From a3a932092af1225d32e038f37f91241da3fd7d0a Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Thu, 29 Oct 2026 22:27:42 +0900
Subject: [PATCH 01/13] benches: wait scenarios (short sections, gaps, pool
 held vs fresh, width, foreign load) with Rayon and libgomp references

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.toml                         |   5 +
 README.md                          |  36 +++
 benches/omp/wait_omp.c             | 113 +++++++
 benches/wait_scenarios.rs          | 497 +++++++++++++++++++++++++++++
 docs/design/waiting-data/README.md |   6 +
 scripts/bench-waits.sh             |  52 +++
 6 files changed, 709 insertions(+)
 create mode 100644 benches/omp/wait_omp.c
 create mode 100644 benches/wait_scenarios.rs
 create mode 100644 docs/design/waiting-data/README.md
 create mode 100755 scripts/bench-waits.sh

diff --git a/Cargo.toml b/Cargo.toml
index 43299cc..400aecc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -83,3 +83,8 @@ unexpected_cfgs = { level = "warn", check-cfg = ['cfg(loom)'] }
 [[bench]]
 name = "cost_lookup"
 harness = false
+
+[[bench]]
+name = "wait_scenarios"
+harness = false
+required-features = ["parallel"]
diff --git a/README.md b/README.md
index efd0948..2b936d1 100644
--- a/README.md
+++ b/README.md
@@ -107,6 +107,42 @@ Consumers assert `ledger::max_live(root) <= budget` in their own tests, and keep
 a test binary that runs serial and pooled work and then checks that
 `rayon::ThreadPoolBuilder::new().build_global()` still succeeds.
 
+## Wait benchmarks
+
+`benches/wait_scenarios.rs` measures how team threads wait, the way callers use them; the design
+is in [`docs/design/waiting.md`](docs/design/waiting.md). A change to the waits is judged by running
+it on the base and on the head of the change, on a quiet host and on a many-core shared host.
+
+| scenario | a call is | reports |
+| --- | --- | --- |
+| `sections` | 200 sections of 5, 20 or 50 µs, team held | per call, and the overhead over `sections * work` |
+| `gaps` | 10 sections of 5 µs, the caller sleeps 0 / 100 µs / 1 ms / 10 ms between calls | the first section (wake latency) and the call |
+| `acquire` | 50 sections of 20 µs: the team held (a token per call), the pool held (members acquired per call), a new pool per call | per call; for a new pool also the total from build to drop |
+| `nested` | 100 splits of the team into pairs, each pair one 20 µs section | per call |
+
+Each scenario runs at width = all CPUs of the affinity set and at three quarters of them, on
+threadteam and on a Rayon `scope`; `benches/omp/wait_omp.c` runs `sections` and `gaps` on libgomp
+(one `omp parallel` region per section, runtime defaults). `--load K:P` adds `K` child processes,
+each busy `P` % of every 10 ms, for the whole run: the stand-in for another user's processes.
+
+```sh
+# one checkout, both passes (quiet, then 8 processes at 10 %), rows appended to
+# docs/design/waiting-data/<host>.csv
+scripts/bench-waits.sh <label>                 # e.g. main-4c73c2b, then the PR head
+scripts/bench-waits.sh <label> 64,48 8:10      # explicit widths and load
+cargo bench --bench wait_scenarios -- --scenario gaps --widths 8   # one scenario; options in the file header
+```
+
+* **evo** (quiet): `scripts/bench-waits.sh <label> "" none` on the base and on the head. The
+  acceptance check is that `sections` and `gaps` do not regress.
+* **broccoli** (64 CPUs, shared): `taskset -c 0-63 scripts/bench-waits.sh <label> 64,48 8:10` on the
+  base and on the head, plus the faer#107 arms of `acquire_probe_107` (tensor4all/faer branch
+  `probe/107-acquire-per-call`). The acceptance check is that width 64 under load is no longer
+  slow and width 48 does not regress.
+
+Results are committed as CSV under [`docs/design/waiting-data/`](docs/design/waiting-data/), one
+file per host, with the label naming the commit; the summary tables live in `waiting.md`.
+
 ## License
 
 Licensed under either of MIT or Apache-2.0 at your option.
diff --git a/benches/omp/wait_omp.c b/benches/omp/wait_omp.c
new file mode 100644
index 0000000..5880039
--- /dev/null
+++ b/benches/omp/wait_omp.c
@@ -0,0 +1,113 @@
+/* The libgomp reference for benches/wait_scenarios.rs (docs/design/waiting.md).
+ *
+ * The same work as the Rust bench: a section is one `omp parallel` region in which every thread
+ * busy-waits `work` microseconds on the clock; a call is a run of sections. Prints rows in the
+ * Rust bench's format and appends them to a CSV file when one is given.
+ *
+ * Build and run with scripts/bench-omp.sh, or:
+ *   gcc -O2 -fopenmp benches/omp/wait_omp.c -o target/wait_omp
+ *   target/wait_omp <width> <calls> [csv] [label]
+ * The OpenMP runtime runs with its defaults (no OMP_WAIT_POLICY, no GOMP_SPINCOUNT, no binding)
+ * unless the caller sets them.
+ */
+#define _GNU_SOURCE
+#include <omp.h>
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+static double now_us(void) {
+  struct timespec t;
+  clock_gettime(CLOCK_MONOTONIC, &t);
+  return t.tv_sec * 1e6 + t.tv_nsec / 1e3;
+}
+
+static inline void relax(void) {
+#if defined(__x86_64__) || defined(__i386__)
+  __builtin_ia32_pause();
+#elif defined(__aarch64__)
+  __asm__ __volatile__("yield");
+#endif
+}
+
+static void busy(double us) {
+  double end = now_us() + us;
+  while (now_us() < end) relax();
+}
+
+static int cmp(const void *a, const void *b) {
+  double x = *(const double *)a, y = *(const double *)b;
+  return (x > y) - (x < y);
+}
+
+static FILE *csv;
+static char prefix[512];
+
+static void row(const char *scenario, int width, const char *param, const char *metric, double *v,
+                int n, double ideal) {
+  qsort(v, n, sizeof *v, cmp);
+  double med = v[n / 2], p90 = v[(n * 9 / 10) < n ? n * 9 / 10 : n - 1], max = v[n - 1];
+  printf("%-9s %-10s %5d %-22s %-7s %11.1f %11.1f %11.1f %10.1f\n", scenario, "libgomp", width,
+         param, metric, med, p90, max, med - ideal);
+  if (csv)
+    fprintf(csv, "%s,%s,libgomp,%d,%s,%s,%.2f,%.2f,%.2f,%.2f\n", prefix, scenario, width, param,
+            metric, med, p90, max, med - ideal);
+}
+
+/* One call: the time of the first section and of the whole call, in us. */
+static void call(int width, int sections, double work, double *first, double *whole) {
+  double t0 = now_us();
+  for (int s = 0; s < sections; s++) {
+#pragma omp parallel num_threads(width)
+    busy(work);
+    if (s == 0) *first = now_us() - t0;
+  }
+  *whole = now_us() - t0;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3) {
+    fprintf(stderr, "usage: wait_omp <width> <calls> [csv] [label]\n");
+    return 2;
+  }
+  int width = atoi(argv[1]), calls = atoi(argv[2]);
+  cpu_set_t set;
+  int cpus = sched_getaffinity(0, sizeof set, &set) == 0 ? CPU_COUNT(&set) : 0;
+  char host[256] = "";
+  gethostname(host, sizeof host - 1);
+  const char *label = argc > 4 ? argv[4] : "";
+  const char *load = getenv("WAIT_BENCH_LOAD") ? getenv("WAIT_BENCH_LOAD") : "none";
+  snprintf(prefix, sizeof prefix, "%s,%s,%d,%s", host, label, cpus, load);
+  if (argc > 3) {
+    int fresh = access(argv[3], F_OK) != 0;
+    csv = fopen(argv[3], "a");
+    if (csv && fresh)
+      fprintf(csv, "host,label,cpus,load,scenario,impl,width,param,metric,median_us,p90_us,max_us,overhead_us\n");
+  }
+  double *a = malloc(sizeof(double) * calls), *b = malloc(sizeof(double) * calls);
+  char param[64];
+  /* warm the hot team */
+  for (int i = 0; i < 10; i++) call(width, 10, 5, a, b);
+
+  int works[3] = {5, 20, 50};
+  for (int k = 0; k < 3; k++) {
+    for (int i = 0; i < calls; i++) call(width, 200, works[k], &a[i], &b[i]);
+    snprintf(param, sizeof param, "work=%dus,sections=200", works[k]);
+    row("sections", width, param, "call", b, calls, 200.0 * works[k]);
+  }
+  int gaps[4] = {0, 100, 1000, 10000};
+  for (int k = 0; k < 4; k++) {
+    for (int i = 0; i < calls / 2; i++) {
+      if (gaps[k]) usleep(gaps[k]);
+      call(width, 10, 5, &a[i], &b[i]);
+    }
+    snprintf(param, sizeof param, "gap=%dus", gaps[k]);
+    row("gaps", width, param, "first", a, calls / 2, 5);
+    row("gaps", width, param, "call", b, calls / 2, 50);
+  }
+  if (csv) fclose(csv);
+  return 0;
+}
diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
new file mode 100644
index 0000000..be3986d
--- /dev/null
+++ b/benches/wait_scenarios.rs
@@ -0,0 +1,497 @@
+//! How team threads wait, measured the way callers use them (`docs/design/waiting.md`).
+//!
+//! `cargo bench --bench wait_scenarios -- [options]` prints one table row per cell and, with
+//! `--csv <file>`, appends the same rows to a CSV file (`docs/design/waiting-data/`). Every cell
+//! repeats a *call* and reports the median, the 90th percentile and the maximum per call.
+//!
+//! A section is `width` participants each busy-waiting `work` microseconds on the clock, so the
+//! ideal time of a call is `sections * work`; the `overhead` column is the median minus that.
+//!
+//! Scenarios (`--scenario`, default `all`):
+//! * `sections`: a call is 200 sections of 5, 20 or 50 µs, on a team held across calls;
+//! * `gaps`: a call is 10 sections of 5 µs, the caller sleeps 0 / 100 µs / 1 ms / 10 ms between
+//!   calls; reports the first section of each call (wake latency + 5 µs) and the whole call;
+//! * `acquire`: a call is 50 sections of 20 µs, with the team held and a token minted per call
+//!   (`held_team`, as tenferro's `CpuEngine`), with the pool held and the members acquired per
+//!   call (`held_pool`, `Exec::new(..).team(..)`), and with a new pool per call (`fresh_pool`, as
+//!   faer's `with_team`; `total` times the build, the acquisition, the call and the drop);
+//! * `nested`: a call is 100 splits of the team into pairs, each pair running one 20 µs
+//!   section: many child leaders join at once (they share one sleeping place in the pool).
+//!
+//! Every scenario runs at the widths given by `--widths` (default: all CPUs of the affinity set,
+//! and three quarters of them), on threadteam and, as a reference, on a Rayon `scope` of the same
+//! width (`--impl threadteam,rayon`). The libgomp reference is `benches/omp/wait_omp.c` (README,
+//! "Wait benchmarks").
+//!
+//! Foreign load (`--load K:P`): `K` child processes of this binary, each busy `P` % of every 10 ms
+//! period, unpinned, for the whole run. They stand for another user's processes on a shared host.
+//!
+//! Options: `--scenario sections|gaps|acquire|nested|all`, `--widths 64,48`, `--impl threadteam,rayon`,
+//! `--load K:P`, `--calls N` (default 200; `gaps` and `acquire` use N/2), `--csv <file>`,
+//! `--label <text>` (the version or commit, written to the CSV).
+
+use std::io::Write;
+use std::time::{Duration, Instant};
+use threadteam::{Pool, Team};
+
+fn busy(us: u64) {
+    let end = Instant::now() + Duration::from_micros(us);
+    while Instant::now() < end {
+        std::hint::spin_loop();
+    }
+}
+
+fn cpus() -> usize {
+    #[cfg(target_os = "linux")]
+    unsafe {
+        let mut set: libc::cpu_set_t = std::mem::zeroed();
+        if libc::sched_getaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &mut set) == 0 {
+            let n = libc::CPU_COUNT(&set) as usize;
+            if n > 0 {
+                return n;
+            }
+        }
+    }
+    std::thread::available_parallelism().map_or(1, |n| n.get())
+}
+
+fn load_average() -> f64 {
+    let mut l = [0f64; 3];
+    unsafe { libc::getloadavg(l.as_mut_ptr(), 3) };
+    l[0]
+}
+
+fn host() -> String {
+    let mut buf = [0u8; 256];
+    unsafe { libc::gethostname(buf.as_mut_ptr().cast(), buf.len()) };
+    let end = buf.iter().position(|&b| b == 0).unwrap_or(buf.len());
+    String::from_utf8_lossy(&buf[..end]).into_owned()
+}
+
+/// Child processes that burn a share of a CPU each until dropped.
+struct Load(Vec<std::process::Child>);
+
+impl Load {
+    fn start(spec: Option<(usize, u64)>) -> Self {
+        let Some((k, pct)) = spec else {
+            return Load(Vec::new());
+        };
+        let exe = std::env::current_exe().expect("own path");
+        Load(
+            (0..k)
+                .map(|_| {
+                    std::process::Command::new(&exe)
+                        .args(["--load-child", &pct.to_string()])
+                        .spawn()
+                        .expect("a load child")
+                })
+                .collect(),
+        )
+    }
+}
+
+impl Drop for Load {
+    fn drop(&mut self) {
+        for c in &mut self.0 {
+            let _ = c.kill();
+            let _ = c.wait();
+        }
+    }
+}
+
+fn load_child(pct: u64) -> ! {
+    let period = Duration::from_millis(10);
+    let on = period * pct.min(100) as u32 / 100;
+    loop {
+        let t = Instant::now();
+        while t.elapsed() < on {
+            std::hint::spin_loop();
+        }
+        if let Some(rest) = period.checked_sub(t.elapsed()) {
+            std::thread::sleep(rest);
+        }
+    }
+}
+
+struct Stats {
+    median: f64,
+    p90: f64,
+    max: f64,
+}
+
+fn stats(mut v: Vec<f64>) -> Stats {
+    v.sort_by(|a, b| a.partial_cmp(b).unwrap());
+    Stats {
+        median: v[v.len() / 2],
+        p90: v[(v.len() * 9 / 10).min(v.len() - 1)],
+        max: v[v.len() - 1],
+    }
+}
+
+fn pool(width: usize) -> Pool {
+    Pool::builder()
+        .threads(width)
+        .acquire_timeout(Duration::from_secs(30))
+        .build()
+        .expect("a pool")
+}
+
+fn team(width: usize) -> Team {
+    pool(width).into_team(width).expect("an idle pool")
+}
+
+/// One call of `sections` sections of `work` µs on a team; the time of the first section and of
+/// the whole call, in µs.
+fn call_team(team: &Team, width: usize, sections: usize, work: u64) -> (f64, f64) {
+    let mut exec = team.exec(width);
+    exec.team(|mut t| {
+        let t0 = Instant::now();
+        t.reborrow().run(|_, _| busy(work));
+        let first = t0.elapsed().as_secs_f64() * 1e6;
+        for _ in 1..sections {
+            t.reborrow().run(|_, _| busy(work));
+        }
+        (first, t0.elapsed().as_secs_f64() * 1e6)
+    })
+    .expect("a team token")
+}
+
+/// One call of `splits` splits of the team into pairs, each pair running one section of
+/// `work` µs; the time of the call in µs.
+fn call_nested(team: &Team, width: usize, splits: usize, work: u64) -> f64 {
+    let mut exec = team.exec(width);
+    exec.team(|mut t| {
+        let pairs = vec![2usize; t.size().get() / 2];
+        let t0 = Instant::now();
+        for _ in 0..splits {
+            t.reborrow()
+                .split(&pairs, |_, child| child.run(|_, _| busy(work)))
+                .expect("a split into pairs");
+        }
+        t0.elapsed().as_secs_f64() * 1e6
+    })
+    .expect("a team token")
+}
+
+/// One call that acquires its members from a held pool (`Exec::new(..).team(..)`); the time of
+/// the acquisition and the call, in µs.
+fn call_pool(pool: &Pool, width: usize, sections: usize, work: u64) -> f64 {
+    let t0 = Instant::now();
+    threadteam::Exec::new(pool, width)
+        .expect("a token")
+        .team(|mut t| {
+            for _ in 0..sections {
+                t.reborrow().run(|_, _| busy(work));
+            }
+        })
+        .expect("members for the scope");
+    t0.elapsed().as_secs_f64() * 1e6
+}
+
+/// The same call on a Rayon pool: one `scope` per section, `width - 1` spawned shares and one on
+/// the caller.
+fn call_rayon(pool: &rayon::ThreadPool, width: usize, sections: usize, work: u64) -> (f64, f64) {
+    pool.install(|| {
+        let t0 = Instant::now();
+        let mut first = 0.0;
+        for s in 0..sections {
+            rayon::scope(|sc| {
+                for _ in 1..width {
+                    sc.spawn(|_| busy(work));
+                }
+                busy(work);
+            });
+            if s == 0 {
+                first = t0.elapsed().as_secs_f64() * 1e6;
+            }
+        }
+        (first, t0.elapsed().as_secs_f64() * 1e6)
+    })
+}
+
+struct Row<'a> {
+    scenario: &'a str,
+    imp: &'a str,
+    width: usize,
+    param: String,
+    metric: &'a str,
+    s: Stats,
+    ideal_us: f64,
+}
+
+struct Out {
+    csv: Option<std::fs::File>,
+    prefix: String,
+}
+
+impl Out {
+    fn row(&mut self, r: Row<'_>) {
+        println!(
+            "{:<9} {:<10} {:>5} {:<22} {:<7} {:>11.1} {:>11.1} {:>11.1} {:>10.1}",
+            r.scenario,
+            r.imp,
+            r.width,
+            r.param,
+            r.metric,
+            r.s.median,
+            r.s.p90,
+            r.s.max,
+            r.s.median - r.ideal_us
+        );
+        if let Some(f) = &mut self.csv {
+            writeln!(
+                f,
+                "{},{},{},{},{},{},{:.2},{:.2},{:.2},{:.2}",
+                self.prefix,
+                r.scenario,
+                r.imp,
+                r.width,
+                r.param,
+                r.metric,
+                r.s.median,
+                r.s.p90,
+                r.s.max,
+                r.s.median - r.ideal_us
+            )
+            .expect("csv write");
+        }
+    }
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let value = |name: &str| {
+        args.iter()
+            .position(|a| a == name)
+            .and_then(|i| args.get(i + 1).cloned())
+    };
+    if let Some(pct) = value("--load-child") {
+        load_child(pct.parse().expect("--load-child <percent>"));
+    }
+    let scenario = value("--scenario").unwrap_or_else(|| "all".into());
+    let n = cpus();
+    let widths: Vec<usize> = value("--widths")
+        .map(|v| v.split(',').map(|w| w.parse().expect("--widths")).collect())
+        .unwrap_or_else(|| {
+            let mut w = vec![n, (n * 3 / 4).max(1)];
+            w.dedup();
+            w
+        });
+    let imps: Vec<String> = value("--impl")
+        .unwrap_or_else(|| "threadteam,rayon".into())
+        .split(',')
+        .map(String::from)
+        .collect();
+    let load_spec = value("--load").map(|v| {
+        let (k, p) = v.split_once(':').expect("--load K:P");
+        (k.parse().expect("--load K"), p.parse().expect("--load P"))
+    });
+    let calls: usize = value("--calls").map_or(200, |v| v.parse().expect("--calls"));
+    let label = value("--label").unwrap_or_default();
+    let load_text = load_spec.map_or("none".into(), |(k, p)| format!("{k}x{p}%"));
+
+    let csv = value("--csv").map(|path| {
+        let fresh = !std::path::Path::new(&path).exists();
+        let mut f = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&path)
+            .expect("csv file");
+        if fresh {
+            writeln!(
+                f,
+                "host,label,cpus,load,scenario,impl,width,param,metric,median_us,p90_us,max_us,overhead_us"
+            )
+            .expect("csv header");
+        }
+        f
+    });
+    let mut out = Out {
+        csv,
+        prefix: format!("{},{label},{n},{load_text}", host()),
+    };
+
+    let _load = Load::start(load_spec);
+    if load_spec.is_some() {
+        std::thread::sleep(Duration::from_millis(200));
+    }
+    println!(
+        "host {} cpus {n} load average {:.2} foreign load {load_text} label {label}",
+        host(),
+        load_average()
+    );
+    println!(
+        "{:<9} {:<10} {:>5} {:<22} {:<7} {:>11} {:>11} {:>11} {:>10}",
+        "scenario", "impl", "width", "param", "metric", "median us", "p90 us", "max us", "overhead"
+    );
+
+    let want = |s: &str| scenario == "all" || scenario == s;
+    for &w in &widths {
+        let rayon_pool = imps.iter().any(|i| i == "rayon").then(|| {
+            rayon::ThreadPoolBuilder::new()
+                .num_threads(w)
+                .build()
+                .expect("a rayon pool")
+        });
+        let mut held = imps.iter().any(|i| i == "threadteam").then(|| team(w));
+
+        if want("sections") {
+            for work in [5u64, 20, 50] {
+                let sections = 200;
+                let param = format!("work={work}us,sections={sections}");
+                let ideal = (sections as u64 * work) as f64;
+                if let Some(t) = &held {
+                    let v = (0..calls)
+                        .map(|_| call_team(t, w, sections, work).1)
+                        .collect();
+                    out.row(Row {
+                        scenario: "sections",
+                        imp: "threadteam",
+                        width: w,
+                        param: param.clone(),
+                        metric: "call",
+                        s: stats(v),
+                        ideal_us: ideal,
+                    });
+                }
+                if let Some(p) = &rayon_pool {
+                    let v = (0..calls)
+                        .map(|_| call_rayon(p, w, sections, work).1)
+                        .collect();
+                    out.row(Row {
+                        scenario: "sections",
+                        imp: "rayon",
+                        width: w,
+                        param,
+                        metric: "call",
+                        s: stats(v),
+                        ideal_us: ideal,
+                    });
+                }
+            }
+        }
+
+        if want("gaps") {
+            for gap_us in [0u64, 100, 1_000, 10_000] {
+                let (sections, work) = (10, 5u64);
+                let param = format!("gap={gap_us}us");
+                let gap = Duration::from_micros(gap_us);
+                let run = |f: &mut dyn FnMut() -> (f64, f64)| {
+                    let mut first = Vec::new();
+                    let mut whole = Vec::new();
+                    for _ in 0..calls / 2 {
+                        if !gap.is_zero() {
+                            std::thread::sleep(gap);
+                        }
+                        let (a, b) = f();
+                        first.push(a);
+                        whole.push(b);
+                    }
+                    (stats(first), stats(whole))
+                };
+                if let Some(t) = &held {
+                    let (a, b) = run(&mut || call_team(t, w, sections, work));
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "threadteam",
+                        width: w,
+                        param: param.clone(),
+                        metric: "first",
+                        s: a,
+                        ideal_us: work as f64,
+                    });
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "threadteam",
+                        width: w,
+                        param: param.clone(),
+                        metric: "call",
+                        s: b,
+                        ideal_us: (sections as u64 * work) as f64,
+                    });
+                }
+                if let Some(p) = &rayon_pool {
+                    let (a, b) = run(&mut || call_rayon(p, w, sections, work));
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "rayon",
+                        width: w,
+                        param: param.clone(),
+                        metric: "first",
+                        s: a,
+                        ideal_us: work as f64,
+                    });
+                    out.row(Row {
+                        scenario: "gaps",
+                        imp: "rayon",
+                        width: w,
+                        param,
+                        metric: "call",
+                        s: b,
+                        ideal_us: (sections as u64 * work) as f64,
+                    });
+                }
+            }
+        }
+
+        if want("nested") && w >= 4 {
+            if let Some(t) = &held {
+                let (splits, work) = (100, 20u64);
+                let v = (0..calls / 2)
+                    .map(|_| call_nested(t, w, splits, work))
+                    .collect();
+                out.row(Row {
+                    scenario: "nested",
+                    imp: "threadteam",
+                    width: w,
+                    param: "pairs,splits=100,work=20us".into(),
+                    metric: "call",
+                    s: stats(v),
+                    ideal_us: (splits as u64 * work) as f64,
+                });
+            }
+        }
+
+        if want("acquire") && imps.iter().any(|i| i == "threadteam") {
+            // No other team of this process stays reserved while these arms run.
+            drop(held.take());
+            let (sections, work) = (50, 20u64);
+            let ideal = (sections as u64 * work) as f64;
+            let mut row = |param: &str, metric: &'static str, v: Vec<f64>| {
+                out.row(Row {
+                    scenario: "acquire",
+                    imp: "threadteam",
+                    width: w,
+                    param: param.into(),
+                    metric,
+                    s: stats(v),
+                    ideal_us: ideal,
+                })
+            };
+            {
+                let t = team(w);
+                let v = (0..calls / 2)
+                    .map(|_| call_team(&t, w, sections, work).1)
+                    .collect();
+                row("held_team", "call", v);
+            }
+            {
+                let p = pool(w);
+                let v = (0..calls / 2)
+                    .map(|_| call_pool(&p, w, sections, work))
+                    .collect();
+                row("held_pool", "call", v);
+            }
+            let (mut call, mut total) = (Vec::new(), Vec::new());
+            for _ in 0..calls / 2 {
+                let t0 = Instant::now();
+                let t = team(w);
+                call.push(call_team(&t, w, sections, work).1);
+                drop(t);
+                total.push(t0.elapsed().as_secs_f64() * 1e6);
+            }
+            row("fresh_pool", "call", call);
+            row("fresh_pool", "total", total);
+        }
+    }
+}
diff --git a/docs/design/waiting-data/README.md b/docs/design/waiting-data/README.md
new file mode 100644
index 0000000..4db405e
--- /dev/null
+++ b/docs/design/waiting-data/README.md
@@ -0,0 +1,6 @@
+# Wait benchmark results
+
+One CSV per host, written by `scripts/bench-waits.sh` (columns: host, label, cpus, load, scenario,
+impl, width, param, metric, median_us, p90_us, max_us, overhead_us). `label` names the commit or
+version measured; `load` is the foreign load of that pass (`none` or `KxP%`). Times are per call in
+microseconds; `overhead_us` is the median minus the ideal `sections * work`.
diff --git a/scripts/bench-waits.sh b/scripts/bench-waits.sh
new file mode 100755
index 0000000..3abfe24
--- /dev/null
+++ b/scripts/bench-waits.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Runs the wait benchmarks (docs/design/waiting.md, README "Wait benchmarks") for one checkout:
+# the Rust bench (threadteam and Rayon) and, when `gcc -fopenmp` works, the libgomp driver, with
+# and without foreign load. Rows are appended to $CSV.
+#
+#   scripts/bench-waits.sh <label> [widths] [load K:P]
+#
+# label   the version or commit under test, written to every row (e.g. `main-4c73c2b`)
+# widths  comma separated (default: all CPUs of the affinity set and three quarters of them)
+# load    foreign load for the second pass (default 8:10, eight processes at 10 % each);
+#         `none` skips the loaded pass
+# CSV     output file (default docs/design/waiting-data/<host>.csv)
+set -euo pipefail
+label=${1:?label}
+widths=${2:-}
+load=${3:-8:10}
+host=$(hostname -s)
+csv=${CSV:-docs/design/waiting-data/$host.csv}
+mkdir -p "$(dirname "$csv")"
+cargo build -j "${JOBS:-4}" --release --bench wait_scenarios >/dev/null
+bench=$(ls -t target/release/deps/wait_scenarios-* | grep -v '\.d$' | head -1)
+wargs=()
+[[ -n $widths ]] && wargs=(--widths "$widths")
+
+omp=""
+if echo 'int main(void){return 0;}' | gcc -fopenmp -x c - -o /dev/null 2>/dev/null; then
+  gcc -O2 -fopenmp benches/omp/wait_omp.c -o target/wait_omp
+  omp=target/wait_omp
+else
+  echo "gcc -fopenmp not available: libgomp reference skipped" >&2
+fi
+cpus=$(nproc)
+ws=${widths:-$cpus,$((cpus * 3 / 4))}
+
+run_pass() { # $1 = load spec or none
+  local largs=()
+  [[ $1 != none ]] && largs=(--load "$1")
+  "$bench" --label "$label" --csv "$csv" "${wargs[@]}" "${largs[@]}"
+  if [[ -n $omp ]]; then
+    local pids=()
+    if [[ $1 != none ]]; then
+      for _ in $(seq "${1%%:*}"); do "$bench" --load-child "${1##*:}" & pids+=($!); done
+      sleep 0.2
+    fi
+    for w in ${ws//,/ }; do WAIT_BENCH_LOAD=$([[ $1 == none ]] && echo none || echo "${1%%:*}x${1##*:}%") \
+      "$omp" "$w" 200 "$csv" "$label"; done
+    [[ ${#pids[@]} -gt 0 ]] && kill "${pids[@]}" 2>/dev/null; wait 2>/dev/null || true
+  fi
+}
+run_pass none
+[[ $load != none ]] && run_pass "$load"
+echo "rows appended to $csv"

From 904501e53eb38c27eab75f1b2b44b9f6eb042a6d Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Thu, 29 Oct 2026 22:49:38 +0900
Subject: [PATCH 02/13] waits: staged like the OpenMP runtimes (bounded poll
 spin, yields, then sleep) for members, joins and barriers; scheduling
 pressure throttles (faer#107)

Every team wait is now an episode: spin for the pool's budget of polls
(PoolBuilder::spin_polls, a count like GOMP_SPINCOUNT; 12288 on x86-64,
~300 us on Zen 3), sixteen yields, then sleep until woken. The leader's join
and every barrier sleep on one pool-wide parker, woken by the last member's
decrement, the last arrival and a cancellation; a member that finds no work
parks on its slot as before. A spinner that sees a >200 us gap between its
clock reads was descheduled: it ends its spin and the pool starts its waits
throttled (100 polls) for 100 ms. Idle members released by a scoped team
return to Rayon after the spin budget or idle_spin, whichever comes first.
The spare worker (threadteam-rs#12) stays: removing it breaks external.

loom: the last member waking a sleeping leader, consecutive barrier rounds,
a cancellation waking a sleeper (each fails when its wake is removed).
Design: docs/design/waiting.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                |   3 +-
 docs/design/placement.md | 187 +++++------------------
 docs/design/waiting.md   | 152 +++++++++++++++++++
 src/awake.rs             | 312 ++++++++++++++++++++-------------------
 src/exec.rs              |  21 +--
 src/lib.rs               |   3 +
 src/park.rs              | 270 ++++++++++++++++++++++++++++++++-
 src/pin.rs               |  13 +-
 src/policy.rs            |   4 +-
 src/pool.rs              |  49 ++++++
 src/reserve.rs           |  44 +++---
 src/sync.rs              |   4 +-
 src/team.rs              |  18 ++-
 src/tests/mod.rs         |   1 +
 src/tests/placement.rs   |  49 ++++++
 src/tests/waiting.rs     |  59 ++++++++
 tests/idle_clock.rs      |  77 +++++-----
 tests/loom_park.rs       |  77 +++++++++-
 tests/oversubscribed.rs  |  31 ++--
 tests/team.rs            |  98 ++++++++++++
 tests/team_alloc_free.rs |  42 ++++++
 21 files changed, 1108 insertions(+), 406 deletions(-)
 create mode 100644 docs/design/waiting.md
 create mode 100644 src/tests/waiting.rs

diff --git a/README.md b/README.md
index 2b936d1..953e5e5 100644
--- a/README.md
+++ b/README.md
@@ -58,7 +58,8 @@ the token to kernels by value. Kernels never store a token and never mint one.
 | `Exec::team(f)` / `team_with(over, f)` | reserve `budget - 1` awake pool members for a scope and run barrier-bearing sections through `TeamExec` (`run`, `run_with`, `split`, `fork`, `reborrow`), or `Err(Refused::Unavailable)`; see the design record |
 | `Pool::into_team(width)` -> `Team` (owns the pool; `IntoTeamError` gives it back), `Team::exec(budget)` / `try_exec`, `Team::pool`, `Team::into_pool` | persistent reservation for an engine that owns its pool (`Pool` is not `Clone`); minted tokens are ordinary `Exec`s whose `fork`, `for_ranges`, `broadcast`, `team` dispatch on the reserved members; one leader at a time (`exec` blocks, `try_exec` -> `Refused::Busy`); idle members park while reserved |
 | `PoolBuilder::qos(Qos)`, `raise_current_thread_qos(Qos)` | worker QoS on macOS (default `UserInitiated`); raise the leading thread without ever lowering it |
-| `PoolBuilder::idle_spin`, `idle_runs_rayon`, `acquire_timeout`; `Pool::release_idle` | waiting policy of idle team members; a reserved member spins with one PAUSE per poll (never `sched_yield`), parks after the delay, and parks after a short spin in a root scope that has more participants than the caller's CPUs |
+| `PoolBuilder::idle_spin`, `idle_runs_rayon`, `acquire_timeout`; `Pool::release_idle` | waiting policy of idle team members (an idle member returns to Rayon after `idle_spin` or the spin budget, whichever comes first) |
+| `PoolBuilder::spin_polls`, `Pool::spin_polls` | spin budget of every team wait, in polls (the shape of libgomp's `GOMP_SPINCOUNT`): a reserved member waiting for work, the leader in a join and a participant in a barrier spin that many polls, yield a few times, then sleep until woken; throttled to 100 polls in an oversubscribed scope or after a waiter was descheduled ([`docs/design/waiting.md`](docs/design/waiting.md)) |
 | `PoolBuilder::pin_participants(bool)`, `Pool::pin_participants()` | opt-in placement of the **members** of a root team scope (Linux; off by default, which is consistent with the rule it protects): member `k` (participant `k >= 1`) pins itself onto the `k`-th CPU of the calling thread's affinity set, `S[0]` is left to the leader, and a member restores its own mask before it returns to Rayon or serves foreign work. **The leader is never pinned**, because a vendor library creates its thread team from the calling thread and a one-CPU caller would confine the whole provider team; a member that calls such a library directly inside a share does confine it, so use `Exec::external` (which restores the member's mask first) or leave pinning off. For tensor4all/faer#107; give each team its own CPU set (`taskset -c`), there is no CPU allocator |
 | `DispatchCosts`, `WidthCosts`, `PoolBuilder::dispatch_costs`, `Exec::dispatch_cost(width)`, `TeamExec::dispatch_cost(width)` | cost of one parallel section per kind of token (team, in pool, outside), steady state; one row per `HostClass` (`HostClass::detect()`, keyed by kernel dispatch: `x86_64-avx512`, `x86_64-avx2`, `x86_64-scalar`, `aarch64-apple`, `aarch64`, `generic`), `DispatchCosts::for_class(class)`; measured rows for `x86_64-avx512` (team anchors at widths 2, 4, 6 and 8) and `aarch64-apple`, a measured Zen2 team row for `x86_64-avx2` (anchors at ten widths from 2 to 64; its plain kinds stay generic), every other class takes the conservative `generic` row (3 / 15 / 40 us at the anchors 2, 4, 6); a row holds measured anchors (`WidthCosts::new`, `WidthCosts::flat`, or `WidthCosts::from_anchors` for measured anchors up to 64 and beyond), interpolates between them and grows linearly above the largest one, so a width above the anchors is never charged the cost of the largest anchor; `DispatchCosts::host_default()` is the detected class's row; `Duration::MAX` when serial; override per pool |
 | `pays_at(est, sections, cost)`, `Exec::pays(est, sections, width)`, `Exec::width_for(est, sections)`, `width_for_by`, `PAYS` | the one rule: parallel iff `est >= PAYS * sections * D(width)`; `width_for` minimises `sections * D(k) + est / k` |
diff --git a/docs/design/placement.md b/docs/design/placement.md
index 7d489ee..da8c02b 100644
--- a/docs/design/placement.md
+++ b/docs/design/placement.md
@@ -326,11 +326,10 @@ closure, the participant count, a padded completion counter, a sense-reversing
 barrier, a cancellation flag and an atomic cell for the first panic payload.
 The leader stores the section address and the participant index into each
 member slot and bumps its `gen` counter with release ordering; members poll
-`gen` and `state` with one PAUSE per poll (`spin_loop`, no `sched_yield`) and
-run their share and decrement the completion counter. After the reservation's
-park delay (the effective `idle_spin`, or zero in an oversubscribed root scope,
-see below) without work, a member parks (see below). The leader runs
-share 0, then waits for the counter, polling the same way. Nothing is allocated and nobody is woken
+`gen` and `state`, run their share and decrement the completion counter. The
+leader runs share 0, then waits for the counter. Every one of these waits
+(a member waiting for work, the leader's join, a barrier) is a staged episode,
+spin, a few yields, then sleep, described in [`waiting.md`](waiting.md). Nothing is allocated, and a dispatch wakes only members that are asleep
 (`tests/team_alloc_free.rs`; acquisition allocates a small `Vec` and, for
 members not already awake, the claim jobs).
 
@@ -406,36 +405,35 @@ release it when they return, so a caller that needs the team across several
 entries keeps the token and lends it with `reborrow`. No thread-local state is
 involved (the owner's thread id is stored in the team).
 
-**Parking.** A reserved member that finds no new section for the park delay
-(the effective `idle_spin` of the reservation: the pool default or the
-`reserve_with` / `team_with` override) parks and stays reserved. All parked
-members of a pool wait on one condition variable (`park_lock`, `park_cv`), with
-a counter `parked` of members inside or entering the wait. The protocol:
+**Parking.** A reserved member that finds no new section within its staged
+wait (spin budget, a few yields; [`waiting.md`](waiting.md)) parks and stays
+reserved. Each member slot has its own `Parker`, and a leader wakes only
+the slots it changed (a publish, a release, a lend); the joins and barriers
+sleep on one pool-wide `Parker`. The protocol of every `Parker`:
 
-* A member raises `parked` (acquire-release increment), takes the lock,
-  re-checks `gen`, `state` and `lent` and waits only while none changed; it
+* A sleeper raises `parked` (acquire-release increment), takes the lock,
+  re-checks the state it waits on and waits only while it is unchanged; it
   lowers `parked` when it leaves.
-* A leader changes the state a member waits on (bumps `gen`, stores `IDLE`,
-  sets `lent`), then reads `parked` with an acquire-release `fetch_add(0)`. If it
-  is nonzero, the leader takes and drops the lock and calls `notify_all`. Either the member sees the changed
-  state after raising `parked`, or the leader sees `parked` (both are read-modify-writes of one atomic, so the
-  argument needs only its modification order and release sequences, not a total
-  order of SeqCst accesses, which `loom` does not model); and because the
-  leader takes the lock before notifying, the notification cannot fall between a
-  member's check and its wait (the usual condition-variable handshake).
-* With nobody parked a dispatch pays one uncontended atomic read-modify-write.
-  A broadcast also wakes parked members of other teams of the same pool, which
-  re-check and sleep again; the leader pays one syscall, not one per member.
-* Spurious wake-ups loop. There is no per-member wake state: every parked member
-  waits on the one condition variable, so no wake-up depends on the order in
-  which a leader publishes to individual members.
+* A waker changes the state (SeqCst), then reads `parked` with an
+  acquire-release `fetch_add(0)`. If it is nonzero, it takes and drops the lock
+  and calls `notify_all`. Either the sleeper sees the changed state after
+  raising `parked`, or the waker sees `parked` (both are read-modify-writes of
+  one atomic, so the argument needs only its modification order and release
+  sequences, not a total order of SeqCst accesses, which `loom` does not
+  model); and because the waker takes the lock before notifying, the
+  notification cannot fall between a sleeper's check and its wait.
+* With nobody asleep a wake costs one uncontended atomic read-modify-write.
+  Spurious wake-ups loop. Which parker each wait uses, and when it sleeps, is
+  in [`waiting.md`](waiting.md).
 
 The handshake is the small `Parker` type in `src/park.rs`, built on a `sync`
 shim (`std`, or `loom` under `--cfg loom`), and checked three ways:
 
 * **Model check.** `tests/loom_park.rs` runs the real `Parker` under `loom` with
-  one leader and two members: a published section, a released reservation, and a
-  member that parks twice. The correctness argument therefore uses only what loom
+  one leader and two members: a published section, a released reservation, a
+  member that parks twice, and per-slot parkers; and the exact join and barrier
+  code (`Completion`, `Barrier`): a leader asleep in a join, consecutive
+  barrier rounds, and a cancellation waking a sleeper. The correctness argument therefore uses only what loom
   models (modification order and release sequences of `parked`). CI job `loom`:
   `RUSTFLAGS="--cfg loom" cargo test --release --test loom_park`.
 * **Forced interleavings.** With the feature `test-hooks`, `test_hooks` lets a
@@ -454,63 +452,12 @@ with a zero idle spin and broadcasts, so the members return to Rayon at once.
 
 ### How a reserved member and a joining leader wait
 
-Two waits exist, both allocation-free and both unchanged in the handshake:
-
-* **Reserved members polling `gen`, and a leader in `Section::join` or
-  `Section::barrier`, in a scope that is not oversubscribed**: one
-  `std::hint::spin_loop()` per poll (PAUSE on x86, YIELD/ISB on aarch64), never
-  a `yield_now`. A thread that only issues PAUSE stays runnable but does not
-  re-enter the scheduler on every poll, so a pair the scheduler stacked on one
-  CPU can be separated instead of preempting each other in a yield loop, and a
-  share does not pay a syscall per poll. This is libgomp's shape. A reserved
-  member still parks after its park delay, which is what ends the spin; nothing
-  else wakes it.
-* **Acquisition, the cold claim, and the `IDLE` / leaving states**: `backoff`
-  as before (a bounded pure spin, then one `yield_now` per poll). Those threads
-  are not reserved yet or are on their way out, so they must cooperate to make
-  progress on a loaded host.
-
-**Oversubscription.** A root team scope is oversubscribed when its participants
-number more than the CPUs in the **entering thread's** affinity mask (on
-non-Linux targets: `std::thread::available_parallelism()`). It is decided at
-root-scope entry on that thread, whether or not participant pinning is on: at
-`Exec::team_with` (acquisition path and the carried path of a root token minted
-by a `Team`), and for a `Team` also when its root token is minted
-(`Team::exec`/`try_exec`), which is the pressure a token used without a team
-scope reports. Because the scope entry repeats it, a token minted on one CPU set
-and used on another is paced and placed by the set of the thread that enters the
-scope, never by the one it was minted on. The result is carried into
-`TeamExec`, team-carrying `Exec` tokens, `reborrow`, `limit`, `split` and `fork`
-children and every `Section`, so a nested section of an oversubscribed root
-knows it too; it is never recomputed from a child's size. The members' park
-delay is written to their slots at the same entry. In such a scope:
-
-* the park delay of the reserved members is **zero**, so a member that finds no
-  section spins one short episode (64 polls) and parks instead of holding a CPU
-  for the whole `idle_spin`. `polls` and `spins` are reset at the start of each
-  idle episode, so the episode is counted afresh;
-* `Section::join` and `Section::barrier` spin about 100 times and then
-  `yield_now` per poll, the shape libomp takes when it detects more threads than
-  CPUs, so the waiting participants do not hold every CPU while their peers are
-  queued behind them.
-
-The flag is per scope and per root; overlapping teams or pools are the caller's
-business (see the placement warning below). This is the behaviour libgomp
-throttles to about 100 spins when oversubscribed; measured on broccoli, parking
-alone did not remove the tensor4all/faer#107 slow mode, so the zero park delay is
-about the CPU a member burns, not about the mode.
-
-**Quality of service.** `PoolBuilder::qos(Qos)` sets the class of each worker
-when it starts (`pthread_set_qos_class_self_np` on Apple targets, nothing
-elsewhere; no platform type is public). The default is `UserInitiated` on
-macOS. `threadteam` never changes the caller's class, but the calling thread
-leads every section, so `raise_current_thread_qos(Qos)` raises the calling
-thread to at least the given class and never lowers it (the current class is
-read first); an engine calls it once for its leading thread. In the wake probe
-the class (builder default, explicit `Default`, `UserInteractive`) made no
-measurable difference to the wake latency on this host. Dropping the
-team stores `IDLE` with a zero idle spin and wakes them, so the members return to
-Rayon at once.
+Replaced by [`waiting.md`](waiting.md): every team wait spins for the pool's
+spin budget in polls, yields a few times, then sleeps; the leader's join and
+the barriers sleep on a pool-wide parker; a descheduled waiter throttles the
+pool's waits. The earlier design (PAUSE-only spin with a wall-time park delay
+for members and no sleep at all in joins and barriers) is in the history of
+this file.
 
 ### Participant placement (opt-in)
 
@@ -591,69 +538,13 @@ How it works:
 
 ### Waiting policy
 
-`PoolBuilder::idle_spin` (default 200 ms, may be zero) and
-`PoolBuilder::idle_runs_rayon` (default `false`) set `WaitPolicy` defaults; an
-oversubscribed root scope overrides the park delay with zero for its own
-reservation only;
-`acquire_timeout` is separate. `WaitOverride` (partial policy) applies to one
-operation: `Exec::team_with` for a root reservation, `TeamExec::with_wait` for a
-scope. Children inherit the effective policy and may override it for their own
-scope. The root reservation's effective policy is stored in its members' slots
-when it ends and governs the idle interval that follows; the interval starts
-when the reservation ends, not when the member last computed. A reserved member
-never leaves on a timeout and never runs an unrelated Rayon job (it parks, still
-reserved, after the park delay), whatever the policy, so an override cannot weaken a reservation, and a child's override
-expires when the child returns and cannot release its parent's members.
-With `idle_runs_rayon`, an idle member calls `rayon::yield_now`, whose job runs
-to completion before the member is claimable again. Without it, an idle member
-leaves its worker out of Rayon service for up to `idle_spin`; a following
-`broadcast` or a Rayon job that needs every worker then waits for them, so a
-caller that alternates with such work sets a short spin or calls
-`Pool::release_idle`.
-
-**Idle clock and the default delay.** The park delay of a reserved member is
-measured on a clock that belongs to that member alone: it starts when the
-member first finds nothing to do after its own last share (or after it started,
-or was taken back from a lend), and it restarts with every share the member
-runs. A share of another member does not move it, and neither does anything the
-leader does between sections. When the clock exceeds the delay the member
-parks. Consequences:
-
-* A team that runs no section costs CPU for the delay after the team is built
-  (or after its last section), then nothing: members that spin beyond that are a
-  bug.
-* Sections less than the delay apart keep every participating member spinning
-  the whole time. That is the intended behaviour, not a leak: it is what makes a
-  dispatch cost one atomic store and no syscall (about 0.3 us, against some tens of
-  us after a park on the reference M5, see `benches/spin_grid.rs`).
-* A CPU measurement over a window of sequential work therefore depends on where
-  the window sits relative to the last section (or the construction of the team):
-  a window inside the first 200 ms reads about `width - 1` extra cores, a window
-  after it reads one. Measure CPU after a settle time longer than the delay, or
-  say what the window contains.
-
-The default is 200 ms, the same as the default blocktime of the LLVM and Intel
-OpenMP runtimes (`KMP_BLOCKTIME`): long enough that a loop of small parallel
-regions with serial work between them never pays a wake-up, short enough that a
-program that stops using the team goes quiet within a fifth of a second. The
-sweep in `benches/spin_grid.rs` (6 participants) shows the trade: with a 200 ms
-delay a dispatch after a 100 ms gap costs 12 us (members still spinning, 4.9
-cores); with a zero delay it costs 37 us after any gap and members use no CPU.
-Callers with sparse sections set a shorter delay with `idle_spin` or
-`team_with`.
-
-The clock is explicit in the code (`last_work` in `member_loop`) and visible
-with the feature `trace`, which stamps every member transition (enter, share
-begin and end, park enter and exit, lend, leave) into a preallocated ring; the
-bench `idle_trace` prints each member's spin, park and run time per phase and
-`tests/idle_clock.rs` checks that a member parks neither before the delay since
-its own last share nor never.
-
-`Pool::release_idle` bumps an epoch: idle members leave at once, reserved
-members leave when their reservation ends. It never revokes a live token and
-does not wait, so it may be called inside a reservation. Dropping the pool
-signals shutdown, which idle members honour. `Pool::resident_members` reports
-the number of awake members (diagnostic).
+`PoolBuilder::idle_spin` (default 200 ms, may be zero) and `idle_runs_rayon`
+govern an *unreserved* idle member, the state a member is in after a scoped
+team (`Exec::team`) ended: it stays claimable without a Rayon wake-up until
+`idle_spin` passes or it has polled for the pool's spin budget, whichever
+comes first, then returns to Rayon. `WaitOverride` overrides them per scope.
+Reserved members do not use `idle_spin` any more; their waits, and the joins
+and barriers, follow [`waiting.md`](waiting.md).
 
 ### Unwind
 
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
new file mode 100644
index 0000000..47cfc08
--- /dev/null
+++ b/docs/design/waiting.md
@@ -0,0 +1,152 @@
+# How team threads wait
+
+This record covers how the threads of a team wait:
+- a reserved member, between sections and between calls;
+- the leader, in `Section::join`;
+- every participant, in `Section::barrier`.
+
+It replaces the waits of 0.1.3 with the shape of the OpenMP runtimes: a bounded spin, then a short yield phase, then a sleep on a futex. Maintainer decision, 2026-10-29: 「threadteam の待ち方を OpenMP に近づけるのがいいと思う」. The trigger is tensor4all/faer#107.
+
+## What 0.1.3 does, and why it stacks
+
+| wait | 0.1.3 |
+| --- | --- |
+| reserved member polling `gen` (between sections and between calls) | one PAUSE per poll; parks after `idle_spin` of **wall time** (200 ms), or after 64 polls when the scope is oversubscribed |
+| leader in `Section::join` | one PAUSE per poll, **never sleeps**; when oversubscribed, ~100 PAUSEs, then `yield_now` per poll |
+| participant in `Section::barrier` | same as `join` |
+| unreserved `IDLE` member | `backoff` (2^14 PAUSEs, then `yield_now`) for `idle_spin` of wall time, then returns to Rayon |
+
+"Oversubscribed" means more participants than CPUs in the caller's affinity set. Foreign load is not counted.
+
+faer#107, broccoli, 64 threads on 64 CPUs with another user's processes at 5-13 %:
+- a fresh pool per call is slow in 20/20 processes (gemm 128: a fixed 16 ms against 0.02 ms);
+- chol 2048 is slow in 10/10 processes even with the pool held;
+- at width 48 on 64 CPUs the slow mode disappears (0.02 ms, 0 % stacked).
+
+The mechanism:
+- At width = CPUs, every CPU holds a participant that is either working or spinning, so no CPU is ever idle.
+- Linux moves a runnable thread from a busy CPU to another CPU mainly when that CPU goes idle (newidle balancing). Periodic balancing has nothing to gain from a 2-to-1 move.
+- So once a member shares a CPU with another runnable thread (a peer, the spare worker, or a foreign process), the pair stays put. Every section then waits for the descheduled member's next time slice.
+- `yield_now` does not help: it hands the CPU to a thread that is already on it, and it leaves no CPU idle.
+
+The only wait that frees a CPU is a sleep.
+
+## What the OpenMP runtimes do (read from their sources; no code is taken)
+
+**libgomp** (gcc `libgomp/config/linux/wait.h`, `bar.c`, `team.c`, `env.c`):
+- **Wait.** `do_wait` polls the futex word up to `gomp_spin_count_var` times, with one `cpu_relax` (PAUSE) per poll, then calls `futex_wait`.
+- **Spin count.** The count is in polls, not in time. The default without `OMP_WAIT_POLICY` is 300000, "a rough estimation of 100000 spins per msec", so about 3 ms, "e.g. 5 times longer or 5 times shorter" depending on the CPU. It is 0 under `PASSIVE`, 3·10^10 under `ACTIVE`, and 1 on x86 hybrid CPUs (`config/linux/x86/spincount.h`).
+- **Throttling.** When libgomp's own threads outnumber the available CPUs (`gomp_managed_threads > gomp_available_cpus`), the count drops to `gomp_throttled_spin_count_var`: 100 by default, 1000 under `ACTIVE`.
+- **Foreign load.** It is not considered.
+- **Barriers.** A barrier is a generation word. The last arriving thread bumps it and calls `futex_wake(INT_MAX)`; the others `do_wait` on it.
+- **Region start.** Pool threads wait between regions on the `threads_dock` simple barrier, and the master's arrival releases them. That barrier covers the whole team, because a region always uses the whole team.
+
+**LLVM libomp** (`openmp/runtime/src/kmp_wait_release.h`, `kmp.h`, `kmp_global.cpp`, `kmp_runtime.cpp`):
+- **Wait.** `__kmp_wait_template` spins with `KMP_CPU_PAUSE` (TPAUSE where available). It yields only when the runtime's own threads exceed the available processors (`KMP_OVERSUBSCRIBED`, `__kmp_use_yield`). It suspends once `KMP_BLOCKTIME` is exhausted.
+- **Blocktime.** The blocktime is **wall time**, checked against `rdtsc` (`KMP_BLOCKING`). The default is 200 ms (`KMP_DEFAULT_BLOCKTIME`), and 0 on hybrid CPUs. With `KMP_ADJUST_BLOCKTIME`, it drops to 0 when there are more threads than processors.
+- **Library mode.** The default `KMP_LIBRARY=throughput` keeps the blocktime. `turnaround` yields only when oversubscribed.
+- **Hot teams.** A team's threads are kept across parallel regions and wait in the fork barrier under the same blocktime rule.
+- **Foreign load.** It is not considered either.
+
+**Implications for threadteam:**
+1. Both runtimes eventually sleep in **every** wait, and neither leaves a waiter spinning forever. That is what lets an idle CPU appear and pull a stacked thread.
+2. libgomp counts **polls**, and libomp counts **time**. A count is consumed only while the waiter runs, so a waiter that is descheduled behind a peer on the same CPU does not use up its budget by waiting in the run queue. A time budget expires there too, and makes the waiter sleep for the wrong reason. threadteam 0.1.3 uses time, like libomp, but 200 ms is far longer than any gap that matters.
+3. Neither runtime reads foreign load. threadteam does, below, because the faer#107 configuration (width = CPUs, foreign processes) is exactly where the static participants-against-CPUs test says "not oversubscribed".
+
+## Design
+
+### Waits
+
+Every wait is an episode of three phases.
+
+1. **Spin.** Poll the condition with one PAUSE (YIELD on aarch64) per poll, for at most `spin_polls` polls. The budget is a count, so it is consumed only while the waiter runs.
+2. **Yield.** Then `yield_now` between polls, for at most `YIELD_POLLS = 16` polls. A peer queued on the same CPU then gets the CPU without paying a futex round trip.
+3. **Sleep.** Then sleep on a `Parker`, until the condition changes or the episode is ended for that waiter.
+
+| wait | condition | sleeps on |
+| --- | --- | --- |
+| reserved member | `gen` changed, the reservation ended, or the member was lent | its slot's `Parker` (unchanged: the leader wakes only the slots it changed) |
+| leader in `join` | `remaining == 0` | the pool's `sync` `Parker`, woken by the member that brings `remaining` to 0 |
+| participant in `barrier` | `epoch` changed, or the section was cancelled | the pool's `sync` `Parker`, woken by the last arrival and by `fail` |
+| unreserved `IDLE` member (after a scoped `Exec::team` ended) | claimed, released, `idle_spin` elapsed, **or the spin budget of polls spent** | returns to Rayon (whose idle worker sleeps after 33 rounds); a team released between calls no longer keeps its members polling for the whole `idle_spin` |
+| acquisition (`acquire`, `claim_cold`) | unchanged (`backoff`) | — |
+
+The `sync` parker is **one per pool** (in `Awake`), not one per section:
+- Sections are stack objects on the hot path. A `Parker` is touched once when it is built (some platforms allocate lazily), so building one per section would cost on every section.
+- A member may touch the parker after its final decrement of `remaining`. By then the leader may have returned and freed the section, but the pool outlives every member loop.
+
+Every leader on a pool shares the parker: two teams on one pool, and also the child leaders of one team's `split` and `fork`, which join at the same time. A wake wakes every sleeper, and each re-checks its own condition. That is correct, and it is not rare: a split of 64 participants into 32 pairs can have 32 child leaders asleep at once. It is kept simple until a measurement shows the broad wake costs something; the `nested` bench scenario (100 splits into pairs per call) is that measurement.
+
+Both new wake points follow the existing `Parker` protocol, which `loom` already models:
+1. change the state with SeqCst: the final `remaining` decrement, the epoch bump, the `cancelled` store;
+2. then call `Parker::wake`, one `fetch_add(0)` that is enough when nobody is parked.
+
+The last member of a section therefore pays one extra uncontended read-modify-write. It reads the pool's parker before its final decrement and never touches the section after it (the leader may free the section as soon as it sees zero); the pool outlives every member loop. The join and the barrier are small types in `src/park.rs` (`Completion`, `Barrier`) that the sections use and that `tests/loom_park.rs` checks as they are: the last of two members waking a sleeping leader, two consecutive barrier rounds, and a cancellation waking a sleeper. Each model fails (deadlock) when its wake is removed.
+
+### Budget
+
+- **A count, as in libgomp.** The budget is `PoolBuilder::spin_polls`, a number of polls (one PAUSE, or YIELD on aarch64, per poll). A waiter that is descheduled does not spend it while it waits for its CPU.
+- **Default.** 12288 polls on x86-64: one poll measured about 24 ns on Zen 3 (EPYC 7713P), so about 300 µs there, and about twice that on Intel cores whose PAUSE is slower. On aarch64 a YIELD is much cheaper, and the default of 2^17 aims at the same order of time without a measurement yet.
+  - A section of 5-50 µs, and the gaps between sections inside a call, stay entirely in the spin phase, so the dispatch costs of `benches/dispatch_cost.rs` should not change.
+  - A member that waits longer than the budget between calls sleeps, and the first section of the next call pays one futex wake.
+  - libgomp's default is about 3 ms, and libomp's 200 ms. 300 µs is a starting value that the wait benchmark confirms or moves.
+- **No calibration.** Converting a time to polls at pool build was considered and dropped (pre-review): a calibration taken while the CPU is contended yields too few polls, and a bare PAUSE loop is not the real poll anyway. The count is approximate in time, as libgomp's is.
+- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed (as before), or while the pool is under recent pressure (below).
+
+### Scheduling pressure
+
+- **Detection.** A spinning waiter reads the clock (`Instant::now`, vDSO) every 64 polls. If the gap since its previous read exceeds 200 µs, it was descheduled while it spun. Sixty-four polls take well under 10 µs, and a scheduler slice is 0.75 ms or more.
+- **What it means.** This is a pressure heuristic, not proof of foreign load. A foreign process, another thread of the team, interrupts, page faults or VM steal all look the same, and a short preemption can escape the threshold. It is acceptable because the response only shortens active waiting; it never changes affinity or correctness.
+- **Response.** The waiter ends its spin at once (yields, then sleeps), and moves the pool's `contended_until` forward to now + 100 ms with a `fetch_max`, so an older observation never shortens a newer one. While that deadline holds, every wait of the pool adopts the throttled budget at its first clock read.
+- **Cost.** A wait that ends within 64 polls never reads the clock; otherwise one clock read per 64 polls. There is no `getrusage` or other syscall in the poll loop.
+- **Limit.** A pool built for a single call (`with_team`) cannot carry the deadline to the next call. What helps it is the short budget and the sleeps in `join` and `barrier`, which give the scheduler idle CPUs within the call. With `pin_participants`, a sleeping waiter frees its CPU, but a pinned member that is descheduled behind a foreign process cannot move.
+
+### Start of a section: no arrival barrier
+
+A section starts when its members observe their `gen`. There is no barrier in which every participant first announces itself. libgomp's region start is a whole-team dock barrier, because a region always uses the whole team. threadteam sections can be narrower than the team (faer narrows regions to the width that pays), and waking or waiting for members a section does not use would make narrow sections pay for the whole team.
+
+A member that slept is woken by the leader's publish on its slot. That wake only makes it runnable; no arrival acknowledgement is needed for a section's correctness, because the reservation's acknowledgement at acquisition already put every member on its own thread, and the section's publication and completion protect its storage. The join at the end of the section is the only barrier. `Section::barrier` inside a share is unchanged in meaning and gains the sleep phase.
+
+### The spare worker (threadteam-rs#12): not in this change
+
+A pool of `w` workers gives a team of at most `w` participants: the leader counts as one, and `w - 1` workers are reserved, so one worker is a spare that only Rayon uses. Letting `into_team(width)` reach `w + 1` from an outside thread would reserve every worker. The pre-review found that this breaks `Exec::external` on a team token:
+- `external` lends the token's `budget - 1` members and installs the callback on a pool worker.
+- Today the spare is the worker that hosts it. Without a spare, the callback occupies one of the lent members, so a callback that waits for `width` Rayon jobs at once deadlocks, and a full-width token advertises `w + 1` threads to a pool of `w`.
+
+Removing the spare therefore needs a new contract for `external`'s width and lending, covering full-width and narrowed tokens. broccoli also showed that the spare is not what separates the slow arms (faer#107, 13:10Z): `team_per_call` runs the same 65 threads and is fast. The spare stays, and threadteam-rs#12 carries the `external` constraint.
+
+## Evaluation
+
+`benches/wait_scenarios.rs` (README, "Wait benchmarks"), run on the base and on the head of the change:
+- `sections`: many short sections per call (5-50 µs of work, 200 sections);
+- `gaps`: the wake latency after a gap of 0 / 100 µs / 1 ms / 10 ms between calls;
+- `acquire`: a pool held with a team per call, against a new pool per call;
+- `nested`: 100 splits into pairs per call (the shared parker under many child leaders);
+- width = CPUs against width < CPUs;
+- with and without a foreign-load generator: child processes that each burn a few % of a CPU;
+- the same work under libgomp (`benches/omp/wait_omp.c`, when `gcc -fopenmp` is available) and under a Rayon `scope`.
+
+The change is accepted when:
+- on a quiet host (evo), `sections`, `gaps` and `nested` do not regress;
+- on broccoli (64 threads, foreign load), the faer#107 arms of `acquire_probe_107` (tensor4all/faer branch `probe/107-acquire-per-call`) are no longer slow.
+
+**First reading, primerose (not an acceptance run).** EPYC 7713P, 64 CPUs, saturated by other users (load average 61-63). Width 6 on `taskset -c 0-5`, 40 calls, threadteam only. Base = the bench commit on 0.1.3; head = this change. Median µs per call:
+
+| scenario | param | base | head | ideal |
+| --- | --- | --- | --- | --- |
+| sections | 5 µs × 200 | 775 725 | 14 497 | 1 000 |
+| sections | 20 µs × 200 | 978 060 | 21 991 | 4 000 |
+| sections | 50 µs × 200 | 1 462 996 | 39 042 | 10 000 |
+| gaps (first section) | 0 | 10 972 | 19 | 5 |
+| gaps (first section) | 1 ms | 10 895 | 47 | 5 |
+| gaps (first section) | 10 ms | 12 003 | 1 033 | 5 |
+| gaps (call) | 10 ms | 124 883 | 9 832 | 50 |
+| nested | pairs, 100 × 20 µs | 741 969 | 37 894 | 2 000 |
+| acquire | team held, token per call | 16 055 | 9 551 | 1 000 |
+| acquire | pool held, members per call | 245 584 | 2 501 | 1 000 |
+| acquire | new pool per call (call) | 393 990 | 61 622 | 1 000 |
+| acquire | new pool per call (build to drop) | 408 038 | 67 548 | 1 000 |
+
+Empty-section dispatch (`benches/team_dispatch.rs`, same host, median ns): width 2, 519 (base) against 530 (head); width 6, 767 against 862; the load average moved from 64 to 74 between the two runs, so this bounds a regression only coarsely.
+
+On a host whose CPUs are all busy, 0.1.3's spinning waiters stack and stay stacked, and calls take hundreds of times their work. The staged waits bring them within about 2-10x of the ideal, the cost of sharing CPUs with other users' processes. A quiet host and broccoli decide the acceptance; these numbers only show the mechanism.
diff --git a/src/awake.rs b/src/awake.rs
index b6f2faf..91841f1 100644
--- a/src/awake.rs
+++ b/src/awake.rs
@@ -11,10 +11,12 @@
 //! ```
 //!
 //! * `ABSENT`: no loop on this worker.
-//! * `RESERVED`: owned by one leader; the member spins on `gen` and runs the
-//!   section the leader published. It neither runs Rayon jobs nor leaves.
-//! * `IDLE`: loop alive but unreserved; spins for the policy's idle time, then
-//!   leaves (`ABSENT`). Claimable by a compare-and-swap, with no waiting.
+//! * `RESERVED`: owned by one leader; the member waits for `gen` (spin, yield,
+//!   then park) and runs the section the leader published. It neither runs
+//!   Rayon jobs nor leaves.
+//! * `IDLE`: loop alive but unreserved; polls for the policy's idle time or
+//!   the pool's spin budget, whichever ends first, then leaves (`ABSENT`).
+//!   Claimable by a compare-and-swap, with no waiting.
 //! * `YIELD`: an idle member inside `rayon::yield_now`; not claimable.
 //!
 //! A leader publishes a [`Section`] (a stack object) by writing its address
@@ -31,7 +33,7 @@
 use crate::error::Refused;
 use crate::park::Parker;
 use crate::policy::WaitPolicy;
-use core::sync::atomic::{AtomicBool, AtomicPtr, AtomicU64, AtomicUsize, Ordering};
+use core::sync::atomic::{AtomicBool, AtomicPtr, AtomicU32, AtomicU64, AtomicUsize, Ordering};
 use std::any::Any;
 use std::time::Duration;
 
@@ -50,17 +52,13 @@ const IDLE: usize = 1;
 const YIELD: usize = 2;
 const RESERVED: usize = 3;
 
-/// Alignment that keeps a hot atomic on its own cache line pair (128 bytes
-/// covers Apple Silicon and adjacent-line prefetch on x86).
-#[repr(align(128))]
-pub(crate) struct Padded<T>(pub(crate) T);
-
 /// Pure spin for a while, then yield the CPU between polls.
 ///
 /// Used where progress needs cooperation with other threads on the same CPUs:
 /// `acquire`, the cold claim, and the loops that are not reserved dispatch
-/// polls (`IDLE`, and the states a loop is leaving). Reserved members and a
-/// leader waiting on a section poll with [`spin_wait`] instead.
+/// polls (`IDLE`, and the states a loop is leaving). Reserved members, and a
+/// leader or participant waiting on a section, wait in staged episodes instead
+/// ([`crate::park::Waiter`]).
 #[inline]
 #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
 pub(crate) fn backoff(spins: &mut u32) {
@@ -72,43 +70,6 @@ pub(crate) fn backoff(spins: &mut u32) {
     }
 }
 
-/// One PAUSE per poll (YIELD on aarch64), never a yield.
-///
-/// The wait of a reserved member polling `gen`, and of a leader in
-/// `Section::join` / `Section::barrier`, in a scope that is not oversubscribed:
-/// a thread that only spins with PAUSE stays runnable but does not repeatedly
-/// re-enter the scheduler, so a stacked pair can be separated and a share does
-/// not pay for a `sched_yield` on every poll. A parked member is woken by the
-/// leader through [`Parker`].
-#[inline]
-pub(crate) fn spin_wait() {
-    std::hint::spin_loop();
-}
-
-/// How many polls a joined section spins before it yields, in an oversubscribed
-/// scope (more participants than CPUs in the caller's set).
-const OVERSUBSCRIBED_SPINS: u32 = 100;
-
-/// One poll of a leader waiting on a section.
-///
-/// Not oversubscribed: [`spin_wait`]. Oversubscribed: about
-/// [`OVERSUBSCRIBED_SPINS`] PAUSE spins, then one `yield_now` per poll, so the
-/// waiting participants do not hold every CPU while their peers are queued
-/// behind them (the shape libomp takes when it detects oversubscription).
-#[inline]
-fn wait_poll(over: bool, polls: &mut u32) {
-    if !over {
-        spin_wait();
-        return;
-    }
-    if *polls >= OVERSUBSCRIBED_SPINS {
-        std::thread::yield_now();
-    } else {
-        *polls += 1;
-        std::hint::spin_loop();
-    }
-}
-
 /// One member's dispatch slot.
 #[repr(align(128))]
 struct Slot {
@@ -120,8 +81,9 @@ struct Slot {
     /// Idle policy written by the releasing leader before `IDLE` is stored.
     idle_spin_ns: AtomicU64,
     idle_yield: AtomicBool,
-    /// How long a reserved member spins without work before it parks.
-    park_ns: AtomicU64,
+    /// Spin budget, in polls, of this reserved member's waits for work (see
+    /// `docs/design/waiting.md`); written by the leader at root-scope entry.
+    spin_budget: AtomicU32,
     /// Set by the leader while the member's thread is lent to Rayon
     /// (`Exec::external` on a team token).
     lent: AtomicBool,
@@ -129,8 +91,8 @@ struct Slot {
     /// of this slot touches it (see [`crate::pin::SavedMask`]).
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
     saved: crate::pin::SavedMask,
-    /// Where this member sleeps once its park delay has passed; woken by the
-    /// leader after it changed `gen`, `state` or `lent` of this slot.
+    /// Where this member sleeps once its spin and yields are spent; woken by
+    /// the leader after it changed `gen`, `state` or `lent` of this slot.
     park: Parker,
 }
 
@@ -143,7 +105,7 @@ impl Slot {
             arg: AtomicUsize::new(0),
             idle_spin_ns: AtomicU64::new(0),
             idle_yield: AtomicBool::new(false),
-            park_ns: AtomicU64::new(u64::MAX),
+            spin_budget: AtomicU32::new(crate::park::THROTTLED_POLLS),
             lent: AtomicBool::new(false),
             saved: crate::pin::SavedMask::new(),
             park: Parker::new(),
@@ -151,9 +113,24 @@ impl Slot {
     }
 }
 
+/// The waiting state of one pool (`docs/design/waiting.md`).
+pub(crate) struct Waits {
+    /// Where leaders sleep in `join` and participants in `barrier`. One per
+    /// pool: a member may wake it after its last decrement, when the section
+    /// may already be gone, and the pool outlives every member loop.
+    pub(crate) sync: Parker,
+    /// Recent scheduling pressure seen by this pool's waiters.
+    pub(crate) pressure: crate::park::Pressure,
+    /// Spin budget of a wait, in polls (`PoolBuilder::spin_polls`).
+    pub(crate) spin_polls: u32,
+}
+
 /// Shared state of the awake members of one pool.
 pub(crate) struct Awake {
     slots: Box<[Slot]>,
+    /// What the joins and barriers of this pool's sections sleep on, and the
+    /// pool's spin budget and scheduling pressure (`docs/design/waiting.md`).
+    pub(crate) waits: Waits,
     pub(crate) shutdown: AtomicBool,
     /// Bumped by `Pool::release_idle`; members that started earlier leave when idle.
     pub(crate) release_epoch: AtomicUsize,
@@ -174,9 +151,15 @@ impl Awake {
         acquire_timeout: Duration,
         costs: crate::cost::DispatchCosts,
         pin: bool,
+        spin_polls: u32,
     ) -> Self {
         Awake {
             slots: (0..width).map(|_| Slot::new()).collect(),
+            waits: Waits {
+                sync: Parker::new(),
+                pressure: crate::park::Pressure::new(),
+                spin_polls,
+            },
             shutdown: AtomicBool::new(false),
             release_epoch: AtomicUsize::new(0),
             defaults,
@@ -209,15 +192,30 @@ impl Awake {
         }
     }
 
-    /// Sets the park delay of the given reserved members, in nanoseconds.
+    /// Spin budget, in polls, of a wait in a root scope: the pool's budget, or
+    /// the throttled one when the scope is oversubscribed.
+    pub(crate) fn spin_budget(&self, over: bool) -> u32 {
+        if over {
+            crate::park::THROTTLED_POLLS.min(self.waits.spin_polls)
+        } else {
+            self.waits.spin_polls
+        }
+    }
+
+    /// The spin budget a member slot currently has (tests).
+    #[cfg(all(test, feature = "parallel", target_os = "linux"))]
+    pub(crate) fn slot_spin_budget(&self, id: usize) -> u32 {
+        self.slots[id].spin_budget.load(Ordering::Relaxed)
+    }
+
+    /// Sets the spin budget of the given reserved members' waits for work.
     ///
-    /// A root team scope writes it once at entry: zero (park after the short
-    /// spin) when the scope is oversubscribed, the effective `idle_spin`
-    /// otherwise. Nothing else changes it, so a member keeps the value of the
+    /// A root team scope writes it once at entry ([`Self::spin_budget`] of its
+    /// pressure). Nothing else changes it, so a member keeps the value of the
     /// scope it was reserved for.
-    pub(crate) fn set_park_ns(&self, ids: &[usize], ns: u64) {
+    pub(crate) fn set_spin_budget(&self, ids: &[usize], polls: u32) {
         for &id in ids {
-            self.slots[id].park_ns.store(ns, Ordering::Relaxed);
+            self.slots[id].spin_budget.store(polls, Ordering::Relaxed);
         }
     }
 
@@ -295,7 +293,7 @@ impl Awake {
         pool: &crate::pool::Pool,
         need: usize,
         policy: WaitPolicy,
-        park_spin: Duration,
+        spin_budget: u32,
     ) -> Result<Reservation, Refused> {
         let mut ids = Vec::with_capacity(need);
         // Idle members are claimed with a compare-and-swap. A member that is
@@ -331,10 +329,7 @@ impl Awake {
                 return Err(Refused::Unavailable);
             }
         }
-        let ns = u64::try_from(park_spin.as_nanos()).unwrap_or(u64::MAX);
-        for &id in &ids {
-            self.slots[id].park_ns.store(ns, Ordering::Relaxed);
-        }
+        self.set_spin_budget(&ids, spin_budget);
         Ok(Reservation {
             awake: std::sync::Arc::clone(self),
             ids,
@@ -486,25 +481,29 @@ fn claim_job(aw: &std::sync::Arc<Awake>, acq: &std::sync::Arc<Acq>) {
 /// The member loop. Returns when the idle policy, `release_idle` or shutdown
 /// returns the thread to Rayon.
 ///
-/// Idle clock of a reserved member: `last_work` is the instant at which this
-/// member first found nothing to do after its last share (or after it started,
-/// or was taken back from Rayon). It belongs to the member alone, a share of
-/// another member does not move it, and it is read only while polling. When it
-/// is older than the member's park delay the member parks and stays reserved;
-/// a member whose team runs no section therefore costs CPU for the park delay
-/// at most, then nothing. The delay is zero in an oversubscribed root scope, so
-/// `polls` and `spins` are reset at the start of each idle episode there: the
-/// member then spins one short episode of `polls` and parks.
+/// A reserved member waits for work in episodes (`docs/design/waiting.md`): an
+/// episode starts when it first finds nothing to do after its last share (or
+/// after it started, or was taken back from Rayon), spins for the slot's spin
+/// budget in polls, yields a few times, then parks and stays reserved. The
+/// budget is a count, so a member that is descheduled does not spend it while
+/// it waits for its CPU; a long gap between its clock reads ends the spin at
+/// once (see [`crate::park::Pressure`]).
+///
+/// An unreserved (`IDLE`) member returns to Rayon after the policy's
+/// `idle_spin` of wall time or after the pool's spin budget of polls, whichever
+/// comes first, so a team released between calls does not keep every CPU busy
+/// for the whole `idle_spin`.
 #[cfg(feature = "parallel")]
 fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
+    use crate::park::{Step, Waiter};
     use std::time::Instant;
     let slot = &aw.slots[id];
     let mut idle_since: Option<Instant> = None;
-    let mut last_work: Option<Instant> = None;
+    let mut idle_polls = 0u64;
+    let mut waiter: Option<Waiter<'_>> = None;
     let mut was_lent = false;
     let mut reserved = true;
     let mut spins = 0u32;
-    let mut polls = 0u32;
     trace!(aw, Some(id), Enter);
     loop {
         let state = slot.state.load(Ordering::Acquire);
@@ -526,7 +525,7 @@ fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
                     trace!(aw, Some(id), LentBegin);
                 }
                 idle_since = None;
-                last_work = None;
+                waiter = None;
                 // Serve the pool's jobs; resume team service when taken back.
                 if !matches!(rayon::yield_now(), Some(rayon::Yield::Executed)) {
                     for _ in 0..32 {
@@ -542,31 +541,21 @@ fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
                 idle_since = None;
                 let g = slot.gen.load(Ordering::Acquire);
                 if g == seen {
-                    let fresh = last_work.is_none();
-                    let since = *last_work.get_or_insert_with(Instant::now);
-                    if fresh {
-                        // A new idle episode: the park check counts from here.
-                        spins = 0;
-                        polls = 0;
-                    }
-                    spin_wait();
-                    polls = polls.wrapping_add(1);
-                    if polls & 0x3F == 0 {
-                        let park_ns = slot.park_ns.load(Ordering::Relaxed);
-                        if since.elapsed().as_nanos() >= u128::from(park_ns) {
-                            trace!(aw, Some(id), ParkEnter);
-                            park_member(slot, seen);
-                            trace!(aw, Some(id), ParkExit);
-                            last_work = None;
-                            spins = 0;
-                            polls = 0;
-                        }
+                    let w = waiter.get_or_insert_with(|| {
+                        Waiter::new(
+                            slot.spin_budget.load(Ordering::Relaxed),
+                            Some(&aw.waits.pressure),
+                        )
+                    });
+                    if w.step() == Step::Sleep {
+                        trace!(aw, Some(id), ParkEnter);
+                        park_member(slot, seen);
+                        trace!(aw, Some(id), ParkExit);
+                        waiter = None;
                     }
                 } else {
                     seen = g;
-                    spins = 0;
-                    polls = 0;
-                    last_work = None;
+                    waiter = None;
                     let ptr = slot.ptr.load(Ordering::Relaxed);
                     let arg = slot.arg.load(Ordering::Relaxed);
                     // SAFETY: the leader keeps the section alive until its
@@ -578,16 +567,23 @@ fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
                         slot.saved.save_if_unpinned();
                     }
                     trace!(aw, Some(id), SectionBegin);
-                    // SAFETY: as above.
+                    // SAFETY: as above; `aw` outlives this loop, so the wake
+                    // after the last decrement does not touch the section.
                     unsafe { Section::execute_member(ptr, arg) };
                     trace!(aw, Some(id), SectionEnd);
                 }
             }
             IDLE => {
+                waiter = None;
+                if idle_since.is_none() {
+                    idle_polls = 0;
+                }
                 let since = *idle_since.get_or_insert_with(Instant::now);
+                idle_polls += 1;
                 let spin_ns = slot.idle_spin_ns.load(Ordering::Relaxed);
                 let leave = aw.shutdown.load(Ordering::Relaxed)
                     || aw.release_epoch.load(Ordering::Relaxed) != epoch
+                    || idle_polls > u64::from(aw.waits.spin_polls)
                     || since.elapsed().as_nanos() >= u128::from(spin_ns);
                 if leave {
                     if slot
@@ -654,19 +650,22 @@ pub(crate) struct Section {
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
     pin: bool,
     /// Dispatched participants that have not finished.
-    remaining: Padded<AtomicUsize>,
-    arrived: Padded<AtomicUsize>,
-    epoch: Padded<AtomicUsize>,
-    cancelled: AtomicBool,
+    done: crate::park::Completion,
+    barrier: crate::park::Barrier,
+    cancelled: crate::sync::AtomicBool,
+    /// The pool's waiting state; null when the section has no pool (nothing is
+    /// dispatched, and its single participant never waits).
+    waits: *const Waits,
     /// First panic payload, boxed twice so that it fits an `AtomicPtr`.
     /// (A `Mutex` would allocate on first use on some platforms.)
     panic: AtomicPtr<Box<dyn Any + Send>>,
 }
 
-// SAFETY: `data` points to a `Sync` closure that outlives the section; every
-// other field is an atomic, a plain flag written before the section is
-// published (and read only after a member observed the publishing `gen` with
-// acquire ordering), or a function pointer.
+// SAFETY: `data` points to a `Sync` closure that outlives the section; `waits`
+// points to the pool's `Waits` (in `Awake`, which outlives every section and
+// member loop) and is only read; every other field is an atomic, a plain flag
+// written before the section is published (and read only after a member
+// observed the publishing `gen` with acquire ordering), or a function pointer.
 unsafe impl Sync for Section {}
 
 /// The geometry of a section: its shares, its participants, and the flags of
@@ -690,6 +689,7 @@ impl Section {
         slot_of: unsafe fn(*const (), usize) -> usize,
         slot_data: *const (),
         geometry: Geometry,
+        waits: Option<&Waits>,
     ) -> Self {
         let Geometry {
             dispatched,
@@ -706,10 +706,10 @@ impl Section {
             slot_data,
             over,
             pin,
-            remaining: Padded(AtomicUsize::new(dispatched)),
-            arrived: Padded(AtomicUsize::new(0)),
-            epoch: Padded(AtomicUsize::new(0)),
-            cancelled: AtomicBool::new(false),
+            done: crate::park::Completion::new(dispatched),
+            barrier: crate::park::Barrier::new(size),
+            cancelled: crate::sync::AtomicBool::new(false),
+            waits: waits.map_or(core::ptr::null(), |w| w as *const Waits),
             panic: AtomicPtr::new(core::ptr::null_mut()),
         }
     }
@@ -738,17 +738,51 @@ impl Section {
     /// decrement.
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
     unsafe fn execute_member(ptr: *const Section, arg: usize) {
-        let sec = &*ptr;
-        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| sec.call_here(arg)));
-        if let Err(p) = r {
-            sec.fail(p);
+        // The pool's waiting state outlives the section: read it now, use it
+        // after the decrement that may let the leader free the section.
+        let waits = (*ptr).waits;
+        {
+            let sec = &*ptr;
+            let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| sec.call_here(arg)));
+            if let Err(p) = r {
+                sec.fail(p);
+            }
+        }
+        crate::park::Completion::finish(
+            core::ptr::addr_of!((*ptr).done),
+            waits.as_ref().map(|w| &w.sync),
+        );
+    }
+
+    /// The pool's waiting state, if the section has a pool.
+    fn waits(&self) -> Option<&Waits> {
+        // SAFETY: `waits` is null or points into the pool's `Awake`, which
+        // outlives the section.
+        unsafe { self.waits.as_ref() }
+    }
+
+    /// A wait episode of this section's join or barrier.
+    fn waiter(&self) -> crate::park::Waiter<'_> {
+        match self.waits() {
+            Some(w) => crate::park::Waiter::new(
+                if self.over {
+                    crate::park::THROTTLED_POLLS.min(w.spin_polls)
+                } else {
+                    w.spin_polls
+                },
+                Some(&w.pressure),
+            ),
+            None => crate::park::Waiter::new(u32::MAX, None),
         }
-        (*ptr).remaining.0.fetch_sub(1, Ordering::Release);
     }
 
     /// Records a participant's panic and cancels barriers.
     pub(crate) fn fail(&self, payload: Box<dyn Any + Send>) {
-        self.cancelled.store(true, Ordering::Release);
+        // SeqCst, then wake: barrier waiters may sleep on the pool's parker.
+        self.cancelled.store(true, Ordering::SeqCst);
+        if let Some(w) = self.waits() {
+            w.sync.wake();
+        }
         let fresh = Box::into_raw(Box::new(payload));
         if self
             .panic
@@ -780,42 +814,24 @@ impl Section {
         self.cancelled.load(Ordering::Acquire)
     }
 
-    /// Waits until every dispatched participant has finished.
-    ///
-    /// Polls with [`spin_wait`] (one PAUSE, no yield) unless the root scope is
-    /// oversubscribed, where it spins about 100 times and then yields per poll.
+    /// Waits until every dispatched participant has finished: a staged wait
+    /// (spin, yield, then sleep on the pool's parker until the last member's
+    /// decrement wakes it), throttled when the root scope is oversubscribed.
     pub(crate) fn join(&self) {
-        let mut polls = 0;
-        while self.remaining.0.load(Ordering::Acquire) != 0 {
-            wait_poll(self.over, &mut polls);
+        if self.done.is_done() {
+            return;
         }
+        let mut waiter = self.waiter();
+        self.done.wait(self.waits().map(|w| &w.sync), &mut waiter);
     }
 
     /// Sense-reversing barrier over the section's participants; `false` when
-    /// a participant failed, so that peers can leave instead of waiting.
+    /// a participant failed, so that peers can leave instead of waiting. Waits
+    /// like [`Self::join`].
     pub(crate) fn barrier(&self) -> bool {
-        if self.is_cancelled() {
-            return false;
-        }
-        if self.size == 1 {
-            return true;
-        }
-        let epoch = self.epoch.0.load(Ordering::Acquire);
-        if self.arrived.0.fetch_add(1, Ordering::AcqRel) + 1 == self.size {
-            self.arrived.0.store(0, Ordering::Relaxed);
-            self.epoch.0.store(epoch.wrapping_add(1), Ordering::Release);
-            return true;
-        }
-        let mut polls = 0;
-        loop {
-            if self.epoch.0.load(Ordering::Acquire) != epoch {
-                return true;
-            }
-            if self.is_cancelled() {
-                return false;
-            }
-            wait_poll(self.over, &mut polls);
-        }
+        let mut waiter = self.waiter();
+        self.barrier
+            .arrive(&self.cancelled, self.waits().map(|w| &w.sync), &mut waiter)
     }
 }
 
diff --git a/src/exec.rs b/src/exec.rs
index e568933..e033e6e 100644
--- a/src/exec.rs
+++ b/src/exec.rs
@@ -765,17 +765,14 @@ impl<'p> Exec<'p> {
             // child, a reborrow or a sub-team re-pins nothing of its own.
             if self._leader.is_some() {
                 // Root-scope entry, on the executing thread: the root pressure
-                // and the members' park delay are decided by *this* thread's CPU
+                // and the members' spin budget are decided by *this* thread's CPU
                 // set. A token minted on another thread (or another mask) is
                 // paced by the thread that enters the scope, exactly as its pin
                 // section is placed by that thread. Descendants inherit it.
                 let oversubscribed = crate::pin::oversubscribed(team.size().get());
                 team.over = oversubscribed;
                 if let Some(awake) = team.awake {
-                    awake.set_park_ns(
-                        team.ids,
-                        crate::pin::park_delay(team.policy, oversubscribed),
-                    );
+                    awake.set_spin_budget(team.ids, awake.spin_budget(oversubscribed));
                 }
                 if let Some(auth) = self.team.as_mut() {
                     auth.over = oversubscribed;
@@ -804,14 +801,12 @@ impl<'p> Exec<'p> {
         // placement of the participants and whether the scope is
         // oversubscribed, whatever the pool's pinning setting.
         let oversubscribed = crate::pin::oversubscribed(self.budget.get());
-        let park_spin = if oversubscribed {
-            Duration::ZERO
-        } else {
-            policy.idle_spin()
-        };
-        let reservation = pool
-            .awake
-            .acquire(pool, self.budget.get() - 1, policy, park_spin)?;
+        let reservation = pool.awake.acquire(
+            pool,
+            self.budget.get() - 1,
+            policy,
+            pool.awake.spin_budget(oversubscribed),
+        )?;
         let mut team = TeamExec {
             awake: Some(&pool.awake),
             ids: &reservation.ids,
diff --git a/src/lib.rs b/src/lib.rs
index 286262f..2250ee6 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -67,6 +67,9 @@ pub use exec::Exec;
 #[cfg(loom)]
 #[doc(hidden)]
 pub use park::Parker;
+#[cfg(loom)]
+#[doc(hidden)]
+pub use park::{Barrier, Completion, Waiter};
 pub use policy::{raise_current_thread_qos, Qos, WaitOverride, WaitPolicy};
 pub use pool::{Pool, PoolBuilder};
 pub use reserve::{IntoTeamError, Team};
diff --git a/src/park.rs b/src/park.rs
index 2d58fc7..07ce462 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -20,7 +20,7 @@
 //! the latter and the exact code is model-checked. With nobody parked a wake is
 //! one uncontended atomic read-modify-write.
 
-use crate::sync::{AtomicUsize, Condvar, Mutex, Ordering};
+use crate::sync::{AtomicBool, AtomicU64, AtomicUsize, Condvar, Mutex, Ordering};
 
 /// Places where a test can pause a thread (feature `test-hooks`).
 #[doc(hidden)]
@@ -142,3 +142,271 @@ impl Parker {
         }
     }
 }
+
+// ---------------------------------------------------------------------------
+// Staged waits (`docs/design/waiting.md`): a bounded spin, a few yields, then a
+// sleep on a `Parker`. The join and the barrier of a section use them through
+// [`Completion`] and [`Barrier`], which are the exact code `loom` checks.
+
+/// Polls of a wait that start with the throttled budget: the scope is
+/// oversubscribed, or the pool saw a waiter descheduled recently. libgomp's
+/// throttled spin count has the same value.
+pub(crate) const THROTTLED_POLLS: u32 = 100;
+
+/// Yields between the spin and the sleep. Each lets a thread queued on the same
+/// CPU run without a futex round trip.
+const YIELD_POLLS: u32 = if cfg!(loom) { 0 } else { 16 };
+
+/// A spinning waiter reads the clock once per this many polls.
+const CHECK_EVERY: u32 = 64;
+
+/// A gap between two clock reads of a spinning waiter longer than this means the
+/// waiter was descheduled while it spun: 64 polls take well under 10 µs, and a
+/// scheduler slice is 0.75 ms or more.
+const PREEMPT_GAP_NS: u64 = 200_000;
+
+/// How long a pool keeps starting its waits throttled after a waiter was
+/// descheduled.
+const CONTENDED_HOLD_NS: u64 = 100_000_000;
+
+/// What a waiting thread does after one [`Waiter::step`].
+#[doc(hidden)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Step {
+    /// It polled (spun or yielded); poll the condition again.
+    Poll,
+    /// The spin and the yields are spent: sleep until woken.
+    Sleep,
+}
+
+/// Recent scheduling pressure on one pool's waiters.
+///
+/// A waiter that finds a long gap between two of its clock reads was
+/// descheduled while it spun: something else ran on its CPU (another thread of
+/// the team, a foreign process, or interrupts and VM steal; the signal does not
+/// tell them apart). It records the time, and for [`CONTENDED_HOLD_NS`] every
+/// wait of the pool starts throttled, so the pool's waiters free CPUs quickly
+/// while that pressure lasts.
+#[doc(hidden)]
+pub struct Pressure {
+    base: std::time::Instant,
+    /// Nanoseconds since `base` until which waits start throttled.
+    until: AtomicU64,
+}
+
+impl Default for Pressure {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Pressure {
+    /// No pressure recorded yet.
+    pub fn new() -> Self {
+        Pressure {
+            base: std::time::Instant::now(),
+            until: AtomicU64::new(0),
+        }
+    }
+
+    pub(crate) fn now(&self) -> u64 {
+        u64::try_from(self.base.elapsed().as_nanos()).unwrap_or(u64::MAX)
+    }
+
+    /// Records a descheduled waiter at `now`. A later deadline is never
+    /// shortened by an older observation.
+    pub(crate) fn note(&self, now: u64) {
+        self.until
+            .fetch_max(now.saturating_add(CONTENDED_HOLD_NS), Ordering::Relaxed);
+    }
+
+    pub(crate) fn active(&self, now: u64) -> bool {
+        self.until.load(Ordering::Relaxed) > now
+    }
+
+    /// Whether any pressure was ever recorded (tests).
+    #[cfg(test)]
+    pub(crate) fn recorded(&self) -> bool {
+        self.until.load(Ordering::Relaxed) != 0
+    }
+}
+
+/// One wait episode: up to `budget` spin polls (one PAUSE, or YIELD on
+/// aarch64, each), then [`YIELD_POLLS`] yields, then sleep.
+///
+/// The budget is a count: a waiter that is descheduled does not spend it while
+/// it waits for its CPU. Every [`CHECK_EVERY`] polls it reads the clock. At the
+/// first read it adopts the throttled budget if the pool is under
+/// [`Pressure`]; a long gap between reads ends the spin at once and records the
+/// pressure. A wait that ends within 64 polls never reads the clock.
+#[doc(hidden)]
+pub struct Waiter<'a> {
+    budget: u32,
+    polls: u32,
+    yields: u32,
+    pressure: Option<&'a Pressure>,
+    last: Option<u64>,
+}
+
+impl<'a> Waiter<'a> {
+    /// A wait episode with a spin of `budget` polls.
+    pub fn new(budget: u32, pressure: Option<&'a Pressure>) -> Self {
+        Waiter {
+            budget,
+            polls: 0,
+            yields: 0,
+            pressure,
+            last: None,
+        }
+    }
+
+    /// One poll of the episode; [`Step::Sleep`] once the spin and the yields
+    /// are spent (and on every call after that).
+    #[inline]
+    pub fn step(&mut self) -> Step {
+        if self.polls < self.budget {
+            self.polls += 1;
+            if self.polls.is_multiple_of(CHECK_EVERY) {
+                self.checkpoint();
+            }
+            std::hint::spin_loop();
+            return Step::Poll;
+        }
+        if self.yields < YIELD_POLLS {
+            self.yields += 1;
+            std::thread::yield_now();
+            return Step::Poll;
+        }
+        Step::Sleep
+    }
+
+    #[cold]
+    fn checkpoint(&mut self) {
+        let Some(p) = self.pressure else { return };
+        let now = p.now();
+        match self.last {
+            None if p.active(now) => self.budget = self.budget.min(THROTTLED_POLLS.max(self.polls)),
+            Some(last) if now.saturating_sub(last) > PREEMPT_GAP_NS => {
+                p.note(now);
+                self.budget = self.polls;
+            }
+            _ => {}
+        }
+        self.last = Some(now);
+    }
+}
+
+#[repr(align(128))]
+struct Pad<T>(T);
+
+/// The dispatched shares of a section that have not finished. The leader's
+/// join waits on it; the member that finishes the last share wakes the leader.
+#[doc(hidden)]
+pub struct Completion {
+    remaining: Pad<AtomicUsize>,
+}
+
+impl Completion {
+    /// `n` shares outstanding.
+    pub fn new(n: usize) -> Self {
+        Completion {
+            remaining: Pad(AtomicUsize::new(n)),
+        }
+    }
+
+    /// Whether every share has finished.
+    pub fn is_done(&self) -> bool {
+        self.remaining.0.load(Ordering::Acquire) == 0
+    }
+
+    /// One share finished; the last one wakes a sleeping leader through `sync`.
+    ///
+    /// # Safety
+    ///
+    /// `this` is valid when called. It is not dereferenced after the decrement,
+    /// because the leader may free it as soon as it observes zero; `sync` must
+    /// outlive the call independently of `this`.
+    pub unsafe fn finish(this: *const Completion, sync: Option<&Parker>) {
+        // SeqCst: the state change of the `Parker` protocol (rule 2).
+        if (*this).remaining.0.fetch_sub(1, Ordering::SeqCst) == 1 {
+            if let Some(sync) = sync {
+                sync.wake();
+            }
+        }
+    }
+
+    /// Waits until every share has finished: spin, yield, then sleep on `sync`.
+    pub fn wait(&self, sync: Option<&Parker>, waiter: &mut Waiter<'_>) {
+        while !self.is_done() {
+            if waiter.step() == Step::Sleep {
+                match sync {
+                    Some(sync) => sync.park_while(|| self.remaining.0.load(Ordering::SeqCst) != 0),
+                    None => std::hint::spin_loop(),
+                }
+            }
+        }
+    }
+}
+
+/// The sense-reversing barrier of a section's participants.
+#[doc(hidden)]
+pub struct Barrier {
+    size: usize,
+    arrived: Pad<AtomicUsize>,
+    epoch: Pad<AtomicUsize>,
+}
+
+impl Barrier {
+    /// A barrier over `size` participants.
+    pub fn new(size: usize) -> Self {
+        Barrier {
+            size,
+            arrived: Pad(AtomicUsize::new(0)),
+            epoch: Pad(AtomicUsize::new(0)),
+        }
+    }
+
+    /// Waits until all `size` participants arrived, or `cancelled` is raised
+    /// (then `false`). The last arrival opens the barrier and wakes sleepers
+    /// through `sync`; whoever raises `cancelled` must wake `sync` too.
+    pub fn arrive(
+        &self,
+        cancelled: &AtomicBool,
+        sync: Option<&Parker>,
+        waiter: &mut Waiter<'_>,
+    ) -> bool {
+        if cancelled.load(Ordering::Acquire) {
+            return false;
+        }
+        if self.size == 1 {
+            return true;
+        }
+        let epoch = self.epoch.0.load(Ordering::Acquire);
+        if self.arrived.0.fetch_add(1, Ordering::AcqRel) + 1 == self.size {
+            self.arrived.0.store(0, Ordering::Relaxed);
+            // SeqCst: the state change of the `Parker` protocol (rule 2).
+            self.epoch.0.store(epoch.wrapping_add(1), Ordering::SeqCst);
+            if let Some(sync) = sync {
+                sync.wake();
+            }
+            return true;
+        }
+        loop {
+            if self.epoch.0.load(Ordering::Acquire) != epoch {
+                return true;
+            }
+            if cancelled.load(Ordering::Acquire) {
+                return false;
+            }
+            if waiter.step() == Step::Sleep {
+                match sync {
+                    Some(sync) => sync.park_while(|| {
+                        self.epoch.0.load(Ordering::SeqCst) == epoch
+                            && !cancelled.load(Ordering::SeqCst)
+                    }),
+                    None => std::hint::spin_loop(),
+                }
+            }
+        }
+    }
+}
diff --git a/src/pin.rs b/src/pin.rs
index 53a2ddb..b1ae886 100644
--- a/src/pin.rs
+++ b/src/pin.rs
@@ -22,7 +22,7 @@
 //! The same CPU set decides whether a root scope is *oversubscribed* (see
 //! [`available`]): a team of more participants than the caller's mask has CPUs
 //! parks its members early instead of spinning (see `awake.rs`), and
-//! [`oversubscribed`] and [`park_delay`] are what the root-scope entries use.
+//! [`oversubscribed`] is what the root-scope entries use.
 
 use core::sync::atomic::{AtomicBool, Ordering};
 
@@ -61,17 +61,6 @@ pub(crate) fn oversubscribed(participants: usize) -> bool {
     participants > available()
 }
 
-/// The park delay of the reserved members of a root scope, in nanoseconds:
-/// zero when the scope is oversubscribed (park after the short spin), the
-/// scope's policy delay otherwise.
-pub(crate) fn park_delay(policy: crate::policy::WaitPolicy, oversubscribed: bool) -> u64 {
-    if oversubscribed {
-        0
-    } else {
-        u64::try_from(policy.idle_spin().as_nanos()).unwrap_or(u64::MAX)
-    }
-}
-
 /// Pins the calling thread onto the `k`-th CPU of `set` (wrapping).
 ///
 /// Called by a member for itself (`k >= 1`); the leader never calls it. Best
diff --git a/src/policy.rs b/src/policy.rs
index 39623fc..64d2742 100644
--- a/src/policy.rs
+++ b/src/policy.rs
@@ -11,7 +11,9 @@ use core::time::Duration;
 ///
 /// * `idle_spin`: how long an idle member keeps spinning, ready to be claimed
 ///   again without a Rayon wake-up, before it returns its thread to Rayon.
-///   Zero returns it immediately.
+///   Zero returns it immediately. The pool's spin budget of polls
+///   ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)) bounds it
+///   too, whichever ends first.
 /// * `idle_runs_rayon`: whether the spinning member runs queued Rayon jobs in
 ///   the meantime. When it does, a job it picked up runs to completion
 ///   (including nested work) before the member is claimable again, and an
diff --git a/src/pool.rs b/src/pool.rs
index 4b177a0..2d16c9e 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -31,6 +31,19 @@ const DEFAULT_ACQUIRE_TIMEOUT: Duration = Duration::from_millis(2);
 /// pool.
 const PIN_PARTICIPANTS_DEFAULT: bool = false;
 
+/// Default spin budget of a wait, in polls (one PAUSE, or YIELD on aarch64,
+/// per poll); see `docs/design/waiting.md`. On x86-64 a poll measured about
+/// 24 ns on Zen 3 (EPYC 7713P), so 12288 polls are about 300 µs, and longer on
+/// CPUs whose PAUSE is slower (Skylake and later Intel cores: about 2x). On
+/// aarch64 a YIELD is much cheaper than a PAUSE; the larger default aims at the
+/// same order of time and is not measured yet. libgomp's default is 300000
+/// polls ("about 3 ms").
+const SPIN_POLLS_DEFAULT: u32 = if cfg!(target_arch = "aarch64") {
+    1 << 17
+} else {
+    12_288
+};
+
 /// A fixed set of worker threads that [`Exec`](crate::Exec) tokens place work on.
 ///
 /// `Pool` is the only way to make a pool. It wraps the scheduler privately: no
@@ -172,6 +185,12 @@ impl Pool {
         self.awake.pin
     }
 
+    /// The spin budget of this pool's team waits, in polls
+    /// ([`PoolBuilder::spin_polls`]).
+    pub fn spin_polls(&self) -> u32 {
+        self.awake.waits.spin_polls
+    }
+
     /// Number of workers currently kept awake as team members, reserved or
     /// idle. Zero once idle members returned to Rayon. A diagnostic: the value
     /// can change at any moment.
@@ -252,6 +271,7 @@ pub struct PoolBuilder {
     qos: Option<Qos>,
     costs: DispatchCosts,
     pin_participants: bool,
+    spin_polls: u32,
 }
 
 impl PoolBuilder {
@@ -266,6 +286,7 @@ impl PoolBuilder {
             qos: None,
             costs: DispatchCosts::host_default(),
             pin_participants: PIN_PARTICIPANTS_DEFAULT,
+            spin_polls: SPIN_POLLS_DEFAULT,
         }
     }
 
@@ -340,6 +361,8 @@ impl PoolBuilder {
 
     /// Default spin time of an unreserved idle team member before it returns
     /// its thread to Rayon. Defaults to 200 ms; zero returns it immediately.
+    /// The member also returns once it has polled for the pool's spin budget
+    /// ([`spin_polls`](Self::spin_polls)), whichever comes first.
     ///
     /// Operations may override it with [`WaitOverride`](crate::WaitOverride).
     /// A reserved member never leaves on a timeout.
@@ -531,6 +554,30 @@ impl PoolBuilder {
         self
     }
 
+    /// Spin budget of a team wait, in polls of one PAUSE (YIELD on aarch64):
+    /// how long a reserved member waiting for work, a leader in a section's
+    /// join, or a participant in a barrier spins before it yields a few times
+    /// and then sleeps until woken (`docs/design/waiting.md`; the shape of
+    /// libgomp's `GOMP_SPINCOUNT`). A count, so a waiter that is descheduled
+    /// does not spend it while it waits for its CPU. Zero sleeps after the
+    /// yields. An oversubscribed scope, or a pool whose waiters were recently
+    /// descheduled, uses at most 100 polls. It also bounds how long an idle
+    /// member released by a team keeps polling before it returns to Rayon,
+    /// together with [`idle_spin`](Self::idle_spin).
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// let pool = threadteam::Pool::builder().threads(2).spin_polls(4096).build()?;
+    /// assert_eq!(pool.spin_polls(), 4096);
+    /// # Ok::<(), threadteam::Error>(())
+    /// ```
+    #[must_use]
+    pub fn spin_polls(mut self, polls: u32) -> Self {
+        self.spin_polls = polls;
+        self
+    }
+
     /// Starts the workers.
     ///
     /// Without the `parallel` feature no thread is started and the pool has
@@ -613,6 +660,7 @@ impl PoolBuilder {
                 self.acquire_timeout,
                 self.costs,
                 self.pin_participants,
+                self.spin_polls,
             )),
         })
     }
@@ -627,6 +675,7 @@ impl PoolBuilder {
                 self.acquire_timeout,
                 self.costs,
                 self.pin_participants,
+                self.spin_polls,
             )),
         })
     }
diff --git a/src/reserve.rs b/src/reserve.rs
index 4ec6b96..23a57b2 100644
--- a/src/reserve.rs
+++ b/src/reserve.rs
@@ -48,11 +48,13 @@ impl Drop for LeaderGuard<'_> {
 ///   returns. A lent job that is still running delays the next section until it
 ///   finishes.
 ///
-/// Reserved members spin for the reservation's `idle_spin`, then **park**
-/// while staying reserved: they do not return to Rayon until the `Team` is
-/// dropped. The next dispatch wakes them with one condition-variable broadcast,
-/// which costs a syscall on the first dispatch after a park
-/// (`benches/wake_probe.rs`) and one atomic load for a warm one.
+/// Reserved members wait for work in staged episodes: they spin for the pool's
+/// spin budget ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)),
+/// yield a few times, then **park** while staying reserved; they do not return
+/// to Rayon until the `Team` is dropped (`docs/design/waiting.md`). The next
+/// dispatch wakes a parked member through its slot's parker, which costs a
+/// syscall on the first dispatch after a park (`benches/wake_probe.rs`) and one
+/// atomic read-modify-write for a warm one.
 ///
 /// # Serialization of callers
 ///
@@ -150,8 +152,8 @@ impl Pool {
     ///
     /// `width` counts the leader and is clamped to the pool width; zero is
     /// treated as one. Acquisition never waits for a running Rayon job (see
-    /// [`Exec::team`](crate::Exec::team)). Members park after the pool's
-    /// `idle_spin` without work.
+    /// [`Exec::team`](crate::Exec::team)). Members park after the pool's spin
+    /// budget without work ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)).
     ///
     /// # Errors
     ///
@@ -174,8 +176,10 @@ impl Pool {
         self.into_team_with(width, WaitOverride::new())
     }
 
-    /// [`into_team`](Pool::into_team) with an override of the park delay
-    /// (`idle_spin`) of the reserved members.
+    /// [`into_team`](Pool::into_team) with an override of the wait policy of
+    /// the reservation. The reserved members' waits for work use the pool's spin
+    /// budget, not `idle_spin` (`docs/design/waiting.md`); the override is kept
+    /// for the policy the team reports.
     ///
     /// # Errors
     ///
@@ -185,13 +189,14 @@ impl Pool {
         let policy = self.wait_policy().with(over);
         // On drop the members leave at once.
         let release = WaitPolicy::new(Duration::ZERO, false);
-        let reservation = match self
-            .awake
-            .acquire(&self, width - 1, release, policy.idle_spin())
-        {
-            Ok(r) => r,
-            Err(reason) => return Err(IntoTeamError { pool: self, reason }),
-        };
+        let reservation =
+            match self
+                .awake
+                .acquire(&self, width - 1, release, self.awake.spin_budget(false))
+            {
+                Ok(r) => r,
+                Err(reason) => return Err(IntoTeamError { pool: self, reason }),
+            };
         let team = Team {
             reservation,
             policy,
@@ -306,15 +311,14 @@ impl Team {
         let ids = &self.reservation.ids[..budget - 1];
         // Root-scope entry of the token: `exec` is serialized (one leader at a
         // time), so the calling thread's CPU set decides here whether the scope
-        // is oversubscribed. When it is, the members park after their short
-        // spin instead of spinning for the whole park delay; otherwise they get
-        // the policy's delay. `Exec::team_with` on the minted token repeats
+        // is oversubscribed. When it is, the members' waits get the throttled
+        // spin budget; otherwise the pool's. `Exec::team_with` on the minted token repeats
         // this on the thread that enters each scope, so a token that travels to
         // a thread with a different CPU set is paced by that set.
         let oversubscribed = crate::pin::oversubscribed(budget);
         self.pool
             .awake
-            .set_park_ns(ids, crate::pin::park_delay(self.policy, oversubscribed));
+            .set_spin_budget(ids, self.pool.awake.spin_budget(oversubscribed));
         let auth = TeamAuth {
             awake: &self.pool.awake,
             ids,
diff --git a/src/sync.rs b/src/sync.rs
index 5567a42..01300c0 100644
--- a/src/sync.rs
+++ b/src/sync.rs
@@ -3,11 +3,11 @@
 
 #[cfg(loom)]
 pub(crate) use loom::sync::{
-    atomic::{AtomicUsize, Ordering},
+    atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
     Condvar, Mutex,
 };
 #[cfg(not(loom))]
 pub(crate) use std::sync::{
-    atomic::{AtomicUsize, Ordering},
+    atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
     Condvar, Mutex,
 };
diff --git a/src/team.rs b/src/team.rs
index 9bac2b4..0dbb1f6 100644
--- a/src/team.rs
+++ b/src/team.rs
@@ -79,13 +79,16 @@ impl Participant<'_> {
 ///   `budget - 1` pool workers. Before any section runs, every participant
 ///   acknowledged on its own thread (a rendezvous), so barriers inside
 ///   sections cannot deadlock for lack of threads.
-/// * Reserved members spin with one PAUSE per poll, then park once the park
-///   delay (`idle_spin`) has passed since their own last share; they run no
-///   unrelated Rayon job and do not leave on a timeout, also between sections
-///   and during a long serial phase of the leader. They are returned when the
-///   scope ends. In a root scope with more participants than CPUs in the
-///   caller's affinity mask the delay is zero, so they park after a short spin
-///   instead of holding a CPU.
+/// * Every wait of a team is a staged episode (`docs/design/waiting.md`): a
+///   reserved member waiting for work, the leader in a section's join, and a
+///   participant in a barrier spin with one PAUSE per poll for the pool's spin
+///   budget ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)), yield
+///   a few times, then sleep until woken. Members run no unrelated Rayon job and
+///   do not leave on a timeout, also between sections and during a long serial
+///   phase of the leader; they are returned when the scope ends. In a root scope
+///   with more participants than CPUs in the caller's affinity mask, or in a
+///   pool whose waiters were recently descheduled, the spin is throttled to 100
+///   polls, so waiters free their CPUs quickly.
 /// * If the pool pins members
 ///   ([`PoolBuilder::pin_participants`](crate::PoolBuilder::pin_participants)),
 ///   member `k` of a root scope (participant `k >= 1`) runs on the `k`-th CPU of
@@ -571,6 +574,7 @@ where
         slot_call::<S>,
         (slot_of as *const S).cast(),
         geometry,
+        awake.map(|a| &a.waits),
     );
     let dispatched = geometry.dispatched;
     let guard = JoinGuard(&sec);
diff --git a/src/tests/mod.rs b/src/tests/mod.rs
index ea7a00b..6e9b33c 100644
--- a/src/tests/mod.rs
+++ b/src/tests/mod.rs
@@ -1,3 +1,4 @@
 #[cfg(all(feature = "parallel", target_os = "linux"))]
 mod placement;
 mod split;
+mod waiting;
diff --git a/src/tests/placement.rs b/src/tests/placement.rs
index 5678605..16bf618 100644
--- a/src/tests/placement.rs
+++ b/src/tests/placement.rs
@@ -72,6 +72,7 @@ fn a_section_carries_the_oversubscription_flag_it_was_built_with() {
         slot_of,
         std::ptr::null(),
         geometry(false),
+        None,
     );
     assert!(!quiet.over);
     let crowded = Section::new(
@@ -80,6 +81,7 @@ fn a_section_carries_the_oversubscription_flag_it_was_built_with() {
         slot_of,
         std::ptr::null(),
         geometry(true),
+        None,
     );
     assert!(crowded.over);
 }
@@ -178,3 +180,50 @@ fn a_team_scope_takes_the_oversubscription_from_the_thread_that_enters_it() {
     );
     assert!(scoped.1, "a fork child inherits the root's pressure");
 }
+
+/// The budget a root scope chooses at entry: the throttled one when its
+/// participants outnumber the caller's CPUs, the pool's otherwise; and a
+/// persistent team's token does the same at every root-scope entry.
+#[test]
+fn a_root_scope_chooses_the_throttled_spin_budget_when_oversubscribed() {
+    use crate::park::THROTTLED_POLLS;
+    let budget = 50_000;
+    let pool = |width| {
+        Pool::builder()
+            .threads(width)
+            .spin_polls(budget)
+            .acquire_timeout(Duration::from_secs(10))
+            .build()
+            .unwrap()
+    };
+    on_two_cpus(|| {
+        let crowded = pool(4);
+        let mut exec = Exec::new(&crowded, 4).unwrap();
+        exec.team(|team| {
+            let awake = team.awake.expect("a pool");
+            assert!(!team.ids.is_empty());
+            for &id in team.ids {
+                assert_eq!(awake.slot_spin_budget(id), THROTTLED_POLLS);
+            }
+        })
+        .expect("an idle pool");
+        drop(exec);
+        let team = crowded.into_team(4).expect("an idle pool");
+        let mut exec = team.exec(4);
+        exec.team(|t| {
+            for &id in t.ids {
+                assert_eq!(t.awake.unwrap().slot_spin_budget(id), THROTTLED_POLLS);
+            }
+        })
+        .expect("a team token opens its scope");
+
+        let fits = pool(2);
+        let mut exec = Exec::new(&fits, 2).unwrap();
+        exec.team(|team| {
+            for &id in team.ids {
+                assert_eq!(team.awake.unwrap().slot_spin_budget(id), budget);
+            }
+        })
+        .expect("an idle pool");
+    });
+}
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
new file mode 100644
index 0000000..61d68d0
--- /dev/null
+++ b/src/tests/waiting.rs
@@ -0,0 +1,59 @@
+//! The staged wait of `crate::park::Waiter` (`docs/design/waiting.md`).
+//!
+//! Nothing here depends on how the scheduler runs this thread: the pressure
+//! deadlines are set explicitly, and the only real delay (a sleep) can only make
+//! a measured gap longer.
+
+use crate::park::{Pressure, Step, Waiter, THROTTLED_POLLS};
+use std::time::Duration;
+
+/// Steps until the waiter says sleep; the number of `Poll` steps before it.
+fn polls_until_sleep(w: &mut Waiter<'_>) -> u32 {
+    let mut n = 0;
+    while w.step() == Step::Poll {
+        n += 1;
+        assert!(n < 10_000_000, "never sleeps");
+    }
+    n
+}
+
+#[test]
+fn a_wait_spins_its_budget_then_yields_sixteen_times_then_sleeps() {
+    for budget in [0u32, 1, 63, 64, 1000] {
+        let mut w = Waiter::new(budget, None);
+        assert_eq!(polls_until_sleep(&mut w), budget + 16, "budget {budget}");
+        // It stays asleep-ready: every further step says sleep.
+        assert_eq!(w.step(), Step::Sleep);
+    }
+}
+
+#[test]
+fn a_pool_under_pressure_starts_its_waits_throttled() {
+    let p = Pressure::new();
+    // A deadline that cannot pass during the test.
+    p.note(u64::MAX);
+    let mut throttled = Waiter::new(100_000, Some(&p));
+    assert_eq!(polls_until_sleep(&mut throttled), THROTTLED_POLLS + 16);
+    // A small budget is never raised to the throttled one.
+    let mut small = Waiter::new(70, Some(&p));
+    assert_eq!(polls_until_sleep(&mut small), 70 + 16);
+}
+
+#[test]
+fn a_descheduled_spinner_ends_its_spin_and_records_the_pressure() {
+    let p = Pressure::new();
+    assert!(!p.recorded());
+    let mut w = Waiter::new(1_000_000, Some(&p));
+    // The first clock read is at poll 64; a gap longer than 200 µs before the
+    // second one (poll 128) stands for a descheduled waiter.
+    for _ in 0..64 {
+        assert_eq!(w.step(), Step::Poll);
+    }
+    std::thread::sleep(Duration::from_millis(2));
+    for _ in 64..128 {
+        assert_eq!(w.step(), Step::Poll);
+    }
+    // The spin is over: what remains is the sixteen yields.
+    assert_eq!(polls_until_sleep(&mut w), 16);
+    assert!(p.recorded(), "the pool records the pressure");
+}
diff --git a/tests/idle_clock.rs b/tests/idle_clock.rs
index b14ce83..4507ef0 100644
--- a/tests/idle_clock.rs
+++ b/tests/idle_clock.rs
@@ -1,5 +1,9 @@
-//! The idle clock of a reserved member (feature `trace`): the time since the
-//! member's own last share (or since it started, or since it woke from a park).
+//! The idle episodes of a reserved member (feature `trace`): after its own last
+//! share (or its start, or a wake-up) a member spins for the pool's spin budget
+//! of polls, yields a few times and parks (`docs/design/waiting.md`). The budget
+//! is a count, so no wall-clock lower bound on a park exists; the gating of the
+//! count itself is unit tested (`src/tests/waiting.rs`). Here the budget is zero
+//! and the test checks the episode's order and the wake-up.
 //!
 //! Everything here is judged by the **order of a member's own trace events**,
 //! never by a wall-clock bound on how fast the leader gets around to the next
@@ -8,11 +12,11 @@
 //! slot ids are read from the trace as well, because the acquisition may claim
 //! any free slots.
 //!
-//! * Never before the delay: for every park of member `m` at time `t`,
-//!   `t - max(m's last share end, m's last wake-up, m's start) >= SPIN`. This
-//!   holds for every park in the whole test.
-//! * After the delay: once no section arrives, every member parks; polled until
-//!   it happens, with no upper bound on how late.
+//! * A park follows an anchor: every `ParkEnter` of member `m` comes after one of
+//!   `m`'s own `SectionEnd`, `ParkExit` or `Enter` events, with no other
+//!   `ParkEnter` of `m` in between (one park per idle episode).
+//! * Once no section arrives, every member parks; polled until it happens, with
+//!   no upper bound on how late.
 //! * A following section wakes every member that was parked: the number of
 //!   `ParkExit`s rises by the number of members parked at that moment.
 #![cfg(all(feature = "trace", feature = "parallel"))]
@@ -21,8 +25,6 @@ use std::time::{Duration, Instant};
 use threadteam::trace::{self, Kind};
 use threadteam::Pool;
 
-const SPIN: Duration = Duration::from_millis(40);
-
 /// Only a hang guard: no assertion below is a bound on how long the members or
 /// the leader take.
 const DEADLINE: Duration = Duration::from_secs(10);
@@ -30,7 +32,7 @@ const DEADLINE: Duration = Duration::from_secs(10);
 fn team(width: usize) -> threadteam::Team {
     Pool::builder()
         .threads(width)
-        .idle_spin(SPIN)
+        .spin_polls(0)
         .acquire_timeout(Duration::from_secs(10))
         .build()
         .unwrap()
@@ -109,8 +111,9 @@ fn every_member_parked_after_its_last_share(events: &[trace::Event]) -> bool {
         })
 }
 
-/// Asserts the "never before the delay" property over every park in the trace.
-fn assert_no_park_before_the_delay(team: &threadteam::Team) {
+/// Asserts that every park follows its own anchor (a share end, a wake-up or the
+/// start) with no second park in the same idle episode.
+fn assert_one_park_per_episode(team: &threadteam::Team) {
     let events = member_events(team);
     let parks: Vec<_> = events
         .iter()
@@ -118,36 +121,39 @@ fn assert_no_park_before_the_delay(team: &threadteam::Team) {
         .collect();
     assert!(!parks.is_empty(), "no member parked at all");
     for park in parks {
-        // The park delay runs from the later of the member's own last share
-        // end, its own last wake-up and its start.
-        let anchor = events
+        let before: Vec<_> = events
             .iter()
             .filter(|e| e.member == park.member && e.ns <= park.ns)
-            .filter(|e| matches!(e.kind, Kind::SectionEnd | Kind::ParkExit | Kind::Enter))
-            .map(|e| e.ns)
-            .max();
-        let Some(anchor) = anchor else {
-            panic!("member {} parked without an anchor event", park.member);
-        };
+            .filter(|e| {
+                matches!(
+                    e.kind,
+                    Kind::SectionEnd | Kind::ParkExit | Kind::Enter | Kind::ParkEnter
+                )
+            })
+            .collect();
+        // The last event before this park (itself excluded) is an anchor.
+        let prev = before
+            .iter()
+            .rev()
+            .find(|e| !std::ptr::eq(**e, park))
+            .unwrap_or_else(|| panic!("member {} parked without an anchor event", park.member));
         assert!(
-            park.ns - anchor >= SPIN.as_nanos() as u64,
-            "member {} parked {} us after its own last share, wake-up or start",
-            park.member,
-            (park.ns - anchor) / 1000
+            prev.kind != Kind::ParkEnter,
+            "member {} parked twice in one idle episode",
+            park.member
         );
     }
 }
 
 #[test]
-fn members_park_after_the_park_delay_since_their_own_last_share_or_wake() {
+fn members_park_once_per_idle_episode_and_wake_on_the_next_section() {
     let team = team(3);
     let mut exec = team.exec(3);
     if team.size().get() < 3 {
         return;
     }
-    // Sections a few milliseconds apart for about 150 ms. This does *not*
-    // assert that nobody parks: on a loaded host the leader's sleeps can wake
-    // late enough for a member to idle through its delay, and that is allowed.
+    // Sections a few milliseconds apart: with a zero budget the members park
+    // between them, and every section wakes them.
     for _ in 0..30 {
         exec.reborrow().broadcast(|_| {}).unwrap();
         std::thread::sleep(Duration::from_millis(5));
@@ -162,9 +168,8 @@ fn members_park_after_the_park_delay_since_their_own_last_share_or_wake() {
         team.size().get() - 1,
         "every member ran a share: {members:?}"
     );
-    // The "not before" property holds for every park of the whole test, the
-    // ones inside the phase of regular sections included.
-    assert_no_park_before_the_delay(&team);
+    // One park per idle episode, over the whole test.
+    assert_one_park_per_episode(&team);
     // A following section wakes every member that is parked now: the wake-ups
     // are exactly the parked members' `ParkExit`s.
     let parked = parked_now(&team);
@@ -178,7 +183,9 @@ fn members_park_after_the_park_delay_since_their_own_last_share_or_wake() {
     wait_until("every parked member woke", || {
         count(&team, Kind::ParkExit) >= exits + parked
     });
-    // The clock restarts from the share they just ran: a later park is again at
-    // least SPIN after it.
-    assert_no_park_before_the_delay(&team);
+    // The episode restarts from the share they just ran.
+    wait_until("every member parked again", || {
+        parked_now(&team) == team.size().get() - 1
+    });
+    assert_one_park_per_episode(&team);
 }
diff --git a/tests/loom_park.rs b/tests/loom_park.rs
index 0e0558a..6fa46c8 100644
--- a/tests/loom_park.rs
+++ b/tests/loom_park.rs
@@ -7,7 +7,7 @@
 //! shows up as a deadlock of the leader's join.
 #![cfg(loom)]
 
-use loom::sync::atomic::{AtomicUsize, Ordering};
+use loom::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use loom::sync::Arc;
 use loom::thread;
 use threadteam::Parker;
@@ -130,3 +130,78 @@ fn a_wake_of_one_slot_leaves_the_other_asleep_until_its_own_change() {
         }
     });
 }
+
+// ---------------------------------------------------------------------------
+// The staged waits of a section (`docs/design/waiting.md`): the exact
+// `Completion` and `Barrier` code, with a zero spin budget so every waiter goes
+// straight to sleep on the shared parker.
+
+use threadteam::{Barrier, Completion, Waiter};
+
+/// The leader sleeps in `join` until the last of two members finishes; the
+/// member that brings the count to zero wakes it. A lost wake-up deadlocks.
+#[test]
+fn the_last_member_wakes_a_leader_asleep_in_join() {
+    model(|| {
+        let done = Arc::new(Completion::new(2));
+        let sync = Arc::new(Parker::new());
+        let ms: Vec<_> = (0..2)
+            .map(|_| {
+                let (done, sync) = (done.clone(), sync.clone());
+                thread::spawn(move || unsafe {
+                    Completion::finish(Arc::as_ptr(&done), Some(&sync))
+                })
+            })
+            .collect();
+        done.wait(Some(&sync), &mut Waiter::new(0, None));
+        assert!(done.is_done());
+        for m in ms {
+            m.join().unwrap();
+        }
+    });
+}
+
+/// Two participants pass two consecutive barrier rounds, sleeping on the
+/// shared parker: the reset of `arrived` and the epoch bump of one round never
+/// lose the other's arrival or wake-up in the next.
+#[test]
+fn consecutive_barrier_rounds_wake_every_sleeper() {
+    model(|| {
+        let barrier = Arc::new(Barrier::new(2));
+        let cancelled = Arc::new(AtomicBool::new(false));
+        let sync = Arc::new(Parker::new());
+        let peer = {
+            let (barrier, cancelled, sync) = (barrier.clone(), cancelled.clone(), sync.clone());
+            thread::spawn(move || {
+                for _ in 0..2 {
+                    assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0, None)));
+                }
+            })
+        };
+        for _ in 0..2 {
+            assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0, None)));
+        }
+        peer.join().unwrap();
+    });
+}
+
+/// A participant asleep in a barrier that can never complete (the third
+/// participant failed) is woken by the cancellation and leaves with `false`.
+#[test]
+fn a_cancellation_wakes_a_participant_asleep_in_a_barrier() {
+    model(|| {
+        let barrier = Arc::new(Barrier::new(3));
+        let cancelled = Arc::new(AtomicBool::new(false));
+        let sync = Arc::new(Parker::new());
+        let waiter = {
+            let (barrier, cancelled, sync) = (barrier.clone(), cancelled.clone(), sync.clone());
+            thread::spawn(move || {
+                barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0, None))
+            })
+        };
+        // `Section::fail`: raise the flag (SeqCst), then wake.
+        cancelled.store(true, Ordering::SeqCst);
+        sync.wake();
+        assert!(!waiter.join().unwrap());
+    });
+}
diff --git a/tests/oversubscribed.rs b/tests/oversubscribed.rs
index d9bd759..8865dc6 100644
--- a/tests/oversubscribed.rs
+++ b/tests/oversubscribed.rs
@@ -1,11 +1,13 @@
 //! A root team scope that has more participants than CPUs in the caller's set
-//! parks its members after a short spin instead of spinning for the whole park
-//! delay, and its nested sections keep that knowledge.
+//! parks its members, and its nested sections keep working, with members that
+//! sleep and wake between them.
 //!
-//! Nothing here is a wall-clock bound on the members: the park delay of the
-//! policy is set far above the deadline of the hang guard, so *reaching* the
-//! park proves the scope used its own (zero) delay, whatever the host's speed,
-//! and the wait itself is a poll of the trace with no upper bound.
+//! These are sleeping and waking smoke tests. The pool's spin budget is lifted
+//! to `u32::MAX` polls (minutes), so a member parks within the hang guard only
+//! through a short budget: the throttled one the oversubscribed scope chose, or
+//! the pressure heuristic of a loaded host (`docs/design/waiting.md`). Which
+//! budget a root scope chooses is checked directly in
+//! `src/tests/placement.rs`.
 #![cfg(all(feature = "trace", feature = "parallel", target_os = "linux"))]
 
 use std::sync::atomic::{AtomicUsize, Ordering};
@@ -13,10 +15,6 @@ use std::time::{Duration, Instant};
 use threadteam::trace::{self, Kind};
 use threadteam::Pool;
 
-/// The policy's park delay. Far above `DEADLINE`: a member that waited for it
-/// could not park within the deadline.
-const PARK_DELAY: Duration = Duration::from_secs(60);
-
 /// Only a hang guard.
 const DEADLINE: Duration = Duration::from_secs(10);
 
@@ -86,10 +84,9 @@ fn members_that_ran(events: &[trace::Event]) -> Vec<usize> {
 /// Polls (hang guard only) until every member that ran a share has a
 /// `ParkEnter` later than its own last `SectionEnd`.
 ///
-/// No upper bound on how late: what the deadline rules out is the opposite —
-/// with `PARK_DELAY` = 60 s, a member that kept the policy's delay cannot park
-/// before it, so parking within `DEADLINE` can only come from the scope's own
-/// (zero) delay.
+/// No upper bound on how late. With the pool's budget lifted to `u32::MAX`
+/// polls, parking within `DEADLINE` comes from a short budget (see the module
+/// documentation).
 fn wait_until_members_parked(team: &threadteam::Team) {
     let start = Instant::now();
     loop {
@@ -119,7 +116,7 @@ fn wait_until_members_parked(team: &threadteam::Team) {
         }
         assert!(
             start.elapsed() < DEADLINE,
-            "no member parked within {DEADLINE:?}: the scope kept the policy's {PARK_DELAY:?} delay"
+            "no member parked within {DEADLINE:?}: the scope kept the pool's lifted spin budget"
         );
         std::thread::sleep(Duration::from_millis(2));
     }
@@ -142,7 +139,7 @@ fn an_oversubscribed_root_scope_parks_its_members_quickly() {
 
     let pool = Pool::builder()
         .threads(4)
-        .idle_spin(PARK_DELAY)
+        .spin_polls(u32::MAX)
         .acquire_timeout(Duration::from_secs(10))
         .build()
         .unwrap();
@@ -185,7 +182,7 @@ fn the_scope_that_enters_decides_the_park_delay_not_the_mint() {
     // with the policy's 60 s park delay.
     let pool = Pool::builder()
         .threads(3)
-        .idle_spin(PARK_DELAY)
+        .spin_polls(u32::MAX)
         .acquire_timeout(Duration::from_secs(10))
         .build()
         .unwrap();
diff --git a/tests/team.rs b/tests/team.rs
index e68298c..e323bbe 100644
--- a/tests/team.rs
+++ b/tests/team.rs
@@ -37,10 +37,15 @@ fn pool(n: usize) -> Pool {
 }
 
 /// A pool whose acquisitions tolerate a loaded test host.
+/// A pool whose idle members stay for `spin` of wall time: the poll bound of
+/// an idle member (`spin_polls`) is lifted so that `idle_spin` alone decides,
+/// which these tests are about. `idle_members_return_after_the_spin_budget`
+/// covers the poll bound.
 fn builder(n: usize, spin: Duration) -> threadteam::PoolBuilder {
     Pool::builder()
         .threads(n)
         .idle_spin(spin)
+        .spin_polls(u32::MAX)
         .acquire_timeout(Duration::from_secs(5))
 }
 
@@ -483,6 +488,80 @@ fn a_panic_cancels_barriers_so_peers_leave_instead_of_deadlocking() {
     }
 }
 
+/// The same with every wait asleep (`spin_polls(0)`): the panicker raises the
+/// cancellation after its peers went to sleep in the barrier, and the
+/// cancellation wakes them (`Section::fail`).
+#[test]
+fn a_panic_wakes_peers_asleep_in_a_barrier() {
+    let _w = watchdog();
+    let pool = Pool::builder()
+        .threads(5)
+        .spin_polls(0)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    for panicker in [0, 3] {
+        let mut exec = Exec::new(&pool, 5).unwrap();
+        let cancelled = AtomicUsize::new(0);
+        let r = catch_unwind(AssertUnwindSafe(|| {
+            exec.team(|team| {
+                team.run_with(|p| {
+                    if p.index() == panicker {
+                        // Let the peers reach the barrier and sleep first.
+                        std::thread::sleep(Duration::from_millis(20));
+                        panic!("boom");
+                    }
+                    if p.barrier() == Err(Cancelled) {
+                        cancelled.fetch_add(1, Ordering::SeqCst);
+                    }
+                });
+            })
+        }));
+        assert!(r.is_err());
+        assert_eq!(cancelled.load(Ordering::SeqCst), 4);
+    }
+}
+
+/// Every wait asleep (`spin_polls(0)`), many short sections with barriers,
+/// splits and forks: every section completes with every share counted. A lost
+/// wake-up hangs (watchdog).
+#[test]
+fn sleeping_waits_complete_every_section() {
+    let _w = watchdog();
+    let pool = Pool::builder()
+        .threads(6)
+        .spin_polls(0)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    let team = pool.into_team(6).unwrap();
+    let mut exec = team.exec(6);
+    let sum = AtomicUsize::new(0);
+    let rounds = 300;
+    exec.team(|mut t| {
+        let size = t.size().get();
+        for _ in 0..rounds {
+            t.reborrow().run(|_, _| {
+                sum.fetch_add(1, Ordering::Relaxed);
+            });
+            t.reborrow().run_with(|p| {
+                p.barrier().unwrap();
+                p.barrier().unwrap();
+                sum.fetch_add(1, Ordering::Relaxed);
+            });
+            t.reborrow()
+                .split(&[size / 2, size - size / 2], |_, child| {
+                    child.run(|_, _| {
+                        sum.fetch_add(1, Ordering::Relaxed);
+                    });
+                })
+                .unwrap();
+        }
+        assert_eq!(sum.load(Ordering::Relaxed), rounds * 3 * size);
+    })
+    .unwrap();
+}
+
 #[test]
 fn a_child_panic_propagates_through_split_after_siblings_finish() {
     let _w = watchdog();
@@ -577,6 +656,25 @@ fn the_team_runs_from_a_pool_worker_with_members_from_the_others() {
     let _ = ok.load(Ordering::SeqCst);
 }
 
+#[test]
+fn idle_members_return_after_the_spin_budget() {
+    let _w = watchdog();
+    // An hour of `idle_spin`, but a budget of 1000 polls: a released member
+    // returns to Rayon after its polls, long before the hour.
+    let pool = Pool::builder()
+        .threads(4)
+        .idle_spin(Duration::from_secs(3600))
+        .spin_polls(1000)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    let mut exec = Exec::new(&pool, 4).unwrap();
+    exec.team(|t| t.run(|_, _| {})).unwrap();
+    wait_until("idle members returned after their polls", || {
+        pool.resident_members() == 0
+    });
+}
+
 #[test]
 fn pool_drop_joins_idle_members() {
     let _w = watchdog();
diff --git a/tests/team_alloc_free.rs b/tests/team_alloc_free.rs
index 32e0ee5..d5ad57b 100644
--- a/tests/team_alloc_free.rs
+++ b/tests/team_alloc_free.rs
@@ -174,4 +174,46 @@ fn team_dispatch_does_not_allocate_after_warm_up() {
     for round in 0..20 {
         assert_eq!(allocs_in(|| token_phases(&team)), 0, "pinned round {round}");
     }
+    drop(team);
+
+    // A zero spin budget: every join and barrier wait that does not finish at
+    // once goes to sleep on the pool's parker (`docs/design/waiting.md`), and
+    // every member waits for work asleep. Neither the sleep nor the wake-up
+    // allocates. The shares are uneven, so that waiters do sleep.
+    let pool = Pool::builder()
+        .threads(4)
+        .spin_polls(0)
+        .acquire_timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+    let team = pool.into_team(4).unwrap();
+    let mut exec = team.exec(4);
+    let sleeping_phases = |exec: &mut Exec<'_>| {
+        exec.reborrow()
+            .team(|mut t| {
+                t.reborrow().run(|i, _| {
+                    if i == 1 {
+                        std::thread::sleep(Duration::from_micros(200));
+                    }
+                });
+                t.reborrow().run_with(|p| {
+                    if p.index() == 2 {
+                        std::thread::sleep(Duration::from_micros(200));
+                    }
+                    p.barrier().unwrap();
+                    sink.fetch_add(p.index(), Ordering::Relaxed);
+                });
+            })
+            .unwrap();
+    };
+    for _ in 0..50 {
+        sleeping_phases(&mut exec);
+    }
+    for round in 0..20 {
+        assert_eq!(
+            allocs_in(|| sleeping_phases(&mut exec)),
+            0,
+            "sleeping round {round}"
+        );
+    }
 }

From c0c024bd3ccb6481a25c9a444fbbf94ae4273f54 Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 00:05:33 +0900
Subject: [PATCH 03/13] waits: libgomp-like default budget (131072 polls, ~3
 ms), pool throttle only on repeated preemptions; wait counters and an
 interleaved A/B script

evo: the first section after a 1 ms / 10 ms gap was 2.3x / 10.8x slower than
0.1.3 with the 12288-poll budget (members asleep). broccoli: held_team and
held_pool at width 64 were 4x slower than 0.1.3 on a mildly shared host,
consistent with one observed preemption throttling the whole pool for 100 ms
(every section then sleeps and pays futex wakes). Now a single preemption ends
only its waiter's spin; four within 100 ms throttle the pool. Both values, the
hold and the throttled budget are benchmark knobs (PoolBuilder::wait_tuning,
hidden), and Pool::wait_counters (hidden) counts sleeps, parks and observed
preemptions, printed under every bench row. scripts/bench-ab.sh alternates two
commits (and head variants) for shared hosts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                 |  7 +++
 benches/wait_scenarios.rs | 95 ++++++++++++++++++++++++++++++++++---
 docs/design/waiting.md    | 14 +++---
 scripts/bench-ab.sh       | 59 +++++++++++++++++++++++
 src/awake.rs              | 32 +++++++++++--
 src/lib.rs                |  2 +
 src/park.rs               | 99 ++++++++++++++++++++++++++++++++-------
 src/pool.rs               | 81 +++++++++++++++++++++++++++++---
 src/tests/waiting.rs      | 36 +++++++++++---
 9 files changed, 377 insertions(+), 48 deletions(-)
 create mode 100755 scripts/bench-ab.sh

diff --git a/README.md b/README.md
index 953e5e5..d2d067b 100644
--- a/README.md
+++ b/README.md
@@ -141,6 +141,13 @@ cargo bench --bench wait_scenarios -- --scenario gaps --widths 8   # one scenari
   `probe/107-acquire-per-call`). The acceptance check is that width 64 under load is no longer
   slow and width 48 does not regress.
 
+To compare two commits on a shared host, `scripts/bench-ab.sh <base-rev> <head-rev> <rounds>
+[bench args]` builds both and alternates them, so a drift of other users' load falls on both sides;
+`HEAD_VARIANTS='--spin-polls 12288;--pressure-events 1'` adds head runs with tuning flags (this
+version only). The base of the waits change is its bench commit `a3a9320` (the bench on the 0.1.3
+waits). Under every threadteam row, a `waits per call` line counts join and barrier sleeps, member
+parks and the preemptions waiters saw.
+
 Results are committed as CSV under [`docs/design/waiting-data/`](docs/design/waiting-data/), one
 file per host, with the label naming the commit; the summary tables live in `waiting.md`.
 
diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
index be3986d..441655b 100644
--- a/benches/wait_scenarios.rs
+++ b/benches/wait_scenarios.rs
@@ -28,11 +28,16 @@
 //!
 //! Options: `--scenario sections|gaps|acquire|nested|all`, `--widths 64,48`, `--impl threadteam,rayon`,
 //! `--load K:P`, `--calls N` (default 200; `gaps` and `acquire` use N/2), `--csv <file>`,
-//! `--label <text>` (the version or commit, written to the CSV).
+//! `--label <text>` (the version or commit, written to the CSV); tuning of the waits (this
+//! version only, `docs/design/waiting.md`): `--spin-polls N`, `--throttled-polls N`,
+//! `--pressure-hold-ms N` (0 throttles only the waiter that saw a preemption),
+//! `--pressure-events N` (preemptions within the hold that throttle the pool). Under each
+//! threadteam row a `waits per call` line counts join and barrier sleeps, member parks and the
+//! preemptions waiters saw.
 
 use std::io::Write;
 use std::time::{Duration, Instant};
-use threadteam::{Pool, Team};
+use threadteam::{Pool, Team, WaitCounters};
 
 fn busy(us: u64) {
     let end = Instant::now() + Duration::from_micros(us);
@@ -128,12 +133,61 @@ fn stats(mut v: Vec<f64>) -> Stats {
     }
 }
 
+/// Pool settings from the command line (`--spin-polls`, `--throttled-polls`,
+/// `--pressure-hold-ms`); `None` keeps the library default.
+type Tuning = (Option<u32>, Option<(u32, Duration, u32)>);
+static TUNING: std::sync::OnceLock<Tuning> = std::sync::OnceLock::new();
+
 fn pool(width: usize) -> Pool {
-    Pool::builder()
+    let mut b = Pool::builder()
         .threads(width)
-        .acquire_timeout(Duration::from_secs(30))
-        .build()
-        .expect("a pool")
+        .acquire_timeout(Duration::from_secs(30));
+    if let Some((spin, throttle)) = TUNING.get() {
+        if let Some(n) = spin {
+            b = b.spin_polls(*n);
+        }
+        if let Some((polls, hold, events)) = throttle {
+            b = b.wait_tuning(*polls, *hold, *events);
+        }
+    }
+    b.build().expect("a pool")
+}
+
+/// Counters of the waits between two snapshots.
+fn waits_between(a: WaitCounters, b: WaitCounters) -> WaitCounters {
+    WaitCounters {
+        join_sleeps: b.join_sleeps - a.join_sleeps,
+        barrier_sleeps: b.barrier_sleeps - a.barrier_sleeps,
+        member_parks: b.member_parks - a.member_parks,
+        pressure_events: b.pressure_events - a.pressure_events,
+    }
+}
+
+fn waits_sum(a: WaitCounters, b: WaitCounters) -> WaitCounters {
+    WaitCounters {
+        join_sleeps: a.join_sleeps + b.join_sleeps,
+        barrier_sleeps: a.barrier_sleeps + b.barrier_sleeps,
+        member_parks: a.member_parks + b.member_parks,
+        pressure_events: a.pressure_events + b.pressure_events,
+    }
+}
+
+fn snap(t: &Option<Team>) -> WaitCounters {
+    t.as_ref()
+        .map(|t| t.pool().wait_counters())
+        .unwrap_or_default()
+}
+
+/// Prints what the waits of the cell just reported did (stdout only).
+fn waits_line(c: WaitCounters, calls: usize) {
+    let per = |n: u64| n as f64 / calls.max(1) as f64;
+    println!(
+        "          waits per call: join sleeps {:.1}, barrier sleeps {:.1}, member parks {:.1}, preemptions seen {:.2}",
+        per(c.join_sleeps),
+        per(c.barrier_sleeps),
+        per(c.member_parks),
+        per(c.pressure_events)
+    );
 }
 
 fn team(width: usize) -> Team {
@@ -288,6 +342,20 @@ fn main() {
     });
     let calls: usize = value("--calls").map_or(200, |v| v.parse().expect("--calls"));
     let label = value("--label").unwrap_or_default();
+    let spin = value("--spin-polls").map(|v| v.parse().expect("--spin-polls"));
+    let throttle = match (
+        value("--throttled-polls"),
+        value("--pressure-hold-ms"),
+        value("--pressure-events"),
+    ) {
+        (None, None, None) => None,
+        (t, h, e) => Some((
+            t.map_or(100, |v| v.parse().expect("--throttled-polls")),
+            Duration::from_millis(h.map_or(100, |v| v.parse().expect("--pressure-hold-ms"))),
+            e.map_or(4, |v| v.parse().expect("--pressure-events")),
+        )),
+    };
+    TUNING.get_or_init(|| (spin, throttle));
     let load_text = load_spec.map_or("none".into(), |(k, p)| format!("{k}x{p}%"));
 
     let csv = value("--csv").map(|path| {
@@ -341,6 +409,7 @@ fn main() {
                 let param = format!("work={work}us,sections={sections}");
                 let ideal = (sections as u64 * work) as f64;
                 if let Some(t) = &held {
+                    let c0 = snap(&held);
                     let v = (0..calls)
                         .map(|_| call_team(t, w, sections, work).1)
                         .collect();
@@ -353,6 +422,7 @@ fn main() {
                         s: stats(v),
                         ideal_us: ideal,
                     });
+                    waits_line(waits_between(c0, snap(&held)), calls);
                 }
                 if let Some(p) = &rayon_pool {
                     let v = (0..calls)
@@ -390,7 +460,9 @@ fn main() {
                     (stats(first), stats(whole))
                 };
                 if let Some(t) = &held {
+                    let c0 = snap(&held);
                     let (a, b) = run(&mut || call_team(t, w, sections, work));
+                    let c = waits_between(c0, snap(&held));
                     out.row(Row {
                         scenario: "gaps",
                         imp: "threadteam",
@@ -409,6 +481,7 @@ fn main() {
                         s: b,
                         ideal_us: (sections as u64 * work) as f64,
                     });
+                    waits_line(c, calls / 2);
                 }
                 if let Some(p) = &rayon_pool {
                     let (a, b) = run(&mut || call_rayon(p, w, sections, work));
@@ -437,6 +510,7 @@ fn main() {
         if want("nested") && w >= 4 {
             if let Some(t) = &held {
                 let (splits, work) = (100, 20u64);
+                let c0 = snap(&held);
                 let v = (0..calls / 2)
                     .map(|_| call_nested(t, w, splits, work))
                     .collect();
@@ -449,6 +523,7 @@ fn main() {
                     s: stats(v),
                     ideal_us: (splits as u64 * work) as f64,
                 });
+                waits_line(waits_between(c0, snap(&held)), calls / 2);
             }
         }
 
@@ -470,28 +545,36 @@ fn main() {
             };
             {
                 let t = team(w);
+                let c0 = t.pool().wait_counters();
                 let v = (0..calls / 2)
                     .map(|_| call_team(&t, w, sections, work).1)
                     .collect();
                 row("held_team", "call", v);
+                waits_line(waits_between(c0, t.pool().wait_counters()), calls / 2);
             }
             {
                 let p = pool(w);
+                let c0 = p.wait_counters();
                 let v = (0..calls / 2)
                     .map(|_| call_pool(&p, w, sections, work))
                     .collect();
                 row("held_pool", "call", v);
+                waits_line(waits_between(c0, p.wait_counters()), calls / 2);
             }
             let (mut call, mut total) = (Vec::new(), Vec::new());
+            let mut c = WaitCounters::default();
             for _ in 0..calls / 2 {
                 let t0 = Instant::now();
                 let t = team(w);
+                let c0 = t.pool().wait_counters();
                 call.push(call_team(&t, w, sections, work).1);
+                c = waits_sum(c, waits_between(c0, t.pool().wait_counters()));
                 drop(t);
                 total.push(t0.elapsed().as_secs_f64() * 1e6);
             }
             row("fresh_pool", "call", call);
             row("fresh_pool", "total", total);
+            waits_line(c, calls / 2);
         }
     }
 }
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
index 47cfc08..66a5b13 100644
--- a/docs/design/waiting.md
+++ b/docs/design/waiting.md
@@ -86,18 +86,20 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
 ### Budget
 
 - **A count, as in libgomp.** The budget is `PoolBuilder::spin_polls`, a number of polls (one PAUSE, or YIELD on aarch64, per poll). A waiter that is descheduled does not spend it while it waits for its CPU.
-- **Default.** 12288 polls on x86-64: one poll measured about 24 ns on Zen 3 (EPYC 7713P), so about 300 µs there, and about twice that on Intel cores whose PAUSE is slower. On aarch64 a YIELD is much cheaper, and the default of 2^17 aims at the same order of time without a measurement yet.
-  - A section of 5-50 µs, and the gaps between sections inside a call, stay entirely in the spin phase, so the dispatch costs of `benches/dispatch_cost.rs` should not change.
-  - A member that waits longer than the budget between calls sleeps, and the first section of the next call pays one futex wake.
-  - libgomp's default is about 3 ms, and libomp's 200 ms. 300 µs is a starting value that the wait benchmark confirms or moves.
+- **Default: 131072 polls on x86-64** (2^21 on aarch64, not measured yet). One poll measured about 24 ns on Zen 3 (EPYC 7713P), so this is about 3 ms there, the order of libgomp's default (300000 polls, "about 3 ms"); Intel cores with a slower PAUSE take about twice as long.
+  - The first default, 12288 polls (about 300 µs), made the first section after a 1 ms or 10 ms gap 2.3x and 10.8x slower than 0.1.3 on a quiet host (evo, 6 → 16 → 75 µs): the members had gone to sleep, and the next call paid futex wakes. With about 3 ms, a team called again within a few milliseconds is still spinning, as under libgomp; after a longer gap it sleeps, as under libgomp.
+  - libomp keeps 200 ms (`KMP_BLOCKTIME`); 0.1.3 kept 200 ms of wall time for members and never slept in joins.
 - **No calibration.** Converting a time to polls at pool build was considered and dropped (pre-review): a calibration taken while the CPU is contended yields too few polls, and a bare PAUSE loop is not the real poll anyway. The count is approximate in time, as libgomp's is.
-- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed (as before), or while the pool is under recent pressure (below).
+- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed, or while the pool is under sustained pressure (below).
 
 ### Scheduling pressure
 
 - **Detection.** A spinning waiter reads the clock (`Instant::now`, vDSO) every 64 polls. If the gap since its previous read exceeds 200 µs, it was descheduled while it spun. Sixty-four polls take well under 10 µs, and a scheduler slice is 0.75 ms or more.
 - **What it means.** This is a pressure heuristic, not proof of foreign load. A foreign process, another thread of the team, interrupts, page faults or VM steal all look the same, and a short preemption can escape the threshold. It is acceptable because the response only shortens active waiting; it never changes affinity or correctness.
-- **Response.** The waiter ends its spin at once (yields, then sleeps), and moves the pool's `contended_until` forward to now + 100 ms with a `fetch_max`, so an older observation never shortens a newer one. While that deadline holds, every wait of the pool adopts the throttled budget at its first clock read.
+- **Response.** The waiter ends its spin at once (yields, then sleeps). The pool counts the observations: once 4 of them come within 100 ms of each other, every wait of the pool adopts the throttled budget at its first clock read, for 100 ms (moved forward with a `fetch_max`, so an older observation never shortens a newer one).
+  - Why a count: throttling the whole pool on a single observation made every section of a width-64 team on a mildly shared host (broccoli, another user's job) sleep and pay futex wakes, 4x slower than 0.1.3 (`held_team` 1.48 → 6.12 ms). An isolated preemption now ends only its own waiter's spin; sustained load still throttles the pool.
+  - Why the pool-wide throttle at all: on a saturated host (primerose), throttling only the waiter that saw the preemption left the pool as slow as 0.1.3.
+  - The threshold, the hold and the throttled budget can be varied for the benchmarks (`PoolBuilder::wait_tuning`, hidden; `--pressure-events`, `--pressure-hold-ms`, `--throttled-polls`), and `Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
 - **Cost.** A wait that ends within 64 polls never reads the clock; otherwise one clock read per 64 polls. There is no `getrusage` or other syscall in the poll loop.
 - **Limit.** A pool built for a single call (`with_team`) cannot carry the deadline to the next call. What helps it is the short budget and the sleeps in `join` and `barrier`, which give the scheduler idle CPUs within the call. With `pin_participants`, a sleeping waiter frees its CPU, but a pinned member that is descheduled behind a foreign process cannot move.
 
diff --git a/scripts/bench-ab.sh b/scripts/bench-ab.sh
new file mode 100755
index 0000000..29be8a1
--- /dev/null
+++ b/scripts/bench-ab.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Interleaved A/B of the wait benchmarks (docs/design/waiting.md): builds `benches/wait_scenarios.rs`
+# at two commits (the base is the bench commit a3a9320, which runs the bench on the 0.1.3 waits) and runs them alternately, so slow drifts of a shared host (other users' jobs)
+# fall on both sides. Rows go to $CSV (default docs/design/waiting-data/<host>-ab.csv), labelled
+# `<name>#<round>`; the `waits per call` lines go to $LOG.
+#
+#   scripts/bench-ab.sh <base-rev> <head-rev> <rounds> [bench args...]
+#
+# Example, the held-pool arms at width 64 (threadteam-rs#14, broccoli):
+#   taskset -c 0-63 scripts/bench-ab.sh a3a9320 feat/wait-openmp 20 \
+#     --scenario acquire --widths 64 --calls 40 --impl threadteam
+#
+# HEAD_VARIANTS adds head runs with extra arguments in every round, `;`-separated, each named by
+# its arguments, e.g. HEAD_VARIANTS='--spin-polls 12288;--pressure-hold-ms 0;--throttled-polls 1024'.
+set -euo pipefail
+base=${1:?base rev}; head=${2:?head rev}; rounds=${3:?rounds}; shift 3
+host=$(hostname -s)
+csv=${CSV:-docs/design/waiting-data/$host-ab.csv}
+log=${LOG:-docs/design/waiting-data/$host-ab.log}
+mkdir -p "$(dirname "$csv")"
+work=$(mktemp -d)
+trap 'git worktree remove --force "$work/base" 2>/dev/null; git worktree remove --force "$work/head" 2>/dev/null; rm -rf "$work"' EXIT
+build() { # $1 = rev, $2 = dir name; prints the bench binary
+  git worktree add -q --detach "$work/$2" "$1"
+  (cd "$work/$2" && cargo build -j "${JOBS:-4}" --release --bench wait_scenarios >/dev/null 2>&1)
+  ls -t "$work/$2"/target/release/deps/wait_scenarios-* | grep -v '\.d$' | head -1
+}
+bin_base=$(build "$base" base)
+bin_head=$(build "$head" head)
+IFS=';' read -r -a variants <<<"${HEAD_VARIANTS:-}"
+echo "base $(git rev-parse --short "$base")  head $(git rev-parse --short "$head")  rounds $rounds  args $*" | tee -a "$log"
+for r in $(seq 1 "$rounds"); do
+  order=(base head); (( r % 2 == 0 )) && order=(head base)
+  for side in "${order[@]}"; do
+    if [[ $side == base ]]; then
+      "$bin_base" --label "base#$r" --csv "$csv" "$@" >>"$log"
+    else
+      "$bin_head" --label "head#$r" --csv "$csv" "$@" >>"$log"
+      for v in "${variants[@]}"; do
+        [[ -z $v ]] && continue
+        # shellcheck disable=SC2086
+        "$bin_head" --label "head[$v]#$r" --csv "$csv" "$@" $v >>"$log"
+      done
+    fi
+  done
+done
+echo "rows in $csv, waits in $log"
+python3 - "$csv" <<'PY'
+import csv, collections, statistics, sys
+rows = list(csv.DictReader(open(sys.argv[1])))
+cells = collections.defaultdict(list)
+for r in rows:
+    name = r["label"].split("#")[0]
+    cells[(r["scenario"], r["width"], r["param"], r["metric"], name)].append(float(r["median_us"]))
+print(f"{'scenario':<9} {'width':>5} {'param':<24} {'metric':<6} {'side':<40} {'n':>3} {'median of medians us':>21}")
+for k in sorted(cells):
+    v = cells[k]
+    print(f"{k[0]:<9} {k[1]:>5} {k[2]:<24} {k[3]:<6} {k[4]:<40} {len(v):>3} {statistics.median(v):>21.1f}")
+PY
diff --git a/src/awake.rs b/src/awake.rs
index 91841f1..0375b4e 100644
--- a/src/awake.rs
+++ b/src/awake.rs
@@ -123,6 +123,11 @@ pub(crate) struct Waits {
     pub(crate) pressure: crate::park::Pressure,
     /// Spin budget of a wait, in polls (`PoolBuilder::spin_polls`).
     pub(crate) spin_polls: u32,
+    /// Diagnostics (`Pool::wait_counters`): sleeps of leaders in joins, of
+    /// participants in barriers, and parks of members waiting for work.
+    pub(crate) join_sleeps: AtomicU64,
+    pub(crate) barrier_sleeps: AtomicU64,
+    pub(crate) member_parks: AtomicU64,
 }
 
 /// Shared state of the awake members of one pool.
@@ -152,13 +157,17 @@ impl Awake {
         costs: crate::cost::DispatchCosts,
         pin: bool,
         spin_polls: u32,
+        pressure: crate::park::Pressure,
     ) -> Self {
         Awake {
             slots: (0..width).map(|_| Slot::new()).collect(),
             waits: Waits {
                 sync: Parker::new(),
-                pressure: crate::park::Pressure::new(),
+                pressure,
                 spin_polls,
+                join_sleeps: AtomicU64::new(0),
+                barrier_sleeps: AtomicU64::new(0),
+                member_parks: AtomicU64::new(0),
             },
             shutdown: AtomicBool::new(false),
             release_epoch: AtomicUsize::new(0),
@@ -196,7 +205,7 @@ impl Awake {
     /// the throttled one when the scope is oversubscribed.
     pub(crate) fn spin_budget(&self, over: bool) -> u32 {
         if over {
-            crate::park::THROTTLED_POLLS.min(self.waits.spin_polls)
+            self.waits.pressure.throttled().min(self.waits.spin_polls)
         } else {
             self.waits.spin_polls
         }
@@ -548,6 +557,7 @@ fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
                         )
                     });
                     if w.step() == Step::Sleep {
+                        aw.waits.member_parks.fetch_add(1, Ordering::Relaxed);
                         trace!(aw, Some(id), ParkEnter);
                         park_member(slot, seen);
                         trace!(aw, Some(id), ParkExit);
@@ -766,7 +776,7 @@ impl Section {
         match self.waits() {
             Some(w) => crate::park::Waiter::new(
                 if self.over {
-                    crate::park::THROTTLED_POLLS.min(w.spin_polls)
+                    w.pressure.throttled().min(w.spin_polls)
                 } else {
                     w.spin_polls
                 },
@@ -823,6 +833,11 @@ impl Section {
         }
         let mut waiter = self.waiter();
         self.done.wait(self.waits().map(|w| &w.sync), &mut waiter);
+        if waiter.slept() {
+            if let Some(w) = self.waits() {
+                w.join_sleeps.fetch_add(1, Ordering::Relaxed);
+            }
+        }
     }
 
     /// Sense-reversing barrier over the section's participants; `false` when
@@ -830,8 +845,15 @@ impl Section {
     /// like [`Self::join`].
     pub(crate) fn barrier(&self) -> bool {
         let mut waiter = self.waiter();
-        self.barrier
-            .arrive(&self.cancelled, self.waits().map(|w| &w.sync), &mut waiter)
+        let passed =
+            self.barrier
+                .arrive(&self.cancelled, self.waits().map(|w| &w.sync), &mut waiter);
+        if waiter.slept() {
+            if let Some(w) = self.waits() {
+                w.barrier_sleeps.fetch_add(1, Ordering::Relaxed);
+            }
+        }
+        passed
     }
 }
 
diff --git a/src/lib.rs b/src/lib.rs
index 2250ee6..326820b 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -71,6 +71,8 @@ pub use park::Parker;
 #[doc(hidden)]
 pub use park::{Barrier, Completion, Waiter};
 pub use policy::{raise_current_thread_qos, Qos, WaitOverride, WaitPolicy};
+#[doc(hidden)]
+pub use pool::WaitCounters;
 pub use pool::{Pool, PoolBuilder};
 pub use reserve::{IntoTeamError, Team};
 pub use team::{Cancelled, Participant, TeamExec};
diff --git a/src/park.rs b/src/park.rs
index 07ce462..584d9e6 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -148,8 +148,8 @@ impl Parker {
 // sleep on a `Parker`. The join and the barrier of a section use them through
 // [`Completion`] and [`Barrier`], which are the exact code `loom` checks.
 
-/// Polls of a wait that start with the throttled budget: the scope is
-/// oversubscribed, or the pool saw a waiter descheduled recently. libgomp's
+/// Default spin budget, in polls, of a wait that starts throttled: the scope
+/// is oversubscribed, or the pool saw a waiter descheduled recently. libgomp's
 /// throttled spin count has the same value.
 pub(crate) const THROTTLED_POLLS: u32 = 100;
 
@@ -165,9 +165,17 @@ const CHECK_EVERY: u32 = 64;
 /// scheduler slice is 0.75 ms or more.
 const PREEMPT_GAP_NS: u64 = 200_000;
 
-/// How long a pool keeps starting its waits throttled after a waiter was
-/// descheduled.
-const CONTENDED_HOLD_NS: u64 = 100_000_000;
+/// Default time a pool keeps starting its waits throttled once its waiters
+/// were descheduled often enough (see [`CONTENDED_EVENTS`]).
+pub(crate) const CONTENDED_HOLD_NS: u64 = 100_000_000;
+
+/// Default number of observed preemptions, within one hold window, that
+/// throttle the whole pool. A single preemption (another user's job taking a
+/// CPU for a slice) only ends the spin of the waiter that saw it: throttling
+/// the pool on it made every section of a width-64 team on a mildly shared
+/// host pay futex wakes (threadteam-rs#14, broccoli). Sustained load produces
+/// many preemptions per window and still throttles.
+pub(crate) const CONTENDED_EVENTS: u32 = 4;
 
 /// What a waiting thread does after one [`Waiter::step`].
 #[doc(hidden)]
@@ -184,14 +192,29 @@ pub enum Step {
 /// A waiter that finds a long gap between two of its clock reads was
 /// descheduled while it spun: something else ran on its CPU (another thread of
 /// the team, a foreign process, or interrupts and VM steal; the signal does not
-/// tell them apart). It records the time, and for [`CONTENDED_HOLD_NS`] every
-/// wait of the pool starts throttled, so the pool's waiters free CPUs quickly
-/// while that pressure lasts.
+/// tell them apart). It records the time, and for its hold time (default
+/// [`CONTENDED_HOLD_NS`]) every wait of the pool starts with the throttled
+/// budget, so the pool's waiters free CPUs quickly while that pressure lasts.
 #[doc(hidden)]
 pub struct Pressure {
     base: std::time::Instant,
     /// Nanoseconds since `base` until which waits start throttled.
     until: AtomicU64,
+    /// How long the pool's waits stay throttled once enough observations
+    /// came within one window of this length; zero throttles only the waiter
+    /// that saw a preemption.
+    hold_ns: u64,
+    /// Observations within one window that throttle the pool.
+    threshold: u32,
+    /// The throttled budget, in polls.
+    throttled: u32,
+    /// Start of the current observation window, and observations in it. A
+    /// heuristic: concurrent updates may lose a count, never an escalation by
+    /// a later window.
+    window: AtomicU64,
+    in_window: AtomicU64,
+    /// Observations so far (a diagnostic).
+    events: AtomicU64,
 }
 
 impl Default for Pressure {
@@ -201,14 +224,37 @@ impl Default for Pressure {
 }
 
 impl Pressure {
-    /// No pressure recorded yet.
+    /// No pressure recorded yet; the default hold and throttled budget.
     pub fn new() -> Self {
+        Self::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, CONTENDED_EVENTS)
+    }
+
+    /// No pressure recorded yet, with a throttled budget of `throttled` polls,
+    /// held for `hold_ns` once `threshold` observations came within `hold_ns`
+    /// of each other (a threshold of 0 or 1 throttles on the first).
+    pub fn tuned(throttled: u32, hold_ns: u64, threshold: u32) -> Self {
         Pressure {
             base: std::time::Instant::now(),
             until: AtomicU64::new(0),
+            hold_ns,
+            threshold,
+            throttled,
+            window: AtomicU64::new(0),
+            in_window: AtomicU64::new(0),
+            events: AtomicU64::new(0),
         }
     }
 
+    /// The throttled budget, in polls.
+    pub(crate) fn throttled(&self) -> u32 {
+        self.throttled
+    }
+
+    /// Observations so far.
+    pub(crate) fn events(&self) -> u64 {
+        self.events.load(Ordering::Relaxed)
+    }
+
     pub(crate) fn now(&self) -> u64 {
         u64::try_from(self.base.elapsed().as_nanos()).unwrap_or(u64::MAX)
     }
@@ -216,19 +262,28 @@ impl Pressure {
     /// Records a descheduled waiter at `now`. A later deadline is never
     /// shortened by an older observation.
     pub(crate) fn note(&self, now: u64) {
-        self.until
-            .fetch_max(now.saturating_add(CONTENDED_HOLD_NS), Ordering::Relaxed);
+        self.events.fetch_add(1, Ordering::Relaxed);
+        if self.hold_ns == 0 {
+            return;
+        }
+        let start = self.window.load(Ordering::Relaxed);
+        let n = if now.saturating_sub(start) > self.hold_ns {
+            // A new window starts with this observation.
+            self.window.store(now, Ordering::Relaxed);
+            self.in_window.store(1, Ordering::Relaxed);
+            1
+        } else {
+            self.in_window.fetch_add(1, Ordering::Relaxed) + 1
+        };
+        if n >= u64::from(self.threshold) {
+            self.until
+                .fetch_max(now.saturating_add(self.hold_ns), Ordering::Relaxed);
+        }
     }
 
     pub(crate) fn active(&self, now: u64) -> bool {
         self.until.load(Ordering::Relaxed) > now
     }
-
-    /// Whether any pressure was ever recorded (tests).
-    #[cfg(test)]
-    pub(crate) fn recorded(&self) -> bool {
-        self.until.load(Ordering::Relaxed) != 0
-    }
 }
 
 /// One wait episode: up to `budget` spin polls (one PAUSE, or YIELD on
@@ -246,6 +301,7 @@ pub struct Waiter<'a> {
     yields: u32,
     pressure: Option<&'a Pressure>,
     last: Option<u64>,
+    slept: bool,
 }
 
 impl<'a> Waiter<'a> {
@@ -257,9 +313,15 @@ impl<'a> Waiter<'a> {
             yields: 0,
             pressure,
             last: None,
+            slept: false,
         }
     }
 
+    /// Whether the episode reached its sleep phase.
+    pub fn slept(&self) -> bool {
+        self.slept
+    }
+
     /// One poll of the episode; [`Step::Sleep`] once the spin and the yields
     /// are spent (and on every call after that).
     #[inline]
@@ -277,6 +339,7 @@ impl<'a> Waiter<'a> {
             std::thread::yield_now();
             return Step::Poll;
         }
+        self.slept = true;
         Step::Sleep
     }
 
@@ -285,7 +348,7 @@ impl<'a> Waiter<'a> {
         let Some(p) = self.pressure else { return };
         let now = p.now();
         match self.last {
-            None if p.active(now) => self.budget = self.budget.min(THROTTLED_POLLS.max(self.polls)),
+            None if p.active(now) => self.budget = self.budget.min(p.throttled().max(self.polls)),
             Some(last) if now.saturating_sub(last) > PREEMPT_GAP_NS => {
                 p.note(now);
                 self.budget = self.polls;
diff --git a/src/pool.rs b/src/pool.rs
index 2d16c9e..275d5c2 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -33,15 +33,18 @@ const PIN_PARTICIPANTS_DEFAULT: bool = false;
 
 /// Default spin budget of a wait, in polls (one PAUSE, or YIELD on aarch64,
 /// per poll); see `docs/design/waiting.md`. On x86-64 a poll measured about
-/// 24 ns on Zen 3 (EPYC 7713P), so 12288 polls are about 300 µs, and longer on
-/// CPUs whose PAUSE is slower (Skylake and later Intel cores: about 2x). On
-/// aarch64 a YIELD is much cheaper than a PAUSE; the larger default aims at the
-/// same order of time and is not measured yet. libgomp's default is 300000
-/// polls ("about 3 ms").
+/// 24 ns on Zen 3 (EPYC 7713P), so 131072 polls are about 3 ms there, the order
+/// of libgomp's default (300000 polls, "about 3 ms"), and longer on CPUs whose
+/// PAUSE is slower (Skylake and later Intel cores: about 2x). A first default of
+/// 12288 polls (about 300 µs) made a team woken after a 1 ms or 10 ms gap 2.3x
+/// and 10.8x slower to start on a quiet host (evo), because its members had gone
+/// to sleep. On aarch64 a YIELD is much cheaper than a PAUSE; the larger default
+/// aims at the same order of time and is not measured yet. Under scheduling
+/// pressure the waits are throttled anyway (`crate::park::Pressure`).
 const SPIN_POLLS_DEFAULT: u32 = if cfg!(target_arch = "aarch64") {
-    1 << 17
+    1 << 21
 } else {
-    12_288
+    1 << 17
 };
 
 /// A fixed set of worker threads that [`Exec`](crate::Exec) tokens place work on.
@@ -191,6 +194,21 @@ impl Pool {
         self.awake.waits.spin_polls
     }
 
+    /// How often this pool's waits slept, and how often a waiter saw itself
+    /// descheduled, since the pool was built: diagnostics for the wait
+    /// benchmarks (`docs/design/waiting.md`).
+    #[doc(hidden)]
+    pub fn wait_counters(&self) -> WaitCounters {
+        use core::sync::atomic::Ordering::Relaxed;
+        let w = &self.awake.waits;
+        WaitCounters {
+            join_sleeps: w.join_sleeps.load(Relaxed),
+            barrier_sleeps: w.barrier_sleeps.load(Relaxed),
+            member_parks: w.member_parks.load(Relaxed),
+            pressure_events: w.pressure.events(),
+        }
+    }
+
     /// Number of workers currently kept awake as team members, reserved or
     /// idle. Zero once idle members returned to Rayon. A diagnostic: the value
     /// can change at any moment.
@@ -272,6 +290,9 @@ pub struct PoolBuilder {
     costs: DispatchCosts,
     pin_participants: bool,
     spin_polls: u32,
+    throttled_polls: u32,
+    pressure_hold: Duration,
+    pressure_events: u32,
 }
 
 impl PoolBuilder {
@@ -287,6 +308,9 @@ impl PoolBuilder {
             costs: DispatchCosts::host_default(),
             pin_participants: PIN_PARTICIPANTS_DEFAULT,
             spin_polls: SPIN_POLLS_DEFAULT,
+            throttled_polls: crate::park::THROTTLED_POLLS,
+            pressure_hold: Duration::from_nanos(crate::park::CONTENDED_HOLD_NS),
+            pressure_events: crate::park::CONTENDED_EVENTS,
         }
     }
 
@@ -578,6 +602,25 @@ impl PoolBuilder {
         self
     }
 
+    /// Tuning of the throttled waits, for the wait benchmarks only: the spin
+    /// budget of a throttled wait (default 100 polls), how long the pool's
+    /// waits stay throttled (default 100 ms; zero throttles only the waiter
+    /// that saw a preemption), and how many observed preemptions within that
+    /// time throttle the pool (default 4). See `docs/design/waiting.md`.
+    #[doc(hidden)]
+    #[must_use]
+    pub fn wait_tuning(
+        mut self,
+        throttled_polls: u32,
+        pressure_hold: Duration,
+        pressure_events: u32,
+    ) -> Self {
+        self.throttled_polls = throttled_polls;
+        self.pressure_hold = pressure_hold;
+        self.pressure_events = pressure_events;
+        self
+    }
+
     /// Starts the workers.
     ///
     /// Without the `parallel` feature no thread is started and the pool has
@@ -661,6 +704,11 @@ impl PoolBuilder {
                 self.costs,
                 self.pin_participants,
                 self.spin_polls,
+                crate::park::Pressure::tuned(
+                    self.throttled_polls,
+                    u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
+                    self.pressure_events,
+                ),
             )),
         })
     }
@@ -676,6 +724,11 @@ impl PoolBuilder {
                 self.costs,
                 self.pin_participants,
                 self.spin_polls,
+                crate::park::Pressure::tuned(
+                    self.throttled_polls,
+                    u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
+                    self.pressure_events,
+                ),
             )),
         })
     }
@@ -719,3 +772,17 @@ mod tests {
             .expect("drop on a worker hung");
     }
 }
+
+/// Counters of [`Pool::wait_counters`] (a diagnostic for the wait benchmarks).
+#[doc(hidden)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct WaitCounters {
+    /// Leaders that slept in a section's join.
+    pub join_sleeps: u64,
+    /// Participants that slept in a barrier.
+    pub barrier_sleeps: u64,
+    /// Reserved members that parked waiting for work.
+    pub member_parks: u64,
+    /// Waiters that saw a gap of more than 200 µs between their clock reads.
+    pub pressure_events: u64,
+}
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
index 61d68d0..4eb0798 100644
--- a/src/tests/waiting.rs
+++ b/src/tests/waiting.rs
@@ -4,7 +4,7 @@
 //! deadlines are set explicitly, and the only real delay (a sleep) can only make
 //! a measured gap longer.
 
-use crate::park::{Pressure, Step, Waiter, THROTTLED_POLLS};
+use crate::park::{Pressure, Step, Waiter, CONTENDED_HOLD_NS, THROTTLED_POLLS};
 use std::time::Duration;
 
 /// Steps until the waiter says sleep; the number of `Poll` steps before it.
@@ -29,9 +29,10 @@ fn a_wait_spins_its_budget_then_yields_sixteen_times_then_sleeps() {
 
 #[test]
 fn a_pool_under_pressure_starts_its_waits_throttled() {
-    let p = Pressure::new();
-    // A deadline that cannot pass during the test.
-    p.note(u64::MAX);
+    // Throttle on the first observation, with a deadline that cannot pass
+    // during the test.
+    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 1);
+    p.note(u64::MAX - CONTENDED_HOLD_NS);
     let mut throttled = Waiter::new(100_000, Some(&p));
     assert_eq!(polls_until_sleep(&mut throttled), THROTTLED_POLLS + 16);
     // A small budget is never raised to the throttled one.
@@ -42,7 +43,7 @@ fn a_pool_under_pressure_starts_its_waits_throttled() {
 #[test]
 fn a_descheduled_spinner_ends_its_spin_and_records_the_pressure() {
     let p = Pressure::new();
-    assert!(!p.recorded());
+    assert_eq!(p.events(), 0);
     let mut w = Waiter::new(1_000_000, Some(&p));
     // The first clock read is at poll 64; a gap longer than 200 µs before the
     // second one (poll 128) stands for a descheduled waiter.
@@ -55,5 +56,28 @@ fn a_descheduled_spinner_ends_its_spin_and_records_the_pressure() {
     }
     // The spin is over: what remains is the sixteen yields.
     assert_eq!(polls_until_sleep(&mut w), 16);
-    assert!(p.recorded(), "the pool records the pressure");
+    assert_eq!(p.events(), 1, "the pool records the observation");
+}
+
+#[test]
+fn one_preemption_throttles_only_its_waiter_and_a_burst_throttles_the_pool() {
+    let p = Pressure::new(); // four observations within 100 ms throttle the pool
+    let t = 1_000_000_000;
+    for k in 0..3 {
+        p.note(t + k * 1_000_000);
+        assert!(!p.active(t + k * 1_000_000), "observation {k} alone");
+    }
+    p.note(t + 3_000_000);
+    assert!(p.active(t + 3_000_000), "the fourth within the window");
+    assert!(
+        !p.active(t + 3_000_000 + CONTENDED_HOLD_NS),
+        "the hold ends"
+    );
+    // Observations spread wider than the window never add up.
+    let q = Pressure::new();
+    for k in 0..10 {
+        let at = t + k * (CONTENDED_HOLD_NS + 1);
+        q.note(at);
+        assert!(!q.active(at), "isolated observation {k}");
+    }
 }

From 2773c361db34ff48b12f7cafa9b174b84930cb43 Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 01:00:17 +0900
Subject: [PATCH 04/13] waits: a preemption throttles the thread that saw it,
 not the pool; fresh-pool phases in the bench

broccoli (15:51Z): under foreign load held_team / held_pool were 3.6-4.1x
slower than 0.1.3 with the pool-wide throttle (every section then woke ~63
sleeping members). A member that sees itself descheduled now moves its own
slot's deadline: its next waits start throttled for the hold, the others keep
spinning. The pool-wide throttle is a benchmark knob (--pressure-events N, off
by default). The fresh_pool rows of the bench now also time build, acquire,
release and drop separately, to locate the 60.7 ms of a one-off pool on a quiet
host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 benches/wait_scenarios.rs | 36 ++++++++++++++++++++++++++++-----
 docs/design/waiting.md    |  9 +++++----
 src/awake.rs              |  9 ++++++++-
 src/park.rs               | 42 +++++++++++++++++++++++++++++++--------
 src/tests/waiting.rs      | 36 ++++++++++++++++++++++++++++++---
 5 files changed, 111 insertions(+), 21 deletions(-)

diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
index 441655b..3ae51aa 100644
--- a/benches/wait_scenarios.rs
+++ b/benches/wait_scenarios.rs
@@ -14,7 +14,8 @@
 //! * `acquire`: a call is 50 sections of 20 µs, with the team held and a token minted per call
 //!   (`held_team`, as tenferro's `CpuEngine`), with the pool held and the members acquired per
 //!   call (`held_pool`, `Exec::new(..).team(..)`), and with a new pool per call (`fresh_pool`, as
-//!   faer's `with_team`; `total` times the build, the acquisition, the call and the drop);
+//!   faer's `with_team`; `total` times the build, the acquisition, the call and the drop, and
+//!   `build`, `acquire`, `release` and `drop` time those phases one by one);
 //! * `nested`: a call is 100 splits of the team into pairs, each pair running one 20 µs
 //!   section: many child leaders join at once (they share one sleeping place in the pool).
 //!
@@ -561,19 +562,44 @@ fn main() {
                 row("held_pool", "call", v);
                 waits_line(waits_between(c0, p.wait_counters()), calls / 2);
             }
-            let (mut call, mut total) = (Vec::new(), Vec::new());
+            // The phases of a pool built for one call: build, acquisition of its
+            // members, the call, the release of the team and the drop of the pool.
+            let (mut build, mut acquire, mut call, mut release, mut drop_pool, mut total) = (
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+            );
+            let us = |a: Instant, b: Instant| (b - a).as_secs_f64() * 1e6;
             let mut c = WaitCounters::default();
             for _ in 0..calls / 2 {
                 let t0 = Instant::now();
-                let t = team(w);
+                let p = pool(w);
+                let t1 = Instant::now();
+                let t = p.into_team(w).expect("an idle pool");
+                let t2 = Instant::now();
                 let c0 = t.pool().wait_counters();
                 call.push(call_team(&t, w, sections, work).1);
                 c = waits_sum(c, waits_between(c0, t.pool().wait_counters()));
-                drop(t);
-                total.push(t0.elapsed().as_secs_f64() * 1e6);
+                let t3 = Instant::now();
+                let p = t.into_pool();
+                let t4 = Instant::now();
+                drop(p);
+                let t5 = Instant::now();
+                build.push(us(t0, t1));
+                acquire.push(us(t1, t2));
+                release.push(us(t3, t4));
+                drop_pool.push(us(t4, t5));
+                total.push(us(t0, t5));
             }
             row("fresh_pool", "call", call);
             row("fresh_pool", "total", total);
+            row("fresh_pool", "build", build);
+            row("fresh_pool", "acquire", acquire);
+            row("fresh_pool", "release", release);
+            row("fresh_pool", "drop", drop_pool);
             waits_line(c, calls / 2);
         }
     }
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
index 66a5b13..4d64f07 100644
--- a/docs/design/waiting.md
+++ b/docs/design/waiting.md
@@ -96,10 +96,11 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
 
 - **Detection.** A spinning waiter reads the clock (`Instant::now`, vDSO) every 64 polls. If the gap since its previous read exceeds 200 µs, it was descheduled while it spun. Sixty-four polls take well under 10 µs, and a scheduler slice is 0.75 ms or more.
 - **What it means.** This is a pressure heuristic, not proof of foreign load. A foreign process, another thread of the team, interrupts, page faults or VM steal all look the same, and a short preemption can escape the threshold. It is acceptable because the response only shortens active waiting; it never changes affinity or correctness.
-- **Response.** The waiter ends its spin at once (yields, then sleeps). The pool counts the observations: once 4 of them come within 100 ms of each other, every wait of the pool adopts the throttled budget at its first clock read, for 100 ms (moved forward with a `fetch_max`, so an older observation never shortens a newer one).
-  - Why a count: throttling the whole pool on a single observation made every section of a width-64 team on a mildly shared host (broccoli, another user's job) sleep and pay futex wakes, 4x slower than 0.1.3 (`held_team` 1.48 → 6.12 ms). An isolated preemption now ends only its own waiter's spin; sustained load still throttles the pool.
-  - Why the pool-wide throttle at all: on a saturated host (primerose), throttling only the waiter that saw the preemption left the pool as slow as 0.1.3.
-  - The threshold, the hold and the throttled budget can be varied for the benchmarks (`PoolBuilder::wait_tuning`, hidden; `--pressure-events`, `--pressure-hold-ms`, `--throttled-polls`), and `Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
+- **Response.** The waiter ends its spin at once (yields, then sleeps). A member also moves its own slot's deadline to now + 100 ms (`fetch_max`), so its next waits start with the throttled budget while that runs: the thread that sees itself preempted gives its CPU back quickly, and the members that are not preempted keep spinning.
+  - Why per thread, not per pool: a pool-wide throttle made every wait of the pool sleep at every section once one waiter (or four, within 100 ms) saw a preemption. On broccoli under foreign load that cost held teams 3.6-4.1x against 0.1.3 (`held_team` 1.56 → 5.6 ms), because each 20 µs section then woke about 63 sleeping members.
+  - The pool-wide throttle remains a benchmark knob (`--pressure-events N`, off by default): on saturated primerose (load average above the CPU count) it was the faster setting, since there every waiter is preempted anyway.
+  - The leader's join and the barriers end their own spin on a preemption, but have no lasting per-thread deadline: the leader is not a slot.
+  - The hold, the throttled budget and the pool threshold can be varied for the benchmarks (`PoolBuilder::wait_tuning`, hidden; `--pressure-hold-ms`, `--throttled-polls`, `--pressure-events`), and `Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
 - **Cost.** A wait that ends within 64 polls never reads the clock; otherwise one clock read per 64 polls. There is no `getrusage` or other syscall in the poll loop.
 - **Limit.** A pool built for a single call (`with_team`) cannot carry the deadline to the next call. What helps it is the short budget and the sleeps in `join` and `barrier`, which give the scheduler idle CPUs within the call. With `pin_participants`, a sleeping waiter frees its CPU, but a pinned member that is descheduled behind a foreign process cannot move.
 
diff --git a/src/awake.rs b/src/awake.rs
index 0375b4e..a8da93e 100644
--- a/src/awake.rs
+++ b/src/awake.rs
@@ -84,6 +84,11 @@ struct Slot {
     /// Spin budget, in polls, of this reserved member's waits for work (see
     /// `docs/design/waiting.md`); written by the leader at root-scope entry.
     spin_budget: AtomicU32,
+    /// Until when this member's waits start throttled: it saw itself
+    /// descheduled while it spun (`crate::park::Pressure`); its own thread
+    /// writes and reads it.
+    #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
+    pressed_until: crate::sync::AtomicU64,
     /// Set by the leader while the member's thread is lent to Rayon
     /// (`Exec::external` on a team token).
     lent: AtomicBool,
@@ -106,6 +111,7 @@ impl Slot {
             idle_spin_ns: AtomicU64::new(0),
             idle_yield: AtomicBool::new(false),
             spin_budget: AtomicU32::new(crate::park::THROTTLED_POLLS),
+            pressed_until: crate::sync::AtomicU64::new(0),
             lent: AtomicBool::new(false),
             saved: crate::pin::SavedMask::new(),
             park: Parker::new(),
@@ -551,9 +557,10 @@ fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
                 let g = slot.gen.load(Ordering::Acquire);
                 if g == seen {
                     let w = waiter.get_or_insert_with(|| {
-                        Waiter::new(
+                        Waiter::of_thread(
                             slot.spin_budget.load(Ordering::Relaxed),
                             Some(&aw.waits.pressure),
+                            Some(&slot.pressed_until),
                         )
                     });
                     if w.step() == Step::Sleep {
diff --git a/src/park.rs b/src/park.rs
index 584d9e6..27e5824 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -170,12 +170,13 @@ const PREEMPT_GAP_NS: u64 = 200_000;
 pub(crate) const CONTENDED_HOLD_NS: u64 = 100_000_000;
 
 /// Default number of observed preemptions, within one hold window, that
-/// throttle the whole pool. A single preemption (another user's job taking a
-/// CPU for a slice) only ends the spin of the waiter that saw it: throttling
-/// the pool on it made every section of a width-64 team on a mildly shared
-/// host pay futex wakes (threadteam-rs#14, broccoli). Sustained load produces
-/// many preemptions per window and still throttles.
-pub(crate) const CONTENDED_EVENTS: u32 = 4;
+/// throttle the whole pool; zero never throttles the whole pool. A preemption
+/// throttles the thread that saw it (its member slot) for the hold. Throttling
+/// the whole pool, on one observation and then on four, made every section of
+/// a width-64 team under foreign load sleep and pay futex wakes, 3.6-4.1x
+/// slower than 0.1.3 (threadteam-rs#14, broccoli), so it is off by default and
+/// kept as a benchmark knob.
+pub(crate) const CONTENDED_EVENTS: u32 = 0;
 
 /// What a waiting thread does after one [`Waiter::step`].
 #[doc(hidden)]
@@ -261,9 +262,14 @@ impl Pressure {
 
     /// Records a descheduled waiter at `now`. A later deadline is never
     /// shortened by an older observation.
+    /// How long an observation throttles the thread that saw it.
+    pub(crate) fn hold_ns(&self) -> u64 {
+        self.hold_ns
+    }
+
     pub(crate) fn note(&self, now: u64) {
         self.events.fetch_add(1, Ordering::Relaxed);
-        if self.hold_ns == 0 {
+        if self.hold_ns == 0 || self.threshold == 0 {
             return;
         }
         let start = self.window.load(Ordering::Relaxed);
@@ -300,6 +306,8 @@ pub struct Waiter<'a> {
     polls: u32,
     yields: u32,
     pressure: Option<&'a Pressure>,
+    /// The waiting thread's own throttle deadline (a member's slot), if any.
+    own: Option<&'a AtomicU64>,
     last: Option<u64>,
     slept: bool,
 }
@@ -307,11 +315,23 @@ pub struct Waiter<'a> {
 impl<'a> Waiter<'a> {
     /// A wait episode with a spin of `budget` polls.
     pub fn new(budget: u32, pressure: Option<&'a Pressure>) -> Self {
+        Self::of_thread(budget, pressure, None)
+    }
+
+    /// A wait episode of a thread with its own throttle deadline `own`: a
+    /// preemption it observes throttles its later waits for the pool's hold,
+    /// and a deadline still running throttles this one.
+    pub(crate) fn of_thread(
+        budget: u32,
+        pressure: Option<&'a Pressure>,
+        own: Option<&'a AtomicU64>,
+    ) -> Self {
         Waiter {
             budget,
             polls: 0,
             yields: 0,
             pressure,
+            own,
             last: None,
             slept: false,
         }
@@ -347,10 +367,16 @@ impl<'a> Waiter<'a> {
     fn checkpoint(&mut self) {
         let Some(p) = self.pressure else { return };
         let now = p.now();
+        let own_active = || self.own.is_some_and(|o| o.load(Ordering::Relaxed) > now);
         match self.last {
-            None if p.active(now) => self.budget = self.budget.min(p.throttled().max(self.polls)),
+            None if p.active(now) || own_active() => {
+                self.budget = self.budget.min(p.throttled().max(self.polls))
+            }
             Some(last) if now.saturating_sub(last) > PREEMPT_GAP_NS => {
                 p.note(now);
+                if let Some(o) = self.own {
+                    o.fetch_max(now.saturating_add(p.hold_ns()), Ordering::Relaxed);
+                }
                 self.budget = self.polls;
             }
             _ => {}
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
index 4eb0798..f2d84ac 100644
--- a/src/tests/waiting.rs
+++ b/src/tests/waiting.rs
@@ -60,8 +60,10 @@ fn a_descheduled_spinner_ends_its_spin_and_records_the_pressure() {
 }
 
 #[test]
-fn one_preemption_throttles_only_its_waiter_and_a_burst_throttles_the_pool() {
-    let p = Pressure::new(); // four observations within 100 ms throttle the pool
+fn with_a_pool_threshold_a_burst_throttles_the_pool_and_isolated_ones_do_not() {
+    // The pool-wide throttle is off by default; four observations within the
+    // hold window throttle the pool when it is on (a benchmark knob).
+    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4);
     let t = 1_000_000_000;
     for k in 0..3 {
         p.note(t + k * 1_000_000);
@@ -74,10 +76,38 @@ fn one_preemption_throttles_only_its_waiter_and_a_burst_throttles_the_pool() {
         "the hold ends"
     );
     // Observations spread wider than the window never add up.
-    let q = Pressure::new();
+    let q = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4);
     for k in 0..10 {
         let at = t + k * (CONTENDED_HOLD_NS + 1);
         q.note(at);
         assert!(!q.active(at), "isolated observation {k}");
     }
 }
+
+#[test]
+fn by_default_a_preemption_throttles_only_the_thread_that_saw_it() {
+    use core::sync::atomic::AtomicU64;
+    let p = Pressure::new();
+    let own = AtomicU64::new(0);
+    // A member's wait sees itself descheduled (a gap before its second clock
+    // read): its spin ends, and its slot's deadline is set.
+    let mut w = Waiter::of_thread(1_000_000, Some(&p), Some(&own));
+    for _ in 0..64 {
+        assert_eq!(w.step(), Step::Poll);
+    }
+    std::thread::sleep(Duration::from_millis(2));
+    for _ in 64..128 {
+        assert_eq!(w.step(), Step::Poll);
+    }
+    assert_eq!(polls_until_sleep(&mut w), 16);
+    assert!(own.load(core::sync::atomic::Ordering::Relaxed) > 0);
+    // The pool is not throttled: another thread's wait spins its full budget.
+    let other_own = AtomicU64::new(0);
+    let mut other = Waiter::of_thread(100_000, Some(&p), Some(&other_own));
+    assert_eq!(polls_until_sleep(&mut other), 100_000 + 16);
+    // The same thread's next wait is throttled while its deadline runs (set
+    // here to one that cannot pass during the test).
+    own.store(u64::MAX, core::sync::atomic::Ordering::Relaxed);
+    let mut again = Waiter::of_thread(100_000, Some(&p), Some(&own));
+    assert_eq!(polls_until_sleep(&mut again), THROTTLED_POLLS + 16);
+}

From d4303477d76b36e388036ba3043b91a0a56727ce Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 01:19:09 +0900
Subject: [PATCH 05/13] waits: back to the pool threshold (c0c024b) as the
 default, per-thread hold as a knob; libgomp held team and load in the A/B
 runs

The monitor's criteria (quiet hosts within 10 % of the base; under load no
worse than libgomp) favour c0c024b: with a per-thread 100 ms hold (2773c36), a
member preempted once on a quiet broccoli slept at every section for the hold,
1.79x / 1.21x slower held teams. The pool throttle after 4 preemptions in
100 ms is the default again; --own-hold-ms N keeps the per-thread variant for
comparison. wait_omp.c gains libgomp's held team (acquire/held_team: calls of
50 x 20 us sections on the hot team), its own load generator (WAIT_OMP_LOAD)
and scenario selection; scripts/bench-ab.sh runs it every round with OMP=1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                 |  5 +--
 benches/omp/wait_omp.c    | 64 ++++++++++++++++++++++++++++++++++++---
 benches/wait_scenarios.rs | 15 +++++----
 docs/design/waiting.md    | 20 +++++++-----
 scripts/bench-ab.sh       | 22 +++++++++++++-
 src/park.rs               | 36 +++++++++++++---------
 src/pool.rs               | 12 ++++++--
 src/tests/waiting.rs      | 39 +++++++++++++++++++-----
 8 files changed, 168 insertions(+), 45 deletions(-)

diff --git a/README.md b/README.md
index d2d067b..ac2ba7f 100644
--- a/README.md
+++ b/README.md
@@ -143,8 +143,9 @@ cargo bench --bench wait_scenarios -- --scenario gaps --widths 8   # one scenari
 
 To compare two commits on a shared host, `scripts/bench-ab.sh <base-rev> <head-rev> <rounds>
 [bench args]` builds both and alternates them, so a drift of other users' load falls on both sides;
-`HEAD_VARIANTS='--spin-polls 12288;--pressure-events 1'` adds head runs with tuning flags (this
-version only). The base of the waits change is its bench commit `a3a9320` (the bench on the 0.1.3
+`HEAD_VARIANTS='--spin-polls 300000;--own-hold-ms 100'` adds head runs with tuning flags (this
+version only), and `OMP=1` runs the libgomp driver in every round with the same scenario, widths,
+calls and load (`acquire` is libgomp's held team). The base of the waits change is its bench commit `a3a9320` (the bench on the 0.1.3
 waits). Under every threadteam row, a `waits per call` line counts join and barrier sleeps, member
 parks and the preemptions waiters saw.
 
diff --git a/benches/omp/wait_omp.c b/benches/omp/wait_omp.c
index 5880039..f8db67c 100644
--- a/benches/omp/wait_omp.c
+++ b/benches/omp/wait_omp.c
@@ -4,11 +4,18 @@
  * busy-waits `work` microseconds on the clock; a call is a run of sections. Prints rows in the
  * Rust bench's format and appends them to a CSV file when one is given.
  *
- * Build and run with scripts/bench-omp.sh, or:
+ * Build and run with scripts/bench-waits.sh or scripts/bench-ab.sh (OMP=1), or:
  *   gcc -O2 -fopenmp benches/omp/wait_omp.c -o target/wait_omp
  *   target/wait_omp <width> <calls> [csv] [label]
  * The OpenMP runtime runs with its defaults (no OMP_WAIT_POLICY, no GOMP_SPINCOUNT, no binding)
  * unless the caller sets them.
+ *
+ * Environment:
+ *   WAIT_OMP_SCENARIO  all (default) | sections | gaps | acquire
+ *   WAIT_OMP_LOAD      K:P, foreign load: K child processes each busy P % of every 10 ms
+ *
+ * `acquire` / `held_team` is libgomp's counterpart of the Rust bench's held team: calls of 50
+ * sections of 20 us on the same (hot) team, back to back.
  */
 #define _GNU_SOURCE
 #include <omp.h>
@@ -17,6 +24,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
+#include <signal.h>
+#include <sys/wait.h>
 #include <unistd.h>
 
 static double now_us(void) {
@@ -68,6 +77,39 @@ static void call(int width, int sections, double work, double *first, double *wh
   *whole = now_us() - t0;
 }
 
+static pid_t load_children[256];
+static int load_n;
+
+/* Foreign load: K children each busy P % of every 10 ms, until killed. */
+static void load_start(const char *spec) {
+  int k = 0, p = 0;
+  if (!spec || sscanf(spec, "%d:%d", &k, &p) != 2) return;
+  for (int i = 0; i < k && i < 256; i++) {
+    pid_t c = fork();
+    if (c == 0) {
+      for (;;) {
+        double t = now_us();
+        while (now_us() - t < 100.0 * p) relax();
+        usleep((useconds_t)(10000 - 100 * p > 0 ? 10000 - 100 * p : 0));
+      }
+    }
+    if (c > 0) load_children[load_n++] = c;
+  }
+  usleep(200000);
+}
+
+static void load_stop(void) {
+  for (int i = 0; i < load_n; i++) {
+    kill(load_children[i], SIGKILL);
+    waitpid(load_children[i], NULL, 0);
+  }
+}
+
+static int want(const char *s) {
+  const char *w = getenv("WAIT_OMP_SCENARIO");
+  return !w || !strcmp(w, "all") || !strcmp(w, s);
+}
+
 int main(int argc, char **argv) {
   if (argc < 3) {
     fprintf(stderr, "usage: wait_omp <width> <calls> [csv] [label]\n");
@@ -79,7 +121,15 @@ int main(int argc, char **argv) {
   char host[256] = "";
   gethostname(host, sizeof host - 1);
   const char *label = argc > 4 ? argv[4] : "";
-  const char *load = getenv("WAIT_BENCH_LOAD") ? getenv("WAIT_BENCH_LOAD") : "none";
+  const char *load_spec = getenv("WAIT_OMP_LOAD");
+  char load_text[64];
+  int lk = 0, lp = 0;
+  if (load_spec && sscanf(load_spec, "%d:%d", &lk, &lp) == 2)
+    snprintf(load_text, sizeof load_text, "%dx%d%%", lk, lp);
+  else
+    snprintf(load_text, sizeof load_text, "%s",
+             getenv("WAIT_BENCH_LOAD") ? getenv("WAIT_BENCH_LOAD") : "none");
+  const char *load = load_text;
   snprintf(prefix, sizeof prefix, "%s,%s,%d,%s", host, label, cpus, load);
   if (argc > 3) {
     int fresh = access(argv[3], F_OK) != 0;
@@ -89,17 +139,18 @@ int main(int argc, char **argv) {
   }
   double *a = malloc(sizeof(double) * calls), *b = malloc(sizeof(double) * calls);
   char param[64];
+  load_start(load_spec);
   /* warm the hot team */
   for (int i = 0; i < 10; i++) call(width, 10, 5, a, b);
 
   int works[3] = {5, 20, 50};
-  for (int k = 0; k < 3; k++) {
+  for (int k = 0; k < 3 && want("sections"); k++) {
     for (int i = 0; i < calls; i++) call(width, 200, works[k], &a[i], &b[i]);
     snprintf(param, sizeof param, "work=%dus,sections=200", works[k]);
     row("sections", width, param, "call", b, calls, 200.0 * works[k]);
   }
   int gaps[4] = {0, 100, 1000, 10000};
-  for (int k = 0; k < 4; k++) {
+  for (int k = 0; k < 4 && want("gaps"); k++) {
     for (int i = 0; i < calls / 2; i++) {
       if (gaps[k]) usleep(gaps[k]);
       call(width, 10, 5, &a[i], &b[i]);
@@ -108,6 +159,11 @@ int main(int argc, char **argv) {
     row("gaps", width, param, "first", a, calls / 2, 5);
     row("gaps", width, param, "call", b, calls / 2, 50);
   }
+  if (want("acquire")) {
+    for (int i = 0; i < calls / 2; i++) call(width, 50, 20, &a[i], &b[i]);
+    row("acquire", width, "held_team", "call", b, calls / 2, 1000);
+  }
+  load_stop();
   if (csv) fclose(csv);
   return 0;
 }
diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
index 3ae51aa..07eacd1 100644
--- a/benches/wait_scenarios.rs
+++ b/benches/wait_scenarios.rs
@@ -32,7 +32,8 @@
 //! `--label <text>` (the version or commit, written to the CSV); tuning of the waits (this
 //! version only, `docs/design/waiting.md`): `--spin-polls N`, `--throttled-polls N`,
 //! `--pressure-hold-ms N` (0 throttles only the waiter that saw a preemption),
-//! `--pressure-events N` (preemptions within the hold that throttle the pool). Under each
+//! `--pressure-events N` (preemptions within the hold that throttle the pool; 0 never),
+//! `--own-hold-ms N` (how long a preemption throttles the member that saw it; default 0). Under each
 //! threadteam row a `waits per call` line counts join and barrier sleeps, member parks and the
 //! preemptions waiters saw.
 
@@ -136,7 +137,7 @@ fn stats(mut v: Vec<f64>) -> Stats {
 
 /// Pool settings from the command line (`--spin-polls`, `--throttled-polls`,
 /// `--pressure-hold-ms`); `None` keeps the library default.
-type Tuning = (Option<u32>, Option<(u32, Duration, u32)>);
+type Tuning = (Option<u32>, Option<(u32, Duration, u32, Duration)>);
 static TUNING: std::sync::OnceLock<Tuning> = std::sync::OnceLock::new();
 
 fn pool(width: usize) -> Pool {
@@ -147,8 +148,8 @@ fn pool(width: usize) -> Pool {
         if let Some(n) = spin {
             b = b.spin_polls(*n);
         }
-        if let Some((polls, hold, events)) = throttle {
-            b = b.wait_tuning(*polls, *hold, *events);
+        if let Some((polls, hold, events, own)) = throttle {
+            b = b.wait_tuning(*polls, *hold, *events, *own);
         }
     }
     b.build().expect("a pool")
@@ -348,12 +349,14 @@ fn main() {
         value("--throttled-polls"),
         value("--pressure-hold-ms"),
         value("--pressure-events"),
+        value("--own-hold-ms"),
     ) {
-        (None, None, None) => None,
-        (t, h, e) => Some((
+        (None, None, None, None) => None,
+        (t, h, e, o) => Some((
             t.map_or(100, |v| v.parse().expect("--throttled-polls")),
             Duration::from_millis(h.map_or(100, |v| v.parse().expect("--pressure-hold-ms"))),
             e.map_or(4, |v| v.parse().expect("--pressure-events")),
+            Duration::from_millis(o.map_or(0, |v| v.parse().expect("--own-hold-ms"))),
         )),
     };
     TUNING.get_or_init(|| (spin, throttle));
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
index 4d64f07..f5877e7 100644
--- a/docs/design/waiting.md
+++ b/docs/design/waiting.md
@@ -96,11 +96,11 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
 
 - **Detection.** A spinning waiter reads the clock (`Instant::now`, vDSO) every 64 polls. If the gap since its previous read exceeds 200 µs, it was descheduled while it spun. Sixty-four polls take well under 10 µs, and a scheduler slice is 0.75 ms or more.
 - **What it means.** This is a pressure heuristic, not proof of foreign load. A foreign process, another thread of the team, interrupts, page faults or VM steal all look the same, and a short preemption can escape the threshold. It is acceptable because the response only shortens active waiting; it never changes affinity or correctness.
-- **Response.** The waiter ends its spin at once (yields, then sleeps). A member also moves its own slot's deadline to now + 100 ms (`fetch_max`), so its next waits start with the throttled budget while that runs: the thread that sees itself preempted gives its CPU back quickly, and the members that are not preempted keep spinning.
-  - Why per thread, not per pool: a pool-wide throttle made every wait of the pool sleep at every section once one waiter (or four, within 100 ms) saw a preemption. On broccoli under foreign load that cost held teams 3.6-4.1x against 0.1.3 (`held_team` 1.56 → 5.6 ms), because each 20 µs section then woke about 63 sleeping members.
-  - The pool-wide throttle remains a benchmark knob (`--pressure-events N`, off by default): on saturated primerose (load average above the CPU count) it was the faster setting, since there every waiter is preempted anyway.
-  - The leader's join and the barriers end their own spin on a preemption, but have no lasting per-thread deadline: the leader is not a slot.
-  - The hold, the throttled budget and the pool threshold can be varied for the benchmarks (`PoolBuilder::wait_tuning`, hidden; `--pressure-hold-ms`, `--throttled-polls`, `--pressure-events`), and `Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
+- **Response.** The waiter ends its spin at once (yields, then sleeps). The pool counts the observations: once 4 come within 100 ms of each other, every wait of the pool adopts the throttled budget at its first clock read, for 100 ms (moved forward with a `fetch_max`, so an older observation never shortens a newer one).
+  - **Not on one observation.** Throttling the whole pool on a single preemption made every section of a width-64 team on a mildly shared host sleep and pay futex wakes (broccoli, `held_team` 1.48 → 6.12 ms, `c0c024b`'s predecessor). An isolated preemption now ends only its own waiter's spin.
+  - **Not per thread.** `2773c36` tried giving the thread that saw a preemption a 100 ms deadline of its own instead of throttling the pool. On a quiet broccoli that made held teams 1.79x / 1.21x slower than 0.1.3 (against 1.03 / 1.07 with the pool threshold): one member preempted once then slept at every section for the hold, and every join waited for its wake-up. The per-thread hold remains a benchmark knob (`--own-hold-ms`, off by default).
+  - **The pool-wide throttle at all:** on a saturated host (primerose), throttling only the waiter that saw the preemption left the pool as slow as 0.1.3.
+  - **Knobs and counters.** The threshold, the hold, the throttled budget and the per-thread hold can be varied for the benchmarks (`PoolBuilder::wait_tuning`, hidden; `--pressure-events`, `--pressure-hold-ms`, `--throttled-polls`, `--own-hold-ms`). `Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
 - **Cost.** A wait that ends within 64 polls never reads the clock; otherwise one clock read per 64 polls. There is no `getrusage` or other syscall in the poll loop.
 - **Limit.** A pool built for a single call (`with_team`) cannot carry the deadline to the next call. What helps it is the short budget and the sleeps in `join` and `barrier`, which give the scheduler idle CPUs within the call. With `pin_participants`, a sleeping waiter frees its CPU, but a pinned member that is descheduled behind a foreign process cannot move.
 
@@ -129,9 +129,13 @@ Removing the spare therefore needs a new contract for `external`'s width and len
 - with and without a foreign-load generator: child processes that each burn a few % of a CPU;
 - the same work under libgomp (`benches/omp/wait_omp.c`, when `gcc -fopenmp` is available) and under a Rayon `scope`.
 
-The change is accepted when:
-- on a quiet host (evo), `sections`, `gaps` and `nested` do not regress;
-- on broccoli (64 threads, foreign load), the faer#107 arms of `acquire_probe_107` (tensor4all/faer branch `probe/107-acquire-per-call`) are no longer slow.
+The change is accepted when (criteria set by the monitor, 2026-10-30):
+- **(a)** the faer#107 slow mode is zero in every arm of `acquire_probe_107` (tensor4all/faer branch `probe/107-acquire-per-call-wait`);
+- **(b)** on quiet hosts (evo, an unloaded broccoli), `held_team`, `held_pool` and `gaps` (0-1 ms) are within 10 % of the base;
+- **(c)** under foreign load (`--load 8:10`), the same scenarios are no worse than libgomp's. The base is not the reference there: it keeps its spinners on CPUs that other processes need;
+- **(d)** the 10 ms gap is tuned with the spin budget; if 300000 polls closes it, that is accepted as the OpenMP default.
+
+The comparison is `scripts/bench-ab.sh` with `OMP=1`, which runs libgomp's counterpart (`acquire`/`held_team`: calls of 50 sections of 20 µs on the same hot team) in every round, with and without load.
 
 **First reading, primerose (not an acceptance run).** EPYC 7713P, 64 CPUs, saturated by other users (load average 61-63). Width 6 on `taskset -c 0-5`, 40 calls, threadteam only. Base = the bench commit on 0.1.3; head = this change. Median µs per call:
 
diff --git a/scripts/bench-ab.sh b/scripts/bench-ab.sh
index 29be8a1..36b8da6 100755
--- a/scripts/bench-ab.sh
+++ b/scripts/bench-ab.sh
@@ -11,7 +11,9 @@
 #     --scenario acquire --widths 64 --calls 40 --impl threadteam
 #
 # HEAD_VARIANTS adds head runs with extra arguments in every round, `;`-separated, each named by
-# its arguments, e.g. HEAD_VARIANTS='--spin-polls 12288;--pressure-hold-ms 0;--throttled-polls 1024'.
+# its arguments, e.g. HEAD_VARIANTS='--spin-polls 300000;--own-hold-ms 100;--pressure-events 0'.
+# OMP=1 also runs the libgomp driver (benches/omp/wait_omp.c) in every round, with the same
+# --scenario (sections, gaps or acquire = libgomp's held team), --widths, --calls and --load.
 set -euo pipefail
 base=${1:?base rev}; head=${2:?head rev}; rounds=${3:?rounds}; shift 3
 host=$(hostname -s)
@@ -27,6 +29,18 @@ build() { # $1 = rev, $2 = dir name; prints the bench binary
 }
 bin_base=$(build "$base" base)
 bin_head=$(build "$head" head)
+omp=""
+if [[ ${OMP:-0} == 1 ]]; then
+  gcc -O2 -fopenmp "$work/head/benches/omp/wait_omp.c" -o "$work/wait_omp"
+  omp="$work/wait_omp"
+fi
+arg() { # value of bench option $1 in "$@" after it, or $2
+  local name=$1 def=$2; shift 2
+  while [[ $# -gt 0 ]]; do [[ $1 == "$name" ]] && { echo "$2"; return; }; shift; done
+  echo "$def"
+}
+omp_scenario=$(arg --scenario all "$@"); omp_widths=$(arg --widths "$(nproc)" "$@")
+omp_calls=$(arg --calls 200 "$@"); omp_load=$(arg --load "" "$@")
 IFS=';' read -r -a variants <<<"${HEAD_VARIANTS:-}"
 echo "base $(git rev-parse --short "$base")  head $(git rev-parse --short "$head")  rounds $rounds  args $*" | tee -a "$log"
 for r in $(seq 1 "$rounds"); do
@@ -36,6 +50,12 @@ for r in $(seq 1 "$rounds"); do
       "$bin_base" --label "base#$r" --csv "$csv" "$@" >>"$log"
     else
       "$bin_head" --label "head#$r" --csv "$csv" "$@" >>"$log"
+      if [[ -n $omp ]]; then
+        for w in ${omp_widths//,/ }; do
+          WAIT_OMP_SCENARIO=$omp_scenario WAIT_OMP_LOAD=$omp_load \
+            "$omp" "$w" "$omp_calls" "$csv" "libgomp#$r" >>"$log"
+        done
+      fi
       for v in "${variants[@]}"; do
         [[ -z $v ]] && continue
         # shellcheck disable=SC2086
diff --git a/src/park.rs b/src/park.rs
index 27e5824..ce979f7 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -170,13 +170,13 @@ const PREEMPT_GAP_NS: u64 = 200_000;
 pub(crate) const CONTENDED_HOLD_NS: u64 = 100_000_000;
 
 /// Default number of observed preemptions, within one hold window, that
-/// throttle the whole pool; zero never throttles the whole pool. A preemption
-/// throttles the thread that saw it (its member slot) for the hold. Throttling
-/// the whole pool, on one observation and then on four, made every section of
-/// a width-64 team under foreign load sleep and pay futex wakes, 3.6-4.1x
-/// slower than 0.1.3 (threadteam-rs#14, broccoli), so it is off by default and
-/// kept as a benchmark knob.
-pub(crate) const CONTENDED_EVENTS: u32 = 0;
+/// throttle the whole pool; zero never throttles the whole pool. A single
+/// preemption (another user's job taking a CPU for a slice) only ends the spin
+/// of the waiter that saw it: throttling the pool on it made every section of
+/// a width-64 team on a mildly shared host pay futex wakes (threadteam-rs#14,
+/// broccoli). Sustained load produces many preemptions per window and still
+/// throttles.
+pub(crate) const CONTENDED_EVENTS: u32 = 4;
 
 /// What a waiting thread does after one [`Waiter::step`].
 #[doc(hidden)]
@@ -207,6 +207,12 @@ pub struct Pressure {
     hold_ns: u64,
     /// Observations within one window that throttle the pool.
     threshold: u32,
+    /// How long an observation throttles the thread that saw it (a member's
+    /// slot); zero, the default, throttles no thread beyond its own wait. On a
+    /// quiet broccoli a per-thread hold of 100 ms made held teams 1.2-1.8x
+    /// slower than 0.1.3: one member preempted once then slept at every
+    /// section for the hold (threadteam-rs#14, 2773c36). A benchmark knob.
+    own_hold_ns: u64,
     /// The throttled budget, in polls.
     throttled: u32,
     /// Start of the current observation window, and observations in it. A
@@ -227,18 +233,20 @@ impl Default for Pressure {
 impl Pressure {
     /// No pressure recorded yet; the default hold and throttled budget.
     pub fn new() -> Self {
-        Self::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, CONTENDED_EVENTS)
+        Self::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, CONTENDED_EVENTS, 0)
     }
 
     /// No pressure recorded yet, with a throttled budget of `throttled` polls,
     /// held for `hold_ns` once `threshold` observations came within `hold_ns`
-    /// of each other (a threshold of 0 or 1 throttles on the first).
-    pub fn tuned(throttled: u32, hold_ns: u64, threshold: u32) -> Self {
+    /// of each other (0 never throttles the pool; 1 throttles on the first), and
+    /// a per-thread hold of `own_hold_ns` (0: none).
+    pub fn tuned(throttled: u32, hold_ns: u64, threshold: u32, own_hold_ns: u64) -> Self {
         Pressure {
             base: std::time::Instant::now(),
             until: AtomicU64::new(0),
             hold_ns,
             threshold,
+            own_hold_ns,
             throttled,
             window: AtomicU64::new(0),
             in_window: AtomicU64::new(0),
@@ -263,8 +271,8 @@ impl Pressure {
     /// Records a descheduled waiter at `now`. A later deadline is never
     /// shortened by an older observation.
     /// How long an observation throttles the thread that saw it.
-    pub(crate) fn hold_ns(&self) -> u64 {
-        self.hold_ns
+    pub(crate) fn own_hold_ns(&self) -> u64 {
+        self.own_hold_ns
     }
 
     pub(crate) fn note(&self, now: u64) {
@@ -374,8 +382,8 @@ impl<'a> Waiter<'a> {
             }
             Some(last) if now.saturating_sub(last) > PREEMPT_GAP_NS => {
                 p.note(now);
-                if let Some(o) = self.own {
-                    o.fetch_max(now.saturating_add(p.hold_ns()), Ordering::Relaxed);
+                if let (Some(o), hold @ 1..) = (self.own, p.own_hold_ns()) {
+                    o.fetch_max(now.saturating_add(hold), Ordering::Relaxed);
                 }
                 self.budget = self.polls;
             }
diff --git a/src/pool.rs b/src/pool.rs
index 275d5c2..63121c1 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -293,6 +293,7 @@ pub struct PoolBuilder {
     throttled_polls: u32,
     pressure_hold: Duration,
     pressure_events: u32,
+    own_hold: Duration,
 }
 
 impl PoolBuilder {
@@ -311,6 +312,7 @@ impl PoolBuilder {
             throttled_polls: crate::park::THROTTLED_POLLS,
             pressure_hold: Duration::from_nanos(crate::park::CONTENDED_HOLD_NS),
             pressure_events: crate::park::CONTENDED_EVENTS,
+            own_hold: Duration::ZERO,
         }
     }
 
@@ -605,8 +607,10 @@ impl PoolBuilder {
     /// Tuning of the throttled waits, for the wait benchmarks only: the spin
     /// budget of a throttled wait (default 100 polls), how long the pool's
     /// waits stay throttled (default 100 ms; zero throttles only the waiter
-    /// that saw a preemption), and how many observed preemptions within that
-    /// time throttle the pool (default 4). See `docs/design/waiting.md`.
+    /// that saw a preemption), how many observed preemptions within that time
+    /// throttle the pool (default 4; zero never), and how long a preemption
+    /// throttles the member that saw it (default zero: only its own wait). See
+    /// `docs/design/waiting.md`.
     #[doc(hidden)]
     #[must_use]
     pub fn wait_tuning(
@@ -614,10 +618,12 @@ impl PoolBuilder {
         throttled_polls: u32,
         pressure_hold: Duration,
         pressure_events: u32,
+        own_hold: Duration,
     ) -> Self {
         self.throttled_polls = throttled_polls;
         self.pressure_hold = pressure_hold;
         self.pressure_events = pressure_events;
+        self.own_hold = own_hold;
         self
     }
 
@@ -708,6 +714,7 @@ impl PoolBuilder {
                     self.throttled_polls,
                     u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
                     self.pressure_events,
+                    u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
                 ),
             )),
         })
@@ -728,6 +735,7 @@ impl PoolBuilder {
                     self.throttled_polls,
                     u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
                     self.pressure_events,
+                    u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
                 ),
             )),
         })
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
index f2d84ac..4eb30b4 100644
--- a/src/tests/waiting.rs
+++ b/src/tests/waiting.rs
@@ -31,7 +31,7 @@ fn a_wait_spins_its_budget_then_yields_sixteen_times_then_sleeps() {
 fn a_pool_under_pressure_starts_its_waits_throttled() {
     // Throttle on the first observation, with a deadline that cannot pass
     // during the test.
-    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 1);
+    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 1, 0);
     p.note(u64::MAX - CONTENDED_HOLD_NS);
     let mut throttled = Waiter::new(100_000, Some(&p));
     assert_eq!(polls_until_sleep(&mut throttled), THROTTLED_POLLS + 16);
@@ -60,10 +60,10 @@ fn a_descheduled_spinner_ends_its_spin_and_records_the_pressure() {
 }
 
 #[test]
-fn with_a_pool_threshold_a_burst_throttles_the_pool_and_isolated_ones_do_not() {
-    // The pool-wide throttle is off by default; four observations within the
-    // hold window throttle the pool when it is on (a benchmark knob).
-    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4);
+fn a_burst_throttles_the_pool_and_isolated_preemptions_do_not() {
+    // Four observations within the hold window throttle the pool (the
+    // default threshold).
+    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4, 0);
     let t = 1_000_000_000;
     for k in 0..3 {
         p.note(t + k * 1_000_000);
@@ -76,7 +76,7 @@ fn with_a_pool_threshold_a_burst_throttles_the_pool_and_isolated_ones_do_not() {
         "the hold ends"
     );
     // Observations spread wider than the window never add up.
-    let q = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4);
+    let q = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4, 0);
     for k in 0..10 {
         let at = t + k * (CONTENDED_HOLD_NS + 1);
         q.note(at);
@@ -85,9 +85,11 @@ fn with_a_pool_threshold_a_burst_throttles_the_pool_and_isolated_ones_do_not() {
 }
 
 #[test]
-fn by_default_a_preemption_throttles_only_the_thread_that_saw_it() {
+fn with_a_per_thread_hold_a_preemption_throttles_the_thread_that_saw_it() {
     use core::sync::atomic::AtomicU64;
-    let p = Pressure::new();
+    // The per-thread hold is a benchmark knob (off by default); the pool
+    // threshold is off here so that only the thread's own deadline acts.
+    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 0, CONTENDED_HOLD_NS);
     let own = AtomicU64::new(0);
     // A member's wait sees itself descheduled (a gap before its second clock
     // read): its spin ends, and its slot's deadline is set.
@@ -111,3 +113,24 @@ fn by_default_a_preemption_throttles_only_the_thread_that_saw_it() {
     let mut again = Waiter::of_thread(100_000, Some(&p), Some(&own));
     assert_eq!(polls_until_sleep(&mut again), THROTTLED_POLLS + 16);
 }
+
+#[test]
+fn by_default_a_preemption_sets_no_per_thread_deadline() {
+    use core::sync::atomic::{AtomicU64, Ordering};
+    let p = Pressure::new();
+    let own = AtomicU64::new(0);
+    let mut w = Waiter::of_thread(1_000_000, Some(&p), Some(&own));
+    for _ in 0..64 {
+        w.step();
+    }
+    std::thread::sleep(Duration::from_millis(2));
+    for _ in 64..128 {
+        w.step();
+    }
+    assert_eq!(polls_until_sleep(&mut w), 16, "its own spin ends");
+    assert_eq!(
+        own.load(Ordering::Relaxed),
+        0,
+        "no lasting per-thread deadline"
+    );
+}

From e76036c2023c21dbde6a1456b6a3993aaf31ecab Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 01:37:46 +0900
Subject: [PATCH 06/13] waits: spin 300000 polls (GOMP_SPINCOUNT) by default; a
 knob to turn preemption detection off for the libgomp-like comparison

evo (d430347): 300000 polls close the 10 ms gap; accepted as the OpenMP
default (criterion d). Under load the throttle made held teams 3.45x slower
than libgomp, which detects nothing. PoolBuilder::preempt_gap (hidden; bench
--preempt-gap-us) sets the gap that counts as a preemption; 0 turns detection
and every throttle off, so the next runs compare that against the current
default and against a long-preemption-only threshold.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 benches/wait_scenarios.rs | 19 +++++++++++++++----
 docs/design/waiting.md    |  5 +++--
 src/park.rs               | 24 +++++++++++++++++++-----
 src/pool.rs               | 37 +++++++++++++++++++++++++------------
 src/tests/waiting.rs      | 14 ++++++++++++++
 5 files changed, 76 insertions(+), 23 deletions(-)

diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
index 07eacd1..c8f22b6 100644
--- a/benches/wait_scenarios.rs
+++ b/benches/wait_scenarios.rs
@@ -33,7 +33,9 @@
 //! version only, `docs/design/waiting.md`): `--spin-polls N`, `--throttled-polls N`,
 //! `--pressure-hold-ms N` (0 throttles only the waiter that saw a preemption),
 //! `--pressure-events N` (preemptions within the hold that throttle the pool; 0 never),
-//! `--own-hold-ms N` (how long a preemption throttles the member that saw it; default 0). Under each
+//! `--own-hold-ms N` (how long a preemption throttles the member that saw it; default 0),
+//! `--preempt-gap-us N` (the gap that counts as a preemption; default 200; 0 turns detection
+//! and every throttle off, as libgomp). Under each
 //! threadteam row a `waits per call` line counts join and barrier sleeps, member parks and the
 //! preemptions waiters saw.
 
@@ -137,14 +139,21 @@ fn stats(mut v: Vec<f64>) -> Stats {
 
 /// Pool settings from the command line (`--spin-polls`, `--throttled-polls`,
 /// `--pressure-hold-ms`); `None` keeps the library default.
-type Tuning = (Option<u32>, Option<(u32, Duration, u32, Duration)>);
+type Tuning = (
+    Option<u32>,
+    Option<(u32, Duration, u32, Duration)>,
+    Option<Duration>,
+);
 static TUNING: std::sync::OnceLock<Tuning> = std::sync::OnceLock::new();
 
 fn pool(width: usize) -> Pool {
     let mut b = Pool::builder()
         .threads(width)
         .acquire_timeout(Duration::from_secs(30));
-    if let Some((spin, throttle)) = TUNING.get() {
+    if let Some((spin, throttle, gap)) = TUNING.get() {
+        if let Some(g) = gap {
+            b = b.preempt_gap(*g);
+        }
         if let Some(n) = spin {
             b = b.spin_polls(*n);
         }
@@ -359,7 +368,9 @@ fn main() {
             Duration::from_millis(o.map_or(0, |v| v.parse().expect("--own-hold-ms"))),
         )),
     };
-    TUNING.get_or_init(|| (spin, throttle));
+    let gap = value("--preempt-gap-us")
+        .map(|v| Duration::from_micros(v.parse().expect("--preempt-gap-us")));
+    TUNING.get_or_init(|| (spin, throttle, gap));
     let load_text = load_spec.map_or("none".into(), |(k, p)| format!("{k}x{p}%"));
 
     let csv = value("--csv").map(|path| {
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
index f5877e7..5badc87 100644
--- a/docs/design/waiting.md
+++ b/docs/design/waiting.md
@@ -86,8 +86,8 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
 ### Budget
 
 - **A count, as in libgomp.** The budget is `PoolBuilder::spin_polls`, a number of polls (one PAUSE, or YIELD on aarch64, per poll). A waiter that is descheduled does not spend it while it waits for its CPU.
-- **Default: 131072 polls on x86-64** (2^21 on aarch64, not measured yet). One poll measured about 24 ns on Zen 3 (EPYC 7713P), so this is about 3 ms there, the order of libgomp's default (300000 polls, "about 3 ms"); Intel cores with a slower PAUSE take about twice as long.
-  - The first default, 12288 polls (about 300 µs), made the first section after a 1 ms or 10 ms gap 2.3x and 10.8x slower than 0.1.3 on a quiet host (evo, 6 → 16 → 75 µs): the members had gone to sleep, and the next call paid futex wakes. With about 3 ms, a team called again within a few milliseconds is still spinning, as under libgomp; after a longer gap it sleeps, as under libgomp.
+- **Default: 300000 polls on x86-64**, libgomp's `GOMP_SPINCOUNT` ("about 3 ms"; about 7 ms at the 24 ns per poll measured on Zen 3). 2^21 on aarch64, not measured yet.
+  - 12288 polls (about 300 µs) made the first section after a 1 ms or 10 ms gap 2.3x and 10.8x slower than 0.1.3 on a quiet host (evo): the members had gone to sleep. 131072 closed the 1 ms gap; 300000 also closes the 10 ms gap (evo, `d430347` runs), and is accepted as the OpenMP default (criterion d).
   - libomp keeps 200 ms (`KMP_BLOCKTIME`); 0.1.3 kept 200 ms of wall time for members and never slept in joins.
 - **No calibration.** Converting a time to polls at pool build was considered and dropped (pre-review): a calibration taken while the CPU is contended yields too few polls, and a bare PAUSE loop is not the real poll anyway. The count is approximate in time, as libgomp's is.
 - **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed, or while the pool is under sustained pressure (below).
@@ -101,6 +101,7 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
   - **Not per thread.** `2773c36` tried giving the thread that saw a preemption a 100 ms deadline of its own instead of throttling the pool. On a quiet broccoli that made held teams 1.79x / 1.21x slower than 0.1.3 (against 1.03 / 1.07 with the pool threshold): one member preempted once then slept at every section for the hold, and every join waited for its wake-up. The per-thread hold remains a benchmark knob (`--own-hold-ms`, off by default).
   - **The pool-wide throttle at all:** on a saturated host (primerose), throttling only the waiter that saw the preemption left the pool as slow as 0.1.3.
   - **Knobs and counters.** The threshold, the hold, the throttled budget and the per-thread hold can be varied for the benchmarks (`PoolBuilder::wait_tuning`, hidden; `--pressure-events`, `--pressure-hold-ms`, `--throttled-polls`, `--own-hold-ms`). `Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
+- **Open comparison (after `d430347`).** Under load the throttle made held teams 3.45x slower than libgomp (5842 against 1693 µs) and the gaps 4-5x, while libgomp, which detects nothing, neither throttles nor collapses. The variant without any detection (`--preempt-gap-us 0`: spin 300000, yield, sleep, as libgomp) is measured against criteria (a)-(c); if it keeps (a), it becomes the default, otherwise the throttle is kept only for long preemptions (a larger `--preempt-gap-us`, for example 2000).
 - **Cost.** A wait that ends within 64 polls never reads the clock; otherwise one clock read per 64 polls. There is no `getrusage` or other syscall in the poll loop.
 - **Limit.** A pool built for a single call (`with_team`) cannot carry the deadline to the next call. What helps it is the short budget and the sleeps in `join` and `barrier`, which give the scheduler idle CPUs within the call. With `pin_participants`, a sleeping waiter frees its CPU, but a pinned member that is descheduled behind a foreign process cannot move.
 
diff --git a/src/park.rs b/src/park.rs
index ce979f7..951302f 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -160,10 +160,10 @@ const YIELD_POLLS: u32 = if cfg!(loom) { 0 } else { 16 };
 /// A spinning waiter reads the clock once per this many polls.
 const CHECK_EVERY: u32 = 64;
 
-/// A gap between two clock reads of a spinning waiter longer than this means the
-/// waiter was descheduled while it spun: 64 polls take well under 10 µs, and a
-/// scheduler slice is 0.75 ms or more.
-const PREEMPT_GAP_NS: u64 = 200_000;
+/// Default gap between two clock reads of a spinning waiter that counts as a
+/// preemption: 64 polls take well under 10 µs, and a scheduler slice is 0.75 ms
+/// or more. Zero turns the detection off (libgomp's behaviour).
+pub(crate) const PREEMPT_GAP_NS: u64 = 200_000;
 
 /// Default time a pool keeps starting its waits throttled once its waiters
 /// were descheduled often enough (see [`CONTENDED_EVENTS`]).
@@ -215,6 +215,9 @@ pub struct Pressure {
     own_hold_ns: u64,
     /// The throttled budget, in polls.
     throttled: u32,
+    /// A gap between two clock reads longer than this is a preemption; zero
+    /// turns the detection (and with it every throttle) off.
+    gap_ns: u64,
     /// Start of the current observation window, and observations in it. A
     /// heuristic: concurrent updates may lose a count, never an escalation by
     /// a later window.
@@ -236,6 +239,13 @@ impl Pressure {
         Self::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, CONTENDED_EVENTS, 0)
     }
 
+    /// This pressure with a preemption gap of `gap_ns` (0: no detection).
+    #[must_use]
+    pub fn with_gap(mut self, gap_ns: u64) -> Self {
+        self.gap_ns = gap_ns;
+        self
+    }
+
     /// No pressure recorded yet, with a throttled budget of `throttled` polls,
     /// held for `hold_ns` once `threshold` observations came within `hold_ns`
     /// of each other (0 never throttles the pool; 1 throttles on the first), and
@@ -248,6 +258,7 @@ impl Pressure {
             threshold,
             own_hold_ns,
             throttled,
+            gap_ns: PREEMPT_GAP_NS,
             window: AtomicU64::new(0),
             in_window: AtomicU64::new(0),
             events: AtomicU64::new(0),
@@ -374,13 +385,16 @@ impl<'a> Waiter<'a> {
     #[cold]
     fn checkpoint(&mut self) {
         let Some(p) = self.pressure else { return };
+        if p.gap_ns == 0 {
+            return;
+        }
         let now = p.now();
         let own_active = || self.own.is_some_and(|o| o.load(Ordering::Relaxed) > now);
         match self.last {
             None if p.active(now) || own_active() => {
                 self.budget = self.budget.min(p.throttled().max(self.polls))
             }
-            Some(last) if now.saturating_sub(last) > PREEMPT_GAP_NS => {
+            Some(last) if now.saturating_sub(last) > p.gap_ns => {
                 p.note(now);
                 if let (Some(o), hold @ 1..) = (self.own, p.own_hold_ns()) {
                     o.fetch_max(now.saturating_add(hold), Ordering::Relaxed);
diff --git a/src/pool.rs b/src/pool.rs
index 63121c1..0810ea6 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -32,19 +32,17 @@ const DEFAULT_ACQUIRE_TIMEOUT: Duration = Duration::from_millis(2);
 const PIN_PARTICIPANTS_DEFAULT: bool = false;
 
 /// Default spin budget of a wait, in polls (one PAUSE, or YIELD on aarch64,
-/// per poll); see `docs/design/waiting.md`. On x86-64 a poll measured about
-/// 24 ns on Zen 3 (EPYC 7713P), so 131072 polls are about 3 ms there, the order
-/// of libgomp's default (300000 polls, "about 3 ms"), and longer on CPUs whose
-/// PAUSE is slower (Skylake and later Intel cores: about 2x). A first default of
-/// 12288 polls (about 300 µs) made a team woken after a 1 ms or 10 ms gap 2.3x
-/// and 10.8x slower to start on a quiet host (evo), because its members had gone
-/// to sleep. On aarch64 a YIELD is much cheaper than a PAUSE; the larger default
-/// aims at the same order of time and is not measured yet. Under scheduling
-/// pressure the waits are throttled anyway (`crate::park::Pressure`).
+/// per poll); see `docs/design/waiting.md`. 300000 on x86-64, libgomp's default
+/// `GOMP_SPINCOUNT` ("about 3 ms"; about 7 ms at the 24 ns per poll measured on
+/// Zen 3, EPYC 7713P; longer on Intel cores whose PAUSE is slower). With it a
+/// team called again 10 ms later on a quiet host starts as fast as 0.1.3
+/// (evo); 12288 polls (about 300 µs) made that first section 10.8x slower,
+/// because the members had gone to sleep. On aarch64 a YIELD is much cheaper
+/// than a PAUSE; 2^21 aims at the same order of time and is not measured yet.
 const SPIN_POLLS_DEFAULT: u32 = if cfg!(target_arch = "aarch64") {
     1 << 21
 } else {
-    1 << 17
+    300_000
 };
 
 /// A fixed set of worker threads that [`Exec`](crate::Exec) tokens place work on.
@@ -294,6 +292,7 @@ pub struct PoolBuilder {
     pressure_hold: Duration,
     pressure_events: u32,
     own_hold: Duration,
+    preempt_gap: Duration,
 }
 
 impl PoolBuilder {
@@ -313,6 +312,7 @@ impl PoolBuilder {
             pressure_hold: Duration::from_nanos(crate::park::CONTENDED_HOLD_NS),
             pressure_events: crate::park::CONTENDED_EVENTS,
             own_hold: Duration::ZERO,
+            preempt_gap: Duration::from_nanos(crate::park::PREEMPT_GAP_NS),
         }
     }
 
@@ -627,6 +627,17 @@ impl PoolBuilder {
         self
     }
 
+    /// The gap between two clock reads of a spinning waiter that counts as a
+    /// preemption (default 200 µs), for the wait benchmarks only. Zero turns
+    /// the detection off: every wait then spins its full budget, yields and
+    /// sleeps, as libgomp's waits do. See `docs/design/waiting.md`.
+    #[doc(hidden)]
+    #[must_use]
+    pub fn preempt_gap(mut self, gap: Duration) -> Self {
+        self.preempt_gap = gap;
+        self
+    }
+
     /// Starts the workers.
     ///
     /// Without the `parallel` feature no thread is started and the pool has
@@ -715,7 +726,8 @@ impl PoolBuilder {
                     u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
                     self.pressure_events,
                     u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
-                ),
+                )
+                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX)),
             )),
         })
     }
@@ -736,7 +748,8 @@ impl PoolBuilder {
                     u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
                     self.pressure_events,
                     u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
-                ),
+                )
+                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX)),
             )),
         })
     }
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
index 4eb30b4..32b17dd 100644
--- a/src/tests/waiting.rs
+++ b/src/tests/waiting.rs
@@ -134,3 +134,17 @@ fn by_default_a_preemption_sets_no_per_thread_deadline() {
         "no lasting per-thread deadline"
     );
 }
+
+#[test]
+fn with_detection_off_a_descheduled_spinner_keeps_spinning() {
+    // A preemption gap of zero: no clock-based detection at all (libgomp's
+    // waits); the spin runs its whole budget whatever the scheduler did.
+    let p = Pressure::new().with_gap(0);
+    let mut w = Waiter::new(1_000, Some(&p));
+    for _ in 0..64 {
+        assert_eq!(w.step(), Step::Poll);
+    }
+    std::thread::sleep(Duration::from_millis(2));
+    assert_eq!(polls_until_sleep(&mut w), 1_000 - 64 + 16);
+    assert_eq!(p.events(), 0);
+}

From 1f2145bf90bc09e27ec06d9ca345a5dc78b335a1 Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 02:08:34 +0900
Subject: [PATCH 07/13] waits: libgomp's waits by default (no preemption
 detection, spin 300000); detection and the pool throttle only during a new
 pool's warm-up (200 ms)

broccoli (e76036c, 16:58Z): with detection off, held teams met (b) and (c)
(held_team 0.91x libgomp under load, quiet within 10 %), but a pool built per
call collapsed (87.6 ms): freshly spawned threads start stacked and spinners
never free a CPU. Detection with the pool throttle (c0c024b) kept the faer#107
arms at zero. So a pool detects for its first 200 ms (gap 200 us, pool throttle
after 4 preemptions in 100 ms) and not after: with_team pools live in that
window, held pools run as libgomp. Knobs: preempt_gap (after the warm-up,
default 0) and warm_up (hidden; --preempt-gap-us, --warm-ms).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 benches/wait_scenarios.rs | 14 +++++++---
 docs/design/waiting.md    | 45 +++++++++++++++++++++----------
 src/park.rs               | 57 ++++++++++++++++++++++++++++++++-------
 src/pool.rs               | 28 ++++++++++++++-----
 src/tests/waiting.rs      | 32 ++++++++++++++++++----
 5 files changed, 137 insertions(+), 39 deletions(-)

diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
index c8f22b6..ac04349 100644
--- a/benches/wait_scenarios.rs
+++ b/benches/wait_scenarios.rs
@@ -34,8 +34,9 @@
 //! `--pressure-hold-ms N` (0 throttles only the waiter that saw a preemption),
 //! `--pressure-events N` (preemptions within the hold that throttle the pool; 0 never),
 //! `--own-hold-ms N` (how long a preemption throttles the member that saw it; default 0),
-//! `--preempt-gap-us N` (the gap that counts as a preemption; default 200; 0 turns detection
-//! and every throttle off, as libgomp). Under each
+//! `--preempt-gap-us N` (the gap that counts as a preemption after the warm-up; default 0:
+//! no detection, as libgomp), `--warm-ms N` (how long after a pool is built preemptions are
+//! detected with a 200 µs gap; default 200; 0: none). Under each
 //! threadteam row a `waits per call` line counts join and barrier sleeps, member parks and the
 //! preemptions waiters saw.
 
@@ -143,6 +144,7 @@ type Tuning = (
     Option<u32>,
     Option<(u32, Duration, u32, Duration)>,
     Option<Duration>,
+    Option<Duration>,
 );
 static TUNING: std::sync::OnceLock<Tuning> = std::sync::OnceLock::new();
 
@@ -150,10 +152,13 @@ fn pool(width: usize) -> Pool {
     let mut b = Pool::builder()
         .threads(width)
         .acquire_timeout(Duration::from_secs(30));
-    if let Some((spin, throttle, gap)) = TUNING.get() {
+    if let Some((spin, throttle, gap, warm)) = TUNING.get() {
         if let Some(g) = gap {
             b = b.preempt_gap(*g);
         }
+        if let Some(w) = warm {
+            b = b.warm_up(*w);
+        }
         if let Some(n) = spin {
             b = b.spin_polls(*n);
         }
@@ -370,7 +375,8 @@ fn main() {
     };
     let gap = value("--preempt-gap-us")
         .map(|v| Duration::from_micros(v.parse().expect("--preempt-gap-us")));
-    TUNING.get_or_init(|| (spin, throttle, gap));
+    let warm = value("--warm-ms").map(|v| Duration::from_millis(v.parse().expect("--warm-ms")));
+    TUNING.get_or_init(|| (spin, throttle, gap, warm));
     let load_text = load_spec.map_or("none".into(), |(k, p)| format!("{k}x{p}%"));
 
     let csv = value("--csv").map(|path| {
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
index 5badc87..bf6de5b 100644
--- a/docs/design/waiting.md
+++ b/docs/design/waiting.md
@@ -90,20 +90,37 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
   - 12288 polls (about 300 µs) made the first section after a 1 ms or 10 ms gap 2.3x and 10.8x slower than 0.1.3 on a quiet host (evo): the members had gone to sleep. 131072 closed the 1 ms gap; 300000 also closes the 10 ms gap (evo, `d430347` runs), and is accepted as the OpenMP default (criterion d).
   - libomp keeps 200 ms (`KMP_BLOCKTIME`); 0.1.3 kept 200 ms of wall time for members and never slept in joins.
 - **No calibration.** Converting a time to polls at pool build was considered and dropped (pre-review): a calibration taken while the CPU is contended yields too few polls, and a bare PAUSE loop is not the real poll anyway. The count is approximate in time, as libgomp's is.
-- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed, or while the pool is under sustained pressure (below).
-
-### Scheduling pressure
-
-- **Detection.** A spinning waiter reads the clock (`Instant::now`, vDSO) every 64 polls. If the gap since its previous read exceeds 200 µs, it was descheduled while it spun. Sixty-four polls take well under 10 µs, and a scheduler slice is 0.75 ms or more.
-- **What it means.** This is a pressure heuristic, not proof of foreign load. A foreign process, another thread of the team, interrupts, page faults or VM steal all look the same, and a short preemption can escape the threshold. It is acceptable because the response only shortens active waiting; it never changes affinity or correctness.
-- **Response.** The waiter ends its spin at once (yields, then sleeps). The pool counts the observations: once 4 come within 100 ms of each other, every wait of the pool adopts the throttled budget at its first clock read, for 100 ms (moved forward with a `fetch_max`, so an older observation never shortens a newer one).
-  - **Not on one observation.** Throttling the whole pool on a single preemption made every section of a width-64 team on a mildly shared host sleep and pay futex wakes (broccoli, `held_team` 1.48 → 6.12 ms, `c0c024b`'s predecessor). An isolated preemption now ends only its own waiter's spin.
-  - **Not per thread.** `2773c36` tried giving the thread that saw a preemption a 100 ms deadline of its own instead of throttling the pool. On a quiet broccoli that made held teams 1.79x / 1.21x slower than 0.1.3 (against 1.03 / 1.07 with the pool threshold): one member preempted once then slept at every section for the hold, and every join waited for its wake-up. The per-thread hold remains a benchmark knob (`--own-hold-ms`, off by default).
-  - **The pool-wide throttle at all:** on a saturated host (primerose), throttling only the waiter that saw the preemption left the pool as slow as 0.1.3.
-  - **Knobs and counters.** The threshold, the hold, the throttled budget and the per-thread hold can be varied for the benchmarks (`PoolBuilder::wait_tuning`, hidden; `--pressure-events`, `--pressure-hold-ms`, `--throttled-polls`, `--own-hold-ms`). `Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
-- **Open comparison (after `d430347`).** Under load the throttle made held teams 3.45x slower than libgomp (5842 against 1693 µs) and the gaps 4-5x, while libgomp, which detects nothing, neither throttles nor collapses. The variant without any detection (`--preempt-gap-us 0`: spin 300000, yield, sleep, as libgomp) is measured against criteria (a)-(c); if it keeps (a), it becomes the default, otherwise the throttle is kept only for long preemptions (a larger `--preempt-gap-us`, for example 2000).
-- **Cost.** A wait that ends within 64 polls never reads the clock; otherwise one clock read per 64 polls. There is no `getrusage` or other syscall in the poll loop.
-- **Limit.** A pool built for a single call (`with_team`) cannot carry the deadline to the next call. What helps it is the short budget and the sleeps in `join` and `barrier`, which give the scheduler idle CPUs within the call. With `pin_participants`, a sleeping waiter frees its CPU, but a pinned member that is descheduled behind a foreign process cannot move.
+- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed, or while a new pool is under sustained pressure (below).
+
+### Scheduling pressure: only while a pool is new
+
+**Default: libgomp's waits.** Once a pool is past its warm-up, its waits detect nothing: every wait spins 300000 polls, yields 16 times and sleeps, as libgomp's do (`GOMP_SPINCOUNT`, futex).
+- On broccoli (`e76036c`, 16:58Z) this was the only configuration that met criteria (b) and (c) together: on quiet hosts held teams within 10 % of 0.1.3, and under load `held_team` at 0.91x libgomp, `held_pool` +7.8 %, gaps on par with libgomp.
+- Every detecting variant made held teams under load 3.5-4x slower than libgomp, because detection throttled waits that libgomp keeps spinning.
+- The main path of real use is a held pool: tenferro's `CpuEngine` holds its pool, and libomp and libgomp hold hot teams.
+
+**Warm-up: detection while a pool is new (default 200 ms after it is built).** Without any detection, a pool built for one call (`fresh_pool`, faer's `with_team`) collapsed (87.6 ms): its freshly spawned threads start stacked, because the scheduler places new threads before it knows their load, and spinning members never leave a CPU idle to pull one over. So during the warm-up a new pool's waiters detect preemptions and the pool can throttle, as in `c0c024b`, which kept the faer#107 arms at zero:
+- **Detection.** A spinning waiter reads the clock every 64 polls. A gap of more than 200 µs between two reads means it was descheduled while it spun: 64 polls take well under 10 µs, and a scheduler slice is 0.75 ms or more.
+- **Response.** That waiter ends its spin (yields, then sleeps). The pool counts the observations, and once 4 come within 100 ms of each other, every wait of the pool adopts the throttled budget (100 polls) at its first clock read, for 100 ms (`fetch_max`).
+- **Limits of the signal.** It is a pressure heuristic: foreign load, the team's own threads, interrupts and VM steal look alike, and it only shortens active waiting.
+- **Cost after the warm-up.** None in the poll loop: a wait's first clock read finds detection off, and that wait stops reading the clock.
+
+**What was tried and measured on the way** (broccoli and evo, threadteam-rs#14):
+
+| detection | quiet held teams | held teams under load | fresh pool |
+| --- | --- | --- | --- |
+| a pool-wide throttle on one preemption | 4x slower than 0.1.3 | — | fixed |
+| a pool-wide throttle on 4 preemptions within 100 ms (`c0c024b`) | within 10 % | 3.5-4x libgomp | fixed |
+| a per-thread 100 ms throttle (`2773c36`) | 1.2-1.8x slower | — | fixed |
+| none (`e76036c` variant) | within 10 % | about libgomp | collapsed (87.6 ms) |
+
+**Knobs and counters for the benchmarks** (`PoolBuilder::preempt_gap`, `warm_up`, `wait_tuning`, all hidden; bench flags `--preempt-gap-us`, `--warm-ms`, `--pressure-events`, `--pressure-hold-ms`, `--throttled-polls`, `--own-hold-ms`):
+- detection after the warm-up (a nonzero gap);
+- the warm-up length;
+- the pool threshold, the hold and the throttled budget;
+- a per-thread hold.
+
+`Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
 
 ### Start of a section: no arrival barrier
 
diff --git a/src/park.rs b/src/park.rs
index 951302f..a1d2227 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -160,11 +160,21 @@ const YIELD_POLLS: u32 = if cfg!(loom) { 0 } else { 16 };
 /// A spinning waiter reads the clock once per this many polls.
 const CHECK_EVERY: u32 = 64;
 
-/// Default gap between two clock reads of a spinning waiter that counts as a
-/// preemption: 64 polls take well under 10 µs, and a scheduler slice is 0.75 ms
-/// or more. Zero turns the detection off (libgomp's behaviour).
+/// The gap between two clock reads of a spinning waiter that counts as a
+/// preemption while detection is on: 64 polls take well under 10 µs, and a
+/// scheduler slice is 0.75 ms or more.
 pub(crate) const PREEMPT_GAP_NS: u64 = 200_000;
 
+/// How long after a pool is built its waiters detect preemptions (with
+/// [`PREEMPT_GAP_NS`]) and the pool can throttle; after that, by default,
+/// nothing is detected and every wait spins, yields and sleeps as libgomp's
+/// do. A pool's first calls are where freshly spawned threads sit stacked
+/// (the scheduler places new threads before it knows their load): a pool
+/// built for one call (`with_team`) collapsed without detection (broccoli,
+/// threadteam-rs#14 `e76036c`: 87.6 ms), while a held pool, past its first
+/// moments, ran as fast as libgomp only without it.
+pub(crate) const WARM_NS: u64 = 200_000_000;
+
 /// Default time a pool keeps starting its waits throttled once its waiters
 /// were descheduled often enough (see [`CONTENDED_EVENTS`]).
 pub(crate) const CONTENDED_HOLD_NS: u64 = 100_000_000;
@@ -215,9 +225,13 @@ pub struct Pressure {
     own_hold_ns: u64,
     /// The throttled budget, in polls.
     throttled: u32,
-    /// A gap between two clock reads longer than this is a preemption; zero
-    /// turns the detection (and with it every throttle) off.
+    /// After the warm-up: a gap between two clock reads longer than this is a
+    /// preemption; zero (the default) turns the detection, and with it every
+    /// throttle, off.
     gap_ns: u64,
+    /// Nanoseconds since `base` until which waiters detect preemptions with
+    /// [`PREEMPT_GAP_NS`] whatever `gap_ns` says (the warm-up of a new pool).
+    warm_until: u64,
     /// Start of the current observation window, and observations in it. A
     /// heuristic: concurrent updates may lose a count, never an escalation by
     /// a later window.
@@ -239,13 +253,31 @@ impl Pressure {
         Self::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, CONTENDED_EVENTS, 0)
     }
 
-    /// This pressure with a preemption gap of `gap_ns` (0: no detection).
+    /// This pressure with a preemption gap of `gap_ns` after the warm-up (0: no
+    /// detection).
     #[must_use]
     pub fn with_gap(mut self, gap_ns: u64) -> Self {
         self.gap_ns = gap_ns;
         self
     }
 
+    /// This pressure with a warm-up of `warm_ns` after its creation, during
+    /// which waiters detect preemptions whatever the gap after it (0: none).
+    #[must_use]
+    pub fn with_warm_up(mut self, warm_ns: u64) -> Self {
+        self.warm_until = warm_ns;
+        self
+    }
+
+    /// The preemption gap that applies at `now` (0: no detection).
+    fn gap_at(&self, now: u64) -> u64 {
+        if now < self.warm_until {
+            PREEMPT_GAP_NS
+        } else {
+            self.gap_ns
+        }
+    }
+
     /// No pressure recorded yet, with a throttled budget of `throttled` polls,
     /// held for `hold_ns` once `threshold` observations came within `hold_ns`
     /// of each other (0 never throttles the pool; 1 throttles on the first), and
@@ -258,7 +290,8 @@ impl Pressure {
             threshold,
             own_hold_ns,
             throttled,
-            gap_ns: PREEMPT_GAP_NS,
+            gap_ns: 0,
+            warm_until: WARM_NS,
             window: AtomicU64::new(0),
             in_window: AtomicU64::new(0),
             events: AtomicU64::new(0),
@@ -385,16 +418,20 @@ impl<'a> Waiter<'a> {
     #[cold]
     fn checkpoint(&mut self) {
         let Some(p) = self.pressure else { return };
-        if p.gap_ns == 0 {
+        let now = p.now();
+        let gap = p.gap_at(now);
+        if gap == 0 {
+            // No detection now, and none later in this episode: stop reading
+            // the clock.
+            self.pressure = None;
             return;
         }
-        let now = p.now();
         let own_active = || self.own.is_some_and(|o| o.load(Ordering::Relaxed) > now);
         match self.last {
             None if p.active(now) || own_active() => {
                 self.budget = self.budget.min(p.throttled().max(self.polls))
             }
-            Some(last) if now.saturating_sub(last) > p.gap_ns => {
+            Some(last) if now.saturating_sub(last) > gap => {
                 p.note(now);
                 if let (Some(o), hold @ 1..) = (self.own, p.own_hold_ns()) {
                     o.fetch_max(now.saturating_add(hold), Ordering::Relaxed);
diff --git a/src/pool.rs b/src/pool.rs
index 0810ea6..4a6aa4d 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -293,6 +293,7 @@ pub struct PoolBuilder {
     pressure_events: u32,
     own_hold: Duration,
     preempt_gap: Duration,
+    warm_up: Duration,
 }
 
 impl PoolBuilder {
@@ -312,7 +313,8 @@ impl PoolBuilder {
             pressure_hold: Duration::from_nanos(crate::park::CONTENDED_HOLD_NS),
             pressure_events: crate::park::CONTENDED_EVENTS,
             own_hold: Duration::ZERO,
-            preempt_gap: Duration::from_nanos(crate::park::PREEMPT_GAP_NS),
+            preempt_gap: Duration::ZERO,
+            warm_up: Duration::from_nanos(crate::park::WARM_NS),
         }
     }
 
@@ -628,9 +630,10 @@ impl PoolBuilder {
     }
 
     /// The gap between two clock reads of a spinning waiter that counts as a
-    /// preemption (default 200 µs), for the wait benchmarks only. Zero turns
-    /// the detection off: every wait then spins its full budget, yields and
-    /// sleeps, as libgomp's waits do. See `docs/design/waiting.md`.
+    /// preemption after the pool's warm-up, for the wait benchmarks only.
+    /// Zero (the default) turns the detection off: every wait then spins its
+    /// full budget, yields and sleeps, as libgomp's waits do. See
+    /// `docs/design/waiting.md`.
     #[doc(hidden)]
     #[must_use]
     pub fn preempt_gap(mut self, gap: Duration) -> Self {
@@ -638,6 +641,17 @@ impl PoolBuilder {
         self
     }
 
+    /// How long after the pool is built its waiters detect preemptions (gap
+    /// 200 µs) and the pool can throttle, whatever [`preempt_gap`](Self::preempt_gap)
+    /// says (default 200 ms; zero: no warm-up), for the wait benchmarks only.
+    /// See `docs/design/waiting.md`.
+    #[doc(hidden)]
+    #[must_use]
+    pub fn warm_up(mut self, warm: Duration) -> Self {
+        self.warm_up = warm;
+        self
+    }
+
     /// Starts the workers.
     ///
     /// Without the `parallel` feature no thread is started and the pool has
@@ -727,7 +741,8 @@ impl PoolBuilder {
                     self.pressure_events,
                     u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
                 )
-                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX)),
+                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX))
+                .with_warm_up(u64::try_from(self.warm_up.as_nanos()).unwrap_or(u64::MAX)),
             )),
         })
     }
@@ -749,7 +764,8 @@ impl PoolBuilder {
                     self.pressure_events,
                     u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
                 )
-                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX)),
+                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX))
+                .with_warm_up(u64::try_from(self.warm_up.as_nanos()).unwrap_or(u64::MAX)),
             )),
         })
     }
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
index 32b17dd..5b01fdd 100644
--- a/src/tests/waiting.rs
+++ b/src/tests/waiting.rs
@@ -4,7 +4,7 @@
 //! deadlines are set explicitly, and the only real delay (a sleep) can only make
 //! a measured gap longer.
 
-use crate::park::{Pressure, Step, Waiter, CONTENDED_HOLD_NS, THROTTLED_POLLS};
+use crate::park::{Pressure, Step, Waiter, CONTENDED_HOLD_NS, PREEMPT_GAP_NS, THROTTLED_POLLS};
 use std::time::Duration;
 
 /// Steps until the waiter says sleep; the number of `Poll` steps before it.
@@ -42,7 +42,8 @@ fn a_pool_under_pressure_starts_its_waits_throttled() {
 
 #[test]
 fn a_descheduled_spinner_ends_its_spin_and_records_the_pressure() {
-    let p = Pressure::new();
+    // Detection on (as during a new pool's warm-up, or with a nonzero gap).
+    let p = Pressure::new().with_gap(PREEMPT_GAP_NS);
     assert_eq!(p.events(), 0);
     let mut w = Waiter::new(1_000_000, Some(&p));
     // The first clock read is at poll 64; a gap longer than 200 µs before the
@@ -89,7 +90,8 @@ fn with_a_per_thread_hold_a_preemption_throttles_the_thread_that_saw_it() {
     use core::sync::atomic::AtomicU64;
     // The per-thread hold is a benchmark knob (off by default); the pool
     // threshold is off here so that only the thread's own deadline acts.
-    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 0, CONTENDED_HOLD_NS);
+    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 0, CONTENDED_HOLD_NS)
+        .with_gap(PREEMPT_GAP_NS);
     let own = AtomicU64::new(0);
     // A member's wait sees itself descheduled (a gap before its second clock
     // read): its spin ends, and its slot's deadline is set.
@@ -117,7 +119,7 @@ fn with_a_per_thread_hold_a_preemption_throttles_the_thread_that_saw_it() {
 #[test]
 fn by_default_a_preemption_sets_no_per_thread_deadline() {
     use core::sync::atomic::{AtomicU64, Ordering};
-    let p = Pressure::new();
+    let p = Pressure::new().with_gap(PREEMPT_GAP_NS);
     let own = AtomicU64::new(0);
     let mut w = Waiter::of_thread(1_000_000, Some(&p), Some(&own));
     for _ in 0..64 {
@@ -139,7 +141,7 @@ fn by_default_a_preemption_sets_no_per_thread_deadline() {
 fn with_detection_off_a_descheduled_spinner_keeps_spinning() {
     // A preemption gap of zero: no clock-based detection at all (libgomp's
     // waits); the spin runs its whole budget whatever the scheduler did.
-    let p = Pressure::new().with_gap(0);
+    let p = Pressure::new().with_gap(0).with_warm_up(0);
     let mut w = Waiter::new(1_000, Some(&p));
     for _ in 0..64 {
         assert_eq!(w.step(), Step::Poll);
@@ -148,3 +150,23 @@ fn with_detection_off_a_descheduled_spinner_keeps_spinning() {
     assert_eq!(polls_until_sleep(&mut w), 1_000 - 64 + 16);
     assert_eq!(p.events(), 0);
 }
+
+#[test]
+fn by_default_a_new_pool_detects_preemptions_only_during_its_warm_up() {
+    let spin_through_a_gap = |p: &Pressure| {
+        let mut w = Waiter::new(1_000, Some(p));
+        for _ in 0..64 {
+            w.step();
+        }
+        std::thread::sleep(Duration::from_millis(2));
+        polls_until_sleep(&mut w)
+    };
+    // During the warm-up (a fresh pressure): the gap ends the spin.
+    let warm = Pressure::new();
+    assert_eq!(spin_through_a_gap(&warm), 64 + 16);
+    assert_eq!(warm.events(), 1);
+    // After it (here: no warm-up), the default detects nothing.
+    let steady = Pressure::new().with_warm_up(0);
+    assert_eq!(spin_through_a_gap(&steady), 1_000 - 64 + 16);
+    assert_eq!(steady.events(), 0);
+}

From 625a593d8e876a0ec70ae446691dc0d0fde31000 Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 02:49:34 +0900
Subject: [PATCH 08/13] waits: libgomp's waits only (no preemption detection,
 no warm-up, no pressure knobs)

The own-threads design (#15) keeps #14's staged waits with its libgomp-type
default (spin 300000 polls, 16 yields, futex) and removes the preemption
detection, the pool throttle on preemptions, the warm-up window and their
hidden knobs: worker reuse, not a waiting heuristic, addresses the one-call
pool. Static oversubscription still throttles to 100 polls.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 benches/wait_scenarios.rs |  65 ++--------
 src/awake.rs              |  46 ++-----
 src/park.rs               | 261 +++-----------------------------------
 src/pool.rs               |  82 +-----------
 src/sync.rs               |   4 +-
 src/tests/waiting.rs      | 154 ++--------------------
 tests/loom_park.rs        |  10 +-
 7 files changed, 58 insertions(+), 564 deletions(-)

diff --git a/benches/wait_scenarios.rs b/benches/wait_scenarios.rs
index ac04349..c9be341 100644
--- a/benches/wait_scenarios.rs
+++ b/benches/wait_scenarios.rs
@@ -29,16 +29,9 @@
 //!
 //! Options: `--scenario sections|gaps|acquire|nested|all`, `--widths 64,48`, `--impl threadteam,rayon`,
 //! `--load K:P`, `--calls N` (default 200; `gaps` and `acquire` use N/2), `--csv <file>`,
-//! `--label <text>` (the version or commit, written to the CSV); tuning of the waits (this
-//! version only, `docs/design/waiting.md`): `--spin-polls N`, `--throttled-polls N`,
-//! `--pressure-hold-ms N` (0 throttles only the waiter that saw a preemption),
-//! `--pressure-events N` (preemptions within the hold that throttle the pool; 0 never),
-//! `--own-hold-ms N` (how long a preemption throttles the member that saw it; default 0),
-//! `--preempt-gap-us N` (the gap that counts as a preemption after the warm-up; default 0:
-//! no detection, as libgomp), `--warm-ms N` (how long after a pool is built preemptions are
-//! detected with a 200 µs gap; default 200; 0: none). Under each
-//! threadteam row a `waits per call` line counts join and barrier sleeps, member parks and the
-//! preemptions waiters saw.
+//! `--label <text>` (the version or commit, written to the CSV), `--spin-polls N` (the pool's
+//! spin budget, this version only). Under each threadteam row a `waits per call` line counts join
+//! and barrier sleeps and member parks.
 
 use std::io::Write;
 use std::time::{Duration, Instant};
@@ -138,33 +131,15 @@ fn stats(mut v: Vec<f64>) -> Stats {
     }
 }
 
-/// Pool settings from the command line (`--spin-polls`, `--throttled-polls`,
-/// `--pressure-hold-ms`); `None` keeps the library default.
-type Tuning = (
-    Option<u32>,
-    Option<(u32, Duration, u32, Duration)>,
-    Option<Duration>,
-    Option<Duration>,
-);
-static TUNING: std::sync::OnceLock<Tuning> = std::sync::OnceLock::new();
+/// The pool's spin budget from the command line (`--spin-polls`); `None` keeps the default.
+static SPIN_POLLS: std::sync::OnceLock<Option<u32>> = std::sync::OnceLock::new();
 
 fn pool(width: usize) -> Pool {
     let mut b = Pool::builder()
         .threads(width)
         .acquire_timeout(Duration::from_secs(30));
-    if let Some((spin, throttle, gap, warm)) = TUNING.get() {
-        if let Some(g) = gap {
-            b = b.preempt_gap(*g);
-        }
-        if let Some(w) = warm {
-            b = b.warm_up(*w);
-        }
-        if let Some(n) = spin {
-            b = b.spin_polls(*n);
-        }
-        if let Some((polls, hold, events, own)) = throttle {
-            b = b.wait_tuning(*polls, *hold, *events, *own);
-        }
+    if let Some(Some(n)) = SPIN_POLLS.get() {
+        b = b.spin_polls(*n);
     }
     b.build().expect("a pool")
 }
@@ -175,7 +150,6 @@ fn waits_between(a: WaitCounters, b: WaitCounters) -> WaitCounters {
         join_sleeps: b.join_sleeps - a.join_sleeps,
         barrier_sleeps: b.barrier_sleeps - a.barrier_sleeps,
         member_parks: b.member_parks - a.member_parks,
-        pressure_events: b.pressure_events - a.pressure_events,
     }
 }
 
@@ -184,7 +158,6 @@ fn waits_sum(a: WaitCounters, b: WaitCounters) -> WaitCounters {
         join_sleeps: a.join_sleeps + b.join_sleeps,
         barrier_sleeps: a.barrier_sleeps + b.barrier_sleeps,
         member_parks: a.member_parks + b.member_parks,
-        pressure_events: a.pressure_events + b.pressure_events,
     }
 }
 
@@ -198,11 +171,10 @@ fn snap(t: &Option<Team>) -> WaitCounters {
 fn waits_line(c: WaitCounters, calls: usize) {
     let per = |n: u64| n as f64 / calls.max(1) as f64;
     println!(
-        "          waits per call: join sleeps {:.1}, barrier sleeps {:.1}, member parks {:.1}, preemptions seen {:.2}",
+        "          waits per call: join sleeps {:.1}, barrier sleeps {:.1}, member parks {:.1}",
         per(c.join_sleeps),
         per(c.barrier_sleeps),
-        per(c.member_parks),
-        per(c.pressure_events)
+        per(c.member_parks)
     );
 }
 
@@ -359,24 +331,7 @@ fn main() {
     let calls: usize = value("--calls").map_or(200, |v| v.parse().expect("--calls"));
     let label = value("--label").unwrap_or_default();
     let spin = value("--spin-polls").map(|v| v.parse().expect("--spin-polls"));
-    let throttle = match (
-        value("--throttled-polls"),
-        value("--pressure-hold-ms"),
-        value("--pressure-events"),
-        value("--own-hold-ms"),
-    ) {
-        (None, None, None, None) => None,
-        (t, h, e, o) => Some((
-            t.map_or(100, |v| v.parse().expect("--throttled-polls")),
-            Duration::from_millis(h.map_or(100, |v| v.parse().expect("--pressure-hold-ms"))),
-            e.map_or(4, |v| v.parse().expect("--pressure-events")),
-            Duration::from_millis(o.map_or(0, |v| v.parse().expect("--own-hold-ms"))),
-        )),
-    };
-    let gap = value("--preempt-gap-us")
-        .map(|v| Duration::from_micros(v.parse().expect("--preempt-gap-us")));
-    let warm = value("--warm-ms").map(|v| Duration::from_millis(v.parse().expect("--warm-ms")));
-    TUNING.get_or_init(|| (spin, throttle, gap, warm));
+    SPIN_POLLS.get_or_init(|| spin);
     let load_text = load_spec.map_or("none".into(), |(k, p)| format!("{k}x{p}%"));
 
     let csv = value("--csv").map(|path| {
diff --git a/src/awake.rs b/src/awake.rs
index a8da93e..0e6aa40 100644
--- a/src/awake.rs
+++ b/src/awake.rs
@@ -84,11 +84,6 @@ struct Slot {
     /// Spin budget, in polls, of this reserved member's waits for work (see
     /// `docs/design/waiting.md`); written by the leader at root-scope entry.
     spin_budget: AtomicU32,
-    /// Until when this member's waits start throttled: it saw itself
-    /// descheduled while it spun (`crate::park::Pressure`); its own thread
-    /// writes and reads it.
-    #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
-    pressed_until: crate::sync::AtomicU64,
     /// Set by the leader while the member's thread is lent to Rayon
     /// (`Exec::external` on a team token).
     lent: AtomicBool,
@@ -111,7 +106,6 @@ impl Slot {
             idle_spin_ns: AtomicU64::new(0),
             idle_yield: AtomicBool::new(false),
             spin_budget: AtomicU32::new(crate::park::THROTTLED_POLLS),
-            pressed_until: crate::sync::AtomicU64::new(0),
             lent: AtomicBool::new(false),
             saved: crate::pin::SavedMask::new(),
             park: Parker::new(),
@@ -125,8 +119,6 @@ pub(crate) struct Waits {
     /// pool: a member may wake it after its last decrement, when the section
     /// may already be gone, and the pool outlives every member loop.
     pub(crate) sync: Parker,
-    /// Recent scheduling pressure seen by this pool's waiters.
-    pub(crate) pressure: crate::park::Pressure,
     /// Spin budget of a wait, in polls (`PoolBuilder::spin_polls`).
     pub(crate) spin_polls: u32,
     /// Diagnostics (`Pool::wait_counters`): sleeps of leaders in joins, of
@@ -140,7 +132,7 @@ pub(crate) struct Waits {
 pub(crate) struct Awake {
     slots: Box<[Slot]>,
     /// What the joins and barriers of this pool's sections sleep on, and the
-    /// pool's spin budget and scheduling pressure (`docs/design/waiting.md`).
+    /// pool's spin budget (`docs/design/waiting.md`).
     pub(crate) waits: Waits,
     pub(crate) shutdown: AtomicBool,
     /// Bumped by `Pool::release_idle`; members that started earlier leave when idle.
@@ -163,13 +155,11 @@ impl Awake {
         costs: crate::cost::DispatchCosts,
         pin: bool,
         spin_polls: u32,
-        pressure: crate::park::Pressure,
     ) -> Self {
         Awake {
             slots: (0..width).map(|_| Slot::new()).collect(),
             waits: Waits {
                 sync: Parker::new(),
-                pressure,
                 spin_polls,
                 join_sleeps: AtomicU64::new(0),
                 barrier_sleeps: AtomicU64::new(0),
@@ -211,7 +201,7 @@ impl Awake {
     /// the throttled one when the scope is oversubscribed.
     pub(crate) fn spin_budget(&self, over: bool) -> u32 {
         if over {
-            self.waits.pressure.throttled().min(self.waits.spin_polls)
+            crate::park::THROTTLED_POLLS.min(self.waits.spin_polls)
         } else {
             self.waits.spin_polls
         }
@@ -225,8 +215,8 @@ impl Awake {
 
     /// Sets the spin budget of the given reserved members' waits for work.
     ///
-    /// A root team scope writes it once at entry ([`Self::spin_budget`] of its
-    /// pressure). Nothing else changes it, so a member keeps the value of the
+    /// A root team scope writes it once at entry ([`Self::spin_budget`] of
+    /// whether it is oversubscribed). Nothing else changes it, so a member keeps the value of the
     /// scope it was reserved for.
     pub(crate) fn set_spin_budget(&self, ids: &[usize], polls: u32) {
         for &id in ids {
@@ -501,8 +491,7 @@ fn claim_job(aw: &std::sync::Arc<Awake>, acq: &std::sync::Arc<Acq>) {
 /// after it started, or was taken back from Rayon), spins for the slot's spin
 /// budget in polls, yields a few times, then parks and stays reserved. The
 /// budget is a count, so a member that is descheduled does not spend it while
-/// it waits for its CPU; a long gap between its clock reads ends the spin at
-/// once (see [`crate::park::Pressure`]).
+/// it waits for its CPU.
 ///
 /// An unreserved (`IDLE`) member returns to Rayon after the policy's
 /// `idle_spin` of wall time or after the pool's spin budget of polls, whichever
@@ -515,7 +504,7 @@ fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
     let slot = &aw.slots[id];
     let mut idle_since: Option<Instant> = None;
     let mut idle_polls = 0u64;
-    let mut waiter: Option<Waiter<'_>> = None;
+    let mut waiter: Option<Waiter> = None;
     let mut was_lent = false;
     let mut reserved = true;
     let mut spins = 0u32;
@@ -557,11 +546,7 @@ fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
                 let g = slot.gen.load(Ordering::Acquire);
                 if g == seen {
                     let w = waiter.get_or_insert_with(|| {
-                        Waiter::of_thread(
-                            slot.spin_budget.load(Ordering::Relaxed),
-                            Some(&aw.waits.pressure),
-                            Some(&slot.pressed_until),
-                        )
+                        Waiter::new(slot.spin_budget.load(Ordering::Relaxed))
                     });
                     if w.step() == Step::Sleep {
                         aw.waits.member_parks.fetch_add(1, Ordering::Relaxed);
@@ -779,17 +764,14 @@ impl Section {
     }
 
     /// A wait episode of this section's join or barrier.
-    fn waiter(&self) -> crate::park::Waiter<'_> {
+    fn waiter(&self) -> crate::park::Waiter {
         match self.waits() {
-            Some(w) => crate::park::Waiter::new(
-                if self.over {
-                    w.pressure.throttled().min(w.spin_polls)
-                } else {
-                    w.spin_polls
-                },
-                Some(&w.pressure),
-            ),
-            None => crate::park::Waiter::new(u32::MAX, None),
+            Some(w) => crate::park::Waiter::new(if self.over {
+                crate::park::THROTTLED_POLLS.min(w.spin_polls)
+            } else {
+                w.spin_polls
+            }),
+            None => crate::park::Waiter::new(u32::MAX),
         }
     }
 
diff --git a/src/park.rs b/src/park.rs
index a1d2227..4fddb34 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -20,7 +20,7 @@
 //! the latter and the exact code is model-checked. With nobody parked a wake is
 //! one uncontended atomic read-modify-write.
 
-use crate::sync::{AtomicBool, AtomicU64, AtomicUsize, Condvar, Mutex, Ordering};
+use crate::sync::{AtomicBool, AtomicUsize, Condvar, Mutex, Ordering};
 
 /// Places where a test can pause a thread (feature `test-hooks`).
 #[doc(hidden)]
@@ -144,50 +144,20 @@ impl Parker {
 }
 
 // ---------------------------------------------------------------------------
-// Staged waits (`docs/design/waiting.md`): a bounded spin, a few yields, then a
-// sleep on a `Parker`. The join and the barrier of a section use them through
-// [`Completion`] and [`Barrier`], which are the exact code `loom` checks.
-
-/// Default spin budget, in polls, of a wait that starts throttled: the scope
-/// is oversubscribed, or the pool saw a waiter descheduled recently. libgomp's
-/// throttled spin count has the same value.
+// Staged waits (`docs/design/waiting.md`): libgomp's waits. A bounded spin of
+// polls, a few yields, then a sleep on a `Parker`. The join and the barrier of
+// a section use them through [`Completion`] and [`Barrier`], which are the
+// exact code `loom` checks.
+
+/// Spin budget, in polls, of a wait in a statically oversubscribed scope (more
+/// participants than CPUs in the caller's set). libgomp's throttled spin count
+/// has the same value.
 pub(crate) const THROTTLED_POLLS: u32 = 100;
 
 /// Yields between the spin and the sleep. Each lets a thread queued on the same
 /// CPU run without a futex round trip.
 const YIELD_POLLS: u32 = if cfg!(loom) { 0 } else { 16 };
 
-/// A spinning waiter reads the clock once per this many polls.
-const CHECK_EVERY: u32 = 64;
-
-/// The gap between two clock reads of a spinning waiter that counts as a
-/// preemption while detection is on: 64 polls take well under 10 µs, and a
-/// scheduler slice is 0.75 ms or more.
-pub(crate) const PREEMPT_GAP_NS: u64 = 200_000;
-
-/// How long after a pool is built its waiters detect preemptions (with
-/// [`PREEMPT_GAP_NS`]) and the pool can throttle; after that, by default,
-/// nothing is detected and every wait spins, yields and sleeps as libgomp's
-/// do. A pool's first calls are where freshly spawned threads sit stacked
-/// (the scheduler places new threads before it knows their load): a pool
-/// built for one call (`with_team`) collapsed without detection (broccoli,
-/// threadteam-rs#14 `e76036c`: 87.6 ms), while a held pool, past its first
-/// moments, ran as fast as libgomp only without it.
-pub(crate) const WARM_NS: u64 = 200_000_000;
-
-/// Default time a pool keeps starting its waits throttled once its waiters
-/// were descheduled often enough (see [`CONTENDED_EVENTS`]).
-pub(crate) const CONTENDED_HOLD_NS: u64 = 100_000_000;
-
-/// Default number of observed preemptions, within one hold window, that
-/// throttle the whole pool; zero never throttles the whole pool. A single
-/// preemption (another user's job taking a CPU for a slice) only ends the spin
-/// of the waiter that saw it: throttling the pool on it made every section of
-/// a width-64 team on a mildly shared host pay futex wakes (threadteam-rs#14,
-/// broccoli). Sustained load produces many preemptions per window and still
-/// throttles.
-pub(crate) const CONTENDED_EVENTS: u32 = 4;
-
 /// What a waiting thread does after one [`Waiter::step`].
 #[doc(hidden)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -198,193 +168,27 @@ pub enum Step {
     Sleep,
 }
 
-/// Recent scheduling pressure on one pool's waiters.
-///
-/// A waiter that finds a long gap between two of its clock reads was
-/// descheduled while it spun: something else ran on its CPU (another thread of
-/// the team, a foreign process, or interrupts and VM steal; the signal does not
-/// tell them apart). It records the time, and for its hold time (default
-/// [`CONTENDED_HOLD_NS`]) every wait of the pool starts with the throttled
-/// budget, so the pool's waiters free CPUs quickly while that pressure lasts.
-#[doc(hidden)]
-pub struct Pressure {
-    base: std::time::Instant,
-    /// Nanoseconds since `base` until which waits start throttled.
-    until: AtomicU64,
-    /// How long the pool's waits stay throttled once enough observations
-    /// came within one window of this length; zero throttles only the waiter
-    /// that saw a preemption.
-    hold_ns: u64,
-    /// Observations within one window that throttle the pool.
-    threshold: u32,
-    /// How long an observation throttles the thread that saw it (a member's
-    /// slot); zero, the default, throttles no thread beyond its own wait. On a
-    /// quiet broccoli a per-thread hold of 100 ms made held teams 1.2-1.8x
-    /// slower than 0.1.3: one member preempted once then slept at every
-    /// section for the hold (threadteam-rs#14, 2773c36). A benchmark knob.
-    own_hold_ns: u64,
-    /// The throttled budget, in polls.
-    throttled: u32,
-    /// After the warm-up: a gap between two clock reads longer than this is a
-    /// preemption; zero (the default) turns the detection, and with it every
-    /// throttle, off.
-    gap_ns: u64,
-    /// Nanoseconds since `base` until which waiters detect preemptions with
-    /// [`PREEMPT_GAP_NS`] whatever `gap_ns` says (the warm-up of a new pool).
-    warm_until: u64,
-    /// Start of the current observation window, and observations in it. A
-    /// heuristic: concurrent updates may lose a count, never an escalation by
-    /// a later window.
-    window: AtomicU64,
-    in_window: AtomicU64,
-    /// Observations so far (a diagnostic).
-    events: AtomicU64,
-}
-
-impl Default for Pressure {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl Pressure {
-    /// No pressure recorded yet; the default hold and throttled budget.
-    pub fn new() -> Self {
-        Self::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, CONTENDED_EVENTS, 0)
-    }
-
-    /// This pressure with a preemption gap of `gap_ns` after the warm-up (0: no
-    /// detection).
-    #[must_use]
-    pub fn with_gap(mut self, gap_ns: u64) -> Self {
-        self.gap_ns = gap_ns;
-        self
-    }
-
-    /// This pressure with a warm-up of `warm_ns` after its creation, during
-    /// which waiters detect preemptions whatever the gap after it (0: none).
-    #[must_use]
-    pub fn with_warm_up(mut self, warm_ns: u64) -> Self {
-        self.warm_until = warm_ns;
-        self
-    }
-
-    /// The preemption gap that applies at `now` (0: no detection).
-    fn gap_at(&self, now: u64) -> u64 {
-        if now < self.warm_until {
-            PREEMPT_GAP_NS
-        } else {
-            self.gap_ns
-        }
-    }
-
-    /// No pressure recorded yet, with a throttled budget of `throttled` polls,
-    /// held for `hold_ns` once `threshold` observations came within `hold_ns`
-    /// of each other (0 never throttles the pool; 1 throttles on the first), and
-    /// a per-thread hold of `own_hold_ns` (0: none).
-    pub fn tuned(throttled: u32, hold_ns: u64, threshold: u32, own_hold_ns: u64) -> Self {
-        Pressure {
-            base: std::time::Instant::now(),
-            until: AtomicU64::new(0),
-            hold_ns,
-            threshold,
-            own_hold_ns,
-            throttled,
-            gap_ns: 0,
-            warm_until: WARM_NS,
-            window: AtomicU64::new(0),
-            in_window: AtomicU64::new(0),
-            events: AtomicU64::new(0),
-        }
-    }
-
-    /// The throttled budget, in polls.
-    pub(crate) fn throttled(&self) -> u32 {
-        self.throttled
-    }
-
-    /// Observations so far.
-    pub(crate) fn events(&self) -> u64 {
-        self.events.load(Ordering::Relaxed)
-    }
-
-    pub(crate) fn now(&self) -> u64 {
-        u64::try_from(self.base.elapsed().as_nanos()).unwrap_or(u64::MAX)
-    }
-
-    /// Records a descheduled waiter at `now`. A later deadline is never
-    /// shortened by an older observation.
-    /// How long an observation throttles the thread that saw it.
-    pub(crate) fn own_hold_ns(&self) -> u64 {
-        self.own_hold_ns
-    }
-
-    pub(crate) fn note(&self, now: u64) {
-        self.events.fetch_add(1, Ordering::Relaxed);
-        if self.hold_ns == 0 || self.threshold == 0 {
-            return;
-        }
-        let start = self.window.load(Ordering::Relaxed);
-        let n = if now.saturating_sub(start) > self.hold_ns {
-            // A new window starts with this observation.
-            self.window.store(now, Ordering::Relaxed);
-            self.in_window.store(1, Ordering::Relaxed);
-            1
-        } else {
-            self.in_window.fetch_add(1, Ordering::Relaxed) + 1
-        };
-        if n >= u64::from(self.threshold) {
-            self.until
-                .fetch_max(now.saturating_add(self.hold_ns), Ordering::Relaxed);
-        }
-    }
-
-    pub(crate) fn active(&self, now: u64) -> bool {
-        self.until.load(Ordering::Relaxed) > now
-    }
-}
-
 /// One wait episode: up to `budget` spin polls (one PAUSE, or YIELD on
 /// aarch64, each), then [`YIELD_POLLS`] yields, then sleep.
 ///
-/// The budget is a count: a waiter that is descheduled does not spend it while
-/// it waits for its CPU. Every [`CHECK_EVERY`] polls it reads the clock. At the
-/// first read it adopts the throttled budget if the pool is under
-/// [`Pressure`]; a long gap between reads ends the spin at once and records the
-/// pressure. A wait that ends within 64 polls never reads the clock.
+/// The budget is a count, as libgomp's `GOMP_SPINCOUNT`: a waiter that is
+/// descheduled does not spend it while it waits for its CPU. Nothing in the
+/// poll loop reads a clock.
 #[doc(hidden)]
-pub struct Waiter<'a> {
+pub struct Waiter {
     budget: u32,
     polls: u32,
     yields: u32,
-    pressure: Option<&'a Pressure>,
-    /// The waiting thread's own throttle deadline (a member's slot), if any.
-    own: Option<&'a AtomicU64>,
-    last: Option<u64>,
     slept: bool,
 }
 
-impl<'a> Waiter<'a> {
+impl Waiter {
     /// A wait episode with a spin of `budget` polls.
-    pub fn new(budget: u32, pressure: Option<&'a Pressure>) -> Self {
-        Self::of_thread(budget, pressure, None)
-    }
-
-    /// A wait episode of a thread with its own throttle deadline `own`: a
-    /// preemption it observes throttles its later waits for the pool's hold,
-    /// and a deadline still running throttles this one.
-    pub(crate) fn of_thread(
-        budget: u32,
-        pressure: Option<&'a Pressure>,
-        own: Option<&'a AtomicU64>,
-    ) -> Self {
+    pub fn new(budget: u32) -> Self {
         Waiter {
             budget,
             polls: 0,
             yields: 0,
-            pressure,
-            own,
-            last: None,
             slept: false,
         }
     }
@@ -400,9 +204,6 @@ impl<'a> Waiter<'a> {
     pub fn step(&mut self) -> Step {
         if self.polls < self.budget {
             self.polls += 1;
-            if self.polls.is_multiple_of(CHECK_EVERY) {
-                self.checkpoint();
-            }
             std::hint::spin_loop();
             return Step::Poll;
         }
@@ -414,34 +215,6 @@ impl<'a> Waiter<'a> {
         self.slept = true;
         Step::Sleep
     }
-
-    #[cold]
-    fn checkpoint(&mut self) {
-        let Some(p) = self.pressure else { return };
-        let now = p.now();
-        let gap = p.gap_at(now);
-        if gap == 0 {
-            // No detection now, and none later in this episode: stop reading
-            // the clock.
-            self.pressure = None;
-            return;
-        }
-        let own_active = || self.own.is_some_and(|o| o.load(Ordering::Relaxed) > now);
-        match self.last {
-            None if p.active(now) || own_active() => {
-                self.budget = self.budget.min(p.throttled().max(self.polls))
-            }
-            Some(last) if now.saturating_sub(last) > gap => {
-                p.note(now);
-                if let (Some(o), hold @ 1..) = (self.own, p.own_hold_ns()) {
-                    o.fetch_max(now.saturating_add(hold), Ordering::Relaxed);
-                }
-                self.budget = self.polls;
-            }
-            _ => {}
-        }
-        self.last = Some(now);
-    }
 }
 
 #[repr(align(128))]
@@ -484,7 +257,7 @@ impl Completion {
     }
 
     /// Waits until every share has finished: spin, yield, then sleep on `sync`.
-    pub fn wait(&self, sync: Option<&Parker>, waiter: &mut Waiter<'_>) {
+    pub fn wait(&self, sync: Option<&Parker>, waiter: &mut Waiter) {
         while !self.is_done() {
             if waiter.step() == Step::Sleep {
                 match sync {
@@ -521,7 +294,7 @@ impl Barrier {
         &self,
         cancelled: &AtomicBool,
         sync: Option<&Parker>,
-        waiter: &mut Waiter<'_>,
+        waiter: &mut Waiter,
     ) -> bool {
         if cancelled.load(Ordering::Acquire) {
             return false;
diff --git a/src/pool.rs b/src/pool.rs
index 4a6aa4d..8bc2385 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -192,9 +192,8 @@ impl Pool {
         self.awake.waits.spin_polls
     }
 
-    /// How often this pool's waits slept, and how often a waiter saw itself
-    /// descheduled, since the pool was built: diagnostics for the wait
-    /// benchmarks (`docs/design/waiting.md`).
+    /// How often this pool's waits slept since the pool was built: diagnostics
+    /// for the wait benchmarks (`docs/design/waiting.md`).
     #[doc(hidden)]
     pub fn wait_counters(&self) -> WaitCounters {
         use core::sync::atomic::Ordering::Relaxed;
@@ -203,7 +202,6 @@ impl Pool {
             join_sleeps: w.join_sleeps.load(Relaxed),
             barrier_sleeps: w.barrier_sleeps.load(Relaxed),
             member_parks: w.member_parks.load(Relaxed),
-            pressure_events: w.pressure.events(),
         }
     }
 
@@ -288,12 +286,6 @@ pub struct PoolBuilder {
     costs: DispatchCosts,
     pin_participants: bool,
     spin_polls: u32,
-    throttled_polls: u32,
-    pressure_hold: Duration,
-    pressure_events: u32,
-    own_hold: Duration,
-    preempt_gap: Duration,
-    warm_up: Duration,
 }
 
 impl PoolBuilder {
@@ -309,12 +301,6 @@ impl PoolBuilder {
             costs: DispatchCosts::host_default(),
             pin_participants: PIN_PARTICIPANTS_DEFAULT,
             spin_polls: SPIN_POLLS_DEFAULT,
-            throttled_polls: crate::park::THROTTLED_POLLS,
-            pressure_hold: Duration::from_nanos(crate::park::CONTENDED_HOLD_NS),
-            pressure_events: crate::park::CONTENDED_EVENTS,
-            own_hold: Duration::ZERO,
-            preempt_gap: Duration::ZERO,
-            warm_up: Duration::from_nanos(crate::park::WARM_NS),
         }
     }
 
@@ -606,52 +592,6 @@ impl PoolBuilder {
         self
     }
 
-    /// Tuning of the throttled waits, for the wait benchmarks only: the spin
-    /// budget of a throttled wait (default 100 polls), how long the pool's
-    /// waits stay throttled (default 100 ms; zero throttles only the waiter
-    /// that saw a preemption), how many observed preemptions within that time
-    /// throttle the pool (default 4; zero never), and how long a preemption
-    /// throttles the member that saw it (default zero: only its own wait). See
-    /// `docs/design/waiting.md`.
-    #[doc(hidden)]
-    #[must_use]
-    pub fn wait_tuning(
-        mut self,
-        throttled_polls: u32,
-        pressure_hold: Duration,
-        pressure_events: u32,
-        own_hold: Duration,
-    ) -> Self {
-        self.throttled_polls = throttled_polls;
-        self.pressure_hold = pressure_hold;
-        self.pressure_events = pressure_events;
-        self.own_hold = own_hold;
-        self
-    }
-
-    /// The gap between two clock reads of a spinning waiter that counts as a
-    /// preemption after the pool's warm-up, for the wait benchmarks only.
-    /// Zero (the default) turns the detection off: every wait then spins its
-    /// full budget, yields and sleeps, as libgomp's waits do. See
-    /// `docs/design/waiting.md`.
-    #[doc(hidden)]
-    #[must_use]
-    pub fn preempt_gap(mut self, gap: Duration) -> Self {
-        self.preempt_gap = gap;
-        self
-    }
-
-    /// How long after the pool is built its waiters detect preemptions (gap
-    /// 200 µs) and the pool can throttle, whatever [`preempt_gap`](Self::preempt_gap)
-    /// says (default 200 ms; zero: no warm-up), for the wait benchmarks only.
-    /// See `docs/design/waiting.md`.
-    #[doc(hidden)]
-    #[must_use]
-    pub fn warm_up(mut self, warm: Duration) -> Self {
-        self.warm_up = warm;
-        self
-    }
-
     /// Starts the workers.
     ///
     /// Without the `parallel` feature no thread is started and the pool has
@@ -735,14 +675,6 @@ impl PoolBuilder {
                 self.costs,
                 self.pin_participants,
                 self.spin_polls,
-                crate::park::Pressure::tuned(
-                    self.throttled_polls,
-                    u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
-                    self.pressure_events,
-                    u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
-                )
-                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX))
-                .with_warm_up(u64::try_from(self.warm_up.as_nanos()).unwrap_or(u64::MAX)),
             )),
         })
     }
@@ -758,14 +690,6 @@ impl PoolBuilder {
                 self.costs,
                 self.pin_participants,
                 self.spin_polls,
-                crate::park::Pressure::tuned(
-                    self.throttled_polls,
-                    u64::try_from(self.pressure_hold.as_nanos()).unwrap_or(u64::MAX),
-                    self.pressure_events,
-                    u64::try_from(self.own_hold.as_nanos()).unwrap_or(u64::MAX),
-                )
-                .with_gap(u64::try_from(self.preempt_gap.as_nanos()).unwrap_or(u64::MAX))
-                .with_warm_up(u64::try_from(self.warm_up.as_nanos()).unwrap_or(u64::MAX)),
             )),
         })
     }
@@ -820,6 +744,4 @@ pub struct WaitCounters {
     pub barrier_sleeps: u64,
     /// Reserved members that parked waiting for work.
     pub member_parks: u64,
-    /// Waiters that saw a gap of more than 200 µs between their clock reads.
-    pub pressure_events: u64,
 }
diff --git a/src/sync.rs b/src/sync.rs
index 01300c0..f368192 100644
--- a/src/sync.rs
+++ b/src/sync.rs
@@ -3,11 +3,11 @@
 
 #[cfg(loom)]
 pub(crate) use loom::sync::{
-    atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
+    atomic::{AtomicBool, AtomicUsize, Ordering},
     Condvar, Mutex,
 };
 #[cfg(not(loom))]
 pub(crate) use std::sync::{
-    atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
+    atomic::{AtomicBool, AtomicUsize, Ordering},
     Condvar, Mutex,
 };
diff --git a/src/tests/waiting.rs b/src/tests/waiting.rs
index 5b01fdd..ef5cc9d 100644
--- a/src/tests/waiting.rs
+++ b/src/tests/waiting.rs
@@ -1,14 +1,9 @@
 //! The staged wait of `crate::park::Waiter` (`docs/design/waiting.md`).
-//!
-//! Nothing here depends on how the scheduler runs this thread: the pressure
-//! deadlines are set explicitly, and the only real delay (a sleep) can only make
-//! a measured gap longer.
 
-use crate::park::{Pressure, Step, Waiter, CONTENDED_HOLD_NS, PREEMPT_GAP_NS, THROTTLED_POLLS};
-use std::time::Duration;
+use crate::park::{Step, Waiter};
 
 /// Steps until the waiter says sleep; the number of `Poll` steps before it.
-fn polls_until_sleep(w: &mut Waiter<'_>) -> u32 {
+fn polls_until_sleep(w: &mut Waiter) -> u32 {
     let mut n = 0;
     while w.step() == Step::Poll {
         n += 1;
@@ -20,153 +15,22 @@ fn polls_until_sleep(w: &mut Waiter<'_>) -> u32 {
 #[test]
 fn a_wait_spins_its_budget_then_yields_sixteen_times_then_sleeps() {
     for budget in [0u32, 1, 63, 64, 1000] {
-        let mut w = Waiter::new(budget, None);
+        let mut w = Waiter::new(budget);
         assert_eq!(polls_until_sleep(&mut w), budget + 16, "budget {budget}");
+        assert!(w.slept());
         // It stays asleep-ready: every further step says sleep.
         assert_eq!(w.step(), Step::Sleep);
     }
 }
 
 #[test]
-fn a_pool_under_pressure_starts_its_waits_throttled() {
-    // Throttle on the first observation, with a deadline that cannot pass
-    // during the test.
-    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 1, 0);
-    p.note(u64::MAX - CONTENDED_HOLD_NS);
-    let mut throttled = Waiter::new(100_000, Some(&p));
-    assert_eq!(polls_until_sleep(&mut throttled), THROTTLED_POLLS + 16);
-    // A small budget is never raised to the throttled one.
-    let mut small = Waiter::new(70, Some(&p));
-    assert_eq!(polls_until_sleep(&mut small), 70 + 16);
-}
-
-#[test]
-fn a_descheduled_spinner_ends_its_spin_and_records_the_pressure() {
-    // Detection on (as during a new pool's warm-up, or with a nonzero gap).
-    let p = Pressure::new().with_gap(PREEMPT_GAP_NS);
-    assert_eq!(p.events(), 0);
-    let mut w = Waiter::new(1_000_000, Some(&p));
-    // The first clock read is at poll 64; a gap longer than 200 µs before the
-    // second one (poll 128) stands for a descheduled waiter.
+fn a_descheduled_spinner_keeps_its_budget() {
+    // Nothing reads a clock: a waiter that was off its CPU for a while spins
+    // exactly as many polls as one that was not (libgomp's waits).
+    let mut w = Waiter::new(1_000);
     for _ in 0..64 {
         assert_eq!(w.step(), Step::Poll);
     }
-    std::thread::sleep(Duration::from_millis(2));
-    for _ in 64..128 {
-        assert_eq!(w.step(), Step::Poll);
-    }
-    // The spin is over: what remains is the sixteen yields.
-    assert_eq!(polls_until_sleep(&mut w), 16);
-    assert_eq!(p.events(), 1, "the pool records the observation");
-}
-
-#[test]
-fn a_burst_throttles_the_pool_and_isolated_preemptions_do_not() {
-    // Four observations within the hold window throttle the pool (the
-    // default threshold).
-    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4, 0);
-    let t = 1_000_000_000;
-    for k in 0..3 {
-        p.note(t + k * 1_000_000);
-        assert!(!p.active(t + k * 1_000_000), "observation {k} alone");
-    }
-    p.note(t + 3_000_000);
-    assert!(p.active(t + 3_000_000), "the fourth within the window");
-    assert!(
-        !p.active(t + 3_000_000 + CONTENDED_HOLD_NS),
-        "the hold ends"
-    );
-    // Observations spread wider than the window never add up.
-    let q = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 4, 0);
-    for k in 0..10 {
-        let at = t + k * (CONTENDED_HOLD_NS + 1);
-        q.note(at);
-        assert!(!q.active(at), "isolated observation {k}");
-    }
-}
-
-#[test]
-fn with_a_per_thread_hold_a_preemption_throttles_the_thread_that_saw_it() {
-    use core::sync::atomic::AtomicU64;
-    // The per-thread hold is a benchmark knob (off by default); the pool
-    // threshold is off here so that only the thread's own deadline acts.
-    let p = Pressure::tuned(THROTTLED_POLLS, CONTENDED_HOLD_NS, 0, CONTENDED_HOLD_NS)
-        .with_gap(PREEMPT_GAP_NS);
-    let own = AtomicU64::new(0);
-    // A member's wait sees itself descheduled (a gap before its second clock
-    // read): its spin ends, and its slot's deadline is set.
-    let mut w = Waiter::of_thread(1_000_000, Some(&p), Some(&own));
-    for _ in 0..64 {
-        assert_eq!(w.step(), Step::Poll);
-    }
-    std::thread::sleep(Duration::from_millis(2));
-    for _ in 64..128 {
-        assert_eq!(w.step(), Step::Poll);
-    }
-    assert_eq!(polls_until_sleep(&mut w), 16);
-    assert!(own.load(core::sync::atomic::Ordering::Relaxed) > 0);
-    // The pool is not throttled: another thread's wait spins its full budget.
-    let other_own = AtomicU64::new(0);
-    let mut other = Waiter::of_thread(100_000, Some(&p), Some(&other_own));
-    assert_eq!(polls_until_sleep(&mut other), 100_000 + 16);
-    // The same thread's next wait is throttled while its deadline runs (set
-    // here to one that cannot pass during the test).
-    own.store(u64::MAX, core::sync::atomic::Ordering::Relaxed);
-    let mut again = Waiter::of_thread(100_000, Some(&p), Some(&own));
-    assert_eq!(polls_until_sleep(&mut again), THROTTLED_POLLS + 16);
-}
-
-#[test]
-fn by_default_a_preemption_sets_no_per_thread_deadline() {
-    use core::sync::atomic::{AtomicU64, Ordering};
-    let p = Pressure::new().with_gap(PREEMPT_GAP_NS);
-    let own = AtomicU64::new(0);
-    let mut w = Waiter::of_thread(1_000_000, Some(&p), Some(&own));
-    for _ in 0..64 {
-        w.step();
-    }
-    std::thread::sleep(Duration::from_millis(2));
-    for _ in 64..128 {
-        w.step();
-    }
-    assert_eq!(polls_until_sleep(&mut w), 16, "its own spin ends");
-    assert_eq!(
-        own.load(Ordering::Relaxed),
-        0,
-        "no lasting per-thread deadline"
-    );
-}
-
-#[test]
-fn with_detection_off_a_descheduled_spinner_keeps_spinning() {
-    // A preemption gap of zero: no clock-based detection at all (libgomp's
-    // waits); the spin runs its whole budget whatever the scheduler did.
-    let p = Pressure::new().with_gap(0).with_warm_up(0);
-    let mut w = Waiter::new(1_000, Some(&p));
-    for _ in 0..64 {
-        assert_eq!(w.step(), Step::Poll);
-    }
-    std::thread::sleep(Duration::from_millis(2));
+    std::thread::sleep(std::time::Duration::from_millis(2));
     assert_eq!(polls_until_sleep(&mut w), 1_000 - 64 + 16);
-    assert_eq!(p.events(), 0);
-}
-
-#[test]
-fn by_default_a_new_pool_detects_preemptions_only_during_its_warm_up() {
-    let spin_through_a_gap = |p: &Pressure| {
-        let mut w = Waiter::new(1_000, Some(p));
-        for _ in 0..64 {
-            w.step();
-        }
-        std::thread::sleep(Duration::from_millis(2));
-        polls_until_sleep(&mut w)
-    };
-    // During the warm-up (a fresh pressure): the gap ends the spin.
-    let warm = Pressure::new();
-    assert_eq!(spin_through_a_gap(&warm), 64 + 16);
-    assert_eq!(warm.events(), 1);
-    // After it (here: no warm-up), the default detects nothing.
-    let steady = Pressure::new().with_warm_up(0);
-    assert_eq!(spin_through_a_gap(&steady), 1_000 - 64 + 16);
-    assert_eq!(steady.events(), 0);
 }
diff --git a/tests/loom_park.rs b/tests/loom_park.rs
index 6fa46c8..e810464 100644
--- a/tests/loom_park.rs
+++ b/tests/loom_park.rs
@@ -153,7 +153,7 @@ fn the_last_member_wakes_a_leader_asleep_in_join() {
                 })
             })
             .collect();
-        done.wait(Some(&sync), &mut Waiter::new(0, None));
+        done.wait(Some(&sync), &mut Waiter::new(0));
         assert!(done.is_done());
         for m in ms {
             m.join().unwrap();
@@ -174,12 +174,12 @@ fn consecutive_barrier_rounds_wake_every_sleeper() {
             let (barrier, cancelled, sync) = (barrier.clone(), cancelled.clone(), sync.clone());
             thread::spawn(move || {
                 for _ in 0..2 {
-                    assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0, None)));
+                    assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0)));
                 }
             })
         };
         for _ in 0..2 {
-            assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0, None)));
+            assert!(barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0)));
         }
         peer.join().unwrap();
     });
@@ -195,9 +195,7 @@ fn a_cancellation_wakes_a_participant_asleep_in_a_barrier() {
         let sync = Arc::new(Parker::new());
         let waiter = {
             let (barrier, cancelled, sync) = (barrier.clone(), cancelled.clone(), sync.clone());
-            thread::spawn(move || {
-                barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0, None))
-            })
+            thread::spawn(move || barrier.arrive(&cancelled, Some(&sync), &mut Waiter::new(0)))
         };
         // `Section::fail`: raise the flag (SeqCst), then wake.
         cancelled.store(true, Ordering::SeqCst);

From 0e259b5ad503d242c6b4804966d01b1cffecff7b Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 03:30:02 +0900
Subject: [PATCH 09/13] own worker threads: a process-wide reserve of
 std::thread workers leased per Pool, a native batch queue and broadcast list,
 cooperative waits (#15)

threadteam no longer runs on a private Rayon ThreadPool. A Pool leases its
workers from a process-wide reserve and returns them on drop, so a pool built
after another one was dropped (faer's with_team, once per call) reuses running
threads instead of spawning fresh ones: the faer#107 one-call collapse came
from fresh-thread stacking, which no waiting policy fixed (#14). Pools with a
thread name, an on_start hook, a stack size or a QoS of their own get
dedicated workers that their drop joins, as before.

- Slot state word (RESERVED/LENT/BUSY/DETACH): a team reserves only free
  workers; a worker wins BUSY before it takes work; release and end-of-work
  never erase each other's bits or DETACH.
- Plain fork/for_ranges/external publish a stack batch on the pool's queue
  (claims under the lock, last claim unlinks, owner frees after completion);
  a worker caller runs its own batch, any waiting worker serves its own pool
  meanwhile (cross-pool chains progress), a plain thread sleeps.
- Broadcast: publication-ordered list, each worker runs its shares in order,
  no lock held while waiting.
- Pool drop: detach, wait for every acknowledgement but the dropping
  worker's own; workers return to the reserve before acknowledging. Workers
  take the leasing caller's CPU set. Reserve cap: the largest width leased.
- Panics in tasks and shares are caught, every claim completes, the first
  payload is resumed after the wait.
- Rayon: opt-in feature 'rayon' (Exec::external_rayon on a private pool);
  idle_runs_rayon is a documented no-op.
- loom: slot state races, a batch with two claimers and a sleeping owner, a
  broadcast to two workers, an idle worker against a publication (12 models).
  Strict alloc-free test incl. broadcast and wake after park. New tests: reuse
  (spawn counter), dedicated workers, A->B->A, broadcast order, task panic,
  affinity on lease; the self-drop test is kept (task published directly).

Design: docs/design/own-threads.md (pi-council + gpt pre-review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.toml                 |  12 +-
 README.md                  |  48 ++-
 docs/design/own-threads.md | 158 ++++++++++
 docs/design/placement.md   |   8 +
 docs/design/waiting.md     |  26 +-
 src/awake.rs               | 620 ++++++++++++++++++-------------------
 src/exec.rs                |  49 ++-
 src/ledger.rs              |   6 +-
 src/lib.rs                 |  17 +-
 src/park.rs                | 496 +++++++++++++++++++++++++++++
 src/pin.rs                 |   5 +
 src/policy.rs              |  31 +-
 src/pool.rs                | 285 ++++++++++-------
 src/reserve.rs             |  15 +-
 src/sched.rs               | 181 ++++++++---
 src/team.rs                |   9 +-
 src/worker.rs              | 265 ++++++++++++++++
 tests/alloc_free.rs        |  32 +-
 tests/loom_park.rs         | 167 ++++++++++
 tests/own_threads.rs       | 232 ++++++++++++++
 20 files changed, 2087 insertions(+), 575 deletions(-)
 create mode 100644 docs/design/own-threads.md
 create mode 100644 src/worker.rs
 create mode 100644 tests/own_threads.rs

diff --git a/Cargo.toml b/Cargo.toml
index 400aecc..e85464b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,9 +13,13 @@ categories = ["concurrency", "science"]
 
 [features]
 default = ["parallel"]
-# Run entries on a private Rayon pool. Without it the same types exist, every
-# pool has width 1 and every entry runs inline on the calling thread.
-parallel = ["dep:rayon"]
+# Run entries on the pool's own worker threads (docs/design/own-threads.md).
+# Without it the same types exist, every pool has width 1 and every entry runs
+# inline on the calling thread.
+parallel = []
+# Opt-in Rayon interop: `Exec::external_rayon` runs a callback inside a private
+# Rayon pool of the token's width. Not needed by anything else.
+rayon = ["parallel", "dep:rayon"]
 # Test support: per-root live-task ledger and entry counters. Zero cost when off.
 ledger = []
 # Test support: hooks that pause threads inside the park/wake handshake and
@@ -45,6 +49,8 @@ libc = "0.2"
 
 [dev-dependencies]
 libc = "0.2"
+# The Rayon reference rows of benches/wait_scenarios.rs.
+rayon = "1.10"
 
 [[bench]]
 name = "team_dispatch"
diff --git a/README.md b/README.md
index ac2ba7f..a919e8f 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,16 @@ that starts tasks: kernels take an `Exec` token and split it, and no scheduler
 type appears in any public signature.
 
 Used by strided-rs, tcontract-rs, cpueinsum-rs, tlinalg-rs and tenferro-rs.
-Design record: [`docs/design/placement.md`](docs/design/placement.md).
+Design records: [`docs/design/placement.md`](docs/design/placement.md) (the token),
+[`docs/design/own-threads.md`](docs/design/own-threads.md) (the worker threads),
+[`docs/design/waiting.md`](docs/design/waiting.md) (how they wait).
+
+The workers are threadteam's own `std::thread`s. A pool leases them from a
+process-wide reserve and gives them back when dropped, so a pool built after another
+one was dropped reuses running threads (faer's `with_team` builds one per call);
+a pool with a thread name, a start hook, a stack size or a QoS of its own gets
+dedicated workers that its drop joins. Rayon is not used unless the opt-in `rayon`
+feature asks for `Exec::external_rayon`.
 
 ## Usage
 
@@ -58,9 +67,9 @@ the token to kernels by value. Kernels never store a token and never mint one.
 | `Exec::team(f)` / `team_with(over, f)` | reserve `budget - 1` awake pool members for a scope and run barrier-bearing sections through `TeamExec` (`run`, `run_with`, `split`, `fork`, `reborrow`), or `Err(Refused::Unavailable)`; see the design record |
 | `Pool::into_team(width)` -> `Team` (owns the pool; `IntoTeamError` gives it back), `Team::exec(budget)` / `try_exec`, `Team::pool`, `Team::into_pool` | persistent reservation for an engine that owns its pool (`Pool` is not `Clone`); minted tokens are ordinary `Exec`s whose `fork`, `for_ranges`, `broadcast`, `team` dispatch on the reserved members; one leader at a time (`exec` blocks, `try_exec` -> `Refused::Busy`); idle members park while reserved |
 | `PoolBuilder::qos(Qos)`, `raise_current_thread_qos(Qos)` | worker QoS on macOS (default `UserInitiated`); raise the leading thread without ever lowering it |
-| `PoolBuilder::idle_spin`, `idle_runs_rayon`, `acquire_timeout`; `Pool::release_idle` | waiting policy of idle team members (an idle member returns to Rayon after `idle_spin` or the spin budget, whichever comes first) |
+| `PoolBuilder::idle_spin`, `idle_runs_rayon`, `acquire_timeout`; `Pool::release_idle` | waiting policy of idle team members (an idle member spins for the spin budget unless `idle_spin` is zero, then sleeps; `idle_runs_rayon` has no effect and is kept for compatibility) |
 | `PoolBuilder::spin_polls`, `Pool::spin_polls` | spin budget of every team wait, in polls (the shape of libgomp's `GOMP_SPINCOUNT`): a reserved member waiting for work, the leader in a join and a participant in a barrier spin that many polls, yield a few times, then sleep until woken; throttled to 100 polls in an oversubscribed scope or after a waiter was descheduled ([`docs/design/waiting.md`](docs/design/waiting.md)) |
-| `PoolBuilder::pin_participants(bool)`, `Pool::pin_participants()` | opt-in placement of the **members** of a root team scope (Linux; off by default, which is consistent with the rule it protects): member `k` (participant `k >= 1`) pins itself onto the `k`-th CPU of the calling thread's affinity set, `S[0]` is left to the leader, and a member restores its own mask before it returns to Rayon or serves foreign work. **The leader is never pinned**, because a vendor library creates its thread team from the calling thread and a one-CPU caller would confine the whole provider team; a member that calls such a library directly inside a share does confine it, so use `Exec::external` (which restores the member's mask first) or leave pinning off. For tensor4all/faer#107; give each team its own CPU set (`taskset -c`), there is no CPU allocator |
+| `PoolBuilder::pin_participants(bool)`, `Pool::pin_participants()` | opt-in placement of the **members** of a root team scope (Linux; off by default, which is consistent with the rule it protects): member `k` (participant `k >= 1`) pins itself onto the `k`-th CPU of the calling thread's affinity set, `S[0]` is left to the leader, and a member restores its own mask before it serves the pool's queue, leaves the pool, or serves foreign work. **The leader is never pinned**, because a vendor library creates its thread team from the calling thread and a one-CPU caller would confine the whole provider team; a member that calls such a library directly inside a share does confine it, so use `Exec::external` (which restores the member's mask first) or leave pinning off. For tensor4all/faer#107; give each team its own CPU set (`taskset -c`), there is no CPU allocator |
 | `DispatchCosts`, `WidthCosts`, `PoolBuilder::dispatch_costs`, `Exec::dispatch_cost(width)`, `TeamExec::dispatch_cost(width)` | cost of one parallel section per kind of token (team, in pool, outside), steady state; one row per `HostClass` (`HostClass::detect()`, keyed by kernel dispatch: `x86_64-avx512`, `x86_64-avx2`, `x86_64-scalar`, `aarch64-apple`, `aarch64`, `generic`), `DispatchCosts::for_class(class)`; measured rows for `x86_64-avx512` (team anchors at widths 2, 4, 6 and 8) and `aarch64-apple`, a measured Zen2 team row for `x86_64-avx2` (anchors at ten widths from 2 to 64; its plain kinds stay generic), every other class takes the conservative `generic` row (3 / 15 / 40 us at the anchors 2, 4, 6); a row holds measured anchors (`WidthCosts::new`, `WidthCosts::flat`, or `WidthCosts::from_anchors` for measured anchors up to 64 and beyond), interpolates between them and grows linearly above the largest one, so a width above the anchors is never charged the cost of the largest anchor; `DispatchCosts::host_default()` is the detected class's row; `Duration::MAX` when serial; override per pool |
 | `pays_at(est, sections, cost)`, `Exec::pays(est, sections, width)`, `Exec::width_for(est, sections)`, `width_for_by`, `PAYS` | the one rule: parallel iff `est >= PAYS * sections * D(width)`; `width_for` minimises `sections * D(k) + est / k` |
 | `Exec::external(f)` | enter the pool once and hand the budget as a plain width to an outside library (faer, a vendor BLAS); how it divides the width is that library's concern |
@@ -73,11 +82,13 @@ the token to kernels by value. Kernels never store a token and never mint one.
   once is at most its budget at every nesting depth. A parent waiting for its
   children keeps no slot.
 * **Lazy and inline.** A serial token, budget one, or one task runs inline on the
-  calling thread and makes no scheduler call, so the process-global Rayon pool is
-  never started implicitly.
-* **Placement by caller.** A worker of the target pool spawns into the current
-  scope without installing; a plain thread or a worker of another pool enters the
-  target pool once and waits. No thread-local state exists in the crate.
+  calling thread and makes no scheduler call; no worker starts before a pool is
+  built, and Rayon's process-global pool is never started.
+* **Placement by caller.** A worker of the target pool runs its own batch's
+  tasks itself and serves the pool while it waits; a worker of another pool
+  publishes on the target pool and serves its own pool while it waits (so
+  chains between pools always make progress); a plain thread publishes and
+  sleeps until its tasks finished. No thread-local state exists in the crate.
 * **`broadcast`** refuses with `Refused::ForkChild` for a token derived from
   `fork` (through `reborrow` or `limit` too), and with `Refused::CallerInPool`
   when the caller is a worker of the same pool. Roots, and their `reborrow`s and
@@ -87,11 +98,14 @@ the token to kernels by value. Kernels never store a token and never mint one.
   blocking work of another token on those workers delays the broadcast.
   `can_broadcast` applies the same rule through one private helper, so the two
   cannot disagree.
-* **Deterministic shutdown.** Dropping a `Pool` joins every worker thread: when
-  `drop` returns, all workers have exited and their thread-local destructors
-  (including state created in an `on_start` hook) have run. A pool dropped from
-  one of its own workers cannot join itself, so that drop only signals shutdown
-  and returns without joining. Without `parallel` there is nothing to join.
+* **Shutdown.** Dropping a `Pool` detaches every worker and waits until each
+  one acknowledged; after that no worker touches the pool. Dedicated workers (a
+  pool with a thread name, an `on_start` hook, a stack size or a QoS of its own)
+  are then joined: their thread-local destructors, including state created in
+  an `on_start` hook, have run when `drop` returns. Shared workers go back to the
+  process-wide reserve, asleep, for the next pool. A pool dropped from one of its
+  own workers does not wait for or join that worker, which acknowledges and
+  leaves after its task returns. Without `parallel` there is nothing to join.
 * **No scheduler type is public.** There is no constructor from, and no accessor
   returning, a scheduler pool. `scripts/check-no-public-rayon.sh` runs
   `cargo public-api -p threadteam` (when installed) and fails if `rayon::`
@@ -101,12 +115,14 @@ the token to kernels by value. Kernels never store a token and never mint one.
 
 | Feature | Effect |
 | --- | --- |
-| `parallel` (default) | run on a private pool. Without it the same types exist, `PoolBuilder::build` returns a width-1 pool and every entry runs inline |
+| `parallel` (default) | run on the pool's own worker threads. Without it the same types exist, `PoolBuilder::build` returns a width-1 pool and every entry runs inline |
+| `rayon` | opt-in Rayon interop: `Exec::external_rayon(f)` runs `f(width)` inside a private Rayon pool of the pool's width (separate threads, built on first use) |
 | `ledger` | test support: `ledger::max_live(root)`, `live`, `installs`, and `Exec::ledger_root`. Records live tasks per root token and pool installs; compiled out when off |
 
 Consumers assert `ledger::max_live(root) <= budget` in their own tests, and keep
-a test binary that runs serial and pooled work and then checks that
-`rayon::ThreadPoolBuilder::new().build_global()` still succeeds.
+a test binary that runs serial and pooled work and then checks
+`ledger::global_pool_unstarted()` (with the `rayon` feature it checks that Rayon's
+process-global pool was never started).
 
 ## Wait benchmarks
 
diff --git a/docs/design/own-threads.md b/docs/design/own-threads.md
new file mode 100644
index 0000000..cac03e7
--- /dev/null
+++ b/docs/design/own-threads.md
@@ -0,0 +1,158 @@
+# Own worker threads (threadteam-rs#15)
+
+threadteam stops running on a private Rayon `ThreadPool`. Its workers are `std::thread`s kept in a process-wide **reserve**; a `Pool` leases a fixed number of them and returns them when it is dropped. The waits stay libgomp's (`waiting.md`). Rayon becomes an opt-in interop layer.
+
+Design inputs:
+- pi-council, plan mode (GPT-6-astra chair, DeepSeek critic, GLM minimalist). The brief and the synthesis are in the shinaoka-advisor run directory `work/runs/threadteam-own/`.
+- The runtime sources read for it, without copying code: libgomp, LLVM libomp, oneTBB.
+- The measurements of threadteam-rs#14, which stays a draft as their record.
+
+## Why: the one-call pool
+
+faer's `with_team` builds a `Pool`, and with it 64 fresh threads, per call. On a 64-CPU set under foreign load those threads start stacked: the scheduler places a new thread before it knows its load. The team's spinning waiters then never leave a CPU idle that could pull one over, and every 20 µs section of the call waits for a descheduled member (faer#107).
+
+The structural difference is the spawn, not the waiting. In one broccoli run (faer#107, 13:10Z, 0.1.3, 64 threads, `gemm128`), the same acquisition path at the same width gave:
+
+| arm | what happens per call | median call |
+| --- | --- | --- |
+| `into_team_per_call` | the pool is held; members are acquired and released per call | 0.03 ms |
+| `fresh_pool` | a new pool, so 64 new threads, per call | 15.99 ms |
+
+On #14, no waiting policy fixed the fresh pool and kept held teams at libgomp's speed at the same time:
+- the pool-wide throttle fixed (a) but cost (c);
+- libgomp's waits met (b) and (c) but left the fresh pool at 11 ms;
+- a wall-clock window could not tell the two apart.
+
+libgomp creates its threads once per process (per master thread) and reuses them for every region, docked on a futex between regions. TBB's RML server owns one process-wide set of workers that every arena reuses, each sleeping on its own monitor when idle.
+
+The answer to question (i) of #15 is therefore (ii): if no `Pool` spawns threads, there is no fresh-thread stacking to detect.
+
+**Caveat.** The first pool of a process still spawns its workers. The acceptance criterion (a) judges a process by its median call over 50, so one cold first call does not make it slow, and the benchmarks report the cold first call separately.
+
+## Decisions
+
+### Reserve and lease
+- **One process-wide reserve: a list of idle workers.** It is created by the first explicit `Pool::build` that wants shared workers. Serial, budget-one and one-task entries never reach it, and no API submits work to it without a pool, so "no implicit global pool" holds.
+- **Compatibility.** A worker of the reserve was spawned with the default stack (16 MiB), the platform's default QoS and no hooks. A pool with any `thread_name`, `on_start`, a different stack size or a QoS gets **dedicated** workers: spawned for it and joined when it is dropped, exactly as before. tcontract's C API names its workers and sets a thread-local in `on_start`; it keeps today's semantics.
+- **`Pool::build`.** It takes `width` idle workers from the reserve and spawns the missing ones; a spawn failure is a build error. A worker learns its pool and its index when leased.
+- **`Pool` drop (shared workers).** Every worker is told to detach. Each one finishes, restores its own affinity mask (a pinned member) and acknowledges. Only then is the worker back in the reserve. The drop waits for all acknowledgements (quiescence) and does not join.
+  - The reserve keeps at most `C` idle workers, `C` being the available parallelism when it was created; a worker beyond the cap exits and is joined by the drop.
+  - A pool dropped from one of its own workers (a worker running a task that owns the pool) cannot wait for itself: it detaches the others, and that worker detaches when its task returns.
+- **Contract change.** "Dropping a `Pool` joins every worker thread" now holds for dedicated workers only; a shared worker outlives the pool, parked in the reserve.
+
+### The worker loop
+Each leased worker runs one native loop over its member slot, the slot of the existing team machinery (`awake.rs`). Slot states:
+
+| state | meaning |
+| --- | --- |
+| `IDLE` | serves the pool's queue and its own mailbox; claimable by a team (CAS) |
+| `RUNNING` | runs a task of the pool's queue or a broadcast share; not claimable |
+| `RESERVED` | a team member, as before; with `lent`, it also serves the pool's queue |
+| `DETACH` | the pool is being dropped; the worker acknowledges and leaves |
+
+Work, in the order the loop looks for it:
+1. A **broadcast share** in its mailbox.
+2. A **task** from the pool's queue.
+3. Otherwise the staged wait: spin, yield, then park on its slot's `Parker`, until the queue generation, the mailbox, or the state changes.
+
+The `ABSENT` state, the claim jobs (`claim_cold`) and the `YIELD` state of the Rayon design disappear: every leased worker is always in its loop.
+
+### Plain tokens: `fork`, `for_ranges`, `external`
+- **A call publishes a stack-allocated batch.** The batch holds the task function, the next unclaimed index, the task count and a completion counter (`Completion`). It is linked into the pool's queue: an intrusive list under a `std::sync::Mutex`, so nothing is allocated.
+- **Claiming and freeing.**
+  - A worker claims an index **under the queue lock**, and the claim that takes the last index unlinks the batch.
+  - The batch's owner frees it only after the completion counter reaches zero.
+  - So no worker can reach a batch after it was unlinked, and an unlinked batch is gone only after all of its tasks finished.
+- **The caller.**
+  - A caller that is a worker of the pool claims its own batch's remaining indices before it waits.
+  - A caller from outside the pool waits (staged; it sleeps on the pool's `sync` parker, woken by the last completion), as "a plain thread enters the pool once and waits" says today.
+- **No deadlock.** Every unclaimed task is claimable by its owner, and an owner that waits only waits for tasks that are already running. A running task blocks only on its own children, which it can run itself. So no cycle of waits is possible; the worst case is a nested fork that runs its children on its own thread.
+- **Budget conservation.** The structure is unchanged: a batch has at most its token's budget of tasks, and the shares of `fork` sum to the budget.
+- **`external`.**
+  - A plain token: the callback runs on a pool worker, as a one-task batch, or inline when the caller is a worker of the pool.
+  - A team token: its members are lent to the pool's queue for the call, and serve tasks the callback's code publishes to the same pool.
+
+### Broadcast
+- The pool holds a broadcast mutex for the whole broadcast. The caller is never a worker of the pool (`CallerInPool` refusal), so holding it cannot deadlock a worker, and concurrent broadcasts run one after the other, in the same order for every worker.
+- The share for worker `i` goes into slot `i`'s mailbox. The caller waits for all `budget` shares, as today; a reserved member serves no broadcast, again as today.
+
+### Identity without thread-locals
+Each slot records its worker's `ThreadId` when leased. "Is the caller a worker of this pool, and which one" is a scan of the pool's slots (`width` comparisons), done at entry points only, never on the team dispatch path.
+
+### Rayon interop: opt-in
+The Rayon lending of `external` has no production caller (downstream use: tests and benchmarks). It becomes a non-default feature, `rayon`: `Exec::external_rayon(f)` runs `f` inside `install` on a private Rayon pool of the token's width, built lazily per pool. Those are separate threads, which the feature documents. Without the feature, Rayon is not a dependency at all.
+
+### Unchanged
+- **The team machinery:** sections, `Completion`, `Barrier`, `Parker`, pinning, root-scope oversubscription, `Team`/`TeamExec` and the spare worker. A pool of `w` workers gives a team of `w` participants with an outside leader, so one worker always stays free for the queue and for `external`. threadteam-rs#12 stays open.
+- **The waits** (`waiting.md`): 300000 polls, 16 yields, futex; 100 polls in a statically oversubscribed scope.
+
+### Public semantics that change (for the maintainer)
+
+| item | before (Rayon) | now |
+| --- | --- | --- |
+| `Pool` drop | joins every worker | dedicated workers: joins. Shared workers: waits for every worker to detach, then returns them to the reserve |
+| `idle_runs_rayon` | an idle member runs queued Rayon jobs | no effect: an idle worker always serves the pool's queue (kept for compatibility) |
+| `idle_spin` | how long an unreserved member spins before returning to Rayon | how long an unreserved worker may spin before it sleeps; the spin budget bounds it as well |
+| `release_idle` | idle members return to Rayon | idle workers stop spinning and sleep now |
+| `resident_members` | members in a member loop (reserved or idle) | workers reserved by a team, or idle and awake |
+| `external` on a team token | lends members to Rayon | lends members to the pool's queue; Rayon lending is `external_rayon` under the `rayon` feature |
+| feature `parallel` | pulls Rayon | pulls nothing; `rayon` is a separate opt-in |
+
+## Pre-review resolutions
+
+The gpt-6.1-sol pre-review (`work/runs/threadteam-own/pre.out`) found one deadlock and seven gaps in the first draft. The design above is amended as follows.
+
+1. **Cross-pool liveness (A → B → A).**
+   - **The problem.** A worker of pool A that waits for a batch it published on pool B must not just sleep. If every worker of A does so, and B's tasks publish back on A, nobody runs A's queue.
+   - **The rule.** A waiting worker of any pool keeps serving **its own pool's queue** (and its broadcast sequence) until its batch completes.
+   - **The wake.** The batch records who to wake: the waiting worker's own slot parker, or the target pool's `sync` parker for a plain outside thread. That waiter sleeps on a predicate that covers both its batch and its pool's work.
+   - **Same pool.** A worker caller of the same pool still claims its own batch's indices first.
+2. **Broadcast.**
+   - **Publication only.** The pool's broadcast lock covers publication, not completion.
+   - **Ordering.** Broadcasts are numbered in publication order and linked into the pool's broadcast list. Each worker runs the broadcasts that target it in sequence order, skipping the others. A broadcast stays linked, and alive on its caller's stack, until all of its targets have finished; its caller unlinks it.
+   - **No lock held while waiting**, so a cooperative waiter re-entering a broadcast cannot block on a lock held lower on its own stack.
+3. **One state word per slot.** Bits `RESERVED`, `LENT`, `BUSY`, `DETACH`.
+   - A team claims a slot only from `0` (compare-and-swap).
+   - A free worker takes work only by winning `0 → BUSY`, and a lent member only by winning `RESERVED|LENT → RESERVED|LENT|BUSY`. Both happen before it removes a task from the queue; a failed compare-and-swap leaves the task unclaimed.
+   - Releasing a reservation clears `RESERVED|LENT` only. A worker still running a lent task stays `BUSY`, so it is not claimable until it finishes.
+   - Detach sets `DETACH`. Finishing a task clears `BUSY` only, so it cannot erase `DETACH`.
+   - Nested execution (a waiting worker helping its queue) keeps `BUSY`.
+   - These transitions are a small type (`SlotState`) that `loom` checks directly.
+4. **Lease state and self-drop.**
+   - **Ownership.** Every leased worker holds an `Arc` of the pool's shared state through its epilogue. Its detach acknowledgement is its last access to that state.
+   - **Drop.** `Pool` drop marks every slot `DETACH`, wakes the workers and waits for the acknowledgements of all workers but itself.
+   - **Self-drop from a worker.** It does not wait for the dropping worker, which acknowledges after its task returns. The other workers cannot be running work of this pool, because any such work borrows the pool, so their acknowledgements come promptly.
+   - **Locks.** No reserve lock is held while waiting.
+   - **Workers above the cap.** They exit, and their handles are detached; only dedicated workers are joined.
+5. **Affinity on lease.** `Pool::build` reads the calling thread's affinity mask, and every worker applies it to itself when it is leased (Linux), as a newly spawned thread would inherit it. A worker whose pin restore failed is not returned to the reserve; it exits.
+6. **Reserve cap.** The cap is the largest of the available parallelism and every width leased so far. So repeated wide pools (faer's per-call `with_team`) keep reusing their workers, whatever the first caller's affinity was.
+7. **Panics.**
+   - Every claimed task and broadcast share runs under `catch_unwind` and always reaches its completion. The first payload is kept on the batch.
+   - The owner waits for completion (all claimed tasks, including tasks still unclaimed, which it runs itself) before it resumes the first panic.
+   - A broadcast share is unlinked by its caller only after completion; a worker never clears a share after signalling it.
+   - `Completion::finish`'s rule holds: nothing touches a batch after its final decrement.
+8. **Verification.**
+   - The loom list grows to the transitions above: state word, queue claim against reserve, last completion against reclamation, broadcast sequence, detach against task end, and lease attach against first publication.
+   - The allocation test of the plain paths drops its Rayon-era minimum-window exemption and counts strictly after warm-up.
+
+Kept against the review's delete list: the opt-in Rayon layer, which the maintainer asked for ("Rayon との相互運用が要る機能は opt-in の層として残す"), and `idle_runs_rayon`, as a documented no-op, so the public API does not break.
+
+## Verification
+- **loom, new paths, small models:**
+  - a batch published with one owner and two claimers, the owner asleep until completion;
+  - an idle worker's wait on the queue generation, its mailbox and its state, against a publish and a detach;
+  - the detach handshake of a pool drop.
+- **The existing tests:** alloc-free (the plain paths and the team paths, warm), ledger, compile-fail, no-public-rayon, and the feature matrix.
+- **New tests:**
+  - reuse: thread creation counted; a second pool of the same width spawns none;
+  - quiescence at drop; dedicated pools keep join-on-drop;
+  - nested forks; a worker caller running its own batch;
+  - concurrent broadcasts; a pinned member restoring its mask on detach.
+- **Benchmarks:** `scripts/bench-ab.sh` against the base (`a3a9320`) and libgomp (`OMP=1`), and faer's `acquire_probe_107` (all arms), on broccoli and evo. The `fresh_pool` rows (`build`, `acquire`, `call`, `release`, `drop`) show the reuse, and the cold first call is reported separately.
+
+## Acceptance
+As on #14:
+- **(a)** faer#107 slow mode zero in every arm;
+- **(b)** quiet hosts within 10 % of 0.1.3 (`held_team`, `held_pool`, gaps 0-1 ms);
+- **(c)** under foreign load no worse than libgomp;
+- **(d)** the 10 ms gap governed by the spin budget.
diff --git a/docs/design/placement.md b/docs/design/placement.md
index da8c02b..d07150d 100644
--- a/docs/design/placement.md
+++ b/docs/design/placement.md
@@ -6,6 +6,14 @@ cpueinsum-rs, tlinalg-rs and tenferro-rs; the cross-repository rules are in
 tensor4all/tensor4all-meta#41 (`docs/design/core-boundary-and-execution-ownership.md`,
 "Where placement is decided").
 
+
+> **Workers (2026-10-30).** threadteam no longer runs on a private Rayon pool.
+> Its workers are its own threads, leased from a process-wide reserve; see
+> [`own-threads.md`](own-threads.md). Where this record describes Rayon jobs,
+> installs or claim jobs, read the native queue, the cooperative waits and the
+> compare-and-swap reservation described there. The token contracts here are
+> unchanged.
+
 ## Problem
 
 The CPU stack places work with **four** mechanisms at once:
diff --git a/docs/design/waiting.md b/docs/design/waiting.md
index bf6de5b..d1d52d8 100644
--- a/docs/design/waiting.md
+++ b/docs/design/waiting.md
@@ -90,22 +90,11 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
   - 12288 polls (about 300 µs) made the first section after a 1 ms or 10 ms gap 2.3x and 10.8x slower than 0.1.3 on a quiet host (evo): the members had gone to sleep. 131072 closed the 1 ms gap; 300000 also closes the 10 ms gap (evo, `d430347` runs), and is accepted as the OpenMP default (criterion d).
   - libomp keeps 200 ms (`KMP_BLOCKTIME`); 0.1.3 kept 200 ms of wall time for members and never slept in joins.
 - **No calibration.** Converting a time to polls at pool build was considered and dropped (pre-review): a calibration taken while the CPU is contended yields too few polls, and a bare PAUSE loop is not the real poll anyway. The count is approximate in time, as libgomp's is.
-- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed, or while a new pool is under sustained pressure (below).
+- **Throttled budget.** 100 polls (libgomp's value) when the root scope is statically oversubscribed.
 
-### Scheduling pressure: only while a pool is new
+### Scheduling pressure: none (libgomp's waits)
 
-**Default: libgomp's waits.** Once a pool is past its warm-up, its waits detect nothing: every wait spins 300000 polls, yields 16 times and sleeps, as libgomp's do (`GOMP_SPINCOUNT`, futex).
-- On broccoli (`e76036c`, 16:58Z) this was the only configuration that met criteria (b) and (c) together: on quiet hosts held teams within 10 % of 0.1.3, and under load `held_team` at 0.91x libgomp, `held_pool` +7.8 %, gaps on par with libgomp.
-- Every detecting variant made held teams under load 3.5-4x slower than libgomp, because detection throttled waits that libgomp keeps spinning.
-- The main path of real use is a held pool: tenferro's `CpuEngine` holds its pool, and libomp and libgomp hold hot teams.
-
-**Warm-up: detection while a pool is new (default 200 ms after it is built).** Without any detection, a pool built for one call (`fresh_pool`, faer's `with_team`) collapsed (87.6 ms): its freshly spawned threads start stacked, because the scheduler places new threads before it knows their load, and spinning members never leave a CPU idle to pull one over. So during the warm-up a new pool's waiters detect preemptions and the pool can throttle, as in `c0c024b`, which kept the faer#107 arms at zero:
-- **Detection.** A spinning waiter reads the clock every 64 polls. A gap of more than 200 µs between two reads means it was descheduled while it spun: 64 polls take well under 10 µs, and a scheduler slice is 0.75 ms or more.
-- **Response.** That waiter ends its spin (yields, then sleeps). The pool counts the observations, and once 4 come within 100 ms of each other, every wait of the pool adopts the throttled budget (100 polls) at its first clock read, for 100 ms (`fetch_max`).
-- **Limits of the signal.** It is a pressure heuristic: foreign load, the team's own threads, interrupts and VM steal look alike, and it only shortens active waiting.
-- **Cost after the warm-up.** None in the poll loop: a wait's first clock read finds detection off, and that wait stops reading the clock.
-
-**What was tried and measured on the way** (broccoli and evo, threadteam-rs#14):
+Nothing detects preemption: every wait spins its budget, yields and sleeps, as libgomp's waits do. #14 tried several detectors on the Rayon base, and each traded one acceptance criterion for another (broccoli, threadteam-rs#14):
 
 | detection | quiet held teams | held teams under load | fresh pool |
 | --- | --- | --- | --- |
@@ -113,14 +102,9 @@ The last member of a section therefore pays one extra uncontended read-modify-wr
 | a pool-wide throttle on 4 preemptions within 100 ms (`c0c024b`) | within 10 % | 3.5-4x libgomp | fixed |
 | a per-thread 100 ms throttle (`2773c36`) | 1.2-1.8x slower | — | fixed |
 | none (`e76036c` variant) | within 10 % | about libgomp | collapsed (87.6 ms) |
+| detection during a 200 ms warm-up (`1f2145b`) | `held_pool` 2.2x | 3.3x libgomp | collapsed (11 ms) |
 
-**Knobs and counters for the benchmarks** (`PoolBuilder::preempt_gap`, `warm_up`, `wait_tuning`, all hidden; bench flags `--preempt-gap-us`, `--warm-ms`, `--pressure-events`, `--pressure-hold-ms`, `--throttled-polls`, `--own-hold-ms`):
-- detection after the warm-up (a nonzero gap);
-- the warm-up length;
-- the pool threshold, the hold and the throttled budget;
-- a per-thread hold.
-
-`Pool::wait_counters` (hidden) counts join and barrier sleeps, member parks and observed preemptions, printed under every bench row.
+The one configuration that met (b) and (c), no detection, failed only on the pool built per call. That pool's collapse comes from spawning fresh threads per call, not from waiting. With threadteam's own threads (`own-threads.md`) a pool reuses the reserve's running workers, so the waits stay libgomp's and the detection, the warm-up and their knobs are gone.
 
 ### Start of a section: no arrival barrier
 
diff --git a/src/awake.rs b/src/awake.rs
index 0e6aa40..ab56f0d 100644
--- a/src/awake.rs
+++ b/src/awake.rs
@@ -1,23 +1,17 @@
-//! Reserved awake members: per-member dispatch slots, sections, acquisition.
+//! The workers of a pool: their slots, the native loop, sections, acquisition.
 //!
-//! A *member* is a worker of the pool that runs a long-lived loop as one
-//! Rayon job. While the loop runs, the worker serves no other Rayon job.
-//! Each worker index owns one cache-line padded [`Slot`]:
+//! Every leased worker runs [`serve`] for its slot until the pool detaches it
+//! (`docs/design/own-threads.md`). A slot's state word ([`crate::park::SlotState`])
+//! has the bits `RESERVED`, `LENT`, `BUSY`, `DETACH`:
 //!
-//! ```text
-//! ABSENT --claim job--> RESERVED <--claim (CAS)-- IDLE
-//!    ^                     |  release (store)      ^ |
-//!    +---- idle timeout ---+-----------------------+ +-- YIELD (inside a Rayon job)
-//! ```
-//!
-//! * `ABSENT`: no loop on this worker.
-//! * `RESERVED`: owned by one leader; the member waits for `gen` (spin, yield,
-//!   then park) and runs the section the leader published. It neither runs
-//!   Rayon jobs nor leaves.
-//! * `IDLE`: loop alive but unreserved; polls for the policy's idle time or
-//!   the pool's spin budget, whichever ends first, then leaves (`ABSENT`).
-//!   Claimable by a compare-and-swap, with no waiting.
-//! * `YIELD`: an idle member inside `rayon::yield_now`; not claimable.
+//! * `0`: free. The worker serves the pool's broadcast shares and queued tasks
+//!   (winning `BUSY` before it takes one) and otherwise waits (spin, yield,
+//!   park). A team claims it by a compare-and-swap from `0`.
+//! * `RESERVED`: a team member. It waits for `gen` (spin, yield, park) and runs
+//!   the sections its leader publishes; it serves nothing else.
+//! * `RESERVED|LENT`: a member lent to the pool's queue (`Exec::external`).
+//! * `BUSY`: running a task or a share; not claimable.
+//! * `DETACH`: the pool is being dropped; the worker acknowledges and leaves.
 //!
 //! A leader publishes a [`Section`] (a stack object) by writing its address
 //! and an argument into the member's slot and bumping `gen`; the member runs
@@ -29,6 +23,7 @@
 //! futex round per section that grew with the number of unused members).
 //!
 //! No thread-local state is used: a member's identity is its slot index.
+#![cfg_attr(not(feature = "parallel"), allow(dead_code))]
 
 use crate::error::Refused;
 use crate::park::Parker;
@@ -46,11 +41,9 @@ macro_rules! trace {
     };
 }
 
-const ABSENT: usize = 0;
-const IDLE: usize = 1;
-#[cfg_attr(not(feature = "parallel"), allow(dead_code))]
-const YIELD: usize = 2;
-const RESERVED: usize = 3;
+#[cfg(feature = "parallel")]
+use crate::park::{BUSY, DETACH};
+use crate::park::{LENT, RESERVED};
 
 /// Pure spin for a while, then yield the CPU between polls.
 ///
@@ -70,45 +63,61 @@ pub(crate) fn backoff(spins: &mut u32) {
     }
 }
 
-/// One member's dispatch slot.
+/// One worker's slot: its state word, its team-member dispatch state, and
+/// where it sleeps.
 #[repr(align(128))]
-struct Slot {
-    state: AtomicUsize,
+pub(crate) struct Slot {
+    /// `RESERVED`/`LENT`/`BUSY`/`DETACH` (see [`crate::park::SlotState`]).
+    pub(crate) state: crate::park::SlotState,
     /// Bumped by the current leader per published section.
     gen: AtomicUsize,
     ptr: AtomicPtr<Section>,
     arg: AtomicUsize,
-    /// Idle policy written by the releasing leader before `IDLE` is stored.
+    /// Idle policy written by the releasing leader before the slot is freed.
     idle_spin_ns: AtomicU64,
-    idle_yield: AtomicBool,
     /// Spin budget, in polls, of this reserved member's waits for work (see
     /// `docs/design/waiting.md`); written by the leader at root-scope entry.
     spin_budget: AtomicU32,
-    /// Set by the leader while the member's thread is lent to Rayon
-    /// (`Exec::external` on a team token).
-    lent: AtomicBool,
-    /// The mask this member saved before pinning itself; only the member thread
-    /// of this slot touches it (see [`crate::pin::SavedMask`]).
+    /// The mask this member saved before pinning itself; only the worker
+    /// thread of this slot touches it (see [`crate::pin::SavedMask`]).
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
-    saved: crate::pin::SavedMask,
-    /// Where this member sleeps once its spin and yields are spent; woken by
-    /// the leader after it changed `gen`, `state` or `lent` of this slot.
-    park: Parker,
+    pub(crate) saved: crate::pin::SavedMask,
+    /// Where this worker sleeps: idle, as a member between sections, or while
+    /// it waits for a batch (`help_while`). An `Arc`, so that a completion can
+    /// keep it alive across its final decrement.
+    pub(crate) park: std::sync::Arc<Parker>,
+    /// The worker thread leased to this slot (set when it attaches).
+    pub(crate) thread: std::sync::OnceLock<std::thread::ThreadId>,
+    /// The worker's broadcast cursor (only the worker touches it).
+    bseq: AtomicU64,
+    /// Set while the worker waits for a batch and serves its pool meanwhile.
+    helping: AtomicBool,
+    /// A released member that has not gone to sleep since (it still spins,
+    /// claimable without a wake): what `Pool::resident_members` counts besides
+    /// reserved members.
+    lingering: AtomicBool,
+    /// The worker attached to its lease / acknowledged its detach.
+    pub(crate) attached: AtomicBool,
+    pub(crate) acked: AtomicBool,
 }
 
 impl Slot {
     fn new() -> Self {
         Slot {
-            state: AtomicUsize::new(ABSENT),
+            state: crate::park::SlotState::new(),
             gen: AtomicUsize::new(0),
             ptr: AtomicPtr::new(core::ptr::null_mut()),
             arg: AtomicUsize::new(0),
-            idle_spin_ns: AtomicU64::new(0),
-            idle_yield: AtomicBool::new(false),
+            idle_spin_ns: AtomicU64::new(u64::MAX),
             spin_budget: AtomicU32::new(crate::park::THROTTLED_POLLS),
-            lent: AtomicBool::new(false),
             saved: crate::pin::SavedMask::new(),
-            park: Parker::new(),
+            park: std::sync::Arc::new(Parker::new()),
+            thread: std::sync::OnceLock::new(),
+            bseq: AtomicU64::new(0),
+            helping: AtomicBool::new(false),
+            lingering: AtomicBool::new(false),
+            attached: AtomicBool::new(false),
+            acked: AtomicBool::new(false),
         }
     }
 }
@@ -117,8 +126,9 @@ impl Slot {
 pub(crate) struct Waits {
     /// Where leaders sleep in `join` and participants in `barrier`. One per
     /// pool: a member may wake it after its last decrement, when the section
-    /// may already be gone, and the pool outlives every member loop.
-    pub(crate) sync: Parker,
+    /// may already be gone, and the pool outlives every member loop. Also
+    /// where a plain outside thread waits for a batch of this pool.
+    pub(crate) sync: std::sync::Arc<Parker>,
     /// Spin budget of a wait, in polls (`PoolBuilder::spin_polls`).
     pub(crate) spin_polls: u32,
     /// Diagnostics (`Pool::wait_counters`): sleeps of leaders in joins, of
@@ -130,7 +140,11 @@ pub(crate) struct Waits {
 
 /// Shared state of the awake members of one pool.
 pub(crate) struct Awake {
-    slots: Box<[Slot]>,
+    pub(crate) slots: Box<[Slot]>,
+    /// The pool's queue of task batches (plain `fork`, `for_ranges`, `external`).
+    pub(crate) queue: crate::park::Queue,
+    /// The pool's broadcasts.
+    pub(crate) bcast: crate::park::BroadcastList,
     /// What the joins and barriers of this pool's sections sleep on, and the
     /// pool's spin budget (`docs/design/waiting.md`).
     pub(crate) waits: Waits,
@@ -158,8 +172,10 @@ impl Awake {
     ) -> Self {
         Awake {
             slots: (0..width).map(|_| Slot::new()).collect(),
+            queue: crate::park::Queue::new(),
+            bcast: crate::park::BroadcastList::new(),
             waits: Waits {
-                sync: Parker::new(),
+                sync: std::sync::Arc::new(Parker::new()),
                 spin_polls,
                 join_sleeps: AtomicU64::new(0),
                 barrier_sleeps: AtomicU64::new(0),
@@ -176,23 +192,23 @@ impl Awake {
         }
     }
 
-    /// Workers currently running a member loop, reserved or idle.
+    /// Members kept awake for teams: reserved ones, and released ones that
+    /// have not gone to sleep since.
     pub(crate) fn resident(&self) -> usize {
         self.slots
             .iter()
-            .filter(|s| s.state.load(Ordering::Acquire) != ABSENT)
+            .filter(|s| s.state.load() & RESERVED != 0 || s.lingering.load(Ordering::Acquire))
             .count()
     }
 
-    /// Hands members back: they become idle under `policy`.
+    /// Hands members back: they become free under `policy`.
     pub(crate) fn release(&self, ids: &[usize], policy: WaitPolicy) {
         let ns = u64::try_from(policy.idle_spin().as_nanos()).unwrap_or(u64::MAX);
         for &id in ids {
             let s = &self.slots[id];
             s.idle_spin_ns.store(ns, Ordering::Relaxed);
-            s.idle_yield
-                .store(policy.idle_runs_rayon(), Ordering::Relaxed);
-            s.state.store(IDLE, Ordering::SeqCst);
+            s.lingering.store(true, Ordering::Release);
+            s.state.release();
             s.park.wake();
         }
     }
@@ -273,66 +289,88 @@ impl Awake {
         trace!(self, None, Publish);
     }
 
-    /// Lends (or takes back) the members' threads to Rayon: while lent, a
-    /// reserved member runs the pool's jobs instead of idling.
+    /// Lends (or takes back) the members' threads to the pool's queue: while
+    /// lent, a reserved member runs the pool's tasks instead of idling. Taking
+    /// it back lets a task it is running finish; the member serves its team
+    /// again after that.
     #[cfg_attr(not(feature = "parallel"), allow(dead_code))]
     pub(crate) fn lend(&self, ids: &[usize], on: bool) {
         for &id in ids {
             let s = &self.slots[id];
-            s.lent.store(on, Ordering::SeqCst);
-            if on {
+            s.state.set_lent(on);
+            s.park.wake();
+        }
+    }
+
+    /// Wakes the workers that can take work of the queue or a broadcast: free
+    /// ones, lent members and workers helping while they wait.
+    pub(crate) fn wake_for_work(&self) {
+        for s in &*self.slots {
+            let st = s.state.load();
+            if st == 0 || st == RESERVED | LENT || s.helping.load(Ordering::SeqCst) {
                 s.park.wake();
             }
         }
     }
 
-    /// Reserves `need` members, or refuses without waiting for a Rayon job.
-    ///
-    /// Idle resident members are claimed with a compare-and-swap. Missing ones
-    /// are requested with claim jobs; the leader waits at most the pool's
-    /// acquisition timeout for *idle workers to wake up*, never for a worker
-    /// that is busy: when the members are not all there by then the claim is
-    /// closed, every tentative member is released and `Unavailable` returned.
+    /// The slot of the calling thread in this pool, if it is one of its
+    /// workers (a scan of the slots: entry points only).
+    pub(crate) fn slot_of_current(&self) -> Option<usize> {
+        let me = std::thread::current().id();
+        self.slots.iter().position(|s| s.thread.get() == Some(&me))
+    }
+
+    /// Reserves `need` free workers by compare-and-swap, waiting at most the
+    /// pool's acquisition timeout for busy ones to become free; on a shortfall
+    /// every tentative member is released and `Unavailable` returned. A worker
+    /// that runs a task is not free, so a reservation never shares a thread
+    /// with a running task.
     pub(crate) fn acquire(
         self: &std::sync::Arc<Self>,
-        pool: &crate::pool::Pool,
+        _pool: &crate::pool::Pool,
         need: usize,
         policy: WaitPolicy,
         spin_budget: u32,
     ) -> Result<Reservation, Refused> {
         let mut ids = Vec::with_capacity(need);
-        // Idle members are claimed with a compare-and-swap. A member that is
-        // inside `yield_now` is not claimable at that instant, but it is only
-        // polling unless it found a job; retry for at most the timeout while
-        // such members exist, instead of treating them as busy at once.
+        let me = self.slot_of_current();
         let started = std::time::Instant::now();
+        let mut spins = 0u32;
         loop {
-            let mut yielding = false;
-            for (i, s) in self.slots.iter().enumerate() {
+            // Members of an earlier team that are still awake first (warm,
+            // claimable without a wake-up), then any other free worker.
+            let order = self
+                .slots
+                .iter()
+                .enumerate()
+                .filter(|(_, s)| s.lingering.load(Ordering::Acquire))
+                .chain(
+                    self.slots
+                        .iter()
+                        .enumerate()
+                        .filter(|(_, s)| !s.lingering.load(Ordering::Acquire)),
+                );
+            for (i, s) in order {
                 if ids.len() == need {
                     break;
                 }
-                match s
-                    .state
-                    .compare_exchange(IDLE, RESERVED, Ordering::AcqRel, Ordering::Relaxed)
+                if Some(i) != me
+                    && !ids.contains(&i)
+                    && s.attached.load(Ordering::Acquire)
+                    && s.state.try_reserve()
                 {
-                    Ok(_) => ids.push(i),
-                    Err(YIELD) => yielding = true,
-                    Err(_) => {}
+                    s.lingering.store(false, Ordering::Release);
+                    ids.push(i);
                 }
             }
-            if ids.len() == need || !yielding || started.elapsed() >= self.acquire_timeout {
+            if ids.len() == need || started.elapsed() >= self.acquire_timeout {
                 break;
             }
-            std::hint::spin_loop();
-        }
-        let missing = need - ids.len();
-        if missing > 0 {
-            self.claim_cold(pool, missing, &mut ids);
-            if ids.len() < need {
-                self.release(&ids, policy);
-                return Err(Refused::Unavailable);
-            }
+            backoff(&mut spins);
+        }
+        if ids.len() < need {
+            self.release(&ids, policy);
+            return Err(Refused::Unavailable);
         }
         self.set_spin_budget(&ids, spin_budget);
         Ok(Reservation {
@@ -342,46 +380,76 @@ impl Awake {
         })
     }
 
+    /// Runs one broadcast share or one queued task on worker `id`, if there is
+    /// one; the caller holds the right to run work (it won `BUSY`, or it is a
+    /// worker waiting for a batch). `true` when something ran.
     #[cfg(feature = "parallel")]
-    fn claim_cold(
-        self: &std::sync::Arc<Self>,
-        pool: &crate::pool::Pool,
-        missing: usize,
-        ids: &mut Vec<usize>,
-    ) {
-        use std::sync::Arc;
-        use std::time::Instant;
-        let acq = Arc::new(Acq::new(missing));
-        for _ in 0..missing {
-            let (aw, a) = (Arc::clone(self), Arc::clone(&acq));
-            pool.inner.spawn(move || claim_job(&aw, &a));
-        }
-        let deadline = Instant::now() + self.acquire_timeout;
-        let mut spins = 0;
-        while acq.joined() < missing && Instant::now() < deadline {
-            backoff(&mut spins);
-        }
-        let n = acq.close();
-        for pos in 0..n {
-            let mut spins = 0;
-            loop {
-                let id = acq.ids[pos].load(Ordering::Acquire);
-                if id != usize::MAX {
-                    ids.push(id);
-                    break;
-                }
-                backoff(&mut spins);
+    pub(crate) fn run_one(&self, id: usize) -> bool {
+        let slot = &self.slots[id];
+        let mut seq = slot.bseq.load(Ordering::Relaxed);
+        if self.bcast.has_after(seq) {
+            let next = self.bcast.next_for(id, &mut seq);
+            slot.bseq.store(seq, Ordering::Relaxed);
+            if let Some(b) = next {
+                // SAFETY: a linked broadcast that targets `id`; its caller
+                // keeps it alive until this share completed.
+                unsafe { crate::park::Broadcast::run_share(b, id) };
+                return true;
             }
         }
+        if let Some((b, i)) = self.queue.claim() {
+            // SAFETY: index `i` of `b` was claimed here.
+            unsafe { crate::park::Batch::run_claimed(b, i) };
+            return true;
+        }
+        false
     }
 
-    #[cfg(not(feature = "parallel"))]
-    fn claim_cold(
-        self: &std::sync::Arc<Self>,
-        _pool: &crate::pool::Pool,
-        _missing: usize,
-        _ids: &mut Vec<usize>,
-    ) {
+    /// Whether worker `id` has work it could run now (a hint).
+    #[cfg(feature = "parallel")]
+    fn work_for(&self, id: usize) -> bool {
+        self.queue.has_work()
+            || self
+                .bcast
+                .has_after(self.slots[id].bseq.load(Ordering::Relaxed))
+    }
+
+    /// A free worker or a lent member takes one piece of work: it wins `BUSY`
+    /// first, so a team cannot reserve it meanwhile, then runs it.
+    #[cfg(feature = "parallel")]
+    fn try_work(&self, id: usize) -> bool {
+        if !self.work_for(id) {
+            return false;
+        }
+        let slot = &self.slots[id];
+        if !slot.state.try_take() {
+            return false;
+        }
+        let ran = self.run_one(id);
+        slot.state.end_busy();
+        ran
+    }
+
+    /// Waits until `done` reports completion. A worker of this pool (`me`)
+    /// serves this pool's queue and broadcasts meanwhile, so nested and
+    /// cross-pool waits always make progress; it sleeps on its own parker,
+    /// which the batch's completion and new work of this pool wake.
+    #[cfg(feature = "parallel")]
+    pub(crate) fn help_while(&self, me: usize, done: impl Fn() -> bool) {
+        let slot = &self.slots[me];
+        slot.helping.store(true, Ordering::SeqCst);
+        let mut waiter = crate::park::Waiter::new(self.waits.spin_polls);
+        while !done() {
+            if self.run_one(me) {
+                waiter = crate::park::Waiter::new(self.waits.spin_polls);
+                continue;
+            }
+            if waiter.step() == crate::park::Step::Sleep {
+                slot.park.park_while(|| !done() && !self.work_for(me));
+                waiter = crate::park::Waiter::new(self.waits.spin_polls);
+            }
+        }
+        slot.helping.store(false, Ordering::SeqCst);
     }
 }
 
@@ -400,236 +468,134 @@ impl Drop for Reservation {
     }
 }
 
-/// One acquisition: how many claim jobs found a worker, and which.
-#[cfg(feature = "parallel")]
-struct Acq {
-    joined: AtomicUsize,
-    ids: Vec<AtomicUsize>,
-}
-
-#[cfg(feature = "parallel")]
-impl Acq {
-    const CLOSED: usize = 1 << (usize::BITS - 1);
-
-    fn new(capacity: usize) -> Self {
-        Acq {
-            joined: AtomicUsize::new(0),
-            ids: (0..capacity)
-                .map(|_| AtomicUsize::new(usize::MAX))
-                .collect(),
-        }
-    }
-
-    fn joined(&self) -> usize {
-        self.joined.load(Ordering::Acquire) & !Self::CLOSED
-    }
-
-    /// A claim job asks for a position; `None` when closed or full.
-    fn join(&self) -> Option<usize> {
-        let mut cur = self.joined.load(Ordering::Acquire);
-        loop {
-            if cur & Self::CLOSED != 0 || cur >= self.ids.len() {
-                return None;
-            }
-            match self.joined.compare_exchange_weak(
-                cur,
-                cur + 1,
-                Ordering::AcqRel,
-                Ordering::Acquire,
-            ) {
-                Ok(_) => return Some(cur),
-                Err(now) => cur = now,
-            }
-        }
-    }
-
-    /// Closes the claim; later jobs do nothing. Returns the joined count.
-    fn close(&self) -> usize {
-        self.joined.fetch_or(Self::CLOSED, Ordering::AcqRel) & !Self::CLOSED
-    }
-}
-
-/// Runs on a pool worker: becomes a member for the acquisition, or does nothing.
-#[cfg(feature = "parallel")]
-fn claim_job(aw: &std::sync::Arc<Awake>, acq: &std::sync::Arc<Acq>) {
-    let Some(w) = rayon::current_thread_index() else {
-        return;
-    };
-    let Some(slot) = aw.slots.get(w) else {
-        return;
-    };
-    if slot
-        .state
-        .compare_exchange(ABSENT, RESERVED, Ordering::AcqRel, Ordering::Relaxed)
-        .is_err()
-    {
-        // Stolen by a resident member that is serving Rayon (idle_runs_rayon):
-        // its thread cannot host a second loop. Hand the job back to the pool
-        // unless the acquisition is already over.
-        if acq.joined.load(Ordering::Acquire) & Acq::CLOSED == 0 {
-            let (aw, acq) = (std::sync::Arc::clone(aw), std::sync::Arc::clone(acq));
-            rayon::spawn(move || claim_job(&aw, &acq));
-        }
-        return;
-    }
-    let seen = slot.gen.load(Ordering::Acquire);
-    let epoch = aw.release_epoch.load(Ordering::Relaxed);
-    match acq.join() {
-        Some(pos) => {
-            acq.ids[pos].store(w, Ordering::Release);
-            member_loop(aw, w, seen, epoch);
-        }
-        None => slot.state.store(ABSENT, Ordering::Release),
-    }
-}
-
-/// The member loop. Returns when the idle policy, `release_idle` or shutdown
-/// returns the thread to Rayon.
+/// The native loop of worker `id` of a pool, from its attachment until the
+/// pool detaches it (`DETACH`, while it is not busy). See
+/// `docs/design/own-threads.md` and `docs/design/waiting.md`.
 ///
-/// A reserved member waits for work in episodes (`docs/design/waiting.md`): an
-/// episode starts when it first finds nothing to do after its last share (or
-/// after it started, or was taken back from Rayon), spins for the slot's spin
-/// budget in polls, yields a few times, then parks and stays reserved. The
-/// budget is a count, so a member that is descheduled does not spend it while
-/// it waits for its CPU.
+/// * Reserved (and not lent): a team member. It waits for its slot's `gen`
+///   in staged episodes (spin for the slot's budget, yield, park) and runs the
+///   sections its leader publishes; it serves nothing else.
+/// * Free, or a lent member: it takes broadcast shares and queued tasks,
+///   winning `BUSY` before it removes anything, and otherwise waits in a staged
+///   episode (the policy's idle spin) and parks until work, a reservation or a
+///   detach arrives.
 ///
-/// An unreserved (`IDLE`) member returns to Rayon after the policy's
-/// `idle_spin` of wall time or after the pool's spin budget of polls, whichever
-/// comes first, so a team released between calls does not keep every CPU busy
-/// for the whole `idle_spin`.
+/// A member restores its own affinity mask when it stops being reserved, and
+/// before it serves foreign work as a lent member.
 #[cfg(feature = "parallel")]
-fn member_loop(aw: &Awake, id: usize, mut seen: usize, epoch: usize) {
+pub(crate) fn serve(aw: &Awake, id: usize) {
     use crate::park::{Step, Waiter};
-    use std::time::Instant;
     let slot = &aw.slots[id];
-    let mut idle_since: Option<Instant> = None;
-    let mut idle_polls = 0u64;
+    let mut seen = slot.gen.load(Ordering::Acquire);
     let mut waiter: Option<Waiter> = None;
     let mut was_lent = false;
-    let mut reserved = true;
-    let mut spins = 0u32;
+    let mut reserved = false;
+    let mut epoch = aw.release_epoch.load(Ordering::Relaxed);
+    // Whether the last iteration served as a member; a wait episode does not
+    // carry over between the member's and the free worker's waits.
+    let mut as_member = false;
     trace!(aw, Some(id), Enter);
     loop {
-        let state = slot.state.load(Ordering::Acquire);
-        // Pinning ends with the reservation, and it ends on this thread: a
-        // member restores its own mask before it leaves `RESERVED` and before
-        // it serves Rayon work (a lend restores it below).
-        if state == RESERVED {
+        let st = slot.state.load();
+        // Pinning ends with the reservation, and it ends on this thread.
+        if st & RESERVED != 0 {
             reserved = true;
         } else if reserved {
             reserved = false;
             slot.saved.restore();
         }
-        match state {
-            RESERVED if slot.lent.load(Ordering::Acquire) => {
-                if !was_lent {
-                    was_lent = true;
-                    // The thread serves the pool's jobs now: undo our pin first.
-                    slot.saved.restore();
-                    trace!(aw, Some(id), LentBegin);
-                }
-                idle_since = None;
+        if st & DETACH != 0 && st & BUSY == 0 {
+            trace!(aw, Some(id), Leave);
+            return;
+        }
+        if st & RESERVED != 0 && st & LENT == 0 {
+            if !as_member {
+                as_member = true;
                 waiter = None;
-                // Serve the pool's jobs; resume team service when taken back.
-                if !matches!(rayon::yield_now(), Some(rayon::Yield::Executed)) {
-                    for _ in 0..32 {
-                        std::hint::spin_loop();
-                    }
-                }
             }
-            RESERVED => {
-                if was_lent {
-                    was_lent = false;
-                    trace!(aw, Some(id), LentEnd);
-                }
-                idle_since = None;
-                let g = slot.gen.load(Ordering::Acquire);
-                if g == seen {
-                    let w = waiter.get_or_insert_with(|| {
-                        Waiter::new(slot.spin_budget.load(Ordering::Relaxed))
-                    });
-                    if w.step() == Step::Sleep {
-                        aw.waits.member_parks.fetch_add(1, Ordering::Relaxed);
-                        trace!(aw, Some(id), ParkEnter);
-                        park_member(slot, seen);
-                        trace!(aw, Some(id), ParkExit);
-                        waiter = None;
-                    }
-                } else {
-                    seen = g;
+            if was_lent {
+                was_lent = false;
+                waiter = None;
+                trace!(aw, Some(id), LentEnd);
+            }
+            let g = slot.gen.load(Ordering::Acquire);
+            if g == seen {
+                let w = waiter
+                    .get_or_insert_with(|| Waiter::new(slot.spin_budget.load(Ordering::Relaxed)));
+                if w.step() == Step::Sleep {
+                    aw.waits.member_parks.fetch_add(1, Ordering::Relaxed);
+                    trace!(aw, Some(id), ParkEnter);
+                    park_member(slot, seen);
+                    trace!(aw, Some(id), ParkExit);
                     waiter = None;
-                    let ptr = slot.ptr.load(Ordering::Relaxed);
-                    let arg = slot.arg.load(Ordering::Relaxed);
-                    // SAFETY: the leader keeps the section alive until its
-                    // completion counter reaches zero, which happens only
-                    // after the call below decremented it.
-                    if unsafe { (*ptr).pin } {
-                        // A pin section: this member saves its previous mask
-                        // here, before it pins itself in its share.
-                        slot.saved.save_if_unpinned();
-                    }
-                    trace!(aw, Some(id), SectionBegin);
-                    // SAFETY: as above; `aw` outlives this loop, so the wake
-                    // after the last decrement does not touch the section.
-                    unsafe { Section::execute_member(ptr, arg) };
-                    trace!(aw, Some(id), SectionEnd);
                 }
-            }
-            IDLE => {
+            } else {
+                seen = g;
                 waiter = None;
-                if idle_since.is_none() {
-                    idle_polls = 0;
-                }
-                let since = *idle_since.get_or_insert_with(Instant::now);
-                idle_polls += 1;
-                let spin_ns = slot.idle_spin_ns.load(Ordering::Relaxed);
-                let leave = aw.shutdown.load(Ordering::Relaxed)
-                    || aw.release_epoch.load(Ordering::Relaxed) != epoch
-                    || idle_polls > u64::from(aw.waits.spin_polls)
-                    || since.elapsed().as_nanos() >= u128::from(spin_ns);
-                if leave {
-                    if slot
-                        .state
-                        .compare_exchange(IDLE, ABSENT, Ordering::AcqRel, Ordering::Relaxed)
-                        .is_ok()
-                    {
-                        trace!(aw, Some(id), Leave);
-                        return;
-                    }
-                    continue; // claimed meanwhile
-                }
-                if slot.idle_yield.load(Ordering::Relaxed)
-                    && slot
-                        .state
-                        .compare_exchange(IDLE, YIELD, Ordering::AcqRel, Ordering::Relaxed)
-                        .is_ok()
-                {
-                    let ran = rayon::yield_now();
-                    slot.state.store(IDLE, Ordering::Release);
-                    if !matches!(ran, Some(rayon::Yield::Executed)) {
-                        // Nothing to run: stay claimable for a moment.
-                        for _ in 0..64 {
-                            std::hint::spin_loop();
-                        }
-                    }
-                } else {
-                    backoff(&mut spins);
+                let ptr = slot.ptr.load(Ordering::Relaxed);
+                let arg = slot.arg.load(Ordering::Relaxed);
+                // SAFETY: the leader keeps the section alive until its
+                // completion counter reaches zero, which happens only after
+                // the call below decremented it.
+                if unsafe { (*ptr).pin } {
+                    // A pin section: save the previous mask before pinning.
+                    slot.saved.save_if_unpinned();
                 }
+                trace!(aw, Some(id), SectionBegin);
+                // SAFETY: as above; `aw` outlives this loop, so the wake after
+                // the last decrement does not touch the section.
+                unsafe { Section::execute_member(ptr, arg) };
+                trace!(aw, Some(id), SectionEnd);
             }
-            _ => backoff(&mut spins),
+            continue;
+        }
+        // Free (`0`) or lent (`RESERVED|LENT`): serve the pool.
+        if as_member {
+            as_member = false;
+            waiter = None;
+        }
+        if st & LENT != 0 && !was_lent {
+            was_lent = true;
+            // The thread serves foreign work now: undo our pin first.
+            slot.saved.restore();
+            trace!(aw, Some(id), LentBegin);
+        }
+        if aw.try_work(id) {
+            waiter = None;
+            continue;
+        }
+        let now = aw.release_epoch.load(Ordering::Relaxed);
+        if now != epoch {
+            // `Pool::release_idle`: stop spinning now.
+            epoch = now;
+            waiter = Some(Waiter::new(0));
+        }
+        let w = waiter.get_or_insert_with(|| {
+            let idle = slot.idle_spin_ns.load(Ordering::Relaxed);
+            Waiter::new(if idle == 0 { 0 } else { aw.waits.spin_polls })
+        });
+        if w.step() == Step::Sleep {
+            slot.lingering.store(false, Ordering::Release);
+            let qgen = aw.queue.gen();
+            let bgen = aw.bcast.gen();
+            slot.park.park_while(|| {
+                slot.state.load() == st
+                    && aw.queue.gen() == qgen
+                    && aw.bcast.gen() == bgen
+                    && !aw.work_for(id)
+            });
+            waiter = None;
         }
     }
 }
 
-/// Sleeps (still reserved) until a section is published, the reservation ends
-/// or the thread is lent. The handshake lives in [`Parker`].
+/// Sleeps (still reserved) until a section is published, the reservation ends,
+/// the member is lent, or the pool detaches it. The handshake lives in
+/// [`Parker`].
 #[cfg(feature = "parallel")]
 fn park_member(slot: &Slot, seen: usize) {
-    slot.park.park_while(|| {
-        slot.gen.load(Ordering::SeqCst) == seen
-            && slot.state.load(Ordering::SeqCst) == RESERVED
-            && !slot.lent.load(Ordering::SeqCst)
-    });
+    slot.park
+        .park_while(|| slot.gen.load(Ordering::SeqCst) == seen && slot.state.load() == RESERVED);
 }
 
 /// A unit of dispatched work, living on the leader's stack.
@@ -752,7 +718,7 @@ impl Section {
         }
         crate::park::Completion::finish(
             core::ptr::addr_of!((*ptr).done),
-            waits.as_ref().map(|w| &w.sync),
+            waits.as_ref().map(|w| &*w.sync),
         );
     }
 
@@ -821,7 +787,7 @@ impl Section {
             return;
         }
         let mut waiter = self.waiter();
-        self.done.wait(self.waits().map(|w| &w.sync), &mut waiter);
+        self.done.wait(self.waits().map(|w| &*w.sync), &mut waiter);
         if waiter.slept() {
             if let Some(w) = self.waits() {
                 w.join_sleeps.fetch_add(1, Ordering::Relaxed);
@@ -836,7 +802,7 @@ impl Section {
         let mut waiter = self.waiter();
         let passed =
             self.barrier
-                .arrive(&self.cancelled, self.waits().map(|w| &w.sync), &mut waiter);
+                .arrive(&self.cancelled, self.waits().map(|w| &*w.sync), &mut waiter);
         if waiter.slept() {
             if let Some(w) = self.waits() {
                 w.barrier_sleeps.fetch_add(1, Ordering::Relaxed);
diff --git a/src/exec.rs b/src/exec.rs
index e033e6e..c645a12 100644
--- a/src/exec.rs
+++ b/src/exec.rs
@@ -637,9 +637,10 @@ impl<'p> Exec<'p> {
     /// This is the only place a bare width exists. The token is consumed, the
     /// pool is entered once (inline when the token is serial, has a budget of
     /// one, or the caller already is a worker of the pool) and `f` receives the
-    /// budget, for example to build `faer::Par::rayon(width)` or to set a vendor
-    /// BLAS thread count. Whatever the library schedules with that width runs on
-    /// this pool, never on an ambient one. How the library divides the width is
+    /// budget, for example to set a vendor BLAS thread count. The callback runs
+    /// on a worker of this pool (inline when the caller is one); a library that
+    /// schedules with Rayon needs `external_rayon`
+    /// (feature `rayon`) instead. How the library divides the width is
     /// its own responsibility. Without the `parallel` feature, `f` runs inline
     /// and receives a width of one.
     ///
@@ -667,7 +668,7 @@ impl<'p> Exec<'p> {
                 let width = self.budget;
                 let _released = self.track.release();
                 // A team token lends its reserved members to the pool for the
-                // call: the library's Rayon work runs on them as well.
+                // call: tasks the callback queues on this pool run on them too.
                 let _lent = self.team.map(|t| LendGuard::new(t.awake, t.ids));
                 // The calling thread may itself be a pinned participant of this
                 // pool (the member that leads a `fork` child, or a token used
@@ -680,20 +681,48 @@ impl<'p> Exec<'p> {
         f(NonZeroUsize::MIN)
     }
 
+    /// Runs `f(width)` inside a private Rayon pool of this pool's width, so that
+    /// a callback whose library parallelizes with Rayon (`rayon::join`,
+    /// parallel iterators) gets `width` threads without starting Rayon's
+    /// process-global pool. The opt-in Rayon interop layer (feature `rayon`;
+    /// `docs/design/own-threads.md`): the Rayon pool's threads are separate
+    /// from this pool's workers, built once per pool when first needed.
+    /// A serial or budget-one token calls `f(1)` inline.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # #[cfg(feature = "rayon")] {
+    /// let pool = threadteam::Pool::builder().threads(2).build().unwrap();
+    /// let w = threadteam::Exec::new(&pool, 2).unwrap().external_rayon(|w| w.get());
+    /// assert_eq!(w, 2);
+    /// # }
+    /// ```
+    #[cfg(feature = "rayon")]
+    pub fn external_rayon<R: Send>(self, f: impl FnOnce(NonZeroUsize) -> R + Send) -> R {
+        match self.pool {
+            Some(pool) if self.budget.get() > 1 => {
+                let width = self.budget;
+                let _released = self.track.release();
+                pool.rayon().install(move || f(width))
+            }
+            _ => f(NonZeroUsize::MIN),
+        }
+    }
+
     /// Reserves `budget - 1` pool members for the scope of `f` and hands `f`
     /// the exclusive [`TeamExec`] authority over them and the calling thread.
     ///
     /// The calling thread is participant 0 (the leader); the members are
-    /// pool workers that stay reserved, spinning and serving no Rayon job,
+    /// pool workers that stay reserved, spinning and serving no other task,
     /// until `f` returns (or unwinds). A serial or budget-one token yields a
     /// team of one without touching the pool.
     ///
-    /// Acquisition never waits for a Rayon job that is already running. Idle
-    /// members of an earlier team (see [`WaitPolicy`]) are claimed with a
-    /// compare-and-swap; missing ones are requested from the pool, and the
-    /// call waits at most the pool's acquisition timeout
+    /// Acquisition never takes a worker that runs a task: free workers are
+    /// claimed with a compare-and-swap, and the call waits at most the pool's
+    /// acquisition timeout
     /// ([`PoolBuilder::acquire_timeout`](crate::PoolBuilder::acquire_timeout))
-    /// for idle workers to wake. If not all members are there by then, every
+    /// for busy ones to become free. If not all members are there by then, every
     /// tentative claim is released and nothing runs. Before `f` is called,
     /// every participant has acknowledged on its own thread.
     ///
diff --git a/src/ledger.rs b/src/ledger.rs
index 20ba8ad..8af7edc 100644
--- a/src/ledger.rs
+++ b/src/ledger.rs
@@ -145,14 +145,16 @@ pub fn installs(root: u64) -> usize {
 /// assert!(ledger::global_pool_unstarted());
 /// ```
 pub fn global_pool_unstarted() -> bool {
-    #[cfg(feature = "parallel")]
+    // threadteam starts no Rayon pool at all unless the opt-in `rayon` feature
+    // is on; then the process-global one must still be unstarted.
+    #[cfg(feature = "rayon")]
     {
         rayon::ThreadPoolBuilder::new()
             .num_threads(1)
             .build_global()
             .is_ok()
     }
-    #[cfg(not(feature = "parallel"))]
+    #[cfg(not(feature = "rayon"))]
     {
         true
     }
diff --git a/src/lib.rs b/src/lib.rs
index 326820b..ddbfe7c 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -9,12 +9,16 @@
 //! * [`Exec::new`] mints a token from a pool; [`Exec::serial`] needs none.
 //! * A token is not `Clone`/`Copy`; entries consume it; splits conserve slots.
 //! * Serial, budget-one and one-task entries run inline and never reach any
-//!   scheduler, so the process-global Rayon pool is never started implicitly.
+//!   scheduler; no worker thread starts before a pool is built, and Rayon is
+//!   not used at all unless the opt-in `rayon` feature is on.
 //!
 //! # Features
 //!
-//! * `parallel` (default): run on a private pool. Without it the same types
-//!   exist, every pool has width 1 and every entry runs inline.
+//! * `parallel` (default): run on the pool's own worker threads, leased from a
+//!   process-wide reserve (`docs/design/own-threads.md`). Without it the same
+//!   types exist, every pool has width 1 and every entry runs inline.
+//! * `rayon` (opt-in): `Exec::external_rayon`, a private Rayon pool per pool
+//!   for callbacks that parallelize with Rayon.
 //! * `ledger`: test support, see the `ledger` module (compiled only with this feature).
 //!
 //! # Examples
@@ -60,6 +64,11 @@ pub mod test_hooks;
 #[cfg(feature = "trace")]
 pub mod trace;
 mod track;
+#[cfg(feature = "parallel")]
+mod worker;
+#[cfg(feature = "parallel")]
+#[doc(hidden)]
+pub use worker::spawned_workers;
 
 pub use cost::{pays_at, width_for_by, DispatchCosts, DispatchKind, HostClass, WidthCosts, PAYS};
 pub use error::{Error, Refused};
@@ -69,7 +78,7 @@ pub use exec::Exec;
 pub use park::Parker;
 #[cfg(loom)]
 #[doc(hidden)]
-pub use park::{Barrier, Completion, Waiter};
+pub use park::{Barrier, Batch, Broadcast, BroadcastList, Completion, Queue, SlotState, Waiter};
 pub use policy::{raise_current_thread_qos, Qos, WaitOverride, WaitPolicy};
 #[doc(hidden)]
 pub use pool::WaitCounters;
diff --git a/src/park.rs b/src/park.rs
index 4fddb34..a41df5d 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -19,6 +19,7 @@
 //! sequences, not a total order of SeqCst accesses, because `loom` does not model
 //! the latter and the exact code is model-checked. With nobody parked a wake is
 //! one uncontended atomic read-modify-write.
+#![cfg_attr(not(feature = "parallel"), allow(dead_code))]
 
 use crate::sync::{AtomicBool, AtomicUsize, Condvar, Mutex, Ordering};
 
@@ -240,6 +241,12 @@ impl Completion {
         self.remaining.0.load(Ordering::Acquire) == 0
     }
 
+    /// Whether every share has finished, read with the ordering of the
+    /// `Parker` protocol (for predicates evaluated under its lock).
+    pub fn is_done_now(&self) -> bool {
+        self.remaining.0.load(Ordering::SeqCst) == 0
+    }
+
     /// One share finished; the last one wakes a sleeping leader through `sync`.
     ///
     /// # Safety
@@ -331,3 +338,492 @@ impl Barrier {
         }
     }
 }
+
+// ---------------------------------------------------------------------------
+// The native scheduler's shared state (`docs/design/own-threads.md`): a slot's
+// state word, the pool's queue of stack batches, and its broadcast list. The
+// exact code is what `loom` checks.
+
+/// The slot is reserved by a team.
+pub(crate) const RESERVED: usize = 1;
+/// The reserved member is lent to the pool's queue (`Exec::external`).
+pub(crate) const LENT: usize = 2;
+/// The worker runs a task or a broadcast share.
+pub(crate) const BUSY: usize = 4;
+/// The pool is being dropped: the worker acknowledges and leaves.
+pub(crate) const DETACH: usize = 8;
+
+/// The state word of one worker slot: bits [`RESERVED`], [`LENT`], [`BUSY`],
+/// [`DETACH`]. A team reserves a slot only from `0`; a worker takes work only
+/// from `0` (free) or `RESERVED|LENT` (lent), before it removes anything from a
+/// queue; ending work clears `BUSY` only, releasing clears `RESERVED|LENT`
+/// only, so neither erases the other's bits or `DETACH`.
+#[doc(hidden)]
+pub struct SlotState(AtomicUsize);
+
+impl Default for SlotState {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl SlotState {
+    /// A free slot.
+    pub fn new() -> Self {
+        SlotState(AtomicUsize::new(0))
+    }
+
+    /// The current bits.
+    pub fn load(&self) -> usize {
+        self.0.load(Ordering::Acquire)
+    }
+
+    /// Reserves a free, idle slot for a team (`0 -> RESERVED`).
+    pub fn try_reserve(&self) -> bool {
+        self.0
+            .compare_exchange(0, RESERVED, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+    }
+
+    /// The worker takes work: `0 -> BUSY`, or `RESERVED|LENT -> RESERVED|LENT|BUSY`.
+    pub fn try_take(&self) -> bool {
+        let cur = self.0.load(Ordering::Acquire);
+        if cur != 0 && cur != RESERVED | LENT {
+            return false;
+        }
+        self.0
+            .compare_exchange(cur, cur | BUSY, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+    }
+
+    /// The worker finished its work (clears `BUSY` only).
+    pub fn end_busy(&self) {
+        self.0.fetch_and(!BUSY, Ordering::SeqCst);
+    }
+
+    /// The team releases the slot (clears `RESERVED|LENT` only); a worker still
+    /// running a lent task stays `BUSY` and is claimable only once it finishes.
+    pub fn release(&self) {
+        self.0.fetch_and(!(RESERVED | LENT), Ordering::SeqCst);
+    }
+
+    /// Lends a reserved member to the pool's queue, or takes it back.
+    pub fn set_lent(&self, on: bool) {
+        if on {
+            self.0.fetch_or(LENT, Ordering::SeqCst);
+        } else {
+            self.0.fetch_and(!LENT, Ordering::SeqCst);
+        }
+    }
+
+    /// The pool is being dropped.
+    pub fn detach(&self) {
+        self.0.fetch_or(DETACH, Ordering::SeqCst);
+    }
+}
+
+/// A batch of `tasks` tasks published on a pool's [`Queue`]: a stack object of
+/// its owner, linked into the queue until its last index is claimed, alive
+/// until its last task completed (the owner waits for that).
+#[doc(hidden)]
+pub struct Batch {
+    run: unsafe fn(*const (), usize),
+    data: *const (),
+    tasks: usize,
+    /// Next unclaimed index; read and written under the queue lock only.
+    next: AtomicUsize,
+    /// Next batch in the queue; under the queue lock only.
+    link: core::cell::Cell<*const Batch>,
+    /// Tasks not yet completed.
+    pub done: Completion,
+    /// Whom the last completion wakes (the owner's own parker, or the pool's).
+    waker: *const std::sync::Arc<Parker>,
+    /// First panic payload, boxed twice so that it fits an `AtomicPtr`.
+    panic: core::sync::atomic::AtomicPtr<Box<dyn std::any::Any + Send>>,
+}
+
+// SAFETY: `data` points to a `Sync` closure of the owner that outlives the
+// batch's tasks; `waker` points to an `Arc` the owner keeps alive while it
+// waits; `link` is touched under the queue lock only.
+unsafe impl Sync for Batch {}
+unsafe impl Send for Batch {}
+
+impl Batch {
+    /// A batch of `tasks` calls `run(data, index)`, waking `waker` when the
+    /// last one completes.
+    ///
+    /// # Safety
+    ///
+    /// `run` and `data` belong together and stay valid until the batch is
+    /// done; `waker` outlives the owner's wait for the batch.
+    pub unsafe fn new(
+        run: unsafe fn(*const (), usize),
+        data: *const (),
+        tasks: usize,
+        waker: *const std::sync::Arc<Parker>,
+    ) -> Self {
+        Batch {
+            run,
+            data,
+            tasks,
+            next: AtomicUsize::new(0),
+            link: core::cell::Cell::new(core::ptr::null()),
+            done: Completion::new(tasks),
+            waker,
+            panic: core::sync::atomic::AtomicPtr::new(core::ptr::null_mut()),
+        }
+    }
+
+    /// Runs claimed task `index` and completes it; a panic is caught and kept.
+    ///
+    /// # Safety
+    ///
+    /// `this` is a batch whose task `index` the caller claimed. It is not
+    /// dereferenced after the final decrement.
+    pub unsafe fn run_claimed(this: *const Batch, index: usize) {
+        let b = &*this;
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| (b.run)(b.data, index)));
+        if let Err(p) = r {
+            let fresh = Box::into_raw(Box::new(p));
+            if b.panic
+                .compare_exchange(
+                    core::ptr::null_mut(),
+                    fresh,
+                    core::sync::atomic::Ordering::AcqRel,
+                    core::sync::atomic::Ordering::Acquire,
+                )
+                .is_err()
+            {
+                drop(Box::from_raw(fresh));
+            }
+        }
+        // Keep the waker alive across the final decrement: after it the owner
+        // may return and free the batch.
+        let waker = std::sync::Arc::clone(&*b.waker);
+        Completion::finish(core::ptr::addr_of!((*this).done), Some(&waker));
+    }
+
+    /// The first panic of a task, once the batch is done.
+    pub fn take_panic(&self) -> Option<Box<dyn std::any::Any + Send>> {
+        let p = self
+            .panic
+            .swap(core::ptr::null_mut(), core::sync::atomic::Ordering::AcqRel);
+        // SAFETY: a non-null value was stored by `run_claimed` from
+        // `Box::into_raw` and `swap` hands it to exactly one taker.
+        (!p.is_null()).then(|| *unsafe { Box::from_raw(p) })
+    }
+}
+
+impl Drop for Batch {
+    fn drop(&mut self) {
+        drop(self.take_panic());
+    }
+}
+
+/// A pool's queue of [`Batch`]es: an intrusive list under a lock, newest
+/// first. Claims happen under the lock, and the claim of a batch's last index
+/// unlinks it, so nobody reaches a batch after it was unlinked; its owner frees
+/// it only once all of its tasks completed.
+#[doc(hidden)]
+pub struct Queue {
+    head: Mutex<QueueHead>,
+    /// Bumped (SeqCst) on every publication: what sleeping workers watch.
+    gen: AtomicUsize,
+    /// Linked batches, for a lock-free emptiness hint.
+    linked: AtomicUsize,
+}
+
+struct QueueHead(*const Batch);
+// SAFETY: the pointer is only dereferenced under the lock (see `Queue`).
+unsafe impl Send for QueueHead {}
+
+impl Default for Queue {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Queue {
+    /// An empty queue. The lock is touched once here: some platforms allocate
+    /// it lazily, and no later operation should allocate.
+    pub fn new() -> Self {
+        let q = Queue {
+            head: Mutex::new(QueueHead(core::ptr::null())),
+            gen: AtomicUsize::new(0),
+            linked: AtomicUsize::new(0),
+        };
+        drop(q.head.lock().unwrap_or_else(|e| e.into_inner()));
+        q
+    }
+
+    /// The publication counter.
+    pub fn gen(&self) -> usize {
+        self.gen.load(Ordering::SeqCst)
+    }
+
+    /// Whether any batch has unclaimed tasks (a hint).
+    pub fn has_work(&self) -> bool {
+        self.linked.load(Ordering::Acquire) != 0
+    }
+
+    /// Links `b` (with at least one task); the caller then wakes the workers.
+    pub fn publish(&self, b: &Batch) {
+        debug_assert!(b.tasks > 0);
+        let mut head = self.head.lock().unwrap_or_else(|e| e.into_inner());
+        b.link.set(head.0);
+        head.0 = b as *const Batch;
+        self.linked.fetch_add(1, Ordering::AcqRel);
+        drop(head);
+        self.gen.fetch_add(1, Ordering::SeqCst);
+    }
+
+    /// Claims the next index of the newest batch; the caller must run it with
+    /// [`Batch::run_claimed`].
+    pub fn claim(&self) -> Option<(*const Batch, usize)> {
+        let mut head = self.head.lock().unwrap_or_else(|e| e.into_inner());
+        let b = head.0;
+        if b.is_null() {
+            return None;
+        }
+        // SAFETY: a linked batch is alive (see `Queue`).
+        let batch = unsafe { &*b };
+        let i = batch.next.load(Ordering::Relaxed);
+        batch.next.store(i + 1, Ordering::Relaxed);
+        if i + 1 == batch.tasks {
+            head.0 = batch.link.get();
+            self.linked.fetch_sub(1, Ordering::AcqRel);
+        }
+        Some((b, i))
+    }
+
+    /// Claims the next index of the caller's own batch `b`, wherever it is in
+    /// the list; `None` once all of its indices are claimed.
+    pub fn claim_own(&self, b: &Batch) -> Option<usize> {
+        let mut head = self.head.lock().unwrap_or_else(|e| e.into_inner());
+        let i = b.next.load(Ordering::Relaxed);
+        if i >= b.tasks {
+            return None;
+        }
+        b.next.store(i + 1, Ordering::Relaxed);
+        if i + 1 == b.tasks {
+            // Unlink `b`: walk the (short) list to its predecessor.
+            let me = b as *const Batch;
+            if head.0 == me {
+                head.0 = b.link.get();
+            } else {
+                let mut cur = head.0;
+                // SAFETY: linked batches are alive; `b` is linked (it still
+                // had unclaimed indices).
+                unsafe {
+                    while (*cur).link.get() != me {
+                        cur = (*cur).link.get();
+                    }
+                    (*cur).link.set(b.link.get());
+                }
+            }
+            self.linked.fetch_sub(1, Ordering::AcqRel);
+        }
+        Some(i)
+    }
+}
+
+/// A broadcast published on a pool's [`BroadcastList`]: share `i` for every
+/// worker `i < budget`. A stack object of its caller, linked until its caller
+/// unlinks it after all shares completed.
+#[doc(hidden)]
+pub struct Broadcast {
+    run: unsafe fn(*const (), usize),
+    data: *const (),
+    budget: usize,
+    /// Publication number; written under the list lock before linking.
+    seq: core::cell::Cell<u64>,
+    link: core::cell::Cell<*const Broadcast>,
+    /// Shares not yet completed.
+    pub done: Completion,
+    waker: *const std::sync::Arc<Parker>,
+    panic: core::sync::atomic::AtomicPtr<Box<dyn std::any::Any + Send>>,
+}
+
+// SAFETY: as for `Batch`; `seq` and `link` are touched under the list lock.
+unsafe impl Sync for Broadcast {}
+unsafe impl Send for Broadcast {}
+
+impl Broadcast {
+    /// A broadcast of `run(data, i)` to workers `0..budget`.
+    ///
+    /// # Safety
+    ///
+    /// As [`Batch::new`].
+    pub unsafe fn new(
+        run: unsafe fn(*const (), usize),
+        data: *const (),
+        budget: usize,
+        waker: *const std::sync::Arc<Parker>,
+    ) -> Self {
+        Broadcast {
+            run,
+            data,
+            budget,
+            seq: core::cell::Cell::new(0),
+            link: core::cell::Cell::new(core::ptr::null()),
+            done: Completion::new(budget),
+            waker,
+            panic: core::sync::atomic::AtomicPtr::new(core::ptr::null_mut()),
+        }
+    }
+
+    /// Runs worker `i`'s share and completes it; a panic is caught and kept.
+    ///
+    /// # Safety
+    ///
+    /// `this` is a linked broadcast that targets `i` and whose share `i` the
+    /// caller took; it is not dereferenced after the final decrement.
+    pub unsafe fn run_share(this: *const Broadcast, i: usize) {
+        let b = &*this;
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| (b.run)(b.data, i)));
+        if let Err(p) = r {
+            let fresh = Box::into_raw(Box::new(p));
+            if b.panic
+                .compare_exchange(
+                    core::ptr::null_mut(),
+                    fresh,
+                    core::sync::atomic::Ordering::AcqRel,
+                    core::sync::atomic::Ordering::Acquire,
+                )
+                .is_err()
+            {
+                drop(Box::from_raw(fresh));
+            }
+        }
+        let waker = std::sync::Arc::clone(&*b.waker);
+        Completion::finish(core::ptr::addr_of!((*this).done), Some(&waker));
+    }
+
+    /// The first panic of a share, once the broadcast is done.
+    pub fn take_panic(&self) -> Option<Box<dyn std::any::Any + Send>> {
+        let p = self
+            .panic
+            .swap(core::ptr::null_mut(), core::sync::atomic::Ordering::AcqRel);
+        // SAFETY: as in `Batch::take_panic`.
+        (!p.is_null()).then(|| *unsafe { Box::from_raw(p) })
+    }
+}
+
+impl Drop for Broadcast {
+    fn drop(&mut self) {
+        drop(self.take_panic());
+    }
+}
+
+/// A pool's broadcasts in publication order. Every worker runs the broadcasts
+/// that target it in that order (its own sequence cursor), so concurrent
+/// broadcasts reach every worker in the same order. Publication and unlinking
+/// take the lock; completion does not, so nobody waits while holding it.
+#[doc(hidden)]
+pub struct BroadcastList {
+    inner: Mutex<BroadcastHead>,
+    /// Bumped (SeqCst) on every publication.
+    gen: AtomicUsize,
+}
+
+struct BroadcastHead {
+    head: *const Broadcast,
+    tail: *const Broadcast,
+    next_seq: u64,
+}
+// SAFETY: the pointers are only dereferenced under the lock.
+unsafe impl Send for BroadcastHead {}
+
+impl Default for BroadcastList {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl BroadcastList {
+    /// An empty list (the lock is touched once, as in [`Queue::new`]).
+    pub fn new() -> Self {
+        let l = BroadcastList {
+            inner: Mutex::new(BroadcastHead {
+                head: core::ptr::null(),
+                tail: core::ptr::null(),
+                next_seq: 0,
+            }),
+            gen: AtomicUsize::new(0),
+        };
+        drop(l.inner.lock().unwrap_or_else(|e| e.into_inner()));
+        l
+    }
+
+    /// The publication counter.
+    pub fn gen(&self) -> usize {
+        self.gen.load(Ordering::SeqCst)
+    }
+
+    /// Appends `b`; the caller then wakes the workers.
+    pub fn publish(&self, b: &Broadcast) {
+        let mut l = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+        b.seq.set(l.next_seq);
+        l.next_seq += 1;
+        b.link.set(core::ptr::null());
+        let me = b as *const Broadcast;
+        if l.tail.is_null() {
+            l.head = me;
+        } else {
+            // SAFETY: linked broadcasts are alive.
+            unsafe { (*l.tail).link.set(me) };
+        }
+        l.tail = me;
+        drop(l);
+        self.gen.fetch_add(1, Ordering::SeqCst);
+    }
+
+    /// The next broadcast for worker `i` at or after its cursor `seq`, which
+    /// moves past every broadcast it inspects. The caller runs the returned
+    /// share with [`Broadcast::run_share`].
+    pub fn next_for(&self, i: usize, seq: &mut u64) -> Option<*const Broadcast> {
+        let l = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+        let mut cur = l.head;
+        while !cur.is_null() {
+            // SAFETY: linked broadcasts are alive.
+            let b = unsafe { &*cur };
+            if b.seq.get() >= *seq {
+                *seq = b.seq.get() + 1;
+                if i < b.budget {
+                    return Some(cur);
+                }
+            }
+            cur = b.link.get();
+        }
+        None
+    }
+
+    /// Whether a broadcast at or after `seq` exists (a hint, lock-free reads
+    /// of the counter only).
+    pub fn has_after(&self, seq: u64) -> bool {
+        (self.gen.load(Ordering::Acquire) as u64) > seq
+    }
+
+    /// Unlinks `b` once all of its shares completed.
+    pub fn unlink(&self, b: &Broadcast) {
+        let mut l = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+        let me = b as *const Broadcast;
+        let mut prev: *const Broadcast = core::ptr::null();
+        let mut cur = l.head;
+        while cur != me {
+            prev = cur;
+            // SAFETY: `b` is linked, so the walk reaches it; links are alive.
+            cur = unsafe { (*cur).link.get() };
+        }
+        let next = b.link.get();
+        if prev.is_null() {
+            l.head = next;
+        } else {
+            // SAFETY: as above.
+            unsafe { (*prev).link.set(next) };
+        }
+        if l.tail == me {
+            l.tail = prev;
+        }
+    }
+}
diff --git a/src/pin.rs b/src/pin.rs
index b1ae886..28c81d4 100644
--- a/src/pin.rs
+++ b/src/pin.rs
@@ -126,6 +126,11 @@ impl SavedMask {
         }
     }
 
+    /// Whether a pin is still in effect (a restore failed or is pending).
+    pub(crate) fn is_pinned(&self) -> bool {
+        self.pinned.load(Ordering::Relaxed)
+    }
+
     /// Restores the saved mask on the calling thread, if this member is pinned.
     ///
     /// Best effort: when the kernel refuses the saved mask (a cpuset changed
diff --git a/src/policy.rs b/src/policy.rs
index 64d2742..08112c7 100644
--- a/src/policy.rs
+++ b/src/policy.rs
@@ -4,24 +4,19 @@ use core::time::Duration;
 
 /// How an idle member behaves after its reservation ended.
 ///
-/// A member that is *reserved* neither runs unrelated Rayon jobs nor leaves
+/// A member that is *reserved* neither runs unrelated tasks nor leaves
 /// on a timeout, whatever the policy says: a policy only governs the idle
 /// interval after the root reservation of a team ends. The interval is
 /// measured from that moment, not from the last time the member computed.
 ///
-/// * `idle_spin`: how long an idle member keeps spinning, ready to be claimed
-///   again without a Rayon wake-up, before it returns its thread to Rayon.
-///   Zero returns it immediately. The pool's spin budget of polls
-///   ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)) bounds it
-///   too, whichever ends first.
-/// * `idle_runs_rayon`: whether the spinning member runs queued Rayon jobs in
-///   the meantime. When it does, a job it picked up runs to completion
-///   (including nested work) before the member is claimable again, and an
-///   acquisition that finds the member in such a job refuses instead of
-///   waiting for it.
-///
-/// While a member spins with `idle_runs_rayon == false`, its thread serves no
-/// Rayon job of the pool for up to `idle_spin`.
+/// * `idle_spin`: whether an idle member keeps spinning, ready to be claimed
+///   again without a wake-up, before it sleeps. Zero puts it to sleep at once;
+///   any other value lets it spin for the pool's spin budget of polls
+///   ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)).
+/// * `idle_runs_rayon`: **no effect** since threadteam runs its own worker
+///   threads (`docs/design/own-threads.md`): an idle worker always serves the
+///   pool's queued tasks, and a worker that runs one is not claimable until it
+///   finishes. Kept so that existing code compiles.
 ///
 /// # Examples
 ///
@@ -44,7 +39,7 @@ pub struct WaitPolicy {
 }
 
 impl WaitPolicy {
-    /// The pool default: spin for 200 ms, run no Rayon jobs while idle.
+    /// The pool default: an idle spin of 200 ms (bounded by the spin budget).
     pub const DEFAULT: WaitPolicy = WaitPolicy {
         idle_spin: Duration::from_millis(200),
         idle_runs_rayon: false,
@@ -58,12 +53,12 @@ impl WaitPolicy {
         }
     }
 
-    /// Spin time of an unreserved idle member before it returns to Rayon.
+    /// Spin time of an unreserved idle member before it sleeps.
     pub const fn idle_spin(&self) -> Duration {
         self.idle_spin
     }
 
-    /// Whether an unreserved idle member runs Rayon jobs while it spins.
+    /// The `idle_runs_rayon` setting (no effect; see [`WaitPolicy`]).
     pub const fn idle_runs_rayon(&self) -> bool {
         self.idle_runs_rayon
     }
@@ -122,7 +117,7 @@ impl WaitOverride {
         self
     }
 
-    /// Overrides whether idle members run Rayon jobs.
+    /// Overrides `idle_runs_rayon` (no effect; see [`WaitPolicy`]).
     #[must_use]
     pub const fn idle_runs_rayon(mut self, on: bool) -> Self {
         self.idle_runs_rayon = Some(on);
diff --git a/src/pool.rs b/src/pool.rs
index 8bc2385..0261df4 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -82,14 +82,30 @@ const SPIN_POLLS_DEFAULT: u32 = if cfg!(target_arch = "aarch64") {
 /// # Ok::<(), threadteam::Error>(())
 /// ```
 pub struct Pool {
-    // Field order matters: `inner` is dropped (shutdown signalled) before
-    // `joiner` waits for the threads.
+    /// The leased workers (`docs/design/own-threads.md`).
     #[cfg(feature = "parallel")]
-    pub(crate) inner: rayon::ThreadPool,
+    workers: Vec<Arc<crate::worker::WorkerCtl>>,
+    /// Join handles of dedicated workers (empty for shared ones).
     #[cfg(feature = "parallel")]
-    _joiner: Joiner,
+    joins: std::sync::Mutex<Vec<std::thread::JoinHandle<()>>>,
     pub(crate) width: NonZeroUsize,
     pub(crate) awake: Arc<Awake>,
+    /// The private Rayon pool of `Exec::external_rayon` (feature `rayon`).
+    #[cfg(feature = "rayon")]
+    rayon: std::sync::OnceLock<rayon::ThreadPool>,
+}
+
+#[cfg(feature = "rayon")]
+impl Pool {
+    /// This pool's private Rayon pool, built on first use.
+    pub(crate) fn rayon(&self) -> &rayon::ThreadPool {
+        self.rayon.get_or_init(|| {
+            rayon::ThreadPoolBuilder::new()
+                .num_threads(self.width.get())
+                .build()
+                .expect("a private Rayon pool for external_rayon")
+        })
+    }
 }
 
 impl Pool {
@@ -139,10 +155,10 @@ impl Pool {
         self.awake.defaults
     }
 
-    /// Asks idle team members to return their threads to Rayon now.
+    /// Asks idle team members to stop spinning and sleep now.
     ///
-    /// Members that are idle leave at once; members that are reserved leave
-    /// when their reservation ends, so this never revokes a live
+    /// Members that are idle sleep at once; members that are reserved stop
+    /// spinning after their reservation ends, so this never revokes a live
     /// [`TeamExec`](crate::TeamExec). The call does not wait for anything,
     /// so it is safe to make from inside a reservation. A team acquired later
     /// starts its members afresh.
@@ -206,7 +222,7 @@ impl Pool {
     }
 
     /// Number of workers currently kept awake as team members, reserved or
-    /// idle. Zero once idle members returned to Rayon. A diagnostic: the value
+    /// idle and still awake. Zero once released members went to sleep. A diagnostic: the value
     /// can change at any moment.
     ///
     /// # Examples
@@ -223,32 +239,38 @@ impl Pool {
 
 impl Drop for Pool {
     fn drop(&mut self) {
-        // Idle members leave their loops so that the workers can be joined.
         self.awake.shutdown.store(true, Ordering::Release);
-    }
-}
-
-/// The worker threads of a pool, joined when it is dropped.
-#[cfg(feature = "parallel")]
-struct Joiner {
-    handles: std::sync::Arc<std::sync::Mutex<Vec<std::thread::JoinHandle<()>>>>,
-}
-
-#[cfg(feature = "parallel")]
-impl Drop for Joiner {
-    fn drop(&mut self) {
-        let handles = match self.handles.lock() {
-            Ok(mut guard) => std::mem::take(&mut *guard),
-            Err(poisoned) => std::mem::take(&mut *poisoned.into_inner()),
-        };
-        let me = std::thread::current().id();
-        // A worker of this pool cannot join itself: skip joining entirely.
-        if handles.iter().any(|h| h.thread().id() == me) {
-            return;
-        }
-        for handle in handles {
-            // A worker that panicked has still exited; nothing to report.
-            let _ = handle.join();
+        #[cfg(feature = "parallel")]
+        {
+            // Detach every worker, then wait for their acknowledgements: after
+            // its acknowledgement a worker touches nothing of this pool. A
+            // worker of this pool that drops it (its own task owned the pool)
+            // acknowledges once that task returns; nobody waits for it.
+            for s in &*self.awake.slots {
+                s.state.detach();
+                s.park.wake();
+            }
+            let me = self.awake.slot_of_current();
+            for (i, s) in self.awake.slots.iter().enumerate() {
+                // A worker that has not attached yet (a dedicated one still in
+                // its start hook) attaches, sees `DETACH` and acknowledges too.
+                if Some(i) == me {
+                    continue;
+                }
+                self.awake
+                    .waits
+                    .sync
+                    .park_while(|| !s.acked.load(Ordering::SeqCst));
+            }
+            let joins = std::mem::take(&mut *self.joins.lock().unwrap_or_else(|e| e.into_inner()));
+            let my_thread = std::thread::current().id();
+            for j in joins {
+                if j.thread().id() != my_thread {
+                    // A worker that panicked has still exited.
+                    let _ = j.join();
+                }
+            }
+            drop(core::mem::take(&mut self.workers));
         }
     }
 }
@@ -373,10 +395,9 @@ impl PoolBuilder {
         self
     }
 
-    /// Default spin time of an unreserved idle team member before it returns
-    /// its thread to Rayon. Defaults to 200 ms; zero returns it immediately.
-    /// The member also returns once it has polled for the pool's spin budget
-    /// ([`spin_polls`](Self::spin_polls)), whichever comes first.
+    /// Default idle spin of an unreserved team member before it sleeps.
+    /// Defaults to 200 ms; zero puts it to sleep immediately. Any nonzero value
+    /// lets it spin for the pool's spin budget ([`spin_polls`](Self::spin_polls)).
     ///
     /// Operations may override it with [`WaitOverride`](crate::WaitOverride).
     /// A reserved member never leaves on a timeout.
@@ -396,11 +417,9 @@ impl PoolBuilder {
         self
     }
 
-    /// Default for whether unreserved idle members run Rayon jobs while they
-    /// spin. Defaults to `false`: native team execution keeps them for the
-    /// next reservation. `true` is the compatibility mode in which an idle
-    /// member serves Rayon work (an acquisition then refuses a member that is
-    /// inside such a job instead of waiting for it).
+    /// **No effect** since threadteam runs its own worker threads
+    /// (`docs/design/own-threads.md`): an idle worker always serves the pool's
+    /// queued tasks. Kept so that existing code compiles.
     ///
     /// # Examples
     ///
@@ -509,7 +528,8 @@ impl PoolBuilder {
     /// coordinating thread, so that thread must keep its CPU set.
     ///
     /// A member saves its previous mask in its own slot and restores it
-    /// *itself* before it stops being reserved: before it returns to Rayon, and
+    /// *itself* before it stops being reserved: before it serves the pool's
+    /// queue again, before it leaves the pool, and
     /// before its thread serves work that is not its team's — while it is lent
     /// by [`Exec::external`](crate::Exec::external), and when it runs such work
     /// itself (a member that leads a `fork` child and calls `external`). No
@@ -574,10 +594,8 @@ impl PoolBuilder {
     /// and then sleeps until woken (`docs/design/waiting.md`; the shape of
     /// libgomp's `GOMP_SPINCOUNT`). A count, so a waiter that is descheduled
     /// does not spend it while it waits for its CPU. Zero sleeps after the
-    /// yields. An oversubscribed scope, or a pool whose waiters were recently
-    /// descheduled, uses at most 100 polls. It also bounds how long an idle
-    /// member released by a team keeps polling before it returns to Rayon,
-    /// together with [`idle_spin`](Self::idle_spin).
+    /// yields. An oversubscribed scope uses at most 100 polls. It also bounds
+    /// how long an idle worker keeps polling before it sleeps.
     ///
     /// # Examples
     ///
@@ -621,61 +639,50 @@ impl PoolBuilder {
         let n = self
             .threads
             .unwrap_or_else(|| std::thread::available_parallelism().map_or(1, NonZeroUsize::get));
-        let handles = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
-        let sink = std::sync::Arc::clone(&handles);
-        let qos = self.qos.or(Qos::PLATFORM_DEFAULT);
-        let mut builder = rayon::ThreadPoolBuilder::new()
-            .num_threads(n)
-            .stack_size(self.stack_size)
-            .spawn_handler(move |thread| {
-                let mut b = std::thread::Builder::new();
-                if let Some(name) = thread.name() {
-                    b = b.name(name.to_owned());
-                }
-                if let Some(size) = thread.stack_size() {
-                    b = b.stack_size(size);
-                }
-                let handle = b.spawn(move || {
-                    if let Some(q) = qos {
-                        q.apply_to_current_thread();
-                    }
-                    thread.run()
-                })?;
-                match sink.lock() {
-                    Ok(mut guard) => guard.push(handle),
-                    Err(poisoned) => poisoned.into_inner().push(handle),
-                }
-                Ok(())
+        // Workers of the reserve have the default stack, the platform's QoS
+        // and no hooks; any other setting gets dedicated workers.
+        let shared = self.thread_name.is_none()
+            && self.on_start.is_none()
+            && self.stack_size == DEFAULT_STACK_BYTES
+            && self.qos.is_none();
+        let on_start: Option<Arc<dyn Fn(usize) + Send + Sync>> = self.on_start.map(Arc::from);
+        let how = crate::worker::Spawn {
+            stack: self.stack_size,
+            name: self.thread_name.as_deref(),
+            on_start,
+            qos: self.qos,
+            shared,
+        };
+        let (workers, joins) =
+            crate::worker::obtain(n, &how).map_err(|e| Error::PoolBuild(e.to_string()))?;
+        let width = NonZeroUsize::new(n).unwrap_or(NonZeroUsize::MIN);
+        let awake = Arc::new(Awake::new(
+            width.get(),
+            self.wait,
+            self.acquire_timeout,
+            self.costs,
+            self.pin_participants,
+            self.spin_polls,
+        ));
+        // A worker takes the caller's CPU set, as a thread it spawned would.
+        let mask = crate::pin::read_here();
+        for (id, w) in workers.iter().enumerate() {
+            w.assign(crate::worker::Lease {
+                aw: Arc::clone(&awake),
+                id,
+                mask,
             });
-        if let Some(name) = self.thread_name {
-            builder = builder.thread_name(name);
-        }
-        if let Some(hook) = self.on_start {
-            builder = builder.start_handler(hook);
         }
-        // On failure `builder` drops its handler, but threads already started
-        // are signalled by rayon and detached; join them here for determinism.
-        let built = builder.build();
-        let inner = match built {
-            Ok(inner) => inner,
-            Err(e) => {
-                drop(Joiner { handles });
-                return Err(Error::PoolBuild(e.to_string()));
-            }
-        };
-        let width = NonZeroUsize::new(inner.current_num_threads()).unwrap_or(NonZeroUsize::MIN);
+        // Workers attach on their own (after a start hook, for dedicated
+        // ones); until then a slot is not claimable by a team, and queued work
+        // waits for them.
         Ok(Pool {
-            inner,
-            _joiner: Joiner { handles },
+            workers,
+            joins: std::sync::Mutex::new(joins),
             width,
-            awake: Arc::new(Awake::new(
-                width.get(),
-                self.wait,
-                self.acquire_timeout,
-                self.costs,
-                self.pin_participants,
-                self.spin_polls,
-            )),
+            awake,
+            #[cfg(feature = "rayon")]
+            rayon: std::sync::OnceLock::new(),
         })
     }
 
@@ -714,23 +721,83 @@ mod tests {
     use std::time::Duration;
 
     /// The last reference is dropped on a worker of the pool itself: the drop
-    /// must not wait for its own thread.
+    /// must not wait for its own thread (it detaches the others, waits for
+    /// their acknowledgements and skips itself; the worker acknowledges and
+    /// leaves after its task). Public entries always borrow the pool while
+    /// their tasks run, so the task here is published on the pool's queue
+    /// directly, as the Rayon version used `spawn`.
     #[test]
     fn drop_from_a_worker_of_the_pool_does_not_hang() {
-        let pool = Arc::new(Pool::builder().threads(2).build().unwrap());
-        let last = Arc::clone(&pool);
-        let (gate_tx, gate_rx) = mpsc::channel::<()>();
+        for shared in [true, false] {
+            let mut b = Pool::builder().threads(2);
+            if !shared {
+                b = b.thread_name(|i| format!("self-drop-{i}"));
+            }
+            let pool = Arc::new(b.build().unwrap());
+            let aw = Arc::clone(&pool.awake);
+            let last = std::sync::Mutex::new(Some(Arc::clone(&pool)));
+            let task = |_: usize| {
+                // The last reference: runs `Pool::drop` on this worker.
+                drop(last.lock().unwrap().take());
+            };
+            unsafe fn call<F: Fn(usize)>(data: *const (), i: usize) {
+                (*data.cast::<F>())(i)
+            }
+            fn call_of<F: Fn(usize)>(_: &F) -> unsafe fn(*const (), usize) {
+                call::<F>
+            }
+            // SAFETY: `task` and the waker (held by `aw`) outlive the batch,
+            // which this test waits for before they go out of scope.
+            let batch = unsafe {
+                crate::park::Batch::new(
+                    call_of(&task),
+                    (&task as *const _ as *const ()).cast(),
+                    1,
+                    &aw.waits.sync,
+                )
+            };
+            aw.queue.publish(&batch);
+            aw.wake_for_work();
+            drop(pool);
+            let (tx, rx) = mpsc::channel::<()>();
+            std::thread::scope(|s| {
+                s.spawn(|| {
+                    let mut w = crate::park::Waiter::new(0);
+                    batch.done.wait(Some(&aw.waits.sync), &mut w);
+                    tx.send(()).unwrap();
+                });
+                rx.recv_timeout(Duration::from_secs(10))
+                    .expect("drop on a worker hung");
+            });
+            assert!(
+                last.lock().unwrap().is_none(),
+                "the pool was dropped by its worker"
+            );
+        }
+    }
+
+    /// A pool built, used and dropped inside a task of another pool: the drop
+    /// waits for the inner pool's workers only, never for the outer worker it
+    /// runs on (a pool cannot be dropped from one of its own workers: every
+    /// task's caller borrows the pool).
+    #[test]
+    fn a_pool_dropped_inside_a_task_of_another_pool_does_not_hang() {
+        let outer = Pool::builder().threads(2).build().unwrap();
         let (done_tx, done_rx) = mpsc::channel::<()>();
-        pool.inner.spawn(move || {
-            gate_rx.recv().unwrap();
-            drop(last); // the last reference: runs `Pool::drop` on this worker
-            done_tx.send(()).unwrap();
+        let done_tx = std::sync::Mutex::new(Some(done_tx));
+        crate::Exec::new(&outer, 2).unwrap().fork(2, |i, _| {
+            if i == 0 {
+                let inner = Arc::new(Pool::builder().threads(2).build().unwrap());
+                crate::Exec::new(&inner, 2).unwrap().fork(2, |_, _| {});
+                drop(inner);
+                if let Some(tx) = done_tx.lock().unwrap().take() {
+                    tx.send(()).unwrap();
+                }
+            }
         });
-        drop(pool);
-        gate_tx.send(()).unwrap();
         done_rx
             .recv_timeout(Duration::from_secs(10))
-            .expect("drop on a worker hung");
+            .expect("a drop inside another pool's task hung");
     }
 }
 
diff --git a/src/reserve.rs b/src/reserve.rs
index 23a57b2..4832d4c 100644
--- a/src/reserve.rs
+++ b/src/reserve.rs
@@ -36,22 +36,21 @@ impl Drop for LeaderGuard<'_> {
 /// [`exec`](Team::exec). A minted token is an ordinary [`Exec`] that carries
 /// the team's authority:
 ///
-/// * `fork` and `for_ranges` dispatch as team sections: no Rayon entry, no
+/// * `fork` and `for_ranges` dispatch as team sections: no queue entry, no
 ///   wake-up, no allocation. Children of `fork` carry the sub-team of their
 ///   share, so nested forks stay on reserved members.
 /// * `broadcast` runs on the reserved members (a `fork` child may broadcast
 ///   too: its members are its own); `can_broadcast` is always true.
 /// * `team` returns the carried (sub)team at once, without acquisition.
 /// * `external` hands the width as on any token and **lends the token's
-///   members to the pool for the call**: they run the pool's Rayon jobs (the
-///   library's work) instead of idling, and resume team service when the call
-///   returns. A lent job that is still running delays the next section until it
-///   finishes.
+///   members to the pool for the call**: they run the pool's queued tasks
+///   instead of idling, and resume team service when the call returns. A lent
+///   task that is still running delays the next section until it finishes.
 ///
 /// Reserved members wait for work in staged episodes: they spin for the pool's
 /// spin budget ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)),
-/// yield a few times, then **park** while staying reserved; they do not return
-/// to Rayon until the `Team` is dropped (`docs/design/waiting.md`). The next
+/// yield a few times, then **park** while staying reserved; they serve nothing
+/// else until the `Team` is dropped (`docs/design/waiting.md`). The next
 /// dispatch wakes a parked member through its slot's parker, which costs a
 /// syscall on the first dispatch after a park (`benches/wake_probe.rs`) and one
 /// atomic read-modify-write for a warm one.
@@ -151,7 +150,7 @@ impl Pool {
     /// long as it lives.
     ///
     /// `width` counts the leader and is clamped to the pool width; zero is
-    /// treated as one. Acquisition never waits for a running Rayon job (see
+    /// treated as one. Acquisition never takes a worker that runs a task (see
     /// [`Exec::team`](crate::Exec::team)). Members park after the pool's spin
     /// budget without work ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)).
     ///
diff --git a/src/sched.rs b/src/sched.rs
index b1f8a21..0807431 100644
--- a/src/sched.rs
+++ b/src/sched.rs
@@ -10,7 +10,7 @@ use crate::track::Track;
 /// Whether the calling thread is a worker of `pool`.
 #[cfg(feature = "parallel")]
 pub(crate) fn in_pool(pool: &Pool) -> bool {
-    pool.inner.current_thread_index().is_some()
+    pool.awake.slot_of_current().is_some()
 }
 
 #[cfg(not(feature = "parallel"))]
@@ -31,42 +31,108 @@ pub(crate) fn in_pool(_pool: &Pool) -> bool {
 /// re-pins at the next pin section.
 #[cfg(feature = "parallel")]
 pub(crate) fn unpin_worker(pool: &Pool) {
-    if let Some(worker) = pool.inner.current_thread_index() {
+    if let Some(worker) = pool.awake.slot_of_current() {
         pool.awake.unpin_member(worker);
     }
 }
 
-/// Runs `task(0..tasks)` concurrently on `pool` and waits for all of them.
+/// Who waits for a batch of `pool`, and how (`docs/design/own-threads.md`).
+#[cfg(feature = "parallel")]
+enum Waiter {
+    /// A worker of `pool` itself (slot index): it runs its own batch's tasks
+    /// first, then serves the pool while it waits.
+    Own(usize),
+    /// A worker of another pool: it serves its own pool while it waits, so a
+    /// cross-pool chain (A -> B -> A) always makes progress.
+    Foreign(std::sync::Arc<crate::awake::Awake>, usize),
+    /// A plain thread: it sleeps on the pool's parker.
+    Outside,
+}
+
+#[cfg(feature = "parallel")]
+fn waiter_of(pool: &Pool) -> Waiter {
+    if let Some(i) = pool.awake.slot_of_current() {
+        Waiter::Own(i)
+    } else if let Some((aw, i)) = crate::worker::current_worker() {
+        Waiter::Foreign(aw, i)
+    } else {
+        Waiter::Outside
+    }
+}
+
+#[cfg(feature = "parallel")]
+impl Waiter {
+    /// The parker the last completion wakes.
+    fn parker<'a>(&'a self, pool: &'a Pool) -> &'a std::sync::Arc<crate::park::Parker> {
+        match self {
+            Waiter::Own(i) => &pool.awake.slots[*i].park,
+            Waiter::Foreign(aw, i) => &aw.slots[*i].park,
+            Waiter::Outside => &pool.awake.waits.sync,
+        }
+    }
+
+    /// Waits until `done` holds.
+    fn wait(&self, pool: &Pool, done: &crate::park::Completion) {
+        match self {
+            Waiter::Own(i) => pool.awake.help_while(*i, || done.is_done_now()),
+            Waiter::Foreign(aw, i) => aw.help_while(*i, || done.is_done_now()),
+            Waiter::Outside => {
+                let mut w = crate::park::Waiter::new(pool.awake.waits.spin_polls);
+                done.wait(Some(&pool.awake.waits.sync), &mut w);
+            }
+        }
+    }
+}
+
+/// Runs `task(0..tasks)` on `pool` and waits for all of them.
 ///
-/// The tasks form a recursive binary `rayon::join` tree, whose jobs live on the
-/// stack, so a steady-state call allocates nothing.
+/// The tasks form one batch on the caller's stack, published on the pool's
+/// queue, so a steady-state call allocates nothing.
 ///
-/// * Caller is a worker of `pool`: the tree runs directly on the caller.
-///   Nothing is installed.
-/// * Caller is a plain thread or a worker of another pool: one
-///   `ThreadPool::install` (a stack job) around the tree; every task runs on a
-///   worker of `pool` and the caller waits.
+/// * Caller is a worker of `pool`: it runs the batch's unclaimed tasks itself,
+///   then serves the pool until the others finish.
+/// * Caller is a worker of another pool: the pool's workers run the tasks; the
+///   caller serves its own pool meanwhile.
+/// * Caller is a plain thread: every task runs on a worker of `pool` and the
+///   caller sleeps until the last one finishes.
 ///
-/// `rayon::join` is only reached on a worker of `pool` (inside `install`, or
-/// when the caller already is one), so it never touches the global registry.
+/// A panicking task does not stop the others; the first panic is resumed once
+/// all of them finished.
 #[cfg(feature = "parallel")]
 pub(crate) fn run_tasks<F: Fn(usize) + Sync>(pool: &Pool, tasks: usize, track: &Track, task: F) {
-    if in_pool(pool) {
-        join_tree(0, tasks, &task);
-    } else {
+    if tasks == 0 {
+        return;
+    }
+    unsafe fn call<F: Fn(usize)>(data: *const (), i: usize) {
+        // SAFETY: `data` is the `&F` of `run_tasks`, alive until the batch is done.
+        (*data.cast::<F>())(i)
+    }
+    let waiter = waiter_of(pool);
+    if !matches!(waiter, Waiter::Own(_)) {
         track.note_install();
-        pool.inner.install(|| join_tree(0, tasks, &task));
     }
-}
-
-/// Runs `task(lo..hi)` as a balanced join tree. Must run on a pool worker.
-#[cfg(feature = "parallel")]
-fn join_tree<F: Fn(usize) + Sync>(lo: usize, hi: usize, task: &F) {
-    if hi - lo == 1 {
-        task(lo);
-    } else {
-        let mid = lo + (hi - lo) / 2;
-        rayon::join(|| join_tree(lo, mid, task), || join_tree(mid, hi, task));
+    // SAFETY: `call::<F>` and `task` belong together; both outlive the batch,
+    // which this function waits for; the waker is kept alive by `waiter` (or
+    // the pool) until the wait below returns.
+    let batch = unsafe {
+        crate::park::Batch::new(
+            call::<F>,
+            (&task as *const F).cast(),
+            tasks,
+            waiter.parker(pool),
+        )
+    };
+    pool.awake.queue.publish(&batch);
+    pool.awake.wake_for_work();
+    if let Waiter::Own(_) = waiter {
+        while let Some(k) = pool.awake.queue.claim_own(&batch) {
+            // SAFETY: index `k` of our own batch was claimed here.
+            unsafe { crate::park::Batch::run_claimed(&batch, k) };
+        }
+    }
+    waiter.wait(pool, &batch.done);
+    if let Some(payload) = batch.take_panic() {
+        std::panic::resume_unwind(payload);
     }
 }
 
@@ -77,32 +143,57 @@ pub(crate) fn run_tasks<F: Fn(usize) + Sync>(_pool: &Pool, tasks: usize, _track:
     }
 }
 
-/// Runs `f` on a worker of `pool`, installing only when the caller is not one.
+/// Runs `f` on a worker of `pool`: inline when the caller is one, otherwise as
+/// a one-task batch while the caller waits.
 #[cfg(feature = "parallel")]
 pub(crate) fn enter<R: Send>(pool: &Pool, track: &Track, f: impl FnOnce() -> R + Send) -> R {
     if in_pool(pool) {
-        f()
-    } else {
-        track.note_install();
-        pool.inner.install(f)
+        return f();
     }
+    let job = std::sync::Mutex::new(Some(f));
+    let out = std::sync::Mutex::new(None);
+    run_tasks(pool, 1, track, |_| {
+        let f = job.lock().unwrap_or_else(|e| e.into_inner()).take();
+        if let Some(f) = f {
+            let r = f();
+            *out.lock().unwrap_or_else(|e| e.into_inner()) = Some(r);
+        }
+    });
+    let r = out.into_inner().unwrap_or_else(|e| e.into_inner());
+    r.expect("the task ran")
 }
 
-/// Runs `f(i)` for every worker index `i < budget` at once, or reports that the
-/// caller already is a worker of `pool`.
+/// Runs `f(i)` for every worker index `i < budget` at once, each on worker
+/// `i` of `pool`. The caller is never a worker of `pool` (`Exec::broadcast`
+/// refuses that); it waits, serving its own pool if it is a worker of one.
 #[cfg(feature = "parallel")]
 pub(crate) fn broadcast(pool: &Pool, track: &Track, budget: usize, f: impl Fn(usize) + Sync) {
-    // No gate is needed: rayon pushes the per-worker jobs of one broadcast
-    // under a single lock, so every worker sees concurrent broadcasts in the
-    // same order and two of them cannot each hold part of the workers. A gate
-    // would deadlock a foreign-pool caller that steals a second broadcast onto
-    // its own stack while waiting.
     track.note_install();
-    pool.inner.broadcast(|ctx| {
-        let i = ctx.index();
-        if i < budget {
-            let _live = track.task();
-            f(i);
-        }
-    });
+    let task = |i: usize| {
+        let _live = track.task();
+        f(i);
+    };
+    unsafe fn call<F: Fn(usize)>(data: *const (), i: usize) {
+        // SAFETY: `data` is the `&F` of `broadcast`, alive until it is done.
+        (*data.cast::<F>())(i)
+    }
+    fn data_of<F>(f: &F) -> *const () {
+        (f as *const F).cast()
+    }
+    fn call_of<F: Fn(usize)>(_: &F) -> unsafe fn(*const (), usize) {
+        call::<F>
+    }
+    let waiter = waiter_of(pool);
+    // SAFETY: as in `run_tasks`; the broadcast is unlinked below, after all of
+    // its shares completed and before it goes out of scope.
+    let b = unsafe {
+        crate::park::Broadcast::new(call_of(&task), data_of(&task), budget, waiter.parker(pool))
+    };
+    pool.awake.bcast.publish(&b);
+    pool.awake.wake_for_work();
+    waiter.wait(pool, &b.done);
+    pool.awake.bcast.unlink(&b);
+    if let Some(payload) = b.take_panic() {
+        std::panic::resume_unwind(payload);
+    }
 }
diff --git a/src/team.rs b/src/team.rs
index 0dbb1f6..bcb7fde 100644
--- a/src/team.rs
+++ b/src/team.rs
@@ -83,12 +83,11 @@ impl Participant<'_> {
 ///   reserved member waiting for work, the leader in a section's join, and a
 ///   participant in a barrier spin with one PAUSE per poll for the pool's spin
 ///   budget ([`PoolBuilder::spin_polls`](crate::PoolBuilder::spin_polls)), yield
-///   a few times, then sleep until woken. Members run no unrelated Rayon job and
+///   a few times, then sleep until woken. Members run no unrelated task and
 ///   do not leave on a timeout, also between sections and during a long serial
 ///   phase of the leader; they are returned when the scope ends. In a root scope
-///   with more participants than CPUs in the caller's affinity mask, or in a
-///   pool whose waiters were recently descheduled, the spin is throttled to 100
-///   polls, so waiters free their CPUs quickly.
+///   with more participants than CPUs in the caller's affinity mask, the spin
+///   is throttled to 100 polls, so waiters free their CPUs quickly.
 /// * If the pool pins members
 ///   ([`PoolBuilder::pin_participants`](crate::PoolBuilder::pin_participants)),
 ///   member `k` of a root scope (participant `k >= 1`) runs on the `k`-th CPU of
@@ -297,7 +296,7 @@ impl<'team> TeamExec<'team> {
     /// The same authority with `over` applied to the scoped policy.
     ///
     /// Children inherit the effective policy. An override never weakens a
-    /// reservation: members stay reserved and run no unrelated Rayon job
+    /// reservation: members stay reserved and run no unrelated task
     /// whatever the policy says. The policy of the *root* reservation governs
     /// the idle interval after it ends; a child's override expires when the
     /// child returns and cannot release the parent's members.
diff --git a/src/worker.rs b/src/worker.rs
new file mode 100644
index 0000000..380e337
--- /dev/null
+++ b/src/worker.rs
@@ -0,0 +1,265 @@
+//! The worker threads and the process-wide reserve (`docs/design/own-threads.md`).
+//!
+//! A worker is a `std::thread` that serves one pool at a time: a [`Lease`]
+//! names the pool's shared state and the worker's slot in it. Between leases a
+//! *shared* worker waits, asleep, in the process-wide reserve, so that a pool
+//! built after another one was dropped (faer's `with_team` builds one per
+//! call) reuses running threads instead of spawning fresh ones. A *dedicated*
+//! worker (a pool with a thread name, a start hook, a stack size or a QoS of
+//! its own) serves one pool and exits; that pool joins it.
+//!
+//! No thread-local state is used: a worker is found by its `ThreadId`.
+
+use crate::awake::Awake;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Condvar, Mutex, OnceLock};
+use std::thread::ThreadId;
+
+/// Worker threads spawned by this process so far (shared and dedicated).
+static SPAWNED: AtomicUsize = AtomicUsize::new(0);
+
+/// How many worker threads this process has spawned so far: a diagnostic, to
+/// check that pools built one after another reuse their workers.
+#[doc(hidden)]
+pub fn spawned_workers() -> usize {
+    SPAWNED.load(Ordering::Relaxed)
+}
+
+/// What a worker serves: slot `id` of the pool whose shared state is `aw`,
+/// with the leasing caller's CPU set (Linux) applied first.
+pub(crate) struct Lease {
+    pub(crate) aw: Arc<Awake>,
+    pub(crate) id: usize,
+    pub(crate) mask: Option<crate::pin::CpuMask>,
+}
+
+/// What a waiting worker is told next.
+enum Next {
+    Lease(Lease),
+    /// Exit without serving (a dedicated worker of a pool whose build failed).
+    Exit,
+}
+
+/// One worker thread's handle in this crate.
+pub(crate) struct WorkerCtl {
+    next: Mutex<Option<Next>>,
+    cv: Condvar,
+    /// A worker of the reserve (as opposed to a dedicated one).
+    shared: bool,
+    /// The pool and slot it serves now, for cross-pool lookups.
+    current: Mutex<Option<(Arc<Awake>, usize)>>,
+    thread: OnceLock<ThreadId>,
+}
+
+impl WorkerCtl {
+    fn new(shared: bool) -> Self {
+        WorkerCtl {
+            next: Mutex::new(None),
+            cv: Condvar::new(),
+            shared,
+            current: Mutex::new(None),
+            thread: OnceLock::new(),
+        }
+    }
+
+    /// Hands the worker its next lease.
+    pub(crate) fn assign(&self, lease: Lease) {
+        let mut next = self.next.lock().unwrap_or_else(|e| e.into_inner());
+        *next = Some(Next::Lease(lease));
+        drop(next);
+        self.cv.notify_one();
+    }
+
+    /// Tells an unleased worker to exit.
+    fn exit(&self) {
+        let mut next = self.next.lock().unwrap_or_else(|e| e.into_inner());
+        *next = Some(Next::Exit);
+        drop(next);
+        self.cv.notify_one();
+    }
+}
+
+struct Reserve {
+    /// Shared workers waiting for a lease.
+    idle: Vec<Arc<WorkerCtl>>,
+    /// The most idle workers kept: the largest of the available parallelism
+    /// and every width leased so far.
+    cap: usize,
+    /// Every live worker, for finding the calling thread's own lease.
+    live: Vec<Arc<WorkerCtl>>,
+}
+
+static RESERVE: OnceLock<Mutex<Reserve>> = OnceLock::new();
+
+fn reserve() -> &'static Mutex<Reserve> {
+    RESERVE.get_or_init(|| {
+        Mutex::new(Reserve {
+            idle: Vec::new(),
+            cap: std::thread::available_parallelism().map_or(1, |n| n.get()),
+            live: Vec::new(),
+        })
+    })
+}
+
+fn lock(r: &Mutex<Reserve>) -> std::sync::MutexGuard<'_, Reserve> {
+    r.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+/// The pool and slot the calling thread serves, when it is a worker of any
+/// pool (the lookup of a cross-pool wait; entry points only).
+pub(crate) fn current_worker() -> Option<(Arc<Awake>, usize)> {
+    let r = RESERVE.get()?;
+    let me = std::thread::current().id();
+    let ctl = lock(r)
+        .live
+        .iter()
+        .find(|c| c.thread.get() == Some(&me))
+        .cloned()?;
+    let cur = ctl.current.lock().unwrap_or_else(|e| e.into_inner());
+    cur.clone()
+}
+
+/// How a pool's workers are started.
+pub(crate) struct Spawn<'a> {
+    pub(crate) stack: usize,
+    pub(crate) name: Option<&'a dyn Fn(usize) -> String>,
+    pub(crate) on_start: Option<Arc<dyn Fn(usize) + Send + Sync>>,
+    pub(crate) qos: Option<crate::policy::Qos>,
+    /// Whether these settings are the reserve's (default stack, platform
+    /// QoS, no hooks): then the workers are shared.
+    pub(crate) shared: bool,
+}
+
+/// The workers obtained for a pool, and the join handles of dedicated ones.
+pub(crate) type Obtained = (Vec<Arc<WorkerCtl>>, Vec<std::thread::JoinHandle<()>>);
+
+/// Workers for a pool of `n`: idle ones of the reserve and freshly spawned
+/// ones (shared), or `n` fresh dedicated ones with their join handles.
+pub(crate) fn obtain(n: usize, how: &Spawn<'_>) -> std::io::Result<Obtained> {
+    let mut ctls = Vec::with_capacity(n);
+    let mut joins = Vec::new();
+    if how.shared {
+        let mut r = lock(reserve());
+        r.cap = r.cap.max(n);
+        while ctls.len() < n {
+            match r.idle.pop() {
+                Some(c) => ctls.push(c),
+                None => break,
+            }
+        }
+    }
+    while ctls.len() < n {
+        let index = ctls.len();
+        match spawn(index, how) {
+            Ok((ctl, handle)) => {
+                ctls.push(ctl);
+                if !how.shared {
+                    joins.push(handle);
+                }
+            }
+            Err(e) => {
+                // Hand back what was taken; dedicated workers spawned so far
+                // exit without a lease.
+                give_back_unleased(ctls, joins);
+                return Err(e);
+            }
+        }
+    }
+    Ok((ctls, joins))
+}
+
+/// Workers obtained for a pool whose build failed: shared ones go back to the
+/// reserve, dedicated ones are stopped and joined.
+fn give_back_unleased(ctls: Vec<Arc<WorkerCtl>>, joins: Vec<std::thread::JoinHandle<()>>) {
+    for c in ctls {
+        if c.shared {
+            lock(reserve()).idle.push(c);
+        } else {
+            c.exit();
+        }
+    }
+    for j in joins {
+        let _ = j.join();
+    }
+}
+
+fn spawn(
+    index: usize,
+    how: &Spawn<'_>,
+) -> std::io::Result<(Arc<WorkerCtl>, std::thread::JoinHandle<()>)> {
+    let ctl = Arc::new(WorkerCtl::new(how.shared));
+    let mut b = std::thread::Builder::new().stack_size(how.stack);
+    if let Some(name) = &how.name {
+        b = b.name(name(index));
+    }
+    let qos = how.qos.or(crate::policy::Qos::PLATFORM_DEFAULT);
+    let on_start = how.on_start.clone();
+    let c = Arc::clone(&ctl);
+    let handle = b.spawn(move || {
+        if let Some(q) = qos {
+            q.apply_to_current_thread();
+        }
+        let _ = c.thread.set(std::thread::current().id());
+        lock(reserve()).live.push(Arc::clone(&c));
+        if let Some(hook) = on_start {
+            hook(index);
+        }
+        worker_main(&c);
+        let mut r = lock(reserve());
+        if let Some(p) = r.live.iter().position(|w| Arc::ptr_eq(w, &c)) {
+            r.live.swap_remove(p);
+        }
+    })?;
+    SPAWNED.fetch_add(1, Ordering::Relaxed);
+    Ok((ctl, handle))
+}
+
+/// A worker's life: wait for a lease, attach, serve the pool until it is
+/// detached, acknowledge, then wait in the reserve (shared) or exit.
+fn worker_main(ctl: &Arc<WorkerCtl>) {
+    loop {
+        let lease = {
+            let mut next = ctl.next.lock().unwrap_or_else(|e| e.into_inner());
+            loop {
+                match next.take() {
+                    Some(Next::Lease(l)) => break l,
+                    Some(Next::Exit) => return,
+                    None => next = ctl.cv.wait(next).unwrap_or_else(|e| e.into_inner()),
+                }
+            }
+        };
+        let slot = &lease.aw.slots[lease.id];
+        // The CPU set a thread spawned by the leasing caller would inherit.
+        if let Some(mask) = &lease.mask {
+            let _ = crate::pin::set_here(mask);
+        }
+        let _ = slot.thread.set(std::thread::current().id());
+        *ctl.current.lock().unwrap_or_else(|e| e.into_inner()) =
+            Some((Arc::clone(&lease.aw), lease.id));
+        slot.attached.store(true, Ordering::SeqCst);
+        crate::awake::serve(&lease.aw, lease.id);
+        // Epilogue: no access to the pool after the acknowledgement.
+        slot.saved.restore();
+        let clean = !slot.saved.is_pinned();
+        *ctl.current.lock().unwrap_or_else(|e| e.into_inner()) = None;
+        // Back in the reserve before the acknowledgement, so that a pool built
+        // right after this one was dropped finds the worker idle. A new lease
+        // only starts once this loop waits for it again, after the
+        // acknowledgement below.
+        let keep = ctl.shared && clean && {
+            let mut r = lock(reserve());
+            if r.idle.len() < r.cap {
+                r.idle.push(Arc::clone(ctl));
+                true
+            } else {
+                false
+            }
+        };
+        slot.acked.store(true, Ordering::SeqCst);
+        lease.aw.waits.sync.wake();
+        drop(lease);
+        if !keep {
+            return;
+        }
+    }
+}
diff --git a/tests/alloc_free.rs b/tests/alloc_free.rs
index 28e73ff..bec9ff1 100644
--- a/tests/alloc_free.rs
+++ b/tests/alloc_free.rs
@@ -37,15 +37,21 @@ fn entries(pool: &Pool) {
     });
     let w = Exec::new(pool, 3).unwrap().external(|w| w.get());
     assert_eq!(w, 3);
+    if !threadteam::Exec::new(pool, 3).unwrap().can_broadcast() {
+        return;
+    }
+    Exec::new(pool, 3)
+        .unwrap()
+        .broadcast(|i| {
+            sink.fetch_add(i, Ordering::Relaxed);
+        })
+        .unwrap();
     assert!(sink.load(Ordering::Relaxed) > 0);
 }
 
-/// Smallest allocation count over `rounds` windows of one call each, after warm-up.
-///
-/// From a plain thread every entry pushes one job into rayon's injector queue,
-/// whose block allocation (one per 31 pushes) is amortized and outside this
-/// crate; a per-call allocation shows up in every window, so the minimum
-/// separates the two.
+/// Largest allocation count over `rounds` windows of one call each, after
+/// warm-up: strict, every window counts (the native scheduler publishes stack
+/// batches, so there is no amortized queue allocation to tolerate).
 fn measure(rounds: usize, f: impl Fn()) -> usize {
     for _ in 0..20 {
         f();
@@ -56,7 +62,7 @@ fn measure(rounds: usize, f: impl Fn()) -> usize {
             f();
             ALLOCS.load(Ordering::SeqCst) - before
         })
-        .min()
+        .max()
         .unwrap_or(0)
 }
 
@@ -66,6 +72,18 @@ fn fork_for_ranges_external_do_not_allocate() {
     let pool = Pool::builder().threads(3).build().unwrap();
     let plain = measure(10, || entries(&pool));
     assert_eq!(plain, 0, "plain-thread entries allocated");
+    // The same after the workers went to sleep: waking them allocates nothing.
+    let asleep = measure(5, || {
+        std::thread::sleep(std::time::Duration::from_millis(20));
+        let before = ALLOCS.load(Ordering::SeqCst);
+        entries(&pool);
+        assert_eq!(
+            ALLOCS.load(Ordering::SeqCst) - before,
+            0,
+            "entries after a park allocated"
+        );
+    });
+    let _ = asleep;
 
     // Inside the pool: a worker of `pool` enters again, which installs nothing,
     // so every window is strict.
diff --git a/tests/loom_park.rs b/tests/loom_park.rs
index e810464..d773623 100644
--- a/tests/loom_park.rs
+++ b/tests/loom_park.rs
@@ -203,3 +203,170 @@ fn a_cancellation_wakes_a_participant_asleep_in_a_barrier() {
         assert!(!waiter.join().unwrap());
     });
 }
+
+// ---------------------------------------------------------------------------
+// The native scheduler (`docs/design/own-threads.md`): the slot state word,
+// the queue of stack batches, the broadcast list, and an idle worker's sleep
+// against a publication. The exact code, under `loom`.
+
+use threadteam::{Batch, Broadcast, BroadcastList, Queue, SlotState};
+
+/// A team reservation and a worker taking work race for a free slot: exactly
+/// one wins, and a release or a detach while the worker is busy neither frees
+/// it early nor is erased when it finishes.
+#[test]
+fn a_free_slot_is_reserved_or_taken_never_both() {
+    model(|| {
+        let s = Arc::new(SlotState::new());
+        let leader = {
+            let s = s.clone();
+            thread::spawn(move || s.try_reserve())
+        };
+        let took = s.try_take();
+        let reserved = leader.join().unwrap();
+        assert!(took != reserved, "exactly one wins");
+        if took {
+            // Busy: a detach arrives, then the work ends.
+            s.detach();
+            s.end_busy();
+            assert_eq!(s.load(), 8, "DETACH survives the end of the work");
+        } else {
+            s.release();
+            assert_eq!(s.load(), 0);
+        }
+    });
+}
+
+/// A lent member that is running a task when its reservation is released
+/// stays busy (not claimable) until the task ends.
+#[test]
+fn a_release_does_not_free_a_busy_lent_member() {
+    model(|| {
+        let s = Arc::new(SlotState::new());
+        assert!(s.try_reserve());
+        s.set_lent(true);
+        assert!(s.try_take());
+        let releaser = {
+            let s = s.clone();
+            thread::spawn(move || s.release())
+        };
+        let claimer = {
+            let s = s.clone();
+            thread::spawn(move || s.try_reserve())
+        };
+        releaser.join().unwrap();
+        assert!(!claimer.join().unwrap(), "a busy worker is not reservable");
+        s.end_busy();
+        assert!(s.try_reserve(), "free again once the task ended");
+    });
+}
+
+unsafe fn count_task(data: *const (), _i: usize) {
+    (*data.cast::<AtomicUsize>()).fetch_add(1, Ordering::SeqCst);
+}
+
+/// An owner publishes a batch of two tasks; two workers claim and run them
+/// while the owner claims its own and then sleeps until the last completion:
+/// every task runs exactly once and the owner wakes (no lost wake-up).
+#[test]
+fn a_batch_runs_every_task_once_and_wakes_its_sleeping_owner() {
+    model(|| {
+        let q = Arc::new(Queue::new());
+        let ran = Arc::new(AtomicUsize::new(0));
+        let waker = std::sync::Arc::new(Parker::new());
+        // SAFETY: `ran` and `waker` outlive the batch, which the owner waits
+        // for below.
+        let batch =
+            Arc::new(unsafe { Batch::new(count_task, Arc::as_ptr(&ran).cast(), 2, &waker) });
+        q.publish(&batch);
+        let ws: Vec<_> = (0..2)
+            .map(|_| {
+                let q = q.clone();
+                thread::spawn(move || {
+                    if let Some((b, i)) = q.claim() {
+                        unsafe { Batch::run_claimed(b, i) };
+                    }
+                })
+            })
+            .collect();
+        while let Some(i) = q.claim_own(&batch) {
+            unsafe { Batch::run_claimed(Arc::as_ptr(&batch), i) };
+        }
+        batch.done.wait(Some(&waker), &mut Waiter::new(0));
+        assert_eq!(ran.load(Ordering::SeqCst), 2);
+        for w in ws {
+            w.join().unwrap();
+        }
+    });
+}
+
+unsafe fn share_task(data: *const (), i: usize) {
+    (*data.cast::<[AtomicUsize; 2]>())[i].fetch_add(1, Ordering::SeqCst);
+}
+
+/// A broadcast to two workers: each runs its own share exactly once, in the
+/// order of its cursor, and the caller wakes before it unlinks the broadcast.
+#[test]
+fn a_broadcast_runs_each_share_once_and_wakes_its_caller() {
+    model(|| {
+        let list = Arc::new(BroadcastList::new());
+        let shares = Arc::new([AtomicUsize::new(0), AtomicUsize::new(0)]);
+        let waker = std::sync::Arc::new(Parker::new());
+        // SAFETY: as above.
+        let b =
+            Arc::new(unsafe { Broadcast::new(share_task, Arc::as_ptr(&shares).cast(), 2, &waker) });
+        list.publish(&b);
+        let ws: Vec<_> = (0..2)
+            .map(|i| {
+                let list = list.clone();
+                thread::spawn(move || {
+                    let mut seq = 0;
+                    while let Some(b) = list.next_for(i, &mut seq) {
+                        unsafe { Broadcast::run_share(b, i) };
+                    }
+                })
+            })
+            .collect();
+        b.done.wait(Some(&waker), &mut Waiter::new(0));
+        list.unlink(&b);
+        assert_eq!(shares[0].load(Ordering::SeqCst), 1);
+        assert_eq!(shares[1].load(Ordering::SeqCst), 1);
+        for w in ws {
+            w.join().unwrap();
+        }
+    });
+}
+
+/// An idle worker going to sleep on its parker against a publication: the
+/// publisher links the batch and wakes; the worker either sees the new work
+/// before it sleeps or is woken (no lost wake-up), then claims it.
+#[test]
+fn an_idle_worker_is_never_left_asleep_by_a_publication() {
+    model(|| {
+        let q = Arc::new(Queue::new());
+        let park = Arc::new(Parker::new());
+        let ran = Arc::new(AtomicUsize::new(0));
+        let waker = std::sync::Arc::new(Parker::new());
+        let worker = {
+            let (q, park) = (q.clone(), park.clone());
+            thread::spawn(move || {
+                let g = q.gen();
+                park.park_while(|| q.gen() == g && !q.has_work());
+                if let Some((b, i)) = q.claim() {
+                    unsafe { Batch::run_claimed(b, i) };
+                }
+            })
+        };
+        // SAFETY: as above.
+        let batch = unsafe { Batch::new(count_task, Arc::as_ptr(&ran).cast(), 1, &waker) };
+        q.publish(&batch);
+        park.wake();
+        worker.join().unwrap();
+        // The worker claimed it, or it is still linked for the owner.
+        while let Some(i) = q.claim_own(&batch) {
+            unsafe { Batch::run_claimed(&batch, i) };
+        }
+        batch.done.wait(Some(&waker), &mut Waiter::new(0));
+        assert_eq!(ran.load(Ordering::SeqCst), 1);
+    });
+}
diff --git a/tests/own_threads.rs b/tests/own_threads.rs
new file mode 100644
index 0000000..da0b588
--- /dev/null
+++ b/tests/own_threads.rs
@@ -0,0 +1,232 @@
+//! The native workers (`docs/design/own-threads.md`): reuse through the
+//! process-wide reserve, cross-pool waits, broadcast order, affinity on lease,
+//! and panics.
+#![cfg(feature = "parallel")]
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Mutex;
+use std::time::Duration;
+use threadteam::{Exec, Pool};
+
+/// A hang is a failure: abort the whole process if the test body stalls.
+fn watchdog() -> impl Drop {
+    struct Stop(std::sync::mpsc::Sender<()>);
+    impl Drop for Stop {
+        fn drop(&mut self) {
+            let _ = self.0.send(());
+        }
+    }
+    let (tx, rx) = std::sync::mpsc::channel::<()>();
+    std::thread::spawn(move || {
+        if rx.recv_timeout(Duration::from_secs(60)).is_err() {
+            eprintln!("watchdog: test stalled");
+            std::process::exit(101);
+        }
+    });
+    Stop(tx)
+}
+
+/// The reserve and the spawn counter are process wide: the tests of this file
+/// take turns.
+static SERIAL: Mutex<()> = Mutex::new(());
+
+#[test]
+fn a_pool_built_after_another_was_dropped_reuses_its_workers() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let width = 4;
+    // A long acquisition timeout: a worker clears its busy bit just after its
+    // last task completed, and on a loaded host that can take a while.
+    let build = || {
+        Pool::builder()
+            .threads(width)
+            .acquire_timeout(Duration::from_secs(5))
+            .build()
+            .unwrap()
+    };
+    let first = build();
+    Exec::new(&first, width).unwrap().fork(width, |_, _| {});
+    drop(first);
+    for round in 0..5 {
+        let before = threadteam::spawned_workers();
+        let pool = build();
+        let n = AtomicUsize::new(0);
+        Exec::new(&pool, width).unwrap().fork(width, |_, _| {
+            n.fetch_add(1, Ordering::SeqCst);
+        });
+        assert_eq!(n.load(Ordering::SeqCst), width);
+        // A team on the reused workers, as faer's `with_team` takes one.
+        let team = pool.into_team(width).expect("idle reused workers");
+        assert_eq!(team.size().get(), width);
+        drop(team);
+        assert_eq!(
+            threadteam::spawned_workers() - before,
+            0,
+            "round {round}: a pool of the same width spawned threads"
+        );
+    }
+}
+
+#[test]
+fn a_pool_with_hooks_gets_dedicated_workers_and_joins_them() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let started = std::sync::Arc::new(AtomicUsize::new(0));
+    let s = std::sync::Arc::clone(&started);
+    let before = threadteam::spawned_workers();
+    let pool = Pool::builder()
+        .threads(2)
+        .thread_name(|i| format!("dedicated-{i}"))
+        .on_start(move |_| {
+            s.fetch_add(1, Ordering::SeqCst);
+        })
+        .build()
+        .unwrap();
+    let names = Mutex::new(Vec::new());
+    Exec::new(&pool, 2).unwrap().fork(2, |_, _| {
+        names
+            .lock()
+            .unwrap()
+            .push(std::thread::current().name().map(String::from));
+    });
+    drop(pool);
+    assert_eq!(threadteam::spawned_workers() - before, 2);
+    assert_eq!(
+        started.load(Ordering::SeqCst),
+        2,
+        "the hook ran on each worker"
+    );
+    assert!(names
+        .into_inner()
+        .unwrap()
+        .iter()
+        .all(|n| n.as_deref().is_some_and(|n| n.starts_with("dedicated-"))));
+}
+
+/// A worker of pool A waits for pool B, whose task waits for pool A again.
+/// Every waiting worker serves its own pool meanwhile, so the chain completes
+/// even when every worker of A is waiting on B.
+#[test]
+fn a_cross_pool_chain_a_b_a_completes() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let a = Pool::builder().threads(2).build().unwrap();
+    let b = Pool::builder().threads(2).build().unwrap();
+    let inner = AtomicUsize::new(0);
+    Exec::new(&a, 2).unwrap().fork(2, |_, _| {
+        Exec::new(&b, 2).unwrap().fork(2, |_, _| {
+            Exec::new(&a, 2).unwrap().fork(2, |_, _| {
+                inner.fetch_add(1, Ordering::SeqCst);
+            });
+        });
+    });
+    assert_eq!(inner.load(Ordering::SeqCst), 2 * 2 * 2);
+}
+
+/// Two plain threads broadcast on one pool at once: every worker runs both
+/// broadcasts, and all workers see them in the same order.
+#[test]
+fn concurrent_broadcasts_reach_every_worker_in_the_same_order() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let width = 3;
+    let pool = Pool::builder().threads(width).build().unwrap();
+    for _ in 0..20 {
+        let seen: Vec<Mutex<Vec<u8>>> = (0..width).map(|_| Mutex::new(Vec::new())).collect();
+        std::thread::scope(|s| {
+            for tag in [1u8, 2] {
+                let (pool, seen) = (&pool, &seen);
+                s.spawn(move || {
+                    Exec::new(pool, width)
+                        .unwrap()
+                        .broadcast(|i| seen[i].lock().unwrap().push(tag))
+                        .unwrap();
+                });
+            }
+        });
+        let orders: Vec<Vec<u8>> = seen.into_iter().map(|m| m.into_inner().unwrap()).collect();
+        assert!(orders.iter().all(|o| o.len() == 2), "{orders:?}");
+        assert!(orders.windows(2).all(|w| w[0] == w[1]), "{orders:?}");
+    }
+}
+
+/// A task panics: the others still run, the panic reaches the caller after
+/// all of them finished, and the pool keeps working.
+#[test]
+fn a_task_panic_propagates_after_the_others_and_the_pool_survives() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let pool = Pool::builder().threads(3).build().unwrap();
+    let done = AtomicUsize::new(0);
+    let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        Exec::new(&pool, 3).unwrap().fork(3, |i, _| {
+            if i == 1 {
+                panic!("boom");
+            }
+            std::thread::sleep(Duration::from_millis(5));
+            done.fetch_add(1, Ordering::SeqCst);
+        });
+    }));
+    assert!(r.is_err());
+    assert_eq!(done.load(Ordering::SeqCst), 2);
+    let n = AtomicUsize::new(0);
+    Exec::new(&pool, 3).unwrap().fork(3, |_, _| {
+        n.fetch_add(1, Ordering::SeqCst);
+    });
+    assert_eq!(n.load(Ordering::SeqCst), 3);
+}
+
+/// A reused worker takes the CPU set of the caller that leases it, as a thread
+/// that caller spawned would, not the set of whoever spawned it first.
+#[cfg(target_os = "linux")]
+#[test]
+fn a_reused_worker_takes_the_leasing_callers_cpu_set() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    fn cpus() -> Vec<usize> {
+        unsafe {
+            let mut set: libc::cpu_set_t = std::mem::zeroed();
+            libc::sched_getaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &mut set);
+            (0..libc::CPU_SETSIZE as usize)
+                .filter(|&c| libc::CPU_ISSET(c, &set))
+                .collect()
+        }
+    }
+    fn set(cpus: &[usize]) -> bool {
+        unsafe {
+            let mut s: libc::cpu_set_t = std::mem::zeroed();
+            libc::CPU_ZERO(&mut s);
+            for &c in cpus {
+                libc::CPU_SET(c, &mut s);
+            }
+            libc::sched_setaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &s) == 0
+        }
+    }
+    let all = cpus();
+    if all.len() < 4 {
+        eprintln!("skipped: needs 4 allowed CPUs");
+        return;
+    }
+    // Run on a helper thread so the test thread's mask is never changed.
+    std::thread::spawn(move || {
+        let width = 2;
+        assert!(set(&all[..2]));
+        drop(Pool::builder().threads(width).build().unwrap());
+        assert!(set(&all[2..4]));
+        let pool = Pool::builder().threads(width).build().unwrap();
+        let masks = Mutex::new(Vec::new());
+        Exec::new(&pool, width)
+            .unwrap()
+            .broadcast(|_| masks.lock().unwrap().push(cpus()))
+            .unwrap();
+        for m in masks.into_inner().unwrap() {
+            assert_eq!(
+                m,
+                all[2..4].to_vec(),
+                "a reused worker kept another caller's CPU set"
+            );
+        }
+    })
+    .join()
+    .unwrap();
+}

From d6fe3f629b1669b990157a52e8d50ea9a8811ebe Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 03:49:09 +0900
Subject: [PATCH 10/13] fix(own-threads): post-review deadlocks, cursor,
 affinity and docs

- A worker marks its slot attached only after it read the slot's section
  generation, so a leader's first section is never taken as already seen.
- Nested waits save and restore the `helping` flag, so `wake_for_work`
  still wakes an outer wait after an inner one returned.
- A worker with a broadcast share on its stack takes no further share: a
  later broadcast run above an unfinished one could deadlock at a barrier.
- A broadcast cursor moves past every publication when nothing is left for
  the worker, so a broadcast unlinked before it looked does not keep it
  awake forever.
- Only reused workers take the leasing caller's CPU set; a dedicated
  worker keeps what its `on_start` hook set.
- Pool and Team shutdown docs distinguish shared and dedicated workers;
  the unused shutdown flag and `acquire`'s pool argument are gone.

Each fix has a regression test that fails or hangs with the fix undone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/design/own-threads.md | 34 ++++++++-------
 src/awake.rs               | 33 ++++++++++-----
 src/exec.rs                |  1 -
 src/park.rs                |  6 ++-
 src/pool.rs                | 72 ++++++++++++++++++++++++++-----
 src/reserve.rs             |  6 +--
 src/worker.rs              |  3 +-
 tests/own_threads.rs       | 86 ++++++++++++++++++++++++++++++++++++++
 8 files changed, 198 insertions(+), 43 deletions(-)

diff --git a/docs/design/own-threads.md b/docs/design/own-threads.md
index cac03e7..897c75c 100644
--- a/docs/design/own-threads.md
+++ b/docs/design/own-threads.md
@@ -36,24 +36,17 @@ The answer to question (i) of #15 is therefore (ii): if no `Pool` spawns threads
 - **Compatibility.** A worker of the reserve was spawned with the default stack (16 MiB), the platform's default QoS and no hooks. A pool with any `thread_name`, `on_start`, a different stack size or a QoS gets **dedicated** workers: spawned for it and joined when it is dropped, exactly as before. tcontract's C API names its workers and sets a thread-local in `on_start`; it keeps today's semantics.
 - **`Pool::build`.** It takes `width` idle workers from the reserve and spawns the missing ones; a spawn failure is a build error. A worker learns its pool and its index when leased.
 - **`Pool` drop (shared workers).** Every worker is told to detach. Each one finishes, restores its own affinity mask (a pinned member) and acknowledges. Only then is the worker back in the reserve. The drop waits for all acknowledgements (quiescence) and does not join.
-  - The reserve keeps at most `C` idle workers, `C` being the available parallelism when it was created; a worker beyond the cap exits and is joined by the drop.
+  - The reserve keeps at most `C` idle workers (pre-review resolution 6 sets `C`); a worker beyond the cap exits.
   - A pool dropped from one of its own workers (a worker running a task that owns the pool) cannot wait for itself: it detaches the others, and that worker detaches when its task returns.
 - **Contract change.** "Dropping a `Pool` joins every worker thread" now holds for dedicated workers only; a shared worker outlives the pool, parked in the reserve.
 
 ### The worker loop
-Each leased worker runs one native loop over its member slot, the slot of the existing team machinery (`awake.rs`). Slot states:
-
-| state | meaning |
-| --- | --- |
-| `IDLE` | serves the pool's queue and its own mailbox; claimable by a team (CAS) |
-| `RUNNING` | runs a task of the pool's queue or a broadcast share; not claimable |
-| `RESERVED` | a team member, as before; with `lent`, it also serves the pool's queue |
-| `DETACH` | the pool is being dropped; the worker acknowledges and leaves |
+Each leased worker runs one native loop over its member slot, the slot of the existing team machinery (`awake.rs`). The slot's state word and its transitions are pre-review resolution 3 (`RESERVED`, `LENT`, `BUSY`, `DETACH`; free is `0`).
 
 Work, in the order the loop looks for it:
-1. A **broadcast share** in its mailbox.
+1. A **broadcast share** for this worker in the pool's broadcast list (pre-review resolution 2).
 2. A **task** from the pool's queue.
-3. Otherwise the staged wait: spin, yield, then park on its slot's `Parker`, until the queue generation, the mailbox, or the state changes.
+3. Otherwise the staged wait: spin, yield, then park on its slot's `Parker`, until the queue generation, the broadcast generation, or the state changes.
 
 The `ABSENT` state, the claim jobs (`claim_cold`) and the `YIELD` state of the Rayon design disappear: every leased worker is always in its loop.
 
@@ -73,8 +66,8 @@ The `ABSENT` state, the claim jobs (`claim_cold`) and the `YIELD` state of the R
   - A team token: its members are lent to the pool's queue for the call, and serve tasks the callback's code publishes to the same pool.
 
 ### Broadcast
-- The pool holds a broadcast mutex for the whole broadcast. The caller is never a worker of the pool (`CallerInPool` refusal), so holding it cannot deadlock a worker, and concurrent broadcasts run one after the other, in the same order for every worker.
-- The share for worker `i` goes into slot `i`'s mailbox. The caller waits for all `budget` shares, as today; a reserved member serves no broadcast, again as today.
+- Broadcasts go into the pool's ordered broadcast list (pre-review resolution 2, which replaced a first draft's whole-broadcast lock and per-slot mailboxes). The caller is never a worker of the pool (`CallerInPool` refusal). Every worker runs the broadcasts that target it in publication order.
+- The caller waits for all `budget` shares, as today; a reserved member serves no broadcast, again as today.
 
 ### Identity without thread-locals
 Each slot records its worker's `ThreadId` when leased. "Is the caller a worker of this pool, and which one" is a scan of the pool's slots (`width` comparisons), done at entry points only, never on the team dispatch path.
@@ -124,7 +117,7 @@ The gpt-6.1-sol pre-review (`work/runs/threadteam-own/pre.out`) found one deadlo
    - **Self-drop from a worker.** It does not wait for the dropping worker, which acknowledges after its task returns. The other workers cannot be running work of this pool, because any such work borrows the pool, so their acknowledgements come promptly.
    - **Locks.** No reserve lock is held while waiting.
    - **Workers above the cap.** They exit, and their handles are detached; only dedicated workers are joined.
-5. **Affinity on lease.** `Pool::build` reads the calling thread's affinity mask, and every worker applies it to itself when it is leased (Linux), as a newly spawned thread would inherit it. A worker whose pin restore failed is not returned to the reserve; it exits.
+5. **Affinity on lease.** `Pool::build` reads the calling thread's affinity mask, and every reused (shared) worker applies it to itself when it is leased (Linux), as a newly spawned thread would inherit it. A dedicated worker was spawned by that caller and inherited it already; it keeps whatever its `on_start` hook set (post-review 5). A worker whose pin restore failed is not returned to the reserve; it exits.
 6. **Reserve cap.** The cap is the largest of the available parallelism and every width leased so far. So repeated wide pools (faer's per-call `with_team`) keep reusing their workers, whatever the first caller's affinity was.
 7. **Panics.**
    - Every claimed task and broadcast share runs under `catch_unwind` and always reaches its completion. The first payload is kept on the batch.
@@ -137,10 +130,21 @@ The gpt-6.1-sol pre-review (`work/runs/threadteam-own/pre.out`) found one deadlo
 
 Kept against the review's delete list: the opt-in Rayon layer, which the maintainer asked for ("Rayon との相互運用が要る機能は opt-in の層として残す"), and `idle_runs_rayon`, as a documented no-op, so the public API does not break.
 
+## Post-review resolutions
+
+The gpt-6.1-sol post-review of the implementation (`work/runs/threadteam-own/post.out`) found three deadlocks, an endless wake-up and an affinity regression. Each fix has a regression test that fails (or hangs) with the fix undone.
+
+1. **Attachment against the first section.** A worker marked its slot claimable before it read the slot's section generation; a leader that reserved it in between published a section the worker then took as already seen, and both waited forever. `serve` now reads the generation first and marks the slot attached after it. (The window is a few instructions wide; no test forces it.)
+2. **Nested helping.** A wait that runs a task which waits in turn cleared the outer wait's `helping` flag on return, so `wake_for_work` skipped a worker still waiting, and A → B → A could hang. The flag is now saved and restored (`a_nested_wait_keeps_the_outer_wait_wakeable`).
+3. **A later broadcast above an unfinished one.** A broadcast share that waits on another pool helps its own pool meanwhile; it could start a later broadcast's share, whose shares meet at a barrier, while the earlier broadcast's other share waited at its own barrier for this worker. A worker with a broadcast share on its stack now takes queued tasks but no further share (`a_waiting_broadcast_share_does_not_start_a_later_broadcast`).
+4. **Cursor past unlinked broadcasts.** A worker outside a broadcast's budget that looked only after the broadcast was unlinked kept its cursor before it; `has_after` stayed true, so the worker never parked. The cursor now moves past every publication when nothing is left for the worker (`a_cursor_moves_past_a_broadcast_unlinked_before_it_looked`).
+5. **Dedicated workers and `on_start` pinning.** The lease reset a dedicated worker's mask to the caller's, undoing a hook's pin. Only reused workers take the caller's mask now (`a_dedicated_worker_keeps_the_pin_of_its_start_hook`).
+6. **Docs.** `Pool`'s and `Team`'s shutdown docs distinguish shared and dedicated workers, as the README does. The unused `shutdown` flag and `acquire`'s unused pool argument are gone.
+
 ## Verification
 - **loom, new paths, small models:**
   - a batch published with one owner and two claimers, the owner asleep until completion;
-  - an idle worker's wait on the queue generation, its mailbox and its state, against a publish and a detach;
+  - an idle worker's wait on the queue generation, the broadcast generation and its state, against a publish and a detach;
   - the detach handshake of a pool drop.
 - **The existing tests:** alloc-free (the plain paths and the team paths, warm), ledger, compile-fail, no-public-rayon, and the feature matrix.
 - **New tests:**
diff --git a/src/awake.rs b/src/awake.rs
index ab56f0d..1e626b5 100644
--- a/src/awake.rs
+++ b/src/awake.rs
@@ -91,7 +91,12 @@ pub(crate) struct Slot {
     /// The worker's broadcast cursor (only the worker touches it).
     bseq: AtomicU64,
     /// Set while the worker waits for a batch and serves its pool meanwhile.
-    helping: AtomicBool,
+    pub(crate) helping: AtomicBool,
+    /// Broadcast shares on this worker's stack (only the worker touches it).
+    /// While one runs, the worker takes no other share: a later broadcast run
+    /// above an unfinished one could wait at its barrier for a worker that
+    /// waits at the earlier one's.
+    in_bcast: AtomicUsize,
     /// A released member that has not gone to sleep since (it still spins,
     /// claimable without a wake): what `Pool::resident_members` counts besides
     /// reserved members.
@@ -115,6 +120,7 @@ impl Slot {
             thread: std::sync::OnceLock::new(),
             bseq: AtomicU64::new(0),
             helping: AtomicBool::new(false),
+            in_bcast: AtomicUsize::new(0),
             lingering: AtomicBool::new(false),
             attached: AtomicBool::new(false),
             acked: AtomicBool::new(false),
@@ -148,7 +154,6 @@ pub(crate) struct Awake {
     /// What the joins and barriers of this pool's sections sleep on, and the
     /// pool's spin budget (`docs/design/waiting.md`).
     pub(crate) waits: Waits,
-    pub(crate) shutdown: AtomicBool,
     /// Bumped by `Pool::release_idle`; members that started earlier leave when idle.
     pub(crate) release_epoch: AtomicUsize,
     pub(crate) defaults: WaitPolicy,
@@ -181,7 +186,6 @@ impl Awake {
                 barrier_sleeps: AtomicU64::new(0),
                 member_parks: AtomicU64::new(0),
             },
-            shutdown: AtomicBool::new(false),
             release_epoch: AtomicUsize::new(0),
             defaults,
             costs,
@@ -327,7 +331,6 @@ impl Awake {
     /// with a running task.
     pub(crate) fn acquire(
         self: &std::sync::Arc<Self>,
-        _pool: &crate::pool::Pool,
         need: usize,
         policy: WaitPolicy,
         spin_budget: u32,
@@ -387,13 +390,16 @@ impl Awake {
     pub(crate) fn run_one(&self, id: usize) -> bool {
         let slot = &self.slots[id];
         let mut seq = slot.bseq.load(Ordering::Relaxed);
-        if self.bcast.has_after(seq) {
+        if slot.in_bcast.load(Ordering::Relaxed) == 0 && self.bcast.has_after(seq) {
             let next = self.bcast.next_for(id, &mut seq);
             slot.bseq.store(seq, Ordering::Relaxed);
             if let Some(b) = next {
+                slot.in_bcast.fetch_add(1, Ordering::Relaxed);
                 // SAFETY: a linked broadcast that targets `id`; its caller
-                // keeps it alive until this share completed.
+                // keeps it alive until this share completed. `run_share`
+                // catches a panic of the share.
                 unsafe { crate::park::Broadcast::run_share(b, id) };
+                slot.in_bcast.fetch_sub(1, Ordering::Relaxed);
                 return true;
             }
         }
@@ -408,10 +414,10 @@ impl Awake {
     /// Whether worker `id` has work it could run now (a hint).
     #[cfg(feature = "parallel")]
     fn work_for(&self, id: usize) -> bool {
+        let slot = &self.slots[id];
         self.queue.has_work()
-            || self
-                .bcast
-                .has_after(self.slots[id].bseq.load(Ordering::Relaxed))
+            || (slot.in_bcast.load(Ordering::Relaxed) == 0
+                && self.bcast.has_after(slot.bseq.load(Ordering::Relaxed)))
     }
 
     /// A free worker or a lent member takes one piece of work: it wins `BUSY`
@@ -437,7 +443,9 @@ impl Awake {
     #[cfg(feature = "parallel")]
     pub(crate) fn help_while(&self, me: usize, done: impl Fn() -> bool) {
         let slot = &self.slots[me];
-        slot.helping.store(true, Ordering::SeqCst);
+        // Waits nest (a task run while helping waits in turn): the outer wait
+        // stays wakeable after the inner one returns.
+        let outer = slot.helping.swap(true, Ordering::SeqCst);
         let mut waiter = crate::park::Waiter::new(self.waits.spin_polls);
         while !done() {
             if self.run_one(me) {
@@ -449,7 +457,7 @@ impl Awake {
                 waiter = crate::park::Waiter::new(self.waits.spin_polls);
             }
         }
-        slot.helping.store(false, Ordering::SeqCst);
+        slot.helping.store(outer, Ordering::SeqCst);
     }
 }
 
@@ -487,6 +495,9 @@ pub(crate) fn serve(aw: &Awake, id: usize) {
     use crate::park::{Step, Waiter};
     let slot = &aw.slots[id];
     let mut seen = slot.gen.load(Ordering::Acquire);
+    // Claimable only from now on: a leader that reserves this slot publishes
+    // its first section after the baseline above.
+    slot.attached.store(true, Ordering::SeqCst);
     let mut waiter: Option<Waiter> = None;
     let mut was_lent = false;
     let mut reserved = false;
diff --git a/src/exec.rs b/src/exec.rs
index c645a12..9a76549 100644
--- a/src/exec.rs
+++ b/src/exec.rs
@@ -831,7 +831,6 @@ impl<'p> Exec<'p> {
         // oversubscribed, whatever the pool's pinning setting.
         let oversubscribed = crate::pin::oversubscribed(self.budget.get());
         let reservation = pool.awake.acquire(
-            pool,
             self.budget.get() - 1,
             policy,
             pool.awake.spin_budget(oversubscribed),
diff --git a/src/park.rs b/src/park.rs
index a41df5d..f59f87a 100644
--- a/src/park.rs
+++ b/src/park.rs
@@ -779,7 +779,8 @@ impl BroadcastList {
     }
 
     /// The next broadcast for worker `i` at or after its cursor `seq`, which
-    /// moves past every broadcast it inspects. The caller runs the returned
+    /// moves past every broadcast it inspects (past every publication so far
+    /// when none is left for `i`). The caller runs the returned
     /// share with [`Broadcast::run_share`].
     pub fn next_for(&self, i: usize, seq: &mut u64) -> Option<*const Broadcast> {
         let l = self.inner.lock().unwrap_or_else(|e| e.into_inner());
@@ -795,6 +796,9 @@ impl BroadcastList {
             }
             cur = b.link.get();
         }
+        // Broadcasts published before and already unlinked are past too, or
+        // `has_after` would keep reporting them.
+        *seq = (*seq).max(l.next_seq);
         None
     }
 
diff --git a/src/pool.rs b/src/pool.rs
index 0261df4..9658d30 100644
--- a/src/pool.rs
+++ b/src/pool.rs
@@ -61,16 +61,20 @@ const SPIN_POLLS_DEFAULT: u32 = if cfg!(target_arch = "aarch64") {
 /// caller), where each call acquires its members with
 /// [`Exec::team`](crate::Exec::team) or uses plain tokens.
 ///
-/// Dropping a `Pool` (or the `Team` that owns it) shuts its workers down and
-/// joins them: when `drop` returns, every worker thread has exited, so the
-/// thread-local destructors of the workers (including state set up by an
-/// [`on_start`](PoolBuilder::on_start) hook) have already run. Without the
-/// `parallel` feature there are no workers and nothing is joined.
+/// Dropping a `Pool` (or the `Team` that owns it) detaches its workers and
+/// waits until each one acknowledged; after that no worker touches the pool.
+/// Workers of a pool with default thread settings are *shared*: they go back,
+/// asleep, to a process-wide reserve that the next pool reuses, so their
+/// threads keep running. A pool with a [`thread_name`](PoolBuilder::thread_name),
+/// an [`on_start`](PoolBuilder::on_start) hook, a stack size or a QoS of its
+/// own has *dedicated* workers, which `drop` joins: when it returns, their
+/// thread-local destructors (including state set up by the hook) have run.
+/// Without the `parallel` feature there are no workers and nothing is joined.
 ///
 /// A pool dropped from one of its own workers cannot wait for itself: that drop
-/// signals shutdown and returns without joining, so the workers exit shortly
-/// after instead of before the return. Drop the pool from a plain thread when
-/// the guarantee matters.
+/// neither waits for nor joins the calling worker, which acknowledges and leaves
+/// after its task returns. Drop the pool from a plain thread when the guarantee
+/// matters.
 ///
 /// # Examples
 ///
@@ -239,7 +243,6 @@ impl Pool {
 
 impl Drop for Pool {
     fn drop(&mut self) {
-        self.awake.shutdown.store(true, Ordering::Release);
         #[cfg(feature = "parallel")]
         {
             // Detach every worker, then wait for their acknowledgements: after
@@ -664,8 +667,14 @@ impl PoolBuilder {
             self.pin_participants,
             self.spin_polls,
         ));
-        // A worker takes the caller's CPU set, as a thread it spawned would.
-        let mask = crate::pin::read_here();
+        // A reused worker takes the caller's CPU set, as a thread it spawned
+        // would. A dedicated worker was spawned by this caller and inherited
+        // it already; resetting it would undo the pinning of an `on_start` hook.
+        let mask = if shared {
+            crate::pin::read_here()
+        } else {
+            None
+        };
         for (id, w) in workers.iter().enumerate() {
             w.assign(crate::worker::Lease {
                 aw: Arc::clone(&awake),
@@ -776,6 +785,47 @@ mod tests {
         }
     }
 
+    /// Waits nest: an inner wait that returns leaves the outer one wakeable
+    /// for new work of the pool (`wake_for_work` looks at `helping`).
+    #[test]
+    fn a_nested_wait_keeps_the_outer_wait_wakeable() {
+        let pool = Pool::builder().threads(1).build().unwrap();
+        let aw = &pool.awake;
+        let helping = || aw.slots[0].helping.load(Ordering::SeqCst);
+        // Both conditions hold at once, so neither wait runs work of slot 0
+        // (whose worker serves it meanwhile).
+        aw.help_while(0, || {
+            aw.help_while(0, || true);
+            assert!(helping(), "the inner wait cleared the outer one's flag");
+            true
+        });
+        assert!(!helping());
+    }
+
+    /// A broadcast that completed and was unlinked before a worker outside
+    /// its budget looked: that worker's cursor still moves past it, so it
+    /// does not see pending work forever (and never parks).
+    #[test]
+    fn a_cursor_moves_past_a_broadcast_unlinked_before_it_looked() {
+        unsafe fn nothing(_: *const (), _: usize) {}
+        let waker = Arc::new(crate::park::Parker::new());
+        let list = crate::park::BroadcastList::new();
+        // SAFETY: `waker` outlives the broadcast; `nothing` reads no data.
+        let b = unsafe { crate::park::Broadcast::new(nothing, core::ptr::null(), 2, &waker) };
+        list.publish(&b);
+        for i in 0..2 {
+            let mut seq = 0;
+            let share = list.next_for(i, &mut seq).expect("a share for i");
+            // SAFETY: linked, alive, and targets `i`.
+            unsafe { crate::park::Broadcast::run_share(share, i) };
+        }
+        list.unlink(&b);
+        let mut seq = 0;
+        assert!(list.has_after(seq));
+        assert!(list.next_for(2, &mut seq).is_none());
+        assert!(!list.has_after(seq), "the cursor stayed before it");
+    }
+
     /// A pool built, used and dropped inside a task of another pool: the drop
     /// waits for the inner pool's workers only, never for the outer worker it
     /// runs on (a pool cannot be dropped from one of its own workers: every
diff --git a/src/reserve.rs b/src/reserve.rs
index 4832d4c..b5253d7 100644
--- a/src/reserve.rs
+++ b/src/reserve.rs
@@ -67,8 +67,8 @@ impl Drop for LeaderGuard<'_> {
 /// A `Team` **owns** its [`Pool`] and has no lifetime: an engine stores a `Team`
 /// (or a plain `Pool` when it wants no team). `Pool` is not `Clone`, no method
 /// hands out a second handle, and [`pool`](Team::pool) only borrows. Dropping
-/// the `Team` releases the members and then drops the pool, which joins the
-/// workers; [`into_pool`](Team::into_pool) releases the members and gives the
+/// the `Team` releases the members and then drops the pool (see [`Pool`] for
+/// what that does to its workers); [`into_pool`](Team::into_pool) releases the members and gives the
 /// pool back instead. Tokens borrow the `Team`, so none outlives it.
 ///
 /// # Examples
@@ -191,7 +191,7 @@ impl Pool {
         let reservation =
             match self
                 .awake
-                .acquire(&self, width - 1, release, self.awake.spin_budget(false))
+                .acquire(width - 1, release, self.awake.spin_budget(false))
             {
                 Ok(r) => r,
                 Err(reason) => return Err(IntoTeamError { pool: self, reason }),
diff --git a/src/worker.rs b/src/worker.rs
index 380e337..e5ed338 100644
--- a/src/worker.rs
+++ b/src/worker.rs
@@ -236,7 +236,8 @@ fn worker_main(ctl: &Arc<WorkerCtl>) {
         let _ = slot.thread.set(std::thread::current().id());
         *ctl.current.lock().unwrap_or_else(|e| e.into_inner()) =
             Some((Arc::clone(&lease.aw), lease.id));
-        slot.attached.store(true, Ordering::SeqCst);
+        // `serve` takes its section baseline before it marks the slot
+        // attached (claimable): a section published after that is seen.
         crate::awake::serve(&lease.aw, lease.id);
         // Epilogue: no access to the pool after the acknowledgement.
         slot.saved.restore();
diff --git a/tests/own_threads.rs b/tests/own_threads.rs
index da0b588..9ea8deb 100644
--- a/tests/own_threads.rs
+++ b/tests/own_threads.rs
@@ -230,3 +230,89 @@ fn a_reused_worker_takes_the_leasing_callers_cpu_set() {
     .join()
     .unwrap();
 }
+
+/// A dedicated worker keeps the CPU set its `on_start` hook pinned it to: the
+/// lease does not reset it to the caller's set.
+#[cfg(target_os = "linux")]
+#[test]
+fn a_dedicated_worker_keeps_the_pin_of_its_start_hook() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    fn cpus() -> Vec<usize> {
+        unsafe {
+            let mut set: libc::cpu_set_t = std::mem::zeroed();
+            libc::sched_getaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &mut set);
+            (0..libc::CPU_SETSIZE as usize)
+                .filter(|&c| libc::CPU_ISSET(c, &set))
+                .collect()
+        }
+    }
+    let all = cpus();
+    if all.len() < 2 {
+        eprintln!("skipped: needs 2 allowed CPUs");
+        return;
+    }
+    let target = all[1];
+    let pool = Pool::builder()
+        .threads(2)
+        .on_start(move |_| unsafe {
+            let mut s: libc::cpu_set_t = std::mem::zeroed();
+            libc::CPU_ZERO(&mut s);
+            libc::CPU_SET(target, &mut s);
+            libc::sched_setaffinity(0, std::mem::size_of::<libc::cpu_set_t>(), &s);
+        })
+        .build()
+        .unwrap();
+    let masks = Mutex::new(Vec::new());
+    Exec::new(&pool, 2)
+        .unwrap()
+        .broadcast(|_| masks.lock().unwrap().push(cpus()))
+        .unwrap();
+    for m in masks.into_inner().unwrap() {
+        assert_eq!(m, vec![target], "the lease undid the hook's pin");
+    }
+}
+
+/// Broadcast X's share 0 waits on another pool while X's share 1 waits at a
+/// barrier of X's shares; meanwhile broadcast Y, whose shares meet at a barrier
+/// too, is published. The waiting share 0 must not start Y's share on top of
+/// X's: Y's barrier would wait for worker 1, which waits for X.
+#[test]
+fn a_waiting_broadcast_share_does_not_start_a_later_broadcast() {
+    let _w = watchdog();
+    let _turn = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    let a = Pool::builder().threads(2).build().unwrap();
+    let b = Pool::builder().threads(2).build().unwrap();
+    for _ in 0..20 {
+        let x_bar = std::sync::Barrier::new(2);
+        let y_bar = std::sync::Barrier::new(2);
+        let x_waiting = std::sync::atomic::AtomicBool::new(false);
+        std::thread::scope(|s| {
+            s.spawn(|| {
+                Exec::new(&a, 2)
+                    .unwrap()
+                    .broadcast(|i| {
+                        if i == 0 {
+                            x_waiting.store(true, Ordering::SeqCst);
+                            Exec::new(&b, 2).unwrap().fork(2, |_, _| {
+                                std::thread::sleep(Duration::from_millis(20));
+                            });
+                        }
+                        x_bar.wait();
+                    })
+                    .unwrap();
+            });
+            s.spawn(|| {
+                while !x_waiting.load(Ordering::SeqCst) {
+                    std::thread::yield_now();
+                }
+                Exec::new(&a, 2)
+                    .unwrap()
+                    .broadcast(|_| {
+                        y_bar.wait();
+                    })
+                    .unwrap();
+            });
+        });
+    }
+}

From 78b59a197235ac0f31d6394a704156d560d470d0 Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 03:52:41 +0900
Subject: [PATCH 11/13] bench-ab: parse params that hold commas; keep the Rayon
 reference rows apart

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/bench-ab.sh | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/scripts/bench-ab.sh b/scripts/bench-ab.sh
index 36b8da6..095f63e 100755
--- a/scripts/bench-ab.sh
+++ b/scripts/bench-ab.sh
@@ -66,12 +66,18 @@ for r in $(seq 1 "$rounds"); do
 done
 echo "rows in $csv, waits in $log"
 python3 - "$csv" <<'PY'
-import csv, collections, statistics, sys
-rows = list(csv.DictReader(open(sys.argv[1])))
+import collections, statistics, sys
+# `param` may hold commas (`work=5us,sections=200`), unquoted: the fields around it are fixed.
 cells = collections.defaultdict(list)
-for r in rows:
-    name = r["label"].split("#")[0]
-    cells[(r["scenario"], r["width"], r["param"], r["metric"], name)].append(float(r["median_us"]))
+for line in open(sys.argv[1]).read().splitlines()[1:]:
+    f = line.split(",")
+    host, label, cpus, load, scenario, impl, width = f[:7]
+    metric, median = f[-5], f[-4]
+    param = ",".join(f[7:-5])
+    name = label.split("#")[0]
+    if impl not in ("threadteam", "libgomp"):
+        name = f"{name} ({impl})"
+    cells[(scenario, width, param, metric, name)].append(float(median))
 print(f"{'scenario':<9} {'width':>5} {'param':<24} {'metric':<6} {'side':<40} {'n':>3} {'median of medians us':>21}")
 for k in sorted(cells):
     v = cells[k]

From 64684c4b080fa9337723bec21b02584a65e0dcfd Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 03:59:05 +0900
Subject: [PATCH 12/13] alloc_free: a failing window reports each allocation's
 size, thread and backtrace

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/alloc_free.rs | 61 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 8 deletions(-)

diff --git a/tests/alloc_free.rs b/tests/alloc_free.rs
index bec9ff1..ee01111 100644
--- a/tests/alloc_free.rs
+++ b/tests/alloc_free.rs
@@ -2,27 +2,67 @@
 #![cfg(all(feature = "parallel", not(feature = "ledger")))]
 
 use std::alloc::{GlobalAlloc, Layout, System};
+use std::cell::Cell;
 use std::num::NonZeroUsize;
-use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::Mutex;
 use threadteam::{Exec, Pool};
 
 struct Counting;
 static ALLOCS: AtomicUsize = AtomicUsize::new(0);
+/// While set, every counted allocation also records its size, its thread and
+/// a backtrace, so that a failure says where it came from (a platform the
+/// author cannot run, such as macOS on CI, is diagnosed from the log alone).
+static RECORD: AtomicBool = AtomicBool::new(false);
+static RECORDED: Mutex<Vec<String>> = Mutex::new(Vec::new());
+
+thread_local! {
+    /// The recording itself allocates: it is neither counted nor recorded.
+    static RECORDING: Cell<bool> = const { Cell::new(false) };
+}
+
+fn count(size: usize) {
+    if RECORDING.with(|r| r.get()) {
+        return;
+    }
+    ALLOCS.fetch_add(1, Ordering::SeqCst);
+    if RECORD.load(Ordering::SeqCst) {
+        RECORDING.with(|r| r.set(true));
+        let entry = format!(
+            "{size} bytes on {:?}:\n{}",
+            std::thread::current().name(),
+            std::backtrace::Backtrace::force_capture()
+        );
+        RECORDED
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .push(entry);
+        RECORDING.with(|r| r.set(false));
+    }
+}
 
 unsafe impl GlobalAlloc for Counting {
     unsafe fn alloc(&self, l: Layout) -> *mut u8 {
-        ALLOCS.fetch_add(1, Ordering::SeqCst);
+        count(l.size());
         System.alloc(l)
     }
     unsafe fn dealloc(&self, p: *mut u8, l: Layout) {
         System.dealloc(p, l)
     }
     unsafe fn realloc(&self, p: *mut u8, l: Layout, n: usize) -> *mut u8 {
-        ALLOCS.fetch_add(1, Ordering::SeqCst);
+        count(n);
         System.realloc(p, l, n)
     }
 }
 
+/// The allocations recorded so far, for a failure message.
+fn recorded() -> String {
+    RECORDED
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .join("\n----\n")
+}
+
 #[global_allocator]
 static A: Counting = Counting;
 
@@ -56,14 +96,17 @@ fn measure(rounds: usize, f: impl Fn()) -> usize {
     for _ in 0..20 {
         f();
     }
-    (0..rounds)
+    RECORD.store(true, Ordering::SeqCst);
+    let worst = (0..rounds)
         .map(|_| {
             let before = ALLOCS.load(Ordering::SeqCst);
             f();
             ALLOCS.load(Ordering::SeqCst) - before
         })
         .max()
-        .unwrap_or(0)
+        .unwrap_or(0);
+    RECORD.store(false, Ordering::SeqCst);
+    worst
 }
 
 // One test: the counter is process-global.
@@ -71,7 +114,7 @@ fn measure(rounds: usize, f: impl Fn()) -> usize {
 fn fork_for_ranges_external_do_not_allocate() {
     let pool = Pool::builder().threads(3).build().unwrap();
     let plain = measure(10, || entries(&pool));
-    assert_eq!(plain, 0, "plain-thread entries allocated");
+    assert_eq!(plain, 0, "plain-thread entries allocated:\n{}", recorded());
     // The same after the workers went to sleep: waking them allocates nothing.
     let asleep = measure(5, || {
         std::thread::sleep(std::time::Duration::from_millis(20));
@@ -80,7 +123,8 @@ fn fork_for_ranges_external_do_not_allocate() {
         assert_eq!(
             ALLOCS.load(Ordering::SeqCst) - before,
             0,
-            "entries after a park allocated"
+            "entries after a park allocated:\n{}",
+            recorded()
         );
     });
     let _ = asleep;
@@ -96,7 +140,8 @@ fn fork_for_ranges_external_do_not_allocate() {
     assert_eq!(
         inside.load(Ordering::SeqCst),
         0,
-        "in-pool entries allocated"
+        "in-pool entries allocated:\n{}",
+        recorded()
     );
 
     // Participant pinning on: the extra pin section a root team scope runs must

From a11768fcda59667e4d2874bb16dd2da104204a42 Mon Sep 17 00:00:00 2001
From: Hiroshi Shinaoka <h.shinaoka@gmail.com>
Date: Fri, 30 Oct 2026 04:02:49 +0900
Subject: [PATCH 13/13] fix(sched): `enter` hands its closure over without a
 Mutex

On macOS a std `Mutex` allocates on its first lock, and `enter` built two
per call (`external` on a plain token): the strict alloc-free test failed
there with two allocations per window. The one-task batch runs its task
exactly once and the caller reads the result after completion, so a
single-use cell is enough.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/sched.rs | 41 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/src/sched.rs b/src/sched.rs
index 0807431..efa275f 100644
--- a/src/sched.rs
+++ b/src/sched.rs
@@ -150,19 +150,50 @@ pub(crate) fn enter<R: Send>(pool: &Pool, track: &Track, f: impl FnOnce() -> R +
     if in_pool(pool) {
         return f();
     }
-    let job = std::sync::Mutex::new(Some(f));
-    let out = std::sync::Mutex::new(None);
+    // No lock: a `Mutex` allocates on its first lock on some platforms
+    // (macOS), and this runs on every call.
+    let job = Handoff(core::cell::UnsafeCell::new(Some(f)));
+    let out = Handoff(core::cell::UnsafeCell::new(None));
     run_tasks(pool, 1, track, |_| {
-        let f = job.lock().unwrap_or_else(|e| e.into_inner()).take();
+        // SAFETY: the batch has one index, claimed exactly once (under the
+        // queue lock), so this body runs once; the caller reads `out` only
+        // after the batch's completion, which orders this write before it.
+        let f = unsafe { job.take() };
         if let Some(f) = f {
             let r = f();
-            *out.lock().unwrap_or_else(|e| e.into_inner()) = Some(r);
+            // SAFETY: as above.
+            unsafe { out.put(r) };
         }
     });
-    let r = out.into_inner().unwrap_or_else(|e| e.into_inner());
+    let r = out.0.into_inner();
     r.expect("the task ran")
 }
 
+/// A value passed into and out of the single task of [`enter`]'s batch: that
+/// task is its only user until the batch completes.
+#[cfg(feature = "parallel")]
+struct Handoff<T>(core::cell::UnsafeCell<Option<T>>);
+
+// SAFETY: one thread at a time touches the value: the task while it runs, the
+// caller after the batch completed (see `enter`); `T: Send` lets it move.
+#[cfg(feature = "parallel")]
+unsafe impl<T: Send> Sync for Handoff<T> {}
+
+#[cfg(feature = "parallel")]
+impl<T> Handoff<T> {
+    /// # Safety
+    /// No other thread accesses the value meanwhile.
+    unsafe fn take(&self) -> Option<T> {
+        (*self.0.get()).take()
+    }
+
+    /// # Safety
+    /// As [`take`](Self::take).
+    unsafe fn put(&self, v: T) {
+        *self.0.get() = Some(v);
+    }
+}
+
 /// Runs `f(i)` for every worker index `i < budget` at once, each on worker
 /// `i` of `pool`. The caller is never a worker of `pool` (`Exec::broadcast`
 /// refuses that); it waits, serving its own pool if it is a worker of one.