that a pool
+//! built after another one was dropped (faer's `with_team` builds one per
+//! call) reuses running threads instead of spawning fresh ones. A *dedicated*
+//! worker (a pool with a thread name, a start hook, a stack size or a QoS of
+//! its own) serves one pool and exits; that pool joins it.
+//!
+//! No thread-local state is used: a worker is found by its `ThreadId`.
+
+use crate::awake::Awake;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Condvar, Mutex, OnceLock};
+use std::thread::ThreadId;
+
+/// Worker threads spawned by this process so far (shared and dedicated).
+static SPAWNED: AtomicUsize = AtomicUsize::new(0);
+
+/// How many worker threads this process has spawned so far: a diagnostic, to
+/// check that pools built one after another reuse their workers.
+#[doc(hidden)]
+pub fn spawned_workers() -> usize {
+    SPAWNED.load(Ordering::Relaxed)
+}
+
+/// What a worker serves: slot `id` of the pool whose shared state is `aw`,
+/// with the leasing caller's CPU set (Linux) applied first.
+pub(crate) struct Lease {
+    pub(crate) aw: Arc<Awake>,
+    pub(crate) id: usize,
+    pub(crate) mask: Option<crate::pin::CpuMask>,
+}
+
+/// What a waiting worker is told next.
+enum Next {
+    Lease(Lease),
+    /// Exit without serving (a dedicated worker of a pool whose build failed).
+    Exit,
+}
+
+/// One worker thread's handle in this crate.
+pub(crate) struct WorkerCtl {
+    next: Mutex<Option<Next>>,
+    cv: Condvar,
+    /// A worker of the reserve (as opposed to a dedicated one).
+    shared: bool,
+    /// The pool and slot it serves now, for cross-pool lookups.
+    current: Mutex<Option<(Arc<Awake>, usize)>>,
+    thread: OnceLock<ThreadId>,
+}
+
+impl WorkerCtl {
+    fn new(shared: bool) -> Self {
+        WorkerCtl {
+            next: Mutex::new(None),
+            cv: Condvar::new(),
+            shared,
+            current: Mutex::new(None),
+            thread: OnceLock::new(),
+        }
+    }
+
+    /// Hands the worker its next lease.
+    pub(crate) fn assign(&self, lease: Lease) {
+        let mut next = self.next.lock().unwrap_or_else(|e| e.into_inner());
+        *next = Some(Next::Lease(lease));
+        drop(next);
+        self.cv.notify_one();
+    }
+
+    /// Tells an unleased worker to exit.
+    fn exit(&self) {
+        let mut next = self.next.lock().unwrap_or_else(|e| e.into_inner());
+        *next = Some(Next::Exit);
+        drop(next);
+        self.cv.notify_one();
+    }
+}
+
+struct Reserve {
+    /// Shared workers waiting for a lease.
+    idle: Vec<Arc<WorkerCtl>>,
+    /// The most idle workers kept: the largest of the available parallelism
+    /// and every width leased so far.
+    cap: usize,
+    /// Every live worker, for finding the calling thread's own lease.
+    live: Vec<Arc<WorkerCtl>>,
+}
+
+static RESERVE: OnceLock<Mutex<Reserve>> = OnceLock::new();
+
+fn reserve() -> &'static Mutex<Reserve> {
+    RESERVE.get_or_init(|| {
+        Mutex::new(Reserve {
+            idle: Vec::new(),
+            cap: std::thread::available_parallelism().map_or(1, |n| n.get()),
+            live: Vec::new(),
+        })
+    })
+}
+
+fn lock(r: &Mutex<Reserve>) -> std::sync::MutexGuard<'_, Reserve> {
+    r.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+/// The pool and slot the calling thread serves, when it is a worker of any
+/// pool (the lookup of a cross-pool wait; entry points only).
+pub(crate) fn current_worker() -> Option<(Arc<Awake>, usize)> {
+    let r = RESERVE.get()?;
+    let me = std::thread::current().id();
+    let ctl = lock(r)
+        .live
+        .iter()
+        .find(|c| c.thread.get() == Some(&me))
+        .cloned()?;
+    let cur = ctl.current.lock().unwrap_or_else(|e| e.into_inner());
+    cur.clone()
+}
+
+/// How a pool's workers are started.
+pub(crate) struct Spawn<'a> {
+    pub(crate) stack: usize,
+    pub(crate) name: Option<&'a dyn Fn(usize) -> String>,
+    pub(crate) on_start: Option<Arc<dyn Fn(usize) + Send + Sync>>,
+    pub(crate) qos: Option<crate::policy::Qos>,
+    /// Whether these settings are the reserve's (default stack, platform
+    /// QoS, no hooks): then the workers are shared.
+    pub(crate) shared: bool,
+}
+
+/// The workers obtained for a pool, and the join handles of dedicated ones.
+pub(crate) type Obtained = (Vec<Arc<WorkerCtl>>, Vec<std::thread::JoinHandle<()>>);
+
+/// Workers for a pool of `n`: idle ones of the reserve and freshly spawned
+/// ones (shared), or `n` fresh dedicated ones with their join handles.
+pub(crate) fn obtain(n: usize, how: &Spawn<'_>) -> std::io::Result<Obtained> {
+    let mut ctls = Vec::with_capacity(n);
+    let mut joins = Vec::new();
+    if how.shared {
+        let mut r = lock(reserve());
+        r.cap = r.cap.max(n);
+        while ctls.len() < n {
+            match r.idle.pop() {
+                Some(c) => ctls.push(c),
+                None => break,
+            }
+        }
+    }
+    while ctls.len() < n {
+        let index = ctls.len();
+        match spawn(index, how) {
+            Ok((ctl, handle)) => {
+                ctls.push(ctl);
+                if !how.shared {
+                    joins.push(handle);
+                }
+            }
+            Err(e) => {
+                // Hand back what was taken; dedicated workers spawned so far
+                // exit without a lease.
+                give_back_unleased(ctls, joins);
+                return Err(e);
+            }
+        }
+    }
+    Ok((ctls, joins))
+}
+
+/// Workers obtained for a pool whose build failed: shared ones go back to the
+/// reserve, dedicated ones are stopped and joined.
+fn give_back_unleased(ctls: Vec<Arc<WorkerCtl>>, joins: Vec<std::thread::JoinHandle<()>>) {
+    for c in ctls {
+        if c.shared {
+            lock(reserve()).idle.push(c);
+        } else {
+            c.exit();
+        }
+    }
+    for j in joins {
+        let _ = j.join();
+    }
+}
+
+fn spawn(
+    index: usize,
+    how: &Spawn<'_>,
+) -> std::io::Result<(Arc<WorkerCtl>, std::thread::JoinHandle<()>)> {
+    let ctl = Arc::new(WorkerCtl::new(how.shared));
+    let mut b = std::thread::Builder::new().stack_size(how.stack);
+    if let Some(name) = &how.name {
+        b = b.name(name(index));
+    }
+    let qos = how.qos.or(crate::policy::Qos::PLATFORM_DEFAULT);
+    let on_start = how.on_start.clone();
+    let c = Arc::clone(&ctl);
+    let handle = b.spawn(move || {
+        if let Some(q) = qos {
+            q.apply_to_current_thread();
+        }
+        let _ = c.thread.set(std::thread::current().id());
+        lock(reserve()).live.push(Arc::clone(&c));
+        if let Some(hook) = on_start {
+            hook(index);
+        }
+        worker_main(&c);
+        let mut r = lock(reserve());
+        if let Some(p) = r.live.iter().position(|w| Arc::ptr_eq(w, &c)) {
+            r.live.swap_remove(p);
+        }
+    })?;
+    SPAWNED.fetch_add(1, Ordering::Relaxed);
+    Ok((ctl, handle))
+}
+
+/// A worker's life: wait for a lease, attach, serve the pool until it is
+/// detached, acknowledge, then wait in the reserve (shared) or exit.
+fn worker_main(ctl: &Arc<WorkerCtl>) {
+    loop {
+        let lease = {
+            let mut next = ctl.next.lock().unwrap_or_else(|e| e.into_inner());
+            loop {
+                match next.take() {
+                    Some(Next::Lease(l)) => break l,
+                    Some(Next::Exit) => return,
+                    None => next = ctl.cv.wait(next).unwrap_or_else(|e| e.into_inner()),
+                }
+            }
+        };
+        let slot = &lease.aw.slots[lease.id];
+        // The CPU set a thread spawned by the leasing caller would inherit.
+        if let Some(mask) = &lease.mask {
+            let _ = crate::pin::set_here(mask);
+        }
+        let _ = slot.thread.set(std::thread::current().id());
+        *ctl.current.lock().unwrap_or_else(|e| e.into_inner()) =
+            Some((Arc::clone(&lease.aw), lease.id));
+        // `serve` takes its section baseline before it marks the slot
+        // attached (claimable): a section published after that is seen.
+        crate::awake::serve(&lease.aw, lease.id);
+        // Epilogue: no access to the pool after the acknowledgement.
+        slot.saved.restore();
+        let clean = !slot.saved.is_pinned();
+        *ctl.current.lock().unwrap_or_else(|e| e.into_inner()) = None;
+        // Back in the reserve before the acknowledgement, so that a pool built
+        // right after this one was dropped finds the worker idle. A new lease
+        // only starts once this loop waits for it again, after the
+        // acknowledgement below.
+        let keep = ctl.shared && clean && {
+            let mut r = lock(reserve());
+            if r.idle.len() < r.cap {
+                r.idle.push(Arc::clone(ctl));
+                true
+            } else {
+                false
+            }
+        };
+        slot.acked.store(true, Ordering::SeqCst);
+        lease.aw.waits.sync.wake();
+        drop(lease);
+        if !keep {
+            return;
+        }
+    }
+}
diff --git a/tests/alloc_free.rs b/tests/alloc_free.rs
index 28e73ff..ee01111 100644
--- a/tests/alloc_free.rs
+++ b/tests/alloc_free.rs
@@ -2,27 +2,67 @@
 #![cfg(all(feature = "parallel", not(feature = "ledger")))]
 
 use std::alloc::{GlobalAlloc, Layout, System};
+use std::cell::Cell;
 use std::num::NonZeroUsize;
-use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::Mutex;
 use threadteam::{Exec, Pool};
 
 struct Counting;
 static ALLOCS: AtomicUsize = AtomicUsize::new(0);
+/// While set, every counted allocation also records its size, its thread and
+/// a backtrace, so that a failure says where it came from (a platform the
+/// author cannot run, such as macOS on CI, is diagnosed from the log alone).
+static RECORD: AtomicBool = AtomicBool::new(false);
+static RECORDED: Mutex<Vec<String>> = Mutex::new(Vec::new());
+
+thread_local! {
+    /// The recording itself allocates: it is neither counted nor recorded.
+    static RECORDING: Cell<bool> = const { Cell::new(false) };
+}
+
+fn count(size: usize) {
+    if RECORDING.with(|r| r.get()) {
+        return;
+    }
+    ALLOCS.fetch_add(1, Ordering::SeqCst);
+    if RECORD.load(Ordering::SeqCst) {
+        RECORDING.with(|r| r.set(true));
+        let entry = format!(
+            "{size} bytes on {:?}:\n{}",
+            std::thread::current().name(),
+            std::backtrace::Backtrace::force_capture()
+        );
+        RECORDED
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .push(entry);
+        RECORDING.with(|r| r.set(false));
+    }
+}
 
 unsafe impl GlobalAlloc for Counting {
     unsafe fn alloc(&self, l: Layout) -> *mut u8 {
-        ALLOCS.fetch_add(1, Ordering::SeqCst);
+        count(l.size());
         System.alloc(l)
     }
     unsafe fn dealloc(&self, p: *mut u8, l: Layout) {
         System.dealloc(p, l)
     }
     unsafe fn realloc(&self, p: *mut u8, l: Layout, n: usize) -> *mut u8 {
-        ALLOCS.fetch_add(1, Ordering::SeqCst);
+        count(n);
         System.realloc(p, l, n)
     }
 }
 
+/// The allocations recorded so far, for a failure message.
+fn recorded() -> String {
+    RECORDED
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .join("\n----\n")
+}
+
 #[global_allocator]
 static A: Counting = Counting;
 
@@ -37,27 +77,36 @@ fn entries(pool: &Pool) {
     });
     let w = Exec::new(pool, 3).unwrap().external(|w| w.get());
     assert_eq!(w, 3);
+    if !threadteam::Exec::new(pool, 3).unwrap().can_broadcast() {
+        return;
+    }
+    Exec::new(pool, 3)
+        .unwrap()
+        .broadcast(|i| {
+            sink.fetch_add(i, Ordering::Relaxed);
+        })
+        .unwrap();
     assert!(sink.load(Ordering::Relaxed) > 0);
 }
 
-/// Smallest allocation count over `rounds` windows of one call each, after warm-up.
-///
-/// From a plain thread every entry pushes one job into rayon's injector queue,
-/// whose block allocation (one per 31 pushes) is amortized and outside this
-/// crate; a per-call allocation shows up in every window, so the minimum
-/// separates the two.
+/// Largest allocation count over `rounds` windows of one call each, after
+/// warm-up: strict, every window counts (the native scheduler publishes stack
+/// batches, so there is no amortized queue allocation to tolerate).
 fn measure(rounds: usize, f: impl Fn()) -> usize {
     for _ in 0..20 {
         f();
     }
-    (0..rounds)
+    RECORD.store(true, Ordering::SeqCst);
+    let worst = (0..rounds)
         .map(|_| {
             let before = ALLOCS.load(Ordering::SeqCst);
             f();
             ALLOCS.load(Ordering::SeqCst) - before
         })
-        .min()
-        .unwrap_or(0)
+        .max()
+        .unwrap_or(0);
+    RECORD.store(false, Ordering::SeqCst);
+    worst
 }
 
 // One test: the counter is process-global.
@@ -65,7 +114,20 @@ fn measure(rounds: usize, f: impl Fn()) -> usize {
 fn fork_for_ranges_external_do_not_allocate() {
     let pool = Pool::builder().threads(3).build().unwrap();
     let plain = measure(10, || entries(&pool));
-    assert_eq!(plain, 0, "plain-thread entries allocated");
+    assert_eq!(plain, 0, "plain-thread entries allocated:\n{}", recorded());
+    // The same after the workers went to sleep: waking them allocates nothing.
+    let asleep = measure(5, || {
+        std::thread::sleep(std::time::Duration::from_millis(20));
+        let before = ALLOCS.load(Ordering::SeqCst);
+        entries(&pool);
+        assert_eq!(
+            ALLOCS.load(Ordering::SeqCst) - before,
+            0,
+            "entries after a park allocated:\n{}",
+            recorded()
+        );
+    });
+    let _ = asleep;
 
     // Inside the pool: a worker of `pool` enters again, which installs nothing,
     // so every window is strict.
@@ -78,7 +140,8 @@ fn fork_for_ranges_external_do_not_allocate() {
     assert_eq!(
         inside.load(Ordering::SeqCst),
         0,
-        "in-pool entries allocated"
+        "in-pool entries allocated:\n{}",
+        recorded()
     );
 
     // Participant pinning on: the extra pin section a root team scope runs must
diff --git a/tests/idle_clock.rs b/tests/idle_clock.rs
index b14ce83..4507ef0 100644
--- a/tests/idle_clock.rs
+++ b/tests/idle_clock.rs
@@ -1,5 +1,9 @@
-//! The idle clock of a reserved member (feature `trace`): the time since the
-//! member's own last share (or since it started, or since it woke from a park).
+//! The idle episodes of a reserved member (feature `trace`): after its own last
+//! share (or its start, or a wake-up) a member spins for the pool's spin budget
+//! of polls, yields a few times and parks (`docs/design/waiting.md`). The budget
+//! is a count, so no wall-clock lower bound on a park exists; the gating of the
+//! count itself is unit tested (`src/tests/waiting.rs`). Here the budget is zero
+//! and the test checks the episode's order and the wake-up.
 //!
 //! Everything here is judged by the **order of a member's own trace events**,
 //! never by a wall-clock bound on how fast the leader gets around to the next
@@ -8,11 +12,11 @@
 //! slot ids are read from the trace as well, because the acquisition may claim
 //! any free slots.
 //!
-//! * Never before the delay: for every park of member `m` at time `t`,
-//!   `t - max(m's last share end, m's last wake-up, m's start) >= SPIN`. This
-//!   holds for every park in the whole test.
-//! * After the delay: once no section arrives, every member parks; polled until
-//!   it happens, with no upper bound on how late.
+//! * A park follows an anchor: every `ParkEnter` of member `m` comes after one of
+//!   `m`'s own `SectionEnd`, `ParkExit` or `Enter` events, with no other
+//!   `ParkEnter` of `m` in between (one park per idle episode).
+//! * Once no section arrives, every member parks; polled until it happens, with
+//!   no upper bound on how late.
 //! * A following section wakes every member that was parked: the number of
 //!   `ParkExit`s rises by the number of members parked at that moment.
 #![cfg(all(feature = "trace", feature = "parallel"))]
@@ -21,8 +25,6 @@ use std::time::{Duration, Instant};
 use threadteam::trace::{self, Kind};
 use threadteam::Pool;
 
-const SPIN: Duration = Duration::from_millis(40);
-
 /// Only a hang guard: no assertion below is a bound on how long the members or
 /// the leader take.
 const DEADLINE: Duration = Duration::from_secs(10);
@@ -30,7 +32,7 @@ const DEADLINE: Duration = Duration::from_secs(10);
 fn team(width: usize) -> threadteam::Team {
     Pool::builder()
         .threads(width)
-        .idle_spin(SPIN)
+        .spin_polls(0)
         .acquire_timeout(Duration::from_secs(10))
         .build()
         .unwrap()
@@ -109,8 +111,9 @@ fn every_member_parked_after_its_last_share(events: &[trace::Event]) -> bool {
         })
 }
 
-/// Asserts the "never before the delay" property over every park in the trace.
-fn assert_no_park_before_the_delay(team: &threadteam::Team) {
+/// Asserts that every park follows its own anchor (a share end, a wake-up or the
+/// start) with no second park in the same idle episode.
+fn assert_one_park_per_episode(team: &threadteam::Team) {
     let events = member_events(team);
     let parks: Vec<_> = events
         .iter()
@@ -118,36 +121,39 @@ fn assert_no_park_before_the_delay(team: &threadteam::Team) {
         .collect();
     assert!(!parks.is_empty(), "no member parked at all");
     for park in parks {
-        // The park delay runs from the later of the member's own last share
-        // end, its own last wake-up and its start.
-        let anchor = events
+        let before: Vec<_> = events
             .iter()
             .filter(|e| e.member == park.member && e.ns <= park.ns)
-            .filter(|e| matches!(e.kind, Kind::SectionEnd | Kind::ParkExit | Kind::Enter))
-            .map(|e| e.ns)
-            .max();
-        let Some(anchor) = anchor else {
-            panic!("member {} parked without an anchor event", park.member);
-        };
+            .filter(|e| {
+                matches!(
+                    e.kind,
+                    Kind::SectionEnd | Kind::ParkExit | Kind::Enter | Kind::ParkEnter
+                )
+            })
+            .collect();
+        // The last event before this park (itself excluded) is an anchor.
+        let prev = before
+            .iter()
+            .rev()
+            .find(|e| !std::ptr::eq(**e, park))
+            .unwrap_or_else(|| panic!("member {} parked without an anchor event", park.member));
         assert!(
-            park.ns - anchor >= SPIN.as_nanos() as u64,
-            "member {} parked {} us after its own last share, wake-up or start",
-            park.member,
-            (park.ns - anchor) / 1000
+            prev.kind != Kind::ParkEnter,
+            "member {} parked twice in one idle episode",
+            park.member
         );
     }
 }
 
 #[test]
-fn members_park_after_the_park_delay_since_their_own_last_share_or_wake() {
+fn members_park_once_per_idle_episode_and_wake_on_the_next_section() {
     let team = team(3);
     let mut exec = team.exec(3);
     if team.size().get() < 3 {
         return;
     }
-    // Sections a few milliseconds apart for about 150 ms. This does *not*
-    // assert that nobody parks: on a loaded host the leader's sleeps can wake
-    // late enough for a member to idle through its delay, and that is allowed.
+    // Sections a few milliseconds apart: with a zero budget the members park
+    // between them, and every section wakes them.
     for _ in 0..30 {
         exec.reborrow().broadcast(|_| {}).unwrap();
         std::thread::sleep(Duration::from_millis(5));
@@ -162,9 +168,8 @@ fn members_park_after_the_park_delay_since_their_own_last_share_or_wake() {
         team.size().get() - 1,
         "every member ran a share: {members:?}"
     );
-    // The "not before" property holds for every park of the whole test, the
-    // ones inside the phase of regular sections included.
-    assert_no_park_before_the_delay(&team);
+    // One park per idle episode, over the whole test.
+    assert_one_park_per_episode(&team);
     // A following section wakes every member that is parked now: the wake-ups
     // are exactly the parked members' `ParkExit`s.
     let parked = parked_now(&team);
@@ -178,7 +183,9 @@ fn members_park_after_the_park_delay_since_their_own_last_share_or_wake() {
     wait_until("every parked member woke", || {
         count(&team, Kind::ParkExit) >= exits + parked
     });
-    // The clock restarts from the share they just ran: a later park is again at
-    // least SPIN after it.
-    assert_no_park_before_the_delay(&team);
+    // The episode restarts from the share they just ran.
+    wait_until("every member parked again", || {
+        parked_now(&team) == team.size().get() - 1
+    });
+    assert_one_park_per_episode(&team);
 }
diff --git a/tests/loom_park.rs b/tests/loom_park.rs
index 0e0558a..d773623 100644
--- a/tests/loom_park.rs
+++ b/tests/loom_park.rs
@@ -7,7 +7,7 @@
 //! shows up as a deadlock of the leader's join.
 #![cfg(loom)]
 
-use loom::sync::atomic::{AtomicUsize, Ordering};
+use loom::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use loom::sync::Arc;
 use loom::thread;
 use threadteam::Parker;
@@ -130,3 +130,243 @@ fn a_wake_of_one_slot_leaves_the_other_asleep_until_its_own_change() {
         }
     });
 }
+
+// ---------------------------------------------------------------------------
+// The staged waits of a section (`docs/design/waiting.md`): the exact
+// `Completion` and `Barrier` code, with a zero spin budget so every waiter goes
+// straight to sleep on the shared parker.
+
+use threadteam::{Barrier, Completion, Waiter};
+
+/// The leader sleeps in `join` until the last of two members finishes; the
+/// member that brings the count to zero wakes it. A lost wake-up deadlocks.
+#[test]
+fn the_last_member_wakes_a_leader_asleep_in_join() {
+    model(|| {
+        let done = Arc::new(Completion::new(2));
+        let sync = Arc::new(Parker::new());
+        let ms: Vec<_> = (0..2)
+            .map(|_| {
+                let (done, sync) = (done.clone(), sync.clone());
+                thread::spawn(move || unsafe {
+                    Completion::finish(Arc::as_ptr(&done), Some(&sync))
+                })
+            })
+            .collect();
+        done.wait(Some(&sync), &mut Waiter::new(0));
+        assert!(done.is_done());
+        for m in ms {
+            m.join().unwrap();
+        }
+    });
+}
+
+/// Two participants pass two consecutive barrier rounds, sleeping on the
+/// shared parker: the reset of `arrived` and the epoch bump of one round never
+/// lose the other's arrival or wake-up in the next.
+#[test]
+fn consecutive_barrier_rounds_wake_every_sleeper() {
+    model(|| {
+        let barrier = Arc::new(Barrier::new(2));
+        let cancelled = Arc::new(AtomicBool::new(false));
+        let sync = Arc::new(Parker::new());
+        let peer = {
+            let (barrier, cancelled, sync) = (barrier.clone(), cancelled.clone(), sync.clone());
+            thread::spawn(move || {
+                for _ in 0..2 {
+                    assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0)));
+                }
+            })
+        };
+        for _ in 0..2 {
+            assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0)));
+        }
+        peer.join().unwrap();
+    });
+}
+
+/// A participant asleep in a barrier that can never complete (the third
+/// participant failed) is woken by the cancellation and leaves with `false`.
+#[test]
+fn a_cancellation_wakes_a_participant_asleep_in_a_barrier() {
+    model(|| {
+        let barrier = Arc::new(Barrier::new(3));
+        let cancelled = Arc::new(AtomicBool::new(false));
+        let sync = Arc::new(Parker::new());
+        let waiter = {
+            let (barrier, cancelled, sync) = (barrier.clone(), cancelled.clone(), sync.clone());
+            thread::spawn(move || barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0)))
+        };
+        // `Section::fail`: raise the flag (SeqCst), then wake.
+        cancelled.store(true, Ordering::SeqCst);
+        sync.wake();
+        assert!(!waiter.join().unwrap());
+    });
+}
+
+// ---------------------------------------------------------------------------
+// The native scheduler (`docs/design/own-threads.md`): the slot state word,
+// the queue of stack batches, the broadcast list, and an idle worker's sleep
+// against a publication. The exact code, under `loom`.
+
+use threadteam::{Batch, Broadcast, BroadcastList, Queue, SlotState};
+
+/// A team reservation and a worker taking work race for a free slot: exactly
+/// one wins, and a release or a detach while the worker is busy neither frees
+/// it early nor is erased when it finishes.
+#[test]
+fn a_free_slot_is_reserved_or_taken_never_both() {
+    model(|| {
+        let s = Arc::new(SlotState::new());
+        let leader = {
+            let s = s.clone();
+            thread::spawn(move || s.try_reserve())
+        };
+        let took = s.try_take();
+        let reserved = leader.join().unwrap();
+        assert!(took != reserved, "exactly one wins");
+        if took {
+            // Busy: a detach arrives, then the work ends.
+            s.detach();
+            s.end_busy();
+            assert_eq!(s.load(), 8, "DETACH survives the end of the work");
+        } else {
+            s.release();
+            assert_eq!(s.load(), 0);
+        }
+    });
+}
+
+/// A lent member that is running a task when its reservation is released
+/// stays busy (not claimable) until the task ends.
+#[test]
+fn a_release_does_not_free_a_busy_lent_member() {
+    model(|| {
+        let s = Arc::new(SlotState::new());
+        assert!(s.try_reserve());
+        s.set_lent(true);
+        assert!(s.try_take());
+        let releaser = {
+            let s = s.clone();
+            thread::spawn(move || s.release())
+        };
+        let claimer = {
+            let s = s.clone();
+            thread::spawn(move || s.try_reserve())
+        };
+        releaser.join().unwrap();
+        assert!(!claimer.join().unwrap(), "a busy worker is not reservable");
+        s.end_busy();
+        assert!(s.try_reserve(), "free again once the task ended");
+    });
+}
+
+unsafe fn count_task(data: *const (), _i: usize) {
+    (*data.cast::<AtomicUsize>()).fetch_add(1, Ordering::SeqCst);
+}
+
+/// An owner publishes a batch of two tasks; two workers claim and run them
+/// while the owner claims its own and then sleeps until the last completion:
+/// every task runs exactly once and the owner wakes (no lost wake-up).
+#[test]
+fn a_batch_runs_every_task_once_and_wakes_its_sleeping_owner() {
+    model(|| {
+        let q = Arc::new(Queue::new());
+        let ran = Arc::new(AtomicUsize::new(0));
+        let waker = std::sync::Arc::new(Parker::new());
+        // SAFETY: `ran` and `waker` outlive the batch, which the owner waits
+        // for below.
+        let batch =
+            Arc::new(unsafe { Batch::new(count_task, Arc::as_ptr(&ran).cast(), 2, &waker) });
+        q.publish(&batch);
+        let ws: Vec<_> = (0..2)
+            .map(|_| {
+                let q = q.clone();
+                thread::spawn(move || {
+                    if let Some((b, i)) = q.claim() {
+                        unsafe { Batch::run_claimed(b, i) };
+                    }
+                })
+            })
+            .collect();
+        while let Some(i) = q.claim_own(&batch) {
+            unsafe { Batch::run_claimed(Arc::as_ptr(&batch), i) };
+        }
+        batch.done.wait(Some(&waker), &mut Waiter::new(0));
+        assert_eq!(ran.load(Ordering::SeqCst), 2);
+        for w in ws {
+            w.join().unwrap();
+        }
+    });
+}
+
+unsafe fn share_task(data: *const (), i: usize) {
+    (*data.cast::<[AtomicUsize; 2]>())[i].fetch_add(1, Ordering::SeqCst);
+}
+
+/// A broadcast to two workers: each runs its own share exactly once, in the
+/// order of its cursor, and the caller wakes before it unlinks the broadcast.
+#[test]
+fn a_broadcast_runs_each_share_once_and_wakes_its_caller() {
+    model(|| {
+        let list = Arc::new(BroadcastList::new());
+        let shares = Arc::new([AtomicUsize::new(0), AtomicUsize::new(0)]);
+        let waker = std::sync::Arc::new(Parker::new());
+        // SAFETY: as above.
+        let b =
+            Arc::new(unsafe { Broadcast::new(share_task, Arc::as_ptr(&shares).cast(), 2, &waker) });
+        list.publish(&b);
+        let ws: Vec<_> = (0..2)
+            .map(|i| {
+                let list = list.clone();
+                thread::spawn(move || {
+                    let mut seq = 0;
+                    while let Some(b) = list.next_for(i, &mut seq) {
+                        unsafe { Broadcast::run_share(b, i) };
+                    }
+                })
+            })
+            .collect();
+        b.done.wait(Some(&waker), &mut Waiter::new(0));
+        list.unlink(&b);
+        assert_eq!(shares[0].load(Ordering::SeqCst), 1);
+        assert_eq!(shares[1].load(Ordering::SeqCst), 1);
+        for w in ws {
+            w.join().unwrap();
+        }
+    });
+}
+
+/// An idle worker going to sleep on its parker against a publication: the
+/// publisher links the batch and wakes; the worker either sees the new work
+/// before it sleeps or is woken (no lost wake-up), then claims it.
+#[test]
+fn an_idle_worker_is_never_left_asleep_by_a_publication() {
+    model(|| {
+        let q = Arc::new(Queue::new());
+        let park = Arc::new(Parker::new());
+        let ran = Arc::new(AtomicUsize::new(0));
+        let waker = std::sync::Arc::new(Parker::new());
+        let worker = {
+            let (q, park) = (q.clone(), park.clone());
+            thread::spawn(move || {
+                let g = q.gen();
+                park.park_while(|| q.gen() == g && !q.has_work());
+                if let Some((b, i)) = q.claim() {
+                    unsafe { Batch::run_claimed(b, i) };
+                }
+            })
+        };
+        // SAFETY: as above.
+        let batch = unsafe { Batch::new(count_task, Arc::as_ptr(&ran).cast(), 1, &waker) };
+        q.publish(&batch);
+        park.wake();
+        worker.join().unwrap();
+        // The worker claimed it, or it is still linked for the owner.
+        while let Some(i) = q.claim_own(&batch) {
+            unsafe { Batch::run_claimed(&batch, i) };
+        }
+        batch.done.wait(Some(&waker), &mut Waiter::new(0));
+        assert_eq!(ran.load(Ordering::SeqCst), 1);
+    });
+}
diff --git a/tests/oversubscribed.rs b/tests/oversubscribed.rs
index d9bd759..8865dc6 100644
--- a/tests/oversubscribed.rs
+++ b/tests/oversubscribed.rs
@@ -1,11 +1,13 @@
 //! A root team scope that has more participants than CPUs in the caller's set
-//! parks its members after a short spin instead of spinning for the whole park
-//! delay, and its nested sections keep that knowledge.
+//! parks its members, and its nested sections keep working, with members that
+//! sleep and wake between them.
 //!
-//! Nothing here is a wall-clock bound on the members: the park delay of the
-//! policy is set far above the deadline of the hang guard, so *reaching* the
-//! park proves the scope used its own (zero) delay, whatever the host's speed,
-//! and the wait itself is a poll of the trace with no upper bound.
+//! These are sleeping and waking smoke tests. The pool's spin budget is lifted
+//! to `u32::MAX` polls (minutes), so a member parks within the hang guard only
+//! through a short budget: the throttled one the oversubscribed scope chose, or
+//! the pressure heuristic of a loaded host (`docs/design/waiting.md`). Which
+//! budget a root scope chooses is checked directly in
+//! `src/tests/placement.rs`.
 #![cfg(all(feature = "trace", feature = "parallel", target_os = "linux"))]
 
 use std::sync::atomic::{AtomicUsize, Ordering};
@@ -13,10 +15,6 @@ use std::time::{Duration, Instant};
 use threadteam::trace::{self, Kind};
 use threadteam::Pool;
 
-/// The policy's park delay. Far above `DEADLINE`: a member that waited for it
-/// could not park within the deadline.
-const PARK_DELAY: Duration = Duration::from_secs(60);
-
 /// Only a hang guard.
 const DEADLINE: Duration = Duration::from_secs(10);
 
@@ -86,10 +84,9 @@ fn members_that_ran(events: &[trace::Event]) -> Vec<usize> {
 /// Polls (hang guard only) until every member that ran a share has a
 /// `ParkEnter` later than its own last `SectionEnd`.
 ///
-/// No upper bound on how late: what the deadline rules out is the opposite —
-/// with `PARK_DELAY` = 60 s, a member that kept the policy's delay cannot park
-/// before it, so parking within `DEADLINE` can only come from the scope's own
-/// (zero) delay.
+/// No upper bound on how late. With the pool's budget lifted to `u32::MAX`
+/// polls, parking within `DEADLINE` comes from a short budget (see the module
+/// documentation).
 fn wait_until_members_parked(team: &threadteam::Team) {
     let start = Instant::now();
     loop {
@@ -119,7 +116,7 @@ fn wait_until_members_parked(team: &threadteam::Team) {
         }
         assert!(
             start.elapsed() < DEADLINE,
-            "no member parked within {DEADLINE:?}: the scope kept the policy's {PARK_DELAY:?} delay"
+            "no member parked within {DEADLINE:?}: the scope kept the pool's lifted spin budget"
         );
         std::thread::sleep(Duration::from_millis(2));
     }
@@ -142,7 +139,7 @@ fn an_oversubscribed_root_scope_parks_its_members_quickly() {
 
     let pool = Pool::builder()
         .threads(4)
-        .idle_spin(PARK_DELAY)
+        .spin_polls(u32::MAX)
         .acquire_timeout(Duration::from_secs(10))
         .build()
         .unwrap();
@@ -185,7 +182,7 @@ fn the_scope_that_enters_decides_the_park_delay_not_the_mint() {
     // with the policy's 60 s park delay.
     let pool = Pool::builder()
         .threads(3)
-        .idle_spin(PARK_DELAY)
+        .spin_polls(u32::MAX)
         .acquire_timeout(Duration::from_secs(10))
         .build()
         .unwrap();
diff --git a/tests/own_threads.rs b/tests/own_threads.rs
new file mode 100644
index 0000000..9ea8deb
--- /dev/null
+++ b/tests/own_threads.rs
@@ -0,0 +1,318 @@
+//! The native workers (`docs/design/own-threads.md`): reuse through the
+//! process-wide reserve, cross-pool waits, broadcast order, affinity on lease,
+//! and panics.
+#![cfg(feature = "parallel")]
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Mutex;
+use std::time::Duration;
+use threadteam::{Exec, Pool};
+
+/// A hang is a failure: abort the whole process if the test body stalls.
+fn watchdog() -> impl Drop {
+    struct Stop(std::sync::mpsc::Sender<()>);
+    impl Drop for Stop {
+        fn drop(&mut self) {
+            let _ = self.0.send(());
+        }
+    }
+    let (tx, rx) = std::sync::mpsc::channel::<()>();
+    std::thread::spawn(move || {
+        if rx.recv_timeout(Duration::from_secs(60)).is_err() {
+            eprintln!("watchdog: test stalled");
+            std::process::exit(101);
+        }
+    });
+    Stop(tx)
+}
+
+/// The reserve and the spawn counter are process wide: the tests of this file
+/// take turns.
+static SERIAL: Mutex<()> = Mutex::new(());
+
+#[test]
+fn a_pool_built_after_another_was_dropped_reuses_its_workers() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let width = 4;
+    // A long acquisition timeout: a worker clears its busy bit just after its
+    // last task completed, and on a loaded host that can take a while.
+    let build = || {
+        Pool::builder()
+            .threads(width)
+            .acquire_timeout(Duration::from_secs(5))
+            .build()
+            .unwrap()
+    };
+    let first = build();
+    Exec::new(&first, width).unwrap().fork(width, |_, _| {});
+    drop(first);
+    for round in 0..5 {
+        let before = threadteam::spawned_workers();
+        let pool = build();
+        let n = AtomicUsize::new(0);
+        Exec::new(&pool, width).unwrap().fork(width, |_, _| {
+            n.fetch_add(1, Ordering::SeqCst);
+        });
+        assert_eq!(n.load(Ordering::SeqCst), width);
+        // A team on the reused workers, as faer's `with_team` takes one.
+        let team = pool.into_team(width).expect("idle reused workers");
+        assert_eq!(team.size().get(), width);
+        drop(team);
+        assert_eq!(
+            threadteam::spawned_workers() - before,
+            0,
+            "round {round}: a pool of the same width spawned threads"
+        );
+    }
+}
+
+#[test]
+fn a_pool_with_hooks_gets_dedicated_workers_and_joins_them() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let started = std::sync::Arc::new(AtomicUsize::new(0));
+    let s = std::sync::Arc::clone(&started);
+    let before = threadteam::spawned_workers();
+    let pool = Pool::builder()
+        .threads(2)
+        .thread_name(|i| format!("dedicated-{i}"))
+        .on_start(move |_| {
+            s.fetch_add(1, Ordering::SeqCst);
+        })
+        .build()
+        .unwrap();
+    let names = Mutex::new(Vec::new());
+    Exec::new(&pool, 2).unwrap().fork(2, |_, _| {
+        names
+            .lock()
+            .unwrap()
+            .push(std::thread::current().name().map(String::from));
+    });
+    drop(pool);
+    assert_eq!(threadteam::spawned_workers() - before, 2);
+    assert_eq!(
+        started.load(Ordering::SeqCst),
+        2,
+        "the hook ran on each worker"
+    );
+    assert!(names
+        .into_inner()
+        .unwrap()
+        .iter()
+        .all(|n| n.as_deref().is_some_and(|n| n.starts_with("dedicated-"))));
+}
+
+/// A worker of pool A waits for pool B, whose task waits for pool A again.
+/// Every waiting worker serves its own pool meanwhile, so the chain completes
+/// even when every worker of A is waiting on B.
+#[test]
+fn a_cross_pool_chain_a_b_a_completes() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let a = Pool::builder().threads(2).build().unwrap();
+    let b = Pool::builder().threads(2).build().unwrap();
+    let inner = AtomicUsize::new(0);
+    Exec::new(&a, 2).unwrap().fork(2, |_, _| {
+        Exec::new(&b, 2).unwrap().fork(2, |_, _| {
+            Exec::new(&a, 2).unwrap().fork(2, |_, _| {
+                inner.fetch_add(1, Ordering::SeqCst);
+            });
+        });
+    });
+    assert_eq!(inner.load(Ordering::SeqCst), 2 * 2 * 2);
+}
+
+/// Two plain threads broadcast on one pool at once: every worker runs both
+/// broadcasts, and all workers see them in the same order.
+#[test]
+fn concurrent_broadcasts_reach_every_worker_in_the_same_order() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let width = 3;
+    let pool = Pool::builder().threads(width).build().unwrap();
+    for _ in 0..20 {
+        let seen: Vec<Mutex<Vec<u8>>> = (0..width).map(|_| Mutex::new(Vec::new())).collect();
+        std::thread::scope(|s| {
+            for tag in [1u8, 2] {
+                let (pool, seen) = (&pool, &seen);
+                s.spawn(move || {
+                    Exec::new(pool, width)
+                        .unwrap()
+                        .broadcast(|i| seen[i].lock().unwrap().push(tag))
+                        .unwrap();
+                });
+            }
+        });
+        let orders: Vec<Vec<u8>> = seen.into_iter().map(|m| m.into_inner().unwrap()).collect();
+        assert!(orders.iter().all(|o| o.len() == 2), "{orders:?}");
+        assert!(orders.windows(2).all(|w| w[0] == w[1]), "{orders:?}");
+    }
+}
+
+/// A task panics: the others still run, the panic reaches the caller after
+/// all of them finished, and the pool keeps working.
+#[test]
+fn a_task_panic_propagates_after_the_others_and_the_pool_survives() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let pool = Pool::builder().threads(3).build().unwrap();
+    let done = AtomicUsize::new(0);
+    let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        Exec::new(&pool, 3).unwrap().fork(3, |i, _| {
+            if i == 1 {
+                panic!("boom");
+            }
+            std::thread::sleep(Duration::from_millis(5));
+            done.fetch_add(1, Ordering::SeqCst);
+        });
+    }));
+    assert!(r.is_err());
+    assert_eq!(done.load(Ordering::SeqCst), 2);
+    let n = AtomicUsize::new(0);
+    Exec::new(&pool, 3).unwrap().fork(3, |_, _| {
+        n.fetch_add(1, Ordering::SeqCst);
+    });
+    assert_eq!(n.load(Ordering::SeqCst), 3);
+}
+
+/// A reused worker takes the CPU set of the caller that leases it, as a thread
+/// that caller spawned would, not the set of whoever spawned it first.
+#[cfg(target_os = "linux")]
+#[test]
+fn a_reused_worker_takes_the_leasing_callers_cpu_set() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    fn cpus() -> Vec<usize> {
+        unsafe {
+            let mut set: libc::cpu_set_t = std::mem::zeroed();
+            libc::sched_getaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &mut set);
+            (0..libc::CPU_SETSIZE as usize)
+                .filter(|&c| libc::CPU_ISSET(c, &set))
+                .collect()
+        }
+    }
+    fn set(cpus: &[usize]) -> bool {
+        unsafe {
+            let mut s: libc::cpu_set_t = std::mem::zeroed();
+            libc::CPU_ZERO(&mut s);
+            for &c in cpus {
+                libc::CPU_SET(c, &mut s);
+            }
+            libc::sched_setaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &s) == 0
+        }
+    }
+    let all = cpus();
+    if all.len() < 4 {
+        eprintln!("skipped: needs 4 allowed CPUs");
+        return;
+    }
+    // Run on a helper thread so the test thread's mask is never changed.
+    std::thread::spawn(move || {
+        let width = 2;
+        assert!(set(&all[..2]));
+        drop(Pool::builder().threads(width).build().unwrap());
+        assert!(set(&all[2..4]));
+        let pool = Pool::builder().threads(width).build().unwrap();
+        let masks = Mutex::new(Vec::new());
+        Exec::new(&pool, width)
+            .unwrap()
+            .broadcast(|_| masks.lock().unwrap().push(cpus()))
+            .unwrap();
+        for m in masks.into_inner().unwrap() {
+            assert_eq!(
+                m,
+                all[2..4].to_vec(),
+                "a reused worker kept another caller's CPU set"
+            );
+        }
+    })
+    .join()
+    .unwrap();
+}
+
+/// A dedicated worker keeps the CPU set its `on_start` hook pinned it to: the
+/// lease does not reset it to the caller's set.
+#[cfg(target_os = "linux")]
+#[test]
+fn a_dedicated_worker_keeps_the_pin_of_its_start_hook() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    fn cpus() -> Vec<usize> {
+        unsafe {
+            let mut set: libc::cpu_set_t = std::mem::zeroed();
+            libc::sched_getaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &mut set);
+            (0..libc::CPU_SETSIZE as usize)
+                .filter(|&c| libc::CPU_ISSET(c, &set))
+                .collect()
+        }
+    }
+    let all = cpus();
+    if all.len() < 2 {
+        eprintln!("skipped: needs 2 allowed CPUs");
+        return;
+    }
+    let target = all[1];
+    let pool = Pool::builder()
+        .threads(2)
+        .on_start(move |_| unsafe {
+            let mut s: libc::cpu_set_t = std::mem::zeroed();
+            libc::CPU_ZERO(&mut s);
+            libc::CPU_SET(target, &mut s);
+            libc::sched_setaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &s);
+        })
+        .build()
+        .unwrap();
+    let masks = Mutex::new(Vec::new());
+    Exec::new(&pool, 2)
+        .unwrap()
+        .broadcast(|_| masks.lock().unwrap().push(cpus()))
+        .unwrap();
+    for m in masks.into_inner().unwrap() {
+        assert_eq!(m, vec![target], "the lease undid the hook's pin");
+    }
+}
+
+/// Broadcast X's share 0 waits on another pool while X's share 1 waits at a
+/// barrier of X's shares; meanwhile broadcast Y, whose shares meet at a barrier
+/// too, is published. The waiting share 0 must not start Y's share on top of
+/// X's: Y's barrier would wait for worker 1, which waits for X.
+#[test]
+fn a_waiting_broadcast_share_does_not_start_a_later_broadcast() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let a = Pool::builder().threads(2).build().unwrap();
+    let b = Pool::builder().threads(2).build().unwrap();
+    for _ in 0..20 {
+        let x_bar = std::sync::Barrier::new(2);
+        let y_bar = std::sync::Barrier::new(2);
+        let x_waiting = std::sync::atomic::AtomicBool::new(false);
+        std::thread::scope(|s| {
+            s.spawn(|| {
+                Exec::new(&a, 2)
+                    .unwrap()
+                    .broadcast(|i| {
+                        if i == 0 {
+                            x_waiting.store(true, Ordering::SeqCst);
+                            Exec::new(&b, 2).unwrap().fork(2, |_, _| {
+                                std::thread::sleep(Duration::from_millis(20));
+                            });
+                        }
+                        x_bar.wait();
+                    })
+                    .unwrap();
+            });
+            s.spawn(|| {
+                while !x_waiting.load(Ordering::SeqCst) {
+                    std::thread::yield_now();
+                }
+                Exec::new(&a, 2)
+                    .unwrap()
+                    .broadcast(|_| {
+                        y_bar.wait();
+                    })
+                    .unwrap();
+            });
+        });
+    }
+}
diff --git a/tests/team.rs b/tests/team.rs
index e68298c..e323bbe 100644
--- a/tests/team.rs
+++ b/tests/team.rs
@@ -37,10 +37,15 @@ fn pool(n: usize) -> Pool {
 }
 
 /// A pool whose acquisitions tolerate a loaded test host.
+/// A pool whose idle members stay for `spin` of wall time: the poll bound of
+/// an idle member (`spin_polls`) is lifted so that `idle_spin` alone decides,
+/// which these tests are about. `idle_members_return_after_the_spin_budget`
+/// covers the poll bound.
 fn builder(n: usize, spin: Duration) -> threadteam::PoolBuilder {
     Pool::builder()
         .threads(n)
         .idle_spin(spin)
+        .spin_polls(u32::MAX)
         .acquire_timeout(Duration::from_secs(5))
 }
 
@@ -483,6 +488,80 @@ fn a_panic_cancels_barriers_so_peers_leave_instead_of_deadlocking() {
     }
 }
 
+/// The same with every wait asleep (`spin_polls(0)`): the panicker raises the
+/// cancellation after its peers went to sleep in the barrier, and the
+/// cancellation wakes them (`Section::fail`).
+#[test]
+fn a_panic_wakes_peers_asleep_in_a_barrier() {
+    let _w = watchdog();
+    let pool = Pool::builder()
+        .threads(5)
+        .spin_polls(0)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    for panicker in [0, 3] {
+        let mut exec = Exec::new(&pool, 5).unwrap();
+        let cancelled = AtomicUsize::new(0);
+        let r = catch_unwind(AssertUnwindSafe(|| {
+            exec.team(|team| {
+                team.run_with(|p| {
+                    if p.index() == panicker {
+                        // Let the peers reach the barrier and sleep first.
+                        std::thread::sleep(Duration::from_millis(20));
+                        panic!("boom");
+                    }
+                    if p.barrier() == Err(Cancelled) {
+                        cancelled.fetch_add(1, Ordering::SeqCst);
+                    }
+                });
+            })
+        }));
+        assert!(r.is_err());
+        assert_eq!(cancelled.load(Ordering::SeqCst), 4);
+    }
+}
+
+/// Every wait asleep (`spin_polls(0)`), many short sections with barriers,
+/// splits and forks: every section completes with every share counted. A lost
+/// wake-up hangs (watchdog).
+#[test]
+fn sleeping_waits_complete_every_section() {
+    let _w = watchdog();
+    let pool = Pool::builder()
+        .threads(6)
+        .spin_polls(0)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    let team = pool.into_team(6).unwrap();
+    let mut exec = team.exec(6);
+    let sum = AtomicUsize::new(0);
+    let rounds = 300;
+    exec.team(|mut t| {
+        let size = t.size().get();
+        for _ in 0..rounds {
+            t.reborrow().run(|_, _| {
+                sum.fetch_add(1, Ordering::Relaxed);
+            });
+            t.reborrow().run_with(|p| {
+                p.barrier().unwrap();
+                p.barrier().unwrap();
+                sum.fetch_add(1, Ordering::Relaxed);
+            });
+            t.reborrow()
+                .split(&[size / 2, size - size / 2], |_, child| {
+                    child.run(|_, _| {
+                        sum.fetch_add(1, Ordering::Relaxed);
+                    });
+                })
+                .unwrap();
+        }
+        assert_eq!(sum.load(Ordering::Relaxed), rounds * 3 * size);
+    })
+    .unwrap();
+}
+
 #[test]
 fn a_child_panic_propagates_through_split_after_siblings_finish() {
     let _w = watchdog();
@@ -577,6 +656,25 @@ fn the_team_runs_from_a_pool_worker_with_members_from_the_others() {
     let _ = ok.load(Ordering::SeqCst);
 }
 
+#[test]
+fn idle_members_return_after_the_spin_budget() {
+    let _w = watchdog();
+    // An hour of `idle_spin`, but a budget of 1000 polls: a released member
+    // returns to Rayon after its polls, long before the hour.
+    let pool = Pool::builder()
+        .threads(4)
+        .idle_spin(Duration::from_secs(3600))
+        .spin_polls(1000)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    let mut exec = Exec::new(&pool, 4).unwrap();
+    exec.team(|t| t.run(|_, _| {})).unwrap();
+    wait_until("idle members returned after their polls", || {
+        pool.resident_members() == 0
+    });
+}
+
 #[test]
 fn pool_drop_joins_idle_members() {
     let _w = watchdog();
diff --git a/tests/team_alloc_free.rs b/tests/team_alloc_free.rs
index 32e0ee5..d5ad57b 100644
--- a/tests/team_alloc_free.rs
+++ b/tests/team_alloc_free.rs
@@ -174,4 +174,46 @@ fn team_dispatch_does_not_allocate_after_warm_up() {
     for round in 0..20 {
         assert_eq!(allocs_in(|| token_phases(&team)), 0, "pinned round {round}");
     }
+    drop(team);
+
+    // A zero spin budget: every join and barrier wait that does not finish at
+    // once goes to sleep on the pool's parker (`docs/design/waiting.md`), and
+    // every member waits for work asleep. Neither the sleep nor the wake-up
+    // allocates. The shares are uneven, so that waiters do sleep.
+    let pool = Pool::builder()
+        .threads(4)
+        .spin_polls(0)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    let team = pool.into_team(4).unwrap();
+    let mut exec = team.exec(4);
+    let sleeping_phases = |exec: &mut Exec<'_>| {
+        exec.reborrow()
+            .team(|mut t| {
+                t.reborrow().run(|i, _| {
+                    if i == 1 {
+                        std::thread::sleep(Duration::from_micros(200));
+                    }
+                });
+                t.reborrow().run_with(|p| {
+                    if p.index() == 2 {
+                        std::thread::sleep(Duration::from_micros(200));
+                    }
+                    p.barrier().unwrap();
+                    sink.fetch_add(p.index(), Ordering::Relaxed);
+                });
+            })
+            .unwrap();
+    };
+    for _ in 0..50 {
+        sleeping_phases(&mut exec);
+    }
+    for round in 0..20 {
+        assert_eq!(
+            allocs_in(|| sleeping_phases(&mut exec)),
+            0,
+            "sleeping round {round}"
+        );
+    }
 }