@napi-rs/cli 3.10.4 → 3.10.6

package/src/api/__tests__/__snapshots__/templates.spec.ts.md

@@ -135,6 +135,20 @@ Generated by [AVA](https://avajs.dev).
     let __emnapiContextDestroyPromise␊
     let __emnapiWasmEnvCleanupPrepared = false␊
     let __emnapiWasmEnvCleanupPreparing = false␊
+    // The closer for a barrier that is parked between \`…_begin\` and \`…_finish\`,␊
+    // set only while that window is open. \`__emnapiWasmEnvCleanupPreparing\` cannot␊
+    // tell those two apart on its own: it is raised both for a purely synchronous␊
+    // frame — which must not be re-entered, and which nothing outside it can␊
+    // finish — and across this window, which spans real event-loop turns, so a␊
+    // caller that cannot yield can land in the middle of one. That caller can close␊
+    // this window, because \`…_finish\` is idempotent and joins, which is exactly␊
+    // what the single call does. See \`__prepareWasmEnvCleanup\`.␊
+    let __finishParkedWasmEnvCleanup␊
+    // Raised while a caller that can still yield is driving the barrier, so the␊
+    // queue it leaves behind is expected rather than lost. See␊
+    // \`__reportUnreachedWasmEnvSettlements\`.␊
+    let __emnapiWasmEnvCleanupYielding = false␊
+    let __emnapiWasmEnvSettlementLossReported = false␊
     let __emnapiWasmEnvCleanupRan = false␊
     let __emnapiWasmEnvCleanupDrained = false␊
     let __emnapiWasmEnvCleanupDrainPromise␊
@@ -247,7 +261,24 @@ Generated by [AVA](https://avajs.dev).
     }␊
     ␊
     function __prepareWasmEnvCleanup() {␊
-      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+      if (__emnapiWasmEnvCleanupPrepared) {␊
+        return␊
+      }␊
+      // A handshake parked between its two halves is one this frame can close, and␊
+      // must: every caller of this function is about to destroy the context, and␊
+      // the turns the poll is waiting for will not come — an 'exit' teardown is␊
+      // the last thing the process runs, and \`Context.destroy()\` takes the␊
+      // environment away. Closing it here runs \`…_finish\`, which is the call that joins, so␊
+      // this degrades to exactly the single call below. Leaving it open instead␊
+      // destroys the context with the barrier still raised, the runtime never␊
+      // joined and the workers never drained.␊
+      const finishParked = __finishParkedWasmEnvCleanup␊
+      if (finishParked !== undefined) {␊
+        finishParked()␊
+        __reportUnreachedWasmEnvSettlements()␊
+        return␊
+      }␊
+      if (__emnapiWasmEnvCleanupPreparing) {␊
         return␊
       }␊
       const prepare = __napiInstance?.exports?.napi_prepare_wasm_env_cleanup␊
@@ -262,10 +293,57 @@ Generated by [AVA](https://avajs.dev).
           __emnapiWasmEnvCleanupPreparing = false␊
         }␊
         __emnapiWasmEnvCleanupRan = true␊
+        __reportUnreachedWasmEnvSettlements()␊
       }␊
       __emnapiWasmEnvCleanupPrepared = true␊
     }␊
     ␊
+    /**␊
+     * Say so when the barrier leaves settlements queued and nothing is left that␊
+     * could deliver them.␊
+     *␊
+     * Only the disposal chain yields the event-loop turns @emnapi/core needs to␊
+     * dispatch its queue. Every other caller of the barrier destroys in the same␊
+     * turn — a raw \`Context.destroy()\`, the 'exit' teardown — and␊
+     * \`Context.destroy()\` runs the threadsafe function's cleanup hook, which drains␊
+     * that queue with a null env and discards it. The promises those settlements␊
+     * were for then hang forever, silently.␊
+     *␊
+     * Loud, once, and never throwing: this runs from inside \`Context.destroy()\`,␊
+     * emnapi's own beforeExit destroy included, where throwing would take the whole␊
+     * teardown down with it. Destroying anyway is still the right trade — the queue␊
+     * is already unreachable by then.␊
+     */␊
+    function __reportUnreachedWasmEnvSettlements() {␊
+      if (__emnapiWasmEnvCleanupYielding || __emnapiWasmEnvSettlementLossReported) {␊
+        return␊
+      }␊
+      const pending = __napiInstance?.exports?.napi_wasm_env_cleanup_pending␊
+      if (typeof pending !== 'function') {␊
+        return␊
+      }␊
+      let queued␊
+      try {␊
+        queued = pending()␊
+      } catch {␊
+        return␊
+      }␊
+      if (!queued) {␊
+        return␊
+      }␊
+      __emnapiWasmEnvSettlementLossReported = true␊
+      try {␊
+        const consoleHost = globalThis.console␊
+        if (consoleHost && typeof consoleHost.error === 'function') {␊
+          consoleHost.error(␊
+            "napi-rs: the wasm environment is being destroyed with " +␊
+              queued +␊
+              " queued promise settlement(s). Context.destroy() discards them, so those promises never settle. Dispose with binding[Symbol.for('napi.rs.wasi.dispose')]() instead: only it yields the event-loop turns the settlements need.",␊
+          )␊
+        }␊
+      } catch {}␊
+    }␊
+    ␊
     // Mirror the primitive @emnapi/core schedules its threadsafe-function dispatch␊
     // on, so the drain turns below interleave with that dispatch instead of racing␊
     // ahead of it on a faster queue.␊
@@ -315,6 +393,291 @@ Generated by [AVA](https://avajs.dev).
       }␊
     }␊
     ␊
+    // A real, referenced timer rather than a zero-delay macrotask, for the same␊
+    // reason the async-work drain uses one: this polls the addon instead of␊
+    // interleaving with the @emnapi/core dispatch, so a zero-delay turn would spin␊
+    // the loop instead of yielding it.␊
+    const __WASM_RUNTIME_WORK_POLL_INTERVAL_MS = 1␊
+    // Arrivals it takes before the poll paces on the host's timers alone. One␊
+    // proves nothing: a timer armed before the host's timers stopped still fires.␊
+    const __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS = 2␊
+    // How long a parked turn's own timer must already have been due before a␊
+    // backup that runs calls it dropped. Slack, not a deadline: a timer is due␊
+    // against the event loop's clock, which is read once per iteration, while␊
+    // these are \`Date.now()\` readings taken part-way through one, so the two␊
+    // drift apart by however long the loop has been inside the current iteration.␊
+    const __WASM_RUNTIME_WORK_POLL_STALL_MS = 50␊
+    // How long a backup itself waits. What is left of it after the slack and one␊
+    // interval — 149 ms — has to cover the *two* poll turns that can separate a␊
+    // parked turn from the last backup armed while the host's timers still␊
+    // worked, so the ceiling on a single turn is half of it. See the invariant on␊
+    // \`__armWasmRuntimePollStallBackup\`.␊
+    const __WASM_RUNTIME_WORK_POLL_BACKUP_MS = 200␊
+    ␊
+    /**␊
+     * Pacing state for one runtime-work poll.␊
+     *␊
+     * Per poll, never per module: whether the host's timers arrive is not a␊
+     * property of the module. A host can lose its timers between two disposals,␊
+     * and in the deferred shape every instance shares this module — one healthy␊
+     * instance must not disarm the fallback for the next one.␊
+     */␊
+    function __createWasmRuntimePollPace() {␊
+      return {␊
+        // Timers armed by *this* poll that have actually arrived.␊
+        arrivals: 0,␊
+        // The turn waiting on a timer alone *right now* — undefined whenever no␊
+        // turn is parked — and when that turn's own timer came due.␊
+        settleTurn: undefined,␊
+        turnTimerDueAt: 0,␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * The backup that ends a turn whose timer is never going to arrive.␊
+     *␊
+     * Once the poll paces on the timer alone it has nothing left to fall back on␊
+     * if the host's timers stop mid-poll: the turn that armed the dead timer is␊
+     * the turn that parks, and a parked poll schedules nothing that could notice.␊
+     * So every turn arms one of these before it yields, and each one compares due␊
+     * times instead of measuring how long the parked turn has been waiting.␊
+     *␊
+     * Invariant: a parked turn is ended by the newest backup that was armed while␊
+     * the host's timers still worked, and a backup ends a turn only when that␊
+     * turn's own timer was already due a whole window before the backup itself.␊
+     * Neither half turns on how far apart the arms happen to fall — what bounds␊
+     * the rescue is how far back that newest live backup is:␊
+     *␊
+     * - *Ends it.* Hosts run timers in due order, so a backup that runs while a␊
+     *   turn due a whole window earlier is still parked proves that turn's timer␊
+     *   was dropped rather than merely late. That same comparison is what leaves a␊
+     *   healthy host alone: there the turn's timer has already run and cleared␊
+     *   \`settleTurn\` before any backup due after it can look.␊
+     * - *Two turns back, not one.* A turn that ended does not prove its own timer␊
+     *   arrived: until \`…_TRUSTED_ARRIVALS\` is reached every turn arms both␊
+     *   primitives and the macrotask wins, so such a turn can end with its own␊
+     *   timer — and the backup armed one line before it — already dead. The␊
+     *   arrival that then flips the poll onto the timer alone can itself be a␊
+     *   timer armed before the host's timers died. So the turn that parks can sit␊
+     *   two turns past the last live arm, and the newest live backup is due␊
+     *   \`…_BACKUP_MS\` less *two* turn lengths after that turn's own timer.␊
+     *   Arming on every turn is what holds it to two, rather than however far back␊
+     *   a throttle last let one through.␊
+     * - *Ceiling.* Coverage therefore holds while two consecutive poll turns fit␊
+     *   inside \`…_BACKUP_MS\` less the slack and one interval: 149 ms, so 74 ms␊
+     *   per turn (measured: a 74 ms turn is still rescued, a 75 ms one parks).␊
+     *   Past that the turn stays parked and the disposal promise never settles.␊
+     *   The bound is deliberate: reaching it takes a host that drops timers␊
+     *   mid-poll *and* keeps every poll turn busy for more than 74 ms, and neither␊
+     *   Node nor WebContainer — the hosts that run the threaded artifact — does␊
+     *   the second.␊
+     *␊
+     * The poll then goes back to arming both primitives until two fresh arrivals␊
+     * prove the timers again. A host that stops running the timers it has␊
+     * *already* accepted leaves nothing to fire, and the disposal promise stays␊
+     * pending rather than wedging the thread — the same outcome as a blocking␊
+     * closure that never returns. Unreferenced wherever the host allows it: the␊
+     * poll's own turn timers are what keep the loop alive, never these.␊
+     */␊
+    function __armWasmRuntimePollStallBackup(pace) {␊
+      const setTimer = globalThis.setTimeout␊
+      if (typeof setTimer !== 'function') {␊
+        // Nothing to back up: \`__scheduleTimer\` is on the macrotask channel␊
+        // already, and that one cannot park.␊
+        return␊
+      }␊
+      // Read before arming, so this never claims to be due earlier than the timer␊
+      // actually is: a backup ends a turn only when it is provably due after it.␊
+      const dueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_BACKUP_MS␊
+      let handle␊
+      try {␊
+        handle = setTimer(() => {␊
+          const settleTurn = pace.settleTurn␊
+          if (␊
+            !settleTurn ||␊
+            pace.turnTimerDueAt > dueAt - __WASM_RUNTIME_WORK_POLL_STALL_MS␊
+          ) {␊
+            // No turn is parked, or the parked one's timer came due too close to␊
+            // this backup to call it dropped — it may still arrive, and the turn␊
+            // that armed it armed a backup due a whole window after *that*.␊
+            return␊
+          }␊
+          pace.arrivals = 0␊
+          pace.settleTurn = undefined␊
+          settleTurn()␊
+        }, __WASM_RUNTIME_WORK_POLL_BACKUP_MS)␊
+      } catch {␊
+        return␊
+      }␊
+      if (handle && typeof handle.unref === 'function') {␊
+        try {␊
+          handle.unref()␊
+        } catch {}␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * One turn of the runtime-work poll.␊
+     *␊
+     * \`__scheduleTimer\` falls back to the macrotask scheduler when \`setTimeout\` is␊
+     * missing or throws, but not when it is present, returns a handle and never␊
+     * fires — fake timers in a test suite that disposes from an \`afterEach\`, or a␊
+     * host whose timers belong to an IO context that is already gone. That host␊
+     * would park this poll forever, and the poll is unbounded, so nothing would␊
+     * ever call \`…_finish\`.␊
+     *␊
+     * Arm both primitives until timers armed by this poll have arrived twice, and␊
+     * let whichever lands first end the turn; the loser resolves nothing. A host␊
+     * with working timers therefore pays the double arming for the first turn or␊
+     * two — the macrotask wins the race, but the timers behind it still arrive and␊
+     * are counted — and paces on the timer alone from then on, instead of spinning␊
+     * the loop on a zero-delay queue. A host whose timers never arrive keeps both,␊
+     * and the macrotask is what keeps the poll moving. A host whose timers stop␊
+     * after proving themselves is caught by \`__armWasmRuntimePollStallBackup\`,␊
+     * which ends the parked turn and puts this poll back on both.␊
+     */␊
+    function __yieldWasmRuntimePollTurn(pace) {␊
+      // Armed before the turn yields, and by every turn: what rescues a parked␊
+      // turn has to have been armed while the host's timers still worked, and the␊
+      // turn that parks is the one whose own timer is already dead.␊
+      __armWasmRuntimePollStallBackup(pace)␊
+      return new Promise((resolve) => {␊
+        let settled = false␊
+        const settle = () => {␊
+          if (settled) {␊
+            return␊
+          }␊
+          settled = true␊
+          if (pace.settleTurn === settle) {␊
+            // Nothing is parked any more: a backup running later must not read a␊
+            // due time this turn has already answered.␊
+            pace.settleTurn = undefined␊
+          }␊
+          resolve()␊
+        }␊
+        __scheduleTimer(() => {␊
+          pace.arrivals++␊
+          settle()␊
+        }, __WASM_RUNTIME_WORK_POLL_INTERVAL_MS)␊
+        // Read next to the arming it describes; see␊
+        // \`__armWasmRuntimePollStallBackup\` for what the two due times mean.␊
+        const turnTimerDueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_INTERVAL_MS␊
+        if (pace.arrivals < __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS) {␊
+          __scheduleMacrotask(settle)␊
+          return␊
+        }␊
+        // Paced by the timer alone from here; the backup is what ends this turn if␊
+        // the timer never arrives.␊
+        pace.settleTurn = settle␊
+        pace.turnTimerDueAt = turnTimerDueAt␊
+      })␊
+    }␊
+    ␊
+    /**␊
+     * The barrier for callers that can yield: \`__prepareWasmEnvCleanup\` with real␊
+     * event-loop turns in the middle.␊
+     *␊
+     * \`napi_prepare_wasm_env_cleanup\` waits — it returns only once the addon's␊
+     * async runtime has quiesced, and on \`wasm32-wasip1-threads\` the thread it␊
+     * waits on is this one, the only thread that can give a running blocking␊
+     * closure the JavaScript turn *it* is waiting for. A single call there can wait␊
+     * for work that can never finish. The addon's two-phase form splits that:␊
+     * \`…_begin\` stops the runtime without joining and reports whether anything is␊
+     * still live, \`napi_wasm_runtime_work_pending\` answers that question again␊
+     * without blocking, and \`…_finish\` joins. The turns yielded in between are the␊
+     * entire point.␊
+     *␊
+     * The poll has no deadline, for the same reason the async-work drain below has␊
+     * none: giving up means calling \`…_finish\`, which joins on this thread, and the␊
+     * work it would join is the work that is waiting for a turn from this thread —␊
+     * so a bound does not end the wait, it only moves it somewhere the JavaScript␊
+     * thread can no longer be reached. A blocking closure that never returns keeps␊
+     * the disposal promise pending instead, exactly as a task whose \`execute\` never␊
+     * returns already keeps an *undisposed* process alive. The host contract is in␊
+     * \`crates/async-runtime/README.md\`: a blocking closure must never wait on a␊
+     * JavaScript turn. The process-exit path still blocks in \`…_finish\`, because it␊
+     * has no turns left to give (see \`__prepareWasmEnvCleanup\`).␊
+     *␊
+     * Feature-detected like every other export in this teardown, so an addon built␊
+     * against a napi crate that predates the split keeps the single blocking call.␊
+     * Returns nothing whenever the handshake finished without yielding, which keeps␊
+     * an idle disposal synchronous.␊
+     */␊
+    function __prepareWasmEnvCleanupWithTurns() {␊
+      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+        return␊
+      }␊
+      const exports = __napiInstance?.exports␊
+      const begin = exports?.napi_prepare_wasm_env_cleanup_begin␊
+      const finish = exports?.napi_prepare_wasm_env_cleanup_finish␊
+      if (typeof begin !== 'function' || typeof finish !== 'function') {␊
+        // No split to use. The settlement drain still follows this, so the queue␊
+        // the single call leaves behind is expected rather than lost.␊
+        __emnapiWasmEnvCleanupYielding = true␊
+        try {␊
+          __prepareWasmEnvCleanup()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupYielding = false␊
+        }␊
+        return␊
+      }␊
+      const workPending = exports?.napi_wasm_runtime_work_pending␊
+      // The in-flight flag stays raised across the turns below, so a \`destroy()\`␊
+      // from one of the JavaScript handlers they run is the same no-op it is inside␊
+      // the single call: the barrier is up and the runtime is mid-teardown, and␊
+      // destroying between the halves would strand exactly what this delivers.␊
+      __emnapiWasmEnvCleanupPreparing = true␊
+      let live␊
+      try {␊
+        live = begin()␊
+      } catch (error) {␊
+        __emnapiWasmEnvCleanupPreparing = false␊
+        throw error␊
+      }␊
+      __emnapiWasmEnvCleanupRan = true␊
+      const finishCleanup = () => {␊
+        if (__emnapiWasmEnvCleanupPrepared) {␊
+          // Already closed by a caller that could not yield — the 'exit' teardown␊
+          // reached \`__prepareWasmEnvCleanup\` while this poll was parked. \`…_finish\`␊
+          // is idempotent, but the flags it lowers are not: running it again here␊
+          // would clear a \`preparing\` some later barrier had raised.␊
+          return␊
+        }␊
+        __finishParkedWasmEnvCleanup = undefined␊
+        try {␊
+          finish()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupPreparing = false␊
+        }␊
+        __emnapiWasmEnvCleanupPrepared = true␊
+      }␊
+      if (!live || typeof workPending !== 'function') {␊
+        finishCleanup()␊
+        return␊
+      }␊
+      // Publish the closer before yielding: from here until \`finishCleanup\` runs,␊
+      // a caller that cannot yield is entitled to end this handshake itself.␊
+      __finishParkedWasmEnvCleanup = finishCleanup␊
+      return (async () => {␊
+        // Unbounded, exactly like the async-work drain below. The wait ends when␊
+        // the addon reports its runtime work finished; the turns spent here are␊
+        // what let that happen at all.␊
+        const pace = __createWasmRuntimePollPace()␊
+        for (;;) {␊
+          await __yieldWasmRuntimePollTurn(pace)␊
+          try {␊
+            if (!workPending()) {␊
+              return␊
+            }␊
+          } catch {␊
+            // A trap is the only way this fails, and a trapped instance has no␊
+            // reachable work left. Stop polling and finish.␊
+            return␊
+          }␊
+        }␊
+      })().then(finishCleanup, finishCleanup)␊
+    }␊
+    ␊
     // Turns to wait for while the addon still reports queued settlements. Reaching␊
     // zero is the only success. A counter still nonzero at this bound rejects the␊
     // disposal as retryable (\`ERR_NAPI_WASI_CLEANUP_PENDING\`) rather than␊
@@ -451,6 +814,19 @@ Generated by [AVA](https://avajs.dev).
       }␊
     ␊
       __prepareWasmEnvCleanup()␊
+      if (__isPreparingWasmEnvCleanup()) {␊
+        // Reached from inside the synchronous barrier — a promise hook one of the␊
+        // settlements above ran, which is the reentrancy the destroy wrapper␊
+        // exists for. \`Context.destroy()\` below would hit that wrapper's in-flight␊
+        // no-op and answer \`undefined\`, and recording that as a completed destroy␊
+        // is what makes the frame that *did* start the barrier skip the real one␊
+        // afterwards, leaving the context retained with its cleanup hooks unrun.␊
+        // Refuse instead: nothing is flagged, and that frame destroys for real the␊
+        // moment it returns. The deferred loader carries the same backstop. A␊
+        // parked handshake cannot get here — \`__prepareWasmEnvCleanup\` closes one␊
+        // rather than skipping it.␊
+        return␊
+      }␊
       const result = __emnapiContext.destroy()␊
       if (!__isThenable(result)) {␊
         __emnapiContextDestroyed = true␊
@@ -724,11 +1100,7 @@ Generated by [AVA](https://avajs.dev).
       return __finishWasiDisposal()␊
     }␊
     ␊
-    function __cleanUpWasmEnvForWasiDisposal() {␊
-      // Run the pre-teardown barrier, then let the settlements it queued actually␊
-      // reach JavaScript, and only then destroy the environment. Doing these two␊
-      // back to back is what strands them.␊
-      __prepareWasmEnvCleanup()␊
+    function __drainWasmEnvForWasiDisposal() {␊
       const drainResult = __drainWasmEnvCleanup()␊
       if (__isThenable(drainResult)) {␊
         return Promise.resolve(drainResult).then(__continueWasiDisposal)␊
@@ -736,6 +1108,18 @@ Generated by [AVA](https://avajs.dev).
       return __continueWasiDisposal()␊
     }␊
     ␊
+    function __cleanUpWasmEnvForWasiDisposal() {␊
+      // Run the pre-teardown barrier — yielding the turns its two-phase form asks␊
+      // for, when the addon has one — then let the settlements it queued actually␊
+      // reach JavaScript, and only then destroy the environment. Doing any two of␊
+      // these back to back is what strands them.␊
+      const prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+      if (__isThenable(prepareResult)) {␊
+        return Promise.resolve(prepareResult).then(__drainWasmEnvForWasiDisposal)␊
+      }␊
+      return __drainWasmEnvForWasiDisposal()␊
+    }␊
+    ␊
     function __startWasiDisposal() {␊
       // Outstanding \`napi_async_work\` goes first, while the environment is still␊
       // completely live: the completion callbacks run addon code, and everything␊
@@ -896,14 +1280,36 @@ Generated by [AVA](https://avajs.dev).
       // be reached without the async-work drain below running first.␊
       function __rollbackWasmEnvForWasiInitialization() {␊
         const cleanupErrors = []␊
+        let prepareResult␊
+        try {␊
+          prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+        } catch (cleanupError) {␊
+          cleanupErrors.push(cleanupError)␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
+        }␊
+        if (__isThenable(prepareResult)) {␊
+          return Promise.resolve(prepareResult).then(␊
+            () => __drainWasmEnvForWasiRollback(cleanupErrors),␊
+            (cleanupError) => {␊
+              cleanupErrors.push(cleanupError)␊
+              return __retainFailedWasiRollback(cleanupErrors)␊
+            },␊
+          )␊
+        }␊
+        return __drainWasmEnvForWasiRollback(cleanupErrors)␊
+      }␊
+    ␊
+      // The settlement drain of the rollback above, reached either straight away or␊
+      // after the barrier's two-phase form has yielded its turns. A barrier that␊
+      // did not finish never gets here: it retains instead, exactly as a drain that␊
+      // did not finish does.␊
+      function __drainWasmEnvForWasiRollback(cleanupErrors) {␊
         let drainResult␊
-        let settlementsUnreached = false␊
         try {␊
-          __prepareWasmEnvCleanup()␊
           drainResult = __drainWasmEnvCleanup()␊
         } catch (cleanupError) {␊
           cleanupErrors.push(cleanupError)␊
-          settlementsUnreached = true␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
         }␊
         if (__isThenable(drainResult)) {␊
           return Promise.resolve(drainResult).then(␊
@@ -914,9 +1320,6 @@ Generated by [AVA](https://avajs.dev).
             },␊
           )␊
         }␊
-        if (settlementsUnreached) {␊
-          return __retainFailedWasiRollback(cleanupErrors)␊
-        }␊
         return __destroyContextForWasiRollback(cleanupErrors)␊
       }␊
     ␊
@@ -948,6 +1351,36 @@ Generated by [AVA](https://avajs.dev).
       return __rollbackWasmEnvForWasiInitialization()␊
     }␊
     ␊
+    // A view of the addon's crash flag, one word of the shared wasm memory, for the␊
+    // pool workers: they raise it when their wasm thread dies, and the shutdown␊
+    // waits inside the cleanup calls on this thread then trap instead of waiting on␊
+    // the dead thread for good. Undefined for an addon built with an older napi.␊
+    let __wasiAddonCrashFlag␊
+    ␊
+    function __captureWasiAddonCrashFlag(instance) {␊
+      try {␊
+        const getAddress = instance.exports.napi_wasm_thread_crash_flag_address␊
+        if (typeof getAddress !== 'function') {␊
+          return␊
+        }␊
+        const address = getAddress() >>> 0␊
+        const buffer = __sharedMemory.buffer␊
+        if (address === 0 || address % 4 !== 0 || address + 4 > buffer.byteLength) {␊
+          return␊
+        }␊
+        __wasiAddonCrashFlag = new Int32Array(buffer, address, 1)␊
+      } catch {}␊
+    }␊
+    ␊
+    function __shareWasiAddonCrashFlag(worker) {␊
+      if (__wasiAddonCrashFlag === undefined) {␊
+        return␊
+      }␊
+      try {␊
+        worker.postMessage({ __napiRsAddonCrashFlag: __wasiAddonCrashFlag })␊
+      } catch {}␊
+    }␊
+    ␊
     let __wasiModule␊
     let __napiModule␊
     ␊
@@ -978,6 +1411,7 @@ Generated by [AVA](https://avajs.dev).
             type: 'module',␊
           })␊
           __wasiWorkers.add(worker)␊
+          __shareWasiAddonCrashFlag(worker)␊
     ␊
     ␊
           return worker␊
@@ -993,6 +1427,10 @@ Generated by [AVA](https://avajs.dev).
         },␊
         beforeInit({ instance }) {␊
           __napiInstance = instance␊
+          __captureWasiAddonCrashFlag(instance)␊
+          for (const worker of __wasiWorkers) {␊
+            __shareWasiAddonCrashFlag(worker)␊
+          }␊
           for (const name of Object.keys(instance.exports)) {␊
             if (name.startsWith('__napi_register__')) {␊
               instance.exports[name]()␊
@@ -1144,6 +1582,20 @@ Generated by [AVA](https://avajs.dev).
     let __emnapiContextDestroyPromise␊
     let __emnapiWasmEnvCleanupPrepared = false␊
     let __emnapiWasmEnvCleanupPreparing = false␊
+    // The closer for a barrier that is parked between \`…_begin\` and \`…_finish\`,␊
+    // set only while that window is open. \`__emnapiWasmEnvCleanupPreparing\` cannot␊
+    // tell those two apart on its own: it is raised both for a purely synchronous␊
+    // frame — which must not be re-entered, and which nothing outside it can␊
+    // finish — and across this window, which spans real event-loop turns, so a␊
+    // caller that cannot yield can land in the middle of one. That caller can close␊
+    // this window, because \`…_finish\` is idempotent and joins, which is exactly␊
+    // what the single call does. See \`__prepareWasmEnvCleanup\`.␊
+    let __finishParkedWasmEnvCleanup␊
+    // Raised while a caller that can still yield is driving the barrier, so the␊
+    // queue it leaves behind is expected rather than lost. See␊
+    // \`__reportUnreachedWasmEnvSettlements\`.␊
+    let __emnapiWasmEnvCleanupYielding = false␊
+    let __emnapiWasmEnvSettlementLossReported = false␊
     let __emnapiWasmEnvCleanupRan = false␊
     let __emnapiWasmEnvCleanupDrained = false␊
     let __emnapiWasmEnvCleanupDrainPromise␊
@@ -1256,7 +1708,24 @@ Generated by [AVA](https://avajs.dev).
     }␊
     ␊
     function __prepareWasmEnvCleanup() {␊
-      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+      if (__emnapiWasmEnvCleanupPrepared) {␊
+        return␊
+      }␊
+      // A handshake parked between its two halves is one this frame can close, and␊
+      // must: every caller of this function is about to destroy the context, and␊
+      // the turns the poll is waiting for will not come — an 'exit' teardown is␊
+      // the last thing the process runs, and \`Context.destroy()\` takes the␊
+      // environment away. Closing it here runs \`…_finish\`, which is the call that joins, so␊
+      // this degrades to exactly the single call below. Leaving it open instead␊
+      // destroys the context with the barrier still raised, the runtime never␊
+      // joined and the workers never drained.␊
+      const finishParked = __finishParkedWasmEnvCleanup␊
+      if (finishParked !== undefined) {␊
+        finishParked()␊
+        __reportUnreachedWasmEnvSettlements()␊
+        return␊
+      }␊
+      if (__emnapiWasmEnvCleanupPreparing) {␊
         return␊
       }␊
       const prepare = __napiInstance?.exports?.napi_prepare_wasm_env_cleanup␊
@@ -1271,10 +1740,57 @@ Generated by [AVA](https://avajs.dev).
           __emnapiWasmEnvCleanupPreparing = false␊
         }␊
         __emnapiWasmEnvCleanupRan = true␊
+        __reportUnreachedWasmEnvSettlements()␊
       }␊
       __emnapiWasmEnvCleanupPrepared = true␊
     }␊
     ␊
+    /**␊
+     * Say so when the barrier leaves settlements queued and nothing is left that␊
+     * could deliver them.␊
+     *␊
+     * Only the disposal chain yields the event-loop turns @emnapi/core needs to␊
+     * dispatch its queue. Every other caller of the barrier destroys in the same␊
+     * turn — a raw \`Context.destroy()\`, the 'exit' teardown — and␊
+     * \`Context.destroy()\` runs the threadsafe function's cleanup hook, which drains␊
+     * that queue with a null env and discards it. The promises those settlements␊
+     * were for then hang forever, silently.␊
+     *␊
+     * Loud, once, and never throwing: this runs from inside \`Context.destroy()\`,␊
+     * emnapi's own beforeExit destroy included, where throwing would take the whole␊
+     * teardown down with it. Destroying anyway is still the right trade — the queue␊
+     * is already unreachable by then.␊
+     */␊
+    function __reportUnreachedWasmEnvSettlements() {␊
+      if (__emnapiWasmEnvCleanupYielding || __emnapiWasmEnvSettlementLossReported) {␊
+        return␊
+      }␊
+      const pending = __napiInstance?.exports?.napi_wasm_env_cleanup_pending␊
+      if (typeof pending !== 'function') {␊
+        return␊
+      }␊
+      let queued␊
+      try {␊
+        queued = pending()␊
+      } catch {␊
+        return␊
+      }␊
+      if (!queued) {␊
+        return␊
+      }␊
+      __emnapiWasmEnvSettlementLossReported = true␊
+      try {␊
+        const consoleHost = globalThis.console␊
+        if (consoleHost && typeof consoleHost.error === 'function') {␊
+          consoleHost.error(␊
+            "napi-rs: the wasm environment is being destroyed with " +␊
+              queued +␊
+              " queued promise settlement(s). Context.destroy() discards them, so those promises never settle. Dispose with binding[Symbol.for('napi.rs.wasi.dispose')]() instead: only it yields the event-loop turns the settlements need.",␊
+          )␊
+        }␊
+      } catch {}␊
+    }␊
+    ␊
     // Mirror the primitive @emnapi/core schedules its threadsafe-function dispatch␊
     // on, so the drain turns below interleave with that dispatch instead of racing␊
     // ahead of it on a faster queue.␊
@@ -1324,6 +1840,291 @@ Generated by [AVA](https://avajs.dev).
       }␊
     }␊
     ␊
+    // A real, referenced timer rather than a zero-delay macrotask, for the same␊
+    // reason the async-work drain uses one: this polls the addon instead of␊
+    // interleaving with the @emnapi/core dispatch, so a zero-delay turn would spin␊
+    // the loop instead of yielding it.␊
+    const __WASM_RUNTIME_WORK_POLL_INTERVAL_MS = 1␊
+    // Arrivals it takes before the poll paces on the host's timers alone. One␊
+    // proves nothing: a timer armed before the host's timers stopped still fires.␊
+    const __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS = 2␊
+    // How long a parked turn's own timer must already have been due before a␊
+    // backup that runs calls it dropped. Slack, not a deadline: a timer is due␊
+    // against the event loop's clock, which is read once per iteration, while␊
+    // these are \`Date.now()\` readings taken part-way through one, so the two␊
+    // drift apart by however long the loop has been inside the current iteration.␊
+    const __WASM_RUNTIME_WORK_POLL_STALL_MS = 50␊
+    // How long a backup itself waits. What is left of it after the slack and one␊
+    // interval — 149 ms — has to cover the *two* poll turns that can separate a␊
+    // parked turn from the last backup armed while the host's timers still␊
+    // worked, so the ceiling on a single turn is half of it. See the invariant on␊
+    // \`__armWasmRuntimePollStallBackup\`.␊
+    const __WASM_RUNTIME_WORK_POLL_BACKUP_MS = 200␊
+    ␊
+    /**␊
+     * Pacing state for one runtime-work poll.␊
+     *␊
+     * Per poll, never per module: whether the host's timers arrive is not a␊
+     * property of the module. A host can lose its timers between two disposals,␊
+     * and in the deferred shape every instance shares this module — one healthy␊
+     * instance must not disarm the fallback for the next one.␊
+     */␊
+    function __createWasmRuntimePollPace() {␊
+      return {␊
+        // Timers armed by *this* poll that have actually arrived.␊
+        arrivals: 0,␊
+        // The turn waiting on a timer alone *right now* — undefined whenever no␊
+        // turn is parked — and when that turn's own timer came due.␊
+        settleTurn: undefined,␊
+        turnTimerDueAt: 0,␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * The backup that ends a turn whose timer is never going to arrive.␊
+     *␊
+     * Once the poll paces on the timer alone it has nothing left to fall back on␊
+     * if the host's timers stop mid-poll: the turn that armed the dead timer is␊
+     * the turn that parks, and a parked poll schedules nothing that could notice.␊
+     * So every turn arms one of these before it yields, and each one compares due␊
+     * times instead of measuring how long the parked turn has been waiting.␊
+     *␊
+     * Invariant: a parked turn is ended by the newest backup that was armed while␊
+     * the host's timers still worked, and a backup ends a turn only when that␊
+     * turn's own timer was already due a whole window before the backup itself.␊
+     * Neither half turns on how far apart the arms happen to fall — what bounds␊
+     * the rescue is how far back that newest live backup is:␊
+     *␊
+     * - *Ends it.* Hosts run timers in due order, so a backup that runs while a␊
+     *   turn due a whole window earlier is still parked proves that turn's timer␊
+     *   was dropped rather than merely late. That same comparison is what leaves a␊
+     *   healthy host alone: there the turn's timer has already run and cleared␊
+     *   \`settleTurn\` before any backup due after it can look.␊
+     * - *Two turns back, not one.* A turn that ended does not prove its own timer␊
+     *   arrived: until \`…_TRUSTED_ARRIVALS\` is reached every turn arms both␊
+     *   primitives and the macrotask wins, so such a turn can end with its own␊
+     *   timer — and the backup armed one line before it — already dead. The␊
+     *   arrival that then flips the poll onto the timer alone can itself be a␊
+     *   timer armed before the host's timers died. So the turn that parks can sit␊
+     *   two turns past the last live arm, and the newest live backup is due␊
+     *   \`…_BACKUP_MS\` less *two* turn lengths after that turn's own timer.␊
+     *   Arming on every turn is what holds it to two, rather than however far back␊
+     *   a throttle last let one through.␊
+     * - *Ceiling.* Coverage therefore holds while two consecutive poll turns fit␊
+     *   inside \`…_BACKUP_MS\` less the slack and one interval: 149 ms, so 74 ms␊
+     *   per turn (measured: a 74 ms turn is still rescued, a 75 ms one parks).␊
+     *   Past that the turn stays parked and the disposal promise never settles.␊
+     *   The bound is deliberate: reaching it takes a host that drops timers␊
+     *   mid-poll *and* keeps every poll turn busy for more than 74 ms, and neither␊
+     *   Node nor WebContainer — the hosts that run the threaded artifact — does␊
+     *   the second.␊
+     *␊
+     * The poll then goes back to arming both primitives until two fresh arrivals␊
+     * prove the timers again. A host that stops running the timers it has␊
+     * *already* accepted leaves nothing to fire, and the disposal promise stays␊
+     * pending rather than wedging the thread — the same outcome as a blocking␊
+     * closure that never returns. Unreferenced wherever the host allows it: the␊
+     * poll's own turn timers are what keep the loop alive, never these.␊
+     */␊
+    function __armWasmRuntimePollStallBackup(pace) {␊
+      const setTimer = globalThis.setTimeout␊
+      if (typeof setTimer !== 'function') {␊
+        // Nothing to back up: \`__scheduleTimer\` is on the macrotask channel␊
+        // already, and that one cannot park.␊
+        return␊
+      }␊
+      // Read before arming, so this never claims to be due earlier than the timer␊
+      // actually is: a backup ends a turn only when it is provably due after it.␊
+      const dueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_BACKUP_MS␊
+      let handle␊
+      try {␊
+        handle = setTimer(() => {␊
+          const settleTurn = pace.settleTurn␊
+          if (␊
+            !settleTurn ||␊
+            pace.turnTimerDueAt > dueAt - __WASM_RUNTIME_WORK_POLL_STALL_MS␊
+          ) {␊
+            // No turn is parked, or the parked one's timer came due too close to␊
+            // this backup to call it dropped — it may still arrive, and the turn␊
+            // that armed it armed a backup due a whole window after *that*.␊
+            return␊
+          }␊
+          pace.arrivals = 0␊
+          pace.settleTurn = undefined␊
+          settleTurn()␊
+        }, __WASM_RUNTIME_WORK_POLL_BACKUP_MS)␊
+      } catch {␊
+        return␊
+      }␊
+      if (handle && typeof handle.unref === 'function') {␊
+        try {␊
+          handle.unref()␊
+        } catch {}␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * One turn of the runtime-work poll.␊
+     *␊
+     * \`__scheduleTimer\` falls back to the macrotask scheduler when \`setTimeout\` is␊
+     * missing or throws, but not when it is present, returns a handle and never␊
+     * fires — fake timers in a test suite that disposes from an \`afterEach\`, or a␊
+     * host whose timers belong to an IO context that is already gone. That host␊
+     * would park this poll forever, and the poll is unbounded, so nothing would␊
+     * ever call \`…_finish\`.␊
+     *␊
+     * Arm both primitives until timers armed by this poll have arrived twice, and␊
+     * let whichever lands first end the turn; the loser resolves nothing. A host␊
+     * with working timers therefore pays the double arming for the first turn or␊
+     * two — the macrotask wins the race, but the timers behind it still arrive and␊
+     * are counted — and paces on the timer alone from then on, instead of spinning␊
+     * the loop on a zero-delay queue. A host whose timers never arrive keeps both,␊
+     * and the macrotask is what keeps the poll moving. A host whose timers stop␊
+     * after proving themselves is caught by \`__armWasmRuntimePollStallBackup\`,␊
+     * which ends the parked turn and puts this poll back on both.␊
+     */␊
+    function __yieldWasmRuntimePollTurn(pace) {␊
+      // Armed before the turn yields, and by every turn: what rescues a parked␊
+      // turn has to have been armed while the host's timers still worked, and the␊
+      // turn that parks is the one whose own timer is already dead.␊
+      __armWasmRuntimePollStallBackup(pace)␊
+      return new Promise((resolve) => {␊
+        let settled = false␊
+        const settle = () => {␊
+          if (settled) {␊
+            return␊
+          }␊
+          settled = true␊
+          if (pace.settleTurn === settle) {␊
+            // Nothing is parked any more: a backup running later must not read a␊
+            // due time this turn has already answered.␊
+            pace.settleTurn = undefined␊
+          }␊
+          resolve()␊
+        }␊
+        __scheduleTimer(() => {␊
+          pace.arrivals++␊
+          settle()␊
+        }, __WASM_RUNTIME_WORK_POLL_INTERVAL_MS)␊
+        // Read next to the arming it describes; see␊
+        // \`__armWasmRuntimePollStallBackup\` for what the two due times mean.␊
+        const turnTimerDueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_INTERVAL_MS␊
+        if (pace.arrivals < __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS) {␊
+          __scheduleMacrotask(settle)␊
+          return␊
+        }␊
+        // Paced by the timer alone from here; the backup is what ends this turn if␊
+        // the timer never arrives.␊
+        pace.settleTurn = settle␊
+        pace.turnTimerDueAt = turnTimerDueAt␊
+      })␊
+    }␊
+    ␊
+    /**␊
+     * The barrier for callers that can yield: \`__prepareWasmEnvCleanup\` with real␊
+     * event-loop turns in the middle.␊
+     *␊
+     * \`napi_prepare_wasm_env_cleanup\` waits — it returns only once the addon's␊
+     * async runtime has quiesced, and on \`wasm32-wasip1-threads\` the thread it␊
+     * waits on is this one, the only thread that can give a running blocking␊
+     * closure the JavaScript turn *it* is waiting for. A single call there can wait␊
+     * for work that can never finish. The addon's two-phase form splits that:␊
+     * \`…_begin\` stops the runtime without joining and reports whether anything is␊
+     * still live, \`napi_wasm_runtime_work_pending\` answers that question again␊
+     * without blocking, and \`…_finish\` joins. The turns yielded in between are the␊
+     * entire point.␊
+     *␊
+     * The poll has no deadline, for the same reason the async-work drain below has␊
+     * none: giving up means calling \`…_finish\`, which joins on this thread, and the␊
+     * work it would join is the work that is waiting for a turn from this thread —␊
+     * so a bound does not end the wait, it only moves it somewhere the JavaScript␊
+     * thread can no longer be reached. A blocking closure that never returns keeps␊
+     * the disposal promise pending instead, exactly as a task whose \`execute\` never␊
+     * returns already keeps an *undisposed* process alive. The host contract is in␊
+     * \`crates/async-runtime/README.md\`: a blocking closure must never wait on a␊
+     * JavaScript turn. The process-exit path still blocks in \`…_finish\`, because it␊
+     * has no turns left to give (see \`__prepareWasmEnvCleanup\`).␊
+     *␊
+     * Feature-detected like every other export in this teardown, so an addon built␊
+     * against a napi crate that predates the split keeps the single blocking call.␊
+     * Returns nothing whenever the handshake finished without yielding, which keeps␊
+     * an idle disposal synchronous.␊
+     */␊
+    function __prepareWasmEnvCleanupWithTurns() {␊
+      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+        return␊
+      }␊
+      const exports = __napiInstance?.exports␊
+      const begin = exports?.napi_prepare_wasm_env_cleanup_begin␊
+      const finish = exports?.napi_prepare_wasm_env_cleanup_finish␊
+      if (typeof begin !== 'function' || typeof finish !== 'function') {␊
+        // No split to use. The settlement drain still follows this, so the queue␊
+        // the single call leaves behind is expected rather than lost.␊
+        __emnapiWasmEnvCleanupYielding = true␊
+        try {␊
+          __prepareWasmEnvCleanup()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupYielding = false␊
+        }␊
+        return␊
+      }␊
+      const workPending = exports?.napi_wasm_runtime_work_pending␊
+      // The in-flight flag stays raised across the turns below, so a \`destroy()\`␊
+      // from one of the JavaScript handlers they run is the same no-op it is inside␊
+      // the single call: the barrier is up and the runtime is mid-teardown, and␊
+      // destroying between the halves would strand exactly what this delivers.␊
+      __emnapiWasmEnvCleanupPreparing = true␊
+      let live␊
+      try {␊
+        live = begin()␊
+      } catch (error) {␊
+        __emnapiWasmEnvCleanupPreparing = false␊
+        throw error␊
+      }␊
+      __emnapiWasmEnvCleanupRan = true␊
+      const finishCleanup = () => {␊
+        if (__emnapiWasmEnvCleanupPrepared) {␊
+          // Already closed by a caller that could not yield — the 'exit' teardown␊
+          // reached \`__prepareWasmEnvCleanup\` while this poll was parked. \`…_finish\`␊
+          // is idempotent, but the flags it lowers are not: running it again here␊
+          // would clear a \`preparing\` some later barrier had raised.␊
+          return␊
+        }␊
+        __finishParkedWasmEnvCleanup = undefined␊
+        try {␊
+          finish()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupPreparing = false␊
+        }␊
+        __emnapiWasmEnvCleanupPrepared = true␊
+      }␊
+      if (!live || typeof workPending !== 'function') {␊
+        finishCleanup()␊
+        return␊
+      }␊
+      // Publish the closer before yielding: from here until \`finishCleanup\` runs,␊
+      // a caller that cannot yield is entitled to end this handshake itself.␊
+      __finishParkedWasmEnvCleanup = finishCleanup␊
+      return (async () => {␊
+        // Unbounded, exactly like the async-work drain below. The wait ends when␊
+        // the addon reports its runtime work finished; the turns spent here are␊
+        // what let that happen at all.␊
+        const pace = __createWasmRuntimePollPace()␊
+        for (;;) {␊
+          await __yieldWasmRuntimePollTurn(pace)␊
+          try {␊
+            if (!workPending()) {␊
+              return␊
+            }␊
+          } catch {␊
+            // A trap is the only way this fails, and a trapped instance has no␊
+            // reachable work left. Stop polling and finish.␊
+            return␊
+          }␊
+        }␊
+      })().then(finishCleanup, finishCleanup)␊
+    }␊
+    ␊
     // Turns to wait for while the addon still reports queued settlements. Reaching␊
     // zero is the only success. A counter still nonzero at this bound rejects the␊
     // disposal as retryable (\`ERR_NAPI_WASI_CLEANUP_PENDING\`) rather than␊
@@ -1460,6 +2261,19 @@ Generated by [AVA](https://avajs.dev).
       }␊
     ␊
       __prepareWasmEnvCleanup()␊
+      if (__isPreparingWasmEnvCleanup()) {␊
+        // Reached from inside the synchronous barrier — a promise hook one of the␊
+        // settlements above ran, which is the reentrancy the destroy wrapper␊
+        // exists for. \`Context.destroy()\` below would hit that wrapper's in-flight␊
+        // no-op and answer \`undefined\`, and recording that as a completed destroy␊
+        // is what makes the frame that *did* start the barrier skip the real one␊
+        // afterwards, leaving the context retained with its cleanup hooks unrun.␊
+        // Refuse instead: nothing is flagged, and that frame destroys for real the␊
+        // moment it returns. The deferred loader carries the same backstop. A␊
+        // parked handshake cannot get here — \`__prepareWasmEnvCleanup\` closes one␊
+        // rather than skipping it.␊
+        return␊
+      }␊
       const result = __emnapiContext.destroy()␊
       if (!__isThenable(result)) {␊
         __emnapiContextDestroyed = true␊
@@ -1733,11 +2547,7 @@ Generated by [AVA](https://avajs.dev).
       return __finishWasiDisposal()␊
     }␊
     ␊
-    function __cleanUpWasmEnvForWasiDisposal() {␊
-      // Run the pre-teardown barrier, then let the settlements it queued actually␊
-      // reach JavaScript, and only then destroy the environment. Doing these two␊
-      // back to back is what strands them.␊
-      __prepareWasmEnvCleanup()␊
+    function __drainWasmEnvForWasiDisposal() {␊
       const drainResult = __drainWasmEnvCleanup()␊
       if (__isThenable(drainResult)) {␊
         return Promise.resolve(drainResult).then(__continueWasiDisposal)␊
@@ -1745,6 +2555,18 @@ Generated by [AVA](https://avajs.dev).
       return __continueWasiDisposal()␊
     }␊
     ␊
+    function __cleanUpWasmEnvForWasiDisposal() {␊
+      // Run the pre-teardown barrier — yielding the turns its two-phase form asks␊
+      // for, when the addon has one — then let the settlements it queued actually␊
+      // reach JavaScript, and only then destroy the environment. Doing any two of␊
+      // these back to back is what strands them.␊
+      const prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+      if (__isThenable(prepareResult)) {␊
+        return Promise.resolve(prepareResult).then(__drainWasmEnvForWasiDisposal)␊
+      }␊
+      return __drainWasmEnvForWasiDisposal()␊
+    }␊
+    ␊
     function __startWasiDisposal() {␊
       // Outstanding \`napi_async_work\` goes first, while the environment is still␊
       // completely live: the completion callbacks run addon code, and everything␊
@@ -1905,14 +2727,36 @@ Generated by [AVA](https://avajs.dev).
       // be reached without the async-work drain below running first.␊
       function __rollbackWasmEnvForWasiInitialization() {␊
         const cleanupErrors = []␊
+        let prepareResult␊
+        try {␊
+          prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+        } catch (cleanupError) {␊
+          cleanupErrors.push(cleanupError)␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
+        }␊
+        if (__isThenable(prepareResult)) {␊
+          return Promise.resolve(prepareResult).then(␊
+            () => __drainWasmEnvForWasiRollback(cleanupErrors),␊
+            (cleanupError) => {␊
+              cleanupErrors.push(cleanupError)␊
+              return __retainFailedWasiRollback(cleanupErrors)␊
+            },␊
+          )␊
+        }␊
+        return __drainWasmEnvForWasiRollback(cleanupErrors)␊
+      }␊
+    ␊
+      // The settlement drain of the rollback above, reached either straight away or␊
+      // after the barrier's two-phase form has yielded its turns. A barrier that␊
+      // did not finish never gets here: it retains instead, exactly as a drain that␊
+      // did not finish does.␊
+      function __drainWasmEnvForWasiRollback(cleanupErrors) {␊
         let drainResult␊
-        let settlementsUnreached = false␊
         try {␊
-          __prepareWasmEnvCleanup()␊
           drainResult = __drainWasmEnvCleanup()␊
         } catch (cleanupError) {␊
           cleanupErrors.push(cleanupError)␊
-          settlementsUnreached = true␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
         }␊
         if (__isThenable(drainResult)) {␊
           return Promise.resolve(drainResult).then(␊
@@ -1923,9 +2767,6 @@ Generated by [AVA](https://avajs.dev).
             },␊
           )␊
         }␊
-        if (settlementsUnreached) {␊
-          return __retainFailedWasiRollback(cleanupErrors)␊
-        }␊
         return __destroyContextForWasiRollback(cleanupErrors)␊
       }␊
     ␊
@@ -1957,6 +2798,36 @@ Generated by [AVA](https://avajs.dev).
       return __rollbackWasmEnvForWasiInitialization()␊
     }␊
     ␊
+    // A view of the addon's crash flag, one word of the shared wasm memory, for the␊
+    // pool workers: they raise it when their wasm thread dies, and the shutdown␊
+    // waits inside the cleanup calls on this thread then trap instead of waiting on␊
+    // the dead thread for good. Undefined for an addon built with an older napi.␊
+    let __wasiAddonCrashFlag␊
+    ␊
+    function __captureWasiAddonCrashFlag(instance) {␊
+      try {␊
+        const getAddress = instance.exports.napi_wasm_thread_crash_flag_address␊
+        if (typeof getAddress !== 'function') {␊
+          return␊
+        }␊
+        const address = getAddress() >>> 0␊
+        const buffer = __sharedMemory.buffer␊
+        if (address === 0 || address % 4 !== 0 || address + 4 > buffer.byteLength) {␊
+          return␊
+        }␊
+        __wasiAddonCrashFlag = new Int32Array(buffer, address, 1)␊
+      } catch {}␊
+    }␊
+    ␊
+    function __shareWasiAddonCrashFlag(worker) {␊
+      if (__wasiAddonCrashFlag === undefined) {␊
+        return␊
+      }␊
+      try {␊
+        worker.postMessage({ __napiRsAddonCrashFlag: __wasiAddonCrashFlag })␊
+      } catch {}␊
+    }␊
+    ␊
     let __wasiModule␊
     let __napiModule␊
     ␊
@@ -1987,6 +2858,7 @@ Generated by [AVA](https://avajs.dev).
             type: 'module',␊
           })␊
           __wasiWorkers.add(worker)␊
+          __shareWasiAddonCrashFlag(worker)␊
     ␊
           worker.addEventListener('message', (event) => {␊
             if (event.data && typeof event.data === 'object' && event.data.type === 'error') {␊
@@ -2015,6 +2887,10 @@ Generated by [AVA](https://avajs.dev).
         },␊
         beforeInit({ instance }) {␊
           __napiInstance = instance␊
+          __captureWasiAddonCrashFlag(instance)␊
+          for (const worker of __wasiWorkers) {␊
+            __shareWasiAddonCrashFlag(worker)␊
+          }␊
           for (const name of Object.keys(instance.exports)) {␊
             if (name.startsWith('__napi_register__')) {␊
               instance.exports[name]()␊
@@ -2172,6 +3048,20 @@ Generated by [AVA](https://avajs.dev).
     let __emnapiContextDestroyPromise␊
     let __emnapiWasmEnvCleanupPrepared = false␊
     let __emnapiWasmEnvCleanupPreparing = false␊
+    // The closer for a barrier that is parked between \`…_begin\` and \`…_finish\`,␊
+    // set only while that window is open. \`__emnapiWasmEnvCleanupPreparing\` cannot␊
+    // tell those two apart on its own: it is raised both for a purely synchronous␊
+    // frame — which must not be re-entered, and which nothing outside it can␊
+    // finish — and across this window, which spans real event-loop turns, so a␊
+    // caller that cannot yield can land in the middle of one. That caller can close␊
+    // this window, because \`…_finish\` is idempotent and joins, which is exactly␊
+    // what the single call does. See \`__prepareWasmEnvCleanup\`.␊
+    let __finishParkedWasmEnvCleanup␊
+    // Raised while a caller that can still yield is driving the barrier, so the␊
+    // queue it leaves behind is expected rather than lost. See␊
+    // \`__reportUnreachedWasmEnvSettlements\`.␊
+    let __emnapiWasmEnvCleanupYielding = false␊
+    let __emnapiWasmEnvSettlementLossReported = false␊
     let __emnapiWasmEnvCleanupRan = false␊
     let __emnapiWasmEnvCleanupDrained = false␊
     let __emnapiWasmEnvCleanupDrainPromise␊
@@ -2284,7 +3174,24 @@ Generated by [AVA](https://avajs.dev).
     }␊
     ␊
     function __prepareWasmEnvCleanup() {␊
-      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+      if (__emnapiWasmEnvCleanupPrepared) {␊
+        return␊
+      }␊
+      // A handshake parked between its two halves is one this frame can close, and␊
+      // must: every caller of this function is about to destroy the context, and␊
+      // the turns the poll is waiting for will not come — an 'exit' teardown is␊
+      // the last thing the process runs, and \`Context.destroy()\` takes the␊
+      // environment away. Closing it here runs \`…_finish\`, which is the call that joins, so␊
+      // this degrades to exactly the single call below. Leaving it open instead␊
+      // destroys the context with the barrier still raised, the runtime never␊
+      // joined and the workers never drained.␊
+      const finishParked = __finishParkedWasmEnvCleanup␊
+      if (finishParked !== undefined) {␊
+        finishParked()␊
+        __reportUnreachedWasmEnvSettlements()␊
+        return␊
+      }␊
+      if (__emnapiWasmEnvCleanupPreparing) {␊
         return␊
       }␊
       const prepare = __napiInstance?.exports?.napi_prepare_wasm_env_cleanup␊
@@ -2299,10 +3206,57 @@ Generated by [AVA](https://avajs.dev).
           __emnapiWasmEnvCleanupPreparing = false␊
         }␊
         __emnapiWasmEnvCleanupRan = true␊
+        __reportUnreachedWasmEnvSettlements()␊
       }␊
       __emnapiWasmEnvCleanupPrepared = true␊
     }␊
     ␊
+    /**␊
+     * Say so when the barrier leaves settlements queued and nothing is left that␊
+     * could deliver them.␊
+     *␊
+     * Only the disposal chain yields the event-loop turns @emnapi/core needs to␊
+     * dispatch its queue. Every other caller of the barrier destroys in the same␊
+     * turn — a raw \`Context.destroy()\`, the 'exit' teardown — and␊
+     * \`Context.destroy()\` runs the threadsafe function's cleanup hook, which drains␊
+     * that queue with a null env and discards it. The promises those settlements␊
+     * were for then hang forever, silently.␊
+     *␊
+     * Loud, once, and never throwing: this runs from inside \`Context.destroy()\`,␊
+     * emnapi's own beforeExit destroy included, where throwing would take the whole␊
+     * teardown down with it. Destroying anyway is still the right trade — the queue␊
+     * is already unreachable by then.␊
+     */␊
+    function __reportUnreachedWasmEnvSettlements() {␊
+      if (__emnapiWasmEnvCleanupYielding || __emnapiWasmEnvSettlementLossReported) {␊
+        return␊
+      }␊
+      const pending = __napiInstance?.exports?.napi_wasm_env_cleanup_pending␊
+      if (typeof pending !== 'function') {␊
+        return␊
+      }␊
+      let queued␊
+      try {␊
+        queued = pending()␊
+      } catch {␊
+        return␊
+      }␊
+      if (!queued) {␊
+        return␊
+      }␊
+      __emnapiWasmEnvSettlementLossReported = true␊
+      try {␊
+        const consoleHost = globalThis.console␊
+        if (consoleHost && typeof consoleHost.error === 'function') {␊
+          consoleHost.error(␊
+            "napi-rs: the wasm environment is being destroyed with " +␊
+              queued +␊
+              " queued promise settlement(s). Context.destroy() discards them, so those promises never settle. Dispose with binding[Symbol.for('napi.rs.wasi.dispose')]() instead: only it yields the event-loop turns the settlements need.",␊
+          )␊
+        }␊
+      } catch {}␊
+    }␊
+    ␊
     // Mirror the primitive @emnapi/core schedules its threadsafe-function dispatch␊
     // on, so the drain turns below interleave with that dispatch instead of racing␊
     // ahead of it on a faster queue.␊
@@ -2334,22 +3288,307 @@ Generated by [AVA](https://avajs.dev).
       }␊
     })()␊
     ␊
-    // A real, *referenced* timer, for waits that must let the whole host make␊
-    // progress between looks — the async-work drain polls the addon rather than␊
-    // interleaving with the @emnapi/core dispatch, so a zero-delay macrotask there␊
-    // would spin the loop instead of yielding it. Falls back to the macrotask␊
-    // scheduler on a host without timers.␊
-    function __scheduleTimer(callback, delay) {␊
-      const setTimer = globalThis.setTimeout␊
-      if (typeof setTimer !== 'function') {␊
-        __scheduleMacrotask(callback)␊
+    // A real, *referenced* timer, for waits that must let the whole host make␊
+    // progress between looks — the async-work drain polls the addon rather than␊
+    // interleaving with the @emnapi/core dispatch, so a zero-delay macrotask there␊
+    // would spin the loop instead of yielding it. Falls back to the macrotask␊
+    // scheduler on a host without timers.␊
+    function __scheduleTimer(callback, delay) {␊
+      const setTimer = globalThis.setTimeout␊
+      if (typeof setTimer !== 'function') {␊
+        __scheduleMacrotask(callback)␊
+        return␊
+      }␊
+      try {␊
+        setTimer(callback, delay)␊
+      } catch {␊
+        __scheduleMacrotask(callback)␊
+      }␊
+    }␊
+    ␊
+    // A real, referenced timer rather than a zero-delay macrotask, for the same␊
+    // reason the async-work drain uses one: this polls the addon instead of␊
+    // interleaving with the @emnapi/core dispatch, so a zero-delay turn would spin␊
+    // the loop instead of yielding it.␊
+    const __WASM_RUNTIME_WORK_POLL_INTERVAL_MS = 1␊
+    // Arrivals it takes before the poll paces on the host's timers alone. One␊
+    // proves nothing: a timer armed before the host's timers stopped still fires.␊
+    const __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS = 2␊
+    // How long a parked turn's own timer must already have been due before a␊
+    // backup that runs calls it dropped. Slack, not a deadline: a timer is due␊
+    // against the event loop's clock, which is read once per iteration, while␊
+    // these are \`Date.now()\` readings taken part-way through one, so the two␊
+    // drift apart by however long the loop has been inside the current iteration.␊
+    const __WASM_RUNTIME_WORK_POLL_STALL_MS = 50␊
+    // How long a backup itself waits. What is left of it after the slack and one␊
+    // interval — 149 ms — has to cover the *two* poll turns that can separate a␊
+    // parked turn from the last backup armed while the host's timers still␊
+    // worked, so the ceiling on a single turn is half of it. See the invariant on␊
+    // \`__armWasmRuntimePollStallBackup\`.␊
+    const __WASM_RUNTIME_WORK_POLL_BACKUP_MS = 200␊
+    ␊
+    /**␊
+     * Pacing state for one runtime-work poll.␊
+     *␊
+     * Per poll, never per module: whether the host's timers arrive is not a␊
+     * property of the module. A host can lose its timers between two disposals,␊
+     * and in the deferred shape every instance shares this module — one healthy␊
+     * instance must not disarm the fallback for the next one.␊
+     */␊
+    function __createWasmRuntimePollPace() {␊
+      return {␊
+        // Timers armed by *this* poll that have actually arrived.␊
+        arrivals: 0,␊
+        // The turn waiting on a timer alone *right now* — undefined whenever no␊
+        // turn is parked — and when that turn's own timer came due.␊
+        settleTurn: undefined,␊
+        turnTimerDueAt: 0,␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * The backup that ends a turn whose timer is never going to arrive.␊
+     *␊
+     * Once the poll paces on the timer alone it has nothing left to fall back on␊
+     * if the host's timers stop mid-poll: the turn that armed the dead timer is␊
+     * the turn that parks, and a parked poll schedules nothing that could notice.␊
+     * So every turn arms one of these before it yields, and each one compares due␊
+     * times instead of measuring how long the parked turn has been waiting.␊
+     *␊
+     * Invariant: a parked turn is ended by the newest backup that was armed while␊
+     * the host's timers still worked, and a backup ends a turn only when that␊
+     * turn's own timer was already due a whole window before the backup itself.␊
+     * Neither half turns on how far apart the arms happen to fall — what bounds␊
+     * the rescue is how far back that newest live backup is:␊
+     *␊
+     * - *Ends it.* Hosts run timers in due order, so a backup that runs while a␊
+     *   turn due a whole window earlier is still parked proves that turn's timer␊
+     *   was dropped rather than merely late. That same comparison is what leaves a␊
+     *   healthy host alone: there the turn's timer has already run and cleared␊
+     *   \`settleTurn\` before any backup due after it can look.␊
+     * - *Two turns back, not one.* A turn that ended does not prove its own timer␊
+     *   arrived: until \`…_TRUSTED_ARRIVALS\` is reached every turn arms both␊
+     *   primitives and the macrotask wins, so such a turn can end with its own␊
+     *   timer — and the backup armed one line before it — already dead. The␊
+     *   arrival that then flips the poll onto the timer alone can itself be a␊
+     *   timer armed before the host's timers died. So the turn that parks can sit␊
+     *   two turns past the last live arm, and the newest live backup is due␊
+     *   \`…_BACKUP_MS\` less *two* turn lengths after that turn's own timer.␊
+     *   Arming on every turn is what holds it to two, rather than however far back␊
+     *   a throttle last let one through.␊
+     * - *Ceiling.* Coverage therefore holds while two consecutive poll turns fit␊
+     *   inside \`…_BACKUP_MS\` less the slack and one interval: 149 ms, so 74 ms␊
+     *   per turn (measured: a 74 ms turn is still rescued, a 75 ms one parks).␊
+     *   Past that the turn stays parked and the disposal promise never settles.␊
+     *   The bound is deliberate: reaching it takes a host that drops timers␊
+     *   mid-poll *and* keeps every poll turn busy for more than 74 ms, and neither␊
+     *   Node nor WebContainer — the hosts that run the threaded artifact — does␊
+     *   the second.␊
+     *␊
+     * The poll then goes back to arming both primitives until two fresh arrivals␊
+     * prove the timers again. A host that stops running the timers it has␊
+     * *already* accepted leaves nothing to fire, and the disposal promise stays␊
+     * pending rather than wedging the thread — the same outcome as a blocking␊
+     * closure that never returns. Unreferenced wherever the host allows it: the␊
+     * poll's own turn timers are what keep the loop alive, never these.␊
+     */␊
+    function __armWasmRuntimePollStallBackup(pace) {␊
+      const setTimer = globalThis.setTimeout␊
+      if (typeof setTimer !== 'function') {␊
+        // Nothing to back up: \`__scheduleTimer\` is on the macrotask channel␊
+        // already, and that one cannot park.␊
+        return␊
+      }␊
+      // Read before arming, so this never claims to be due earlier than the timer␊
+      // actually is: a backup ends a turn only when it is provably due after it.␊
+      const dueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_BACKUP_MS␊
+      let handle␊
+      try {␊
+        handle = setTimer(() => {␊
+          const settleTurn = pace.settleTurn␊
+          if (␊
+            !settleTurn ||␊
+            pace.turnTimerDueAt > dueAt - __WASM_RUNTIME_WORK_POLL_STALL_MS␊
+          ) {␊
+            // No turn is parked, or the parked one's timer came due too close to␊
+            // this backup to call it dropped — it may still arrive, and the turn␊
+            // that armed it armed a backup due a whole window after *that*.␊
+            return␊
+          }␊
+          pace.arrivals = 0␊
+          pace.settleTurn = undefined␊
+          settleTurn()␊
+        }, __WASM_RUNTIME_WORK_POLL_BACKUP_MS)␊
+      } catch {␊
+        return␊
+      }␊
+      if (handle && typeof handle.unref === 'function') {␊
+        try {␊
+          handle.unref()␊
+        } catch {}␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * One turn of the runtime-work poll.␊
+     *␊
+     * \`__scheduleTimer\` falls back to the macrotask scheduler when \`setTimeout\` is␊
+     * missing or throws, but not when it is present, returns a handle and never␊
+     * fires — fake timers in a test suite that disposes from an \`afterEach\`, or a␊
+     * host whose timers belong to an IO context that is already gone. That host␊
+     * would park this poll forever, and the poll is unbounded, so nothing would␊
+     * ever call \`…_finish\`.␊
+     *␊
+     * Arm both primitives until timers armed by this poll have arrived twice, and␊
+     * let whichever lands first end the turn; the loser resolves nothing. A host␊
+     * with working timers therefore pays the double arming for the first turn or␊
+     * two — the macrotask wins the race, but the timers behind it still arrive and␊
+     * are counted — and paces on the timer alone from then on, instead of spinning␊
+     * the loop on a zero-delay queue. A host whose timers never arrive keeps both,␊
+     * and the macrotask is what keeps the poll moving. A host whose timers stop␊
+     * after proving themselves is caught by \`__armWasmRuntimePollStallBackup\`,␊
+     * which ends the parked turn and puts this poll back on both.␊
+     */␊
+    function __yieldWasmRuntimePollTurn(pace) {␊
+      // Armed before the turn yields, and by every turn: what rescues a parked␊
+      // turn has to have been armed while the host's timers still worked, and the␊
+      // turn that parks is the one whose own timer is already dead.␊
+      __armWasmRuntimePollStallBackup(pace)␊
+      return new Promise((resolve) => {␊
+        let settled = false␊
+        const settle = () => {␊
+          if (settled) {␊
+            return␊
+          }␊
+          settled = true␊
+          if (pace.settleTurn === settle) {␊
+            // Nothing is parked any more: a backup running later must not read a␊
+            // due time this turn has already answered.␊
+            pace.settleTurn = undefined␊
+          }␊
+          resolve()␊
+        }␊
+        __scheduleTimer(() => {␊
+          pace.arrivals++␊
+          settle()␊
+        }, __WASM_RUNTIME_WORK_POLL_INTERVAL_MS)␊
+        // Read next to the arming it describes; see␊
+        // \`__armWasmRuntimePollStallBackup\` for what the two due times mean.␊
+        const turnTimerDueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_INTERVAL_MS␊
+        if (pace.arrivals < __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS) {␊
+          __scheduleMacrotask(settle)␊
+          return␊
+        }␊
+        // Paced by the timer alone from here; the backup is what ends this turn if␊
+        // the timer never arrives.␊
+        pace.settleTurn = settle␊
+        pace.turnTimerDueAt = turnTimerDueAt␊
+      })␊
+    }␊
+    ␊
+    /**␊
+     * The barrier for callers that can yield: \`__prepareWasmEnvCleanup\` with real␊
+     * event-loop turns in the middle.␊
+     *␊
+     * \`napi_prepare_wasm_env_cleanup\` waits — it returns only once the addon's␊
+     * async runtime has quiesced, and on \`wasm32-wasip1-threads\` the thread it␊
+     * waits on is this one, the only thread that can give a running blocking␊
+     * closure the JavaScript turn *it* is waiting for. A single call there can wait␊
+     * for work that can never finish. The addon's two-phase form splits that:␊
+     * \`…_begin\` stops the runtime without joining and reports whether anything is␊
+     * still live, \`napi_wasm_runtime_work_pending\` answers that question again␊
+     * without blocking, and \`…_finish\` joins. The turns yielded in between are the␊
+     * entire point.␊
+     *␊
+     * The poll has no deadline, for the same reason the async-work drain below has␊
+     * none: giving up means calling \`…_finish\`, which joins on this thread, and the␊
+     * work it would join is the work that is waiting for a turn from this thread —␊
+     * so a bound does not end the wait, it only moves it somewhere the JavaScript␊
+     * thread can no longer be reached. A blocking closure that never returns keeps␊
+     * the disposal promise pending instead, exactly as a task whose \`execute\` never␊
+     * returns already keeps an *undisposed* process alive. The host contract is in␊
+     * \`crates/async-runtime/README.md\`: a blocking closure must never wait on a␊
+     * JavaScript turn. The process-exit path still blocks in \`…_finish\`, because it␊
+     * has no turns left to give (see \`__prepareWasmEnvCleanup\`).␊
+     *␊
+     * Feature-detected like every other export in this teardown, so an addon built␊
+     * against a napi crate that predates the split keeps the single blocking call.␊
+     * Returns nothing whenever the handshake finished without yielding, which keeps␊
+     * an idle disposal synchronous.␊
+     */␊
+    function __prepareWasmEnvCleanupWithTurns() {␊
+      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+        return␊
+      }␊
+      const exports = __napiInstance?.exports␊
+      const begin = exports?.napi_prepare_wasm_env_cleanup_begin␊
+      const finish = exports?.napi_prepare_wasm_env_cleanup_finish␊
+      if (typeof begin !== 'function' || typeof finish !== 'function') {␊
+        // No split to use. The settlement drain still follows this, so the queue␊
+        // the single call leaves behind is expected rather than lost.␊
+        __emnapiWasmEnvCleanupYielding = true␊
+        try {␊
+          __prepareWasmEnvCleanup()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupYielding = false␊
+        }␊
         return␊
       }␊
+      const workPending = exports?.napi_wasm_runtime_work_pending␊
+      // The in-flight flag stays raised across the turns below, so a \`destroy()\`␊
+      // from one of the JavaScript handlers they run is the same no-op it is inside␊
+      // the single call: the barrier is up and the runtime is mid-teardown, and␊
+      // destroying between the halves would strand exactly what this delivers.␊
+      __emnapiWasmEnvCleanupPreparing = true␊
+      let live␊
       try {␊
-        setTimer(callback, delay)␊
-      } catch {␊
-        __scheduleMacrotask(callback)␊
+        live = begin()␊
+      } catch (error) {␊
+        __emnapiWasmEnvCleanupPreparing = false␊
+        throw error␊
+      }␊
+      __emnapiWasmEnvCleanupRan = true␊
+      const finishCleanup = () => {␊
+        if (__emnapiWasmEnvCleanupPrepared) {␊
+          // Already closed by a caller that could not yield — the 'exit' teardown␊
+          // reached \`__prepareWasmEnvCleanup\` while this poll was parked. \`…_finish\`␊
+          // is idempotent, but the flags it lowers are not: running it again here␊
+          // would clear a \`preparing\` some later barrier had raised.␊
+          return␊
+        }␊
+        __finishParkedWasmEnvCleanup = undefined␊
+        try {␊
+          finish()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupPreparing = false␊
+        }␊
+        __emnapiWasmEnvCleanupPrepared = true␊
       }␊
+      if (!live || typeof workPending !== 'function') {␊
+        finishCleanup()␊
+        return␊
+      }␊
+      // Publish the closer before yielding: from here until \`finishCleanup\` runs,␊
+      // a caller that cannot yield is entitled to end this handshake itself.␊
+      __finishParkedWasmEnvCleanup = finishCleanup␊
+      return (async () => {␊
+        // Unbounded, exactly like the async-work drain below. The wait ends when␊
+        // the addon reports its runtime work finished; the turns spent here are␊
+        // what let that happen at all.␊
+        const pace = __createWasmRuntimePollPace()␊
+        for (;;) {␊
+          await __yieldWasmRuntimePollTurn(pace)␊
+          try {␊
+            if (!workPending()) {␊
+              return␊
+            }␊
+          } catch {␊
+            // A trap is the only way this fails, and a trapped instance has no␊
+            // reachable work left. Stop polling and finish.␊
+            return␊
+          }␊
+        }␊
+      })().then(finishCleanup, finishCleanup)␊
     }␊
     ␊
     // Turns to wait for while the addon still reports queued settlements. Reaching␊
@@ -2488,6 +3727,19 @@ Generated by [AVA](https://avajs.dev).
       }␊
     ␊
       __prepareWasmEnvCleanup()␊
+      if (__isPreparingWasmEnvCleanup()) {␊
+        // Reached from inside the synchronous barrier — a promise hook one of the␊
+        // settlements above ran, which is the reentrancy the destroy wrapper␊
+        // exists for. \`Context.destroy()\` below would hit that wrapper's in-flight␊
+        // no-op and answer \`undefined\`, and recording that as a completed destroy␊
+        // is what makes the frame that *did* start the barrier skip the real one␊
+        // afterwards, leaving the context retained with its cleanup hooks unrun.␊
+        // Refuse instead: nothing is flagged, and that frame destroys for real the␊
+        // moment it returns. The deferred loader carries the same backstop. A␊
+        // parked handshake cannot get here — \`__prepareWasmEnvCleanup\` closes one␊
+        // rather than skipping it.␊
+        return␊
+      }␊
       const result = __emnapiContext.destroy()␊
       if (!__isThenable(result)) {␊
         __emnapiContextDestroyed = true␊
@@ -2761,11 +4013,7 @@ Generated by [AVA](https://avajs.dev).
       return __finishWasiDisposal()␊
     }␊
     ␊
-    function __cleanUpWasmEnvForWasiDisposal() {␊
-      // Run the pre-teardown barrier, then let the settlements it queued actually␊
-      // reach JavaScript, and only then destroy the environment. Doing these two␊
-      // back to back is what strands them.␊
-      __prepareWasmEnvCleanup()␊
+    function __drainWasmEnvForWasiDisposal() {␊
       const drainResult = __drainWasmEnvCleanup()␊
       if (__isThenable(drainResult)) {␊
         return Promise.resolve(drainResult).then(__continueWasiDisposal)␊
@@ -2773,6 +4021,18 @@ Generated by [AVA](https://avajs.dev).
       return __continueWasiDisposal()␊
     }␊
     ␊
+    function __cleanUpWasmEnvForWasiDisposal() {␊
+      // Run the pre-teardown barrier — yielding the turns its two-phase form asks␊
+      // for, when the addon has one — then let the settlements it queued actually␊
+      // reach JavaScript, and only then destroy the environment. Doing any two of␊
+      // these back to back is what strands them.␊
+      const prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+      if (__isThenable(prepareResult)) {␊
+        return Promise.resolve(prepareResult).then(__drainWasmEnvForWasiDisposal)␊
+      }␊
+      return __drainWasmEnvForWasiDisposal()␊
+    }␊
+    ␊
     function __startWasiDisposal() {␊
       // Outstanding \`napi_async_work\` goes first, while the environment is still␊
       // completely live: the completion callbacks run addon code, and everything␊
@@ -2933,14 +4193,36 @@ Generated by [AVA](https://avajs.dev).
       // be reached without the async-work drain below running first.␊
       function __rollbackWasmEnvForWasiInitialization() {␊
         const cleanupErrors = []␊
+        let prepareResult␊
+        try {␊
+          prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+        } catch (cleanupError) {␊
+          cleanupErrors.push(cleanupError)␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
+        }␊
+        if (__isThenable(prepareResult)) {␊
+          return Promise.resolve(prepareResult).then(␊
+            () => __drainWasmEnvForWasiRollback(cleanupErrors),␊
+            (cleanupError) => {␊
+              cleanupErrors.push(cleanupError)␊
+              return __retainFailedWasiRollback(cleanupErrors)␊
+            },␊
+          )␊
+        }␊
+        return __drainWasmEnvForWasiRollback(cleanupErrors)␊
+      }␊
+    ␊
+      // The settlement drain of the rollback above, reached either straight away or␊
+      // after the barrier's two-phase form has yielded its turns. A barrier that␊
+      // did not finish never gets here: it retains instead, exactly as a drain that␊
+      // did not finish does.␊
+      function __drainWasmEnvForWasiRollback(cleanupErrors) {␊
         let drainResult␊
-        let settlementsUnreached = false␊
         try {␊
-          __prepareWasmEnvCleanup()␊
           drainResult = __drainWasmEnvCleanup()␊
         } catch (cleanupError) {␊
           cleanupErrors.push(cleanupError)␊
-          settlementsUnreached = true␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
         }␊
         if (__isThenable(drainResult)) {␊
           return Promise.resolve(drainResult).then(␊
@@ -2951,9 +4233,6 @@ Generated by [AVA](https://avajs.dev).
             },␊
           )␊
         }␊
-        if (settlementsUnreached) {␊
-          return __retainFailedWasiRollback(cleanupErrors)␊
-        }␊
         return __destroyContextForWasiRollback(cleanupErrors)␊
       }␊
     ␊
@@ -2985,6 +4264,36 @@ Generated by [AVA](https://avajs.dev).
       return __rollbackWasmEnvForWasiInitialization()␊
     }␊
     ␊
+    // A view of the addon's crash flag, one word of the shared wasm memory, for the␊
+    // pool workers: they raise it when their wasm thread dies, and the shutdown␊
+    // waits inside the cleanup calls on this thread then trap instead of waiting on␊
+    // the dead thread for good. Undefined for an addon built with an older napi.␊
+    let __wasiAddonCrashFlag␊
+    ␊
+    function __captureWasiAddonCrashFlag(instance) {␊
+      try {␊
+        const getAddress = instance.exports.napi_wasm_thread_crash_flag_address␊
+        if (typeof getAddress !== 'function') {␊
+          return␊
+        }␊
+        const address = getAddress() >>> 0␊
+        const buffer = __sharedMemory.buffer␊
+        if (address === 0 || address % 4 !== 0 || address + 4 > buffer.byteLength) {␊
+          return␊
+        }␊
+        __wasiAddonCrashFlag = new Int32Array(buffer, address, 1)␊
+      } catch {}␊
+    }␊
+    ␊
+    function __shareWasiAddonCrashFlag(worker) {␊
+      if (__wasiAddonCrashFlag === undefined) {␊
+        return␊
+      }␊
+      try {␊
+        worker.postMessage({ __napiRsAddonCrashFlag: __wasiAddonCrashFlag })␊
+      } catch {}␊
+    }␊
+    ␊
     let __wasiModule␊
     let __napiModule␊
     ␊
@@ -3015,6 +4324,7 @@ Generated by [AVA](https://avajs.dev).
             type: 'module',␊
           })␊
           __wasiWorkers.add(worker)␊
+          __shareWasiAddonCrashFlag(worker)␊
           worker.addEventListener('message', __wasmCreateOnMessageForFsProxy(__fs))␊
     ␊
           worker.addEventListener('message', (event) => {␊
@@ -3044,6 +4354,10 @@ Generated by [AVA](https://avajs.dev).
         },␊
         beforeInit({ instance }) {␊
           __napiInstance = instance␊
+          __captureWasiAddonCrashFlag(instance)␊
+          for (const worker of __wasiWorkers) {␊
+            __shareWasiAddonCrashFlag(worker)␊
+          }␊
           for (const name of Object.keys(instance.exports)) {␊
             if (name.startsWith('__napi_register__')) {␊
               instance.exports[name]()␊
@@ -3188,6 +4502,20 @@ Generated by [AVA](https://avajs.dev).
     let __emnapiContextDestroyPromise␊
     let __emnapiWasmEnvCleanupPrepared = false␊
     let __emnapiWasmEnvCleanupPreparing = false␊
+    // The closer for a barrier that is parked between \`…_begin\` and \`…_finish\`,␊
+    // set only while that window is open. \`__emnapiWasmEnvCleanupPreparing\` cannot␊
+    // tell those two apart on its own: it is raised both for a purely synchronous␊
+    // frame — which must not be re-entered, and which nothing outside it can␊
+    // finish — and across this window, which spans real event-loop turns, so a␊
+    // caller that cannot yield can land in the middle of one. That caller can close␊
+    // this window, because \`…_finish\` is idempotent and joins, which is exactly␊
+    // what the single call does. See \`__prepareWasmEnvCleanup\`.␊
+    let __finishParkedWasmEnvCleanup␊
+    // Raised while a caller that can still yield is driving the barrier, so the␊
+    // queue it leaves behind is expected rather than lost. See␊
+    // \`__reportUnreachedWasmEnvSettlements\`.␊
+    let __emnapiWasmEnvCleanupYielding = false␊
+    let __emnapiWasmEnvSettlementLossReported = false␊
     let __emnapiWasmEnvCleanupRan = false␊
     let __emnapiWasmEnvCleanupDrained = false␊
     let __emnapiWasmEnvCleanupDrainPromise␊
@@ -3330,7 +4658,24 @@ Generated by [AVA](https://avajs.dev).
     }␊
     ␊
     function __prepareWasmEnvCleanup() {␊
-      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+      if (__emnapiWasmEnvCleanupPrepared) {␊
+        return␊
+      }␊
+      // A handshake parked between its two halves is one this frame can close, and␊
+      // must: every caller of this function is about to destroy the context, and␊
+      // the turns the poll is waiting for will not come — an 'exit' teardown is␊
+      // the last thing the process runs, and \`Context.destroy()\` takes the␊
+      // environment away. Closing it here runs \`…_finish\`, which is the call that joins, so␊
+      // this degrades to exactly the single call below. Leaving it open instead␊
+      // destroys the context with the barrier still raised, the runtime never␊
+      // joined and the workers never drained.␊
+      const finishParked = __finishParkedWasmEnvCleanup␊
+      if (finishParked !== undefined) {␊
+        finishParked()␊
+        __reportUnreachedWasmEnvSettlements()␊
+        return␊
+      }␊
+      if (__emnapiWasmEnvCleanupPreparing) {␊
         return␊
       }␊
       const prepare = __napiInstance?.exports?.napi_prepare_wasm_env_cleanup␊
@@ -3345,10 +4690,57 @@ Generated by [AVA](https://avajs.dev).
           __emnapiWasmEnvCleanupPreparing = false␊
         }␊
         __emnapiWasmEnvCleanupRan = true␊
+        __reportUnreachedWasmEnvSettlements()␊
       }␊
       __emnapiWasmEnvCleanupPrepared = true␊
     }␊
     ␊
+    /**␊
+     * Say so when the barrier leaves settlements queued and nothing is left that␊
+     * could deliver them.␊
+     *␊
+     * Only the disposal chain yields the event-loop turns @emnapi/core needs to␊
+     * dispatch its queue. Every other caller of the barrier destroys in the same␊
+     * turn — a raw \`Context.destroy()\`, the 'exit' teardown — and␊
+     * \`Context.destroy()\` runs the threadsafe function's cleanup hook, which drains␊
+     * that queue with a null env and discards it. The promises those settlements␊
+     * were for then hang forever, silently.␊
+     *␊
+     * Loud, once, and never throwing: this runs from inside \`Context.destroy()\`,␊
+     * emnapi's own beforeExit destroy included, where throwing would take the whole␊
+     * teardown down with it. Destroying anyway is still the right trade — the queue␊
+     * is already unreachable by then.␊
+     */␊
+    function __reportUnreachedWasmEnvSettlements() {␊
+      if (__emnapiWasmEnvCleanupYielding || __emnapiWasmEnvSettlementLossReported) {␊
+        return␊
+      }␊
+      const pending = __napiInstance?.exports?.napi_wasm_env_cleanup_pending␊
+      if (typeof pending !== 'function') {␊
+        return␊
+      }␊
+      let queued␊
+      try {␊
+        queued = pending()␊
+      } catch {␊
+        return␊
+      }␊
+      if (!queued) {␊
+        return␊
+      }␊
+      __emnapiWasmEnvSettlementLossReported = true␊
+      try {␊
+        const consoleHost = globalThis.console␊
+        if (consoleHost && typeof consoleHost.error === 'function') {␊
+          consoleHost.error(␊
+            "napi-rs: the wasm environment is being destroyed with " +␊
+              queued +␊
+              " queued promise settlement(s). Context.destroy() discards them, so those promises never settle. Dispose with binding[Symbol.for('napi.rs.wasi.dispose')]() instead: only it yields the event-loop turns the settlements need.",␊
+          )␊
+        }␊
+      } catch {}␊
+    }␊
+    ␊
     // Mirror the primitive @emnapi/core schedules its threadsafe-function dispatch␊
     // on, so the drain turns below interleave with that dispatch instead of racing␊
     // ahead of it on a faster queue.␊
@@ -3398,6 +4790,291 @@ Generated by [AVA](https://avajs.dev).
       }␊
     }␊
     ␊
+    // A real, referenced timer rather than a zero-delay macrotask, for the same␊
+    // reason the async-work drain uses one: this polls the addon instead of␊
+    // interleaving with the @emnapi/core dispatch, so a zero-delay turn would spin␊
+    // the loop instead of yielding it.␊
+    const __WASM_RUNTIME_WORK_POLL_INTERVAL_MS = 1␊
+    // Arrivals it takes before the poll paces on the host's timers alone. One␊
+    // proves nothing: a timer armed before the host's timers stopped still fires.␊
+    const __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS = 2␊
+    // How long a parked turn's own timer must already have been due before a␊
+    // backup that runs calls it dropped. Slack, not a deadline: a timer is due␊
+    // against the event loop's clock, which is read once per iteration, while␊
+    // these are \`Date.now()\` readings taken part-way through one, so the two␊
+    // drift apart by however long the loop has been inside the current iteration.␊
+    const __WASM_RUNTIME_WORK_POLL_STALL_MS = 50␊
+    // How long a backup itself waits. What is left of it after the slack and one␊
+    // interval — 149 ms — has to cover the *two* poll turns that can separate a␊
+    // parked turn from the last backup armed while the host's timers still␊
+    // worked, so the ceiling on a single turn is half of it. See the invariant on␊
+    // \`__armWasmRuntimePollStallBackup\`.␊
+    const __WASM_RUNTIME_WORK_POLL_BACKUP_MS = 200␊
+    ␊
+    /**␊
+     * Pacing state for one runtime-work poll.␊
+     *␊
+     * Per poll, never per module: whether the host's timers arrive is not a␊
+     * property of the module. A host can lose its timers between two disposals,␊
+     * and in the deferred shape every instance shares this module — one healthy␊
+     * instance must not disarm the fallback for the next one.␊
+     */␊
+    function __createWasmRuntimePollPace() {␊
+      return {␊
+        // Timers armed by *this* poll that have actually arrived.␊
+        arrivals: 0,␊
+        // The turn waiting on a timer alone *right now* — undefined whenever no␊
+        // turn is parked — and when that turn's own timer came due.␊
+        settleTurn: undefined,␊
+        turnTimerDueAt: 0,␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * The backup that ends a turn whose timer is never going to arrive.␊
+     *␊
+     * Once the poll paces on the timer alone it has nothing left to fall back on␊
+     * if the host's timers stop mid-poll: the turn that armed the dead timer is␊
+     * the turn that parks, and a parked poll schedules nothing that could notice.␊
+     * So every turn arms one of these before it yields, and each one compares due␊
+     * times instead of measuring how long the parked turn has been waiting.␊
+     *␊
+     * Invariant: a parked turn is ended by the newest backup that was armed while␊
+     * the host's timers still worked, and a backup ends a turn only when that␊
+     * turn's own timer was already due a whole window before the backup itself.␊
+     * Neither half turns on how far apart the arms happen to fall — what bounds␊
+     * the rescue is how far back that newest live backup is:␊
+     *␊
+     * - *Ends it.* Hosts run timers in due order, so a backup that runs while a␊
+     *   turn due a whole window earlier is still parked proves that turn's timer␊
+     *   was dropped rather than merely late. That same comparison is what leaves a␊
+     *   healthy host alone: there the turn's timer has already run and cleared␊
+     *   \`settleTurn\` before any backup due after it can look.␊
+     * - *Two turns back, not one.* A turn that ended does not prove its own timer␊
+     *   arrived: until \`…_TRUSTED_ARRIVALS\` is reached every turn arms both␊
+     *   primitives and the macrotask wins, so such a turn can end with its own␊
+     *   timer — and the backup armed one line before it — already dead. The␊
+     *   arrival that then flips the poll onto the timer alone can itself be a␊
+     *   timer armed before the host's timers died. So the turn that parks can sit␊
+     *   two turns past the last live arm, and the newest live backup is due␊
+     *   \`…_BACKUP_MS\` less *two* turn lengths after that turn's own timer.␊
+     *   Arming on every turn is what holds it to two, rather than however far back␊
+     *   a throttle last let one through.␊
+     * - *Ceiling.* Coverage therefore holds while two consecutive poll turns fit␊
+     *   inside \`…_BACKUP_MS\` less the slack and one interval: 149 ms, so 74 ms␊
+     *   per turn (measured: a 74 ms turn is still rescued, a 75 ms one parks).␊
+     *   Past that the turn stays parked and the disposal promise never settles.␊
+     *   The bound is deliberate: reaching it takes a host that drops timers␊
+     *   mid-poll *and* keeps every poll turn busy for more than 74 ms, and neither␊
+     *   Node nor WebContainer — the hosts that run the threaded artifact — does␊
+     *   the second.␊
+     *␊
+     * The poll then goes back to arming both primitives until two fresh arrivals␊
+     * prove the timers again. A host that stops running the timers it has␊
+     * *already* accepted leaves nothing to fire, and the disposal promise stays␊
+     * pending rather than wedging the thread — the same outcome as a blocking␊
+     * closure that never returns. Unreferenced wherever the host allows it: the␊
+     * poll's own turn timers are what keep the loop alive, never these.␊
+     */␊
+    function __armWasmRuntimePollStallBackup(pace) {␊
+      const setTimer = globalThis.setTimeout␊
+      if (typeof setTimer !== 'function') {␊
+        // Nothing to back up: \`__scheduleTimer\` is on the macrotask channel␊
+        // already, and that one cannot park.␊
+        return␊
+      }␊
+      // Read before arming, so this never claims to be due earlier than the timer␊
+      // actually is: a backup ends a turn only when it is provably due after it.␊
+      const dueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_BACKUP_MS␊
+      let handle␊
+      try {␊
+        handle = setTimer(() => {␊
+          const settleTurn = pace.settleTurn␊
+          if (␊
+            !settleTurn ||␊
+            pace.turnTimerDueAt > dueAt - __WASM_RUNTIME_WORK_POLL_STALL_MS␊
+          ) {␊
+            // No turn is parked, or the parked one's timer came due too close to␊
+            // this backup to call it dropped — it may still arrive, and the turn␊
+            // that armed it armed a backup due a whole window after *that*.␊
+            return␊
+          }␊
+          pace.arrivals = 0␊
+          pace.settleTurn = undefined␊
+          settleTurn()␊
+        }, __WASM_RUNTIME_WORK_POLL_BACKUP_MS)␊
+      } catch {␊
+        return␊
+      }␊
+      if (handle && typeof handle.unref === 'function') {␊
+        try {␊
+          handle.unref()␊
+        } catch {}␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * One turn of the runtime-work poll.␊
+     *␊
+     * \`__scheduleTimer\` falls back to the macrotask scheduler when \`setTimeout\` is␊
+     * missing or throws, but not when it is present, returns a handle and never␊
+     * fires — fake timers in a test suite that disposes from an \`afterEach\`, or a␊
+     * host whose timers belong to an IO context that is already gone. That host␊
+     * would park this poll forever, and the poll is unbounded, so nothing would␊
+     * ever call \`…_finish\`.␊
+     *␊
+     * Arm both primitives until timers armed by this poll have arrived twice, and␊
+     * let whichever lands first end the turn; the loser resolves nothing. A host␊
+     * with working timers therefore pays the double arming for the first turn or␊
+     * two — the macrotask wins the race, but the timers behind it still arrive and␊
+     * are counted — and paces on the timer alone from then on, instead of spinning␊
+     * the loop on a zero-delay queue. A host whose timers never arrive keeps both,␊
+     * and the macrotask is what keeps the poll moving. A host whose timers stop␊
+     * after proving themselves is caught by \`__armWasmRuntimePollStallBackup\`,␊
+     * which ends the parked turn and puts this poll back on both.␊
+     */␊
+    function __yieldWasmRuntimePollTurn(pace) {␊
+      // Armed before the turn yields, and by every turn: what rescues a parked␊
+      // turn has to have been armed while the host's timers still worked, and the␊
+      // turn that parks is the one whose own timer is already dead.␊
+      __armWasmRuntimePollStallBackup(pace)␊
+      return new Promise((resolve) => {␊
+        let settled = false␊
+        const settle = () => {␊
+          if (settled) {␊
+            return␊
+          }␊
+          settled = true␊
+          if (pace.settleTurn === settle) {␊
+            // Nothing is parked any more: a backup running later must not read a␊
+            // due time this turn has already answered.␊
+            pace.settleTurn = undefined␊
+          }␊
+          resolve()␊
+        }␊
+        __scheduleTimer(() => {␊
+          pace.arrivals++␊
+          settle()␊
+        }, __WASM_RUNTIME_WORK_POLL_INTERVAL_MS)␊
+        // Read next to the arming it describes; see␊
+        // \`__armWasmRuntimePollStallBackup\` for what the two due times mean.␊
+        const turnTimerDueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_INTERVAL_MS␊
+        if (pace.arrivals < __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS) {␊
+          __scheduleMacrotask(settle)␊
+          return␊
+        }␊
+        // Paced by the timer alone from here; the backup is what ends this turn if␊
+        // the timer never arrives.␊
+        pace.settleTurn = settle␊
+        pace.turnTimerDueAt = turnTimerDueAt␊
+      })␊
+    }␊
+    ␊
+    /**␊
+     * The barrier for callers that can yield: \`__prepareWasmEnvCleanup\` with real␊
+     * event-loop turns in the middle.␊
+     *␊
+     * \`napi_prepare_wasm_env_cleanup\` waits — it returns only once the addon's␊
+     * async runtime has quiesced, and on \`wasm32-wasip1-threads\` the thread it␊
+     * waits on is this one, the only thread that can give a running blocking␊
+     * closure the JavaScript turn *it* is waiting for. A single call there can wait␊
+     * for work that can never finish. The addon's two-phase form splits that:␊
+     * \`…_begin\` stops the runtime without joining and reports whether anything is␊
+     * still live, \`napi_wasm_runtime_work_pending\` answers that question again␊
+     * without blocking, and \`…_finish\` joins. The turns yielded in between are the␊
+     * entire point.␊
+     *␊
+     * The poll has no deadline, for the same reason the async-work drain below has␊
+     * none: giving up means calling \`…_finish\`, which joins on this thread, and the␊
+     * work it would join is the work that is waiting for a turn from this thread —␊
+     * so a bound does not end the wait, it only moves it somewhere the JavaScript␊
+     * thread can no longer be reached. A blocking closure that never returns keeps␊
+     * the disposal promise pending instead, exactly as a task whose \`execute\` never␊
+     * returns already keeps an *undisposed* process alive. The host contract is in␊
+     * \`crates/async-runtime/README.md\`: a blocking closure must never wait on a␊
+     * JavaScript turn. The process-exit path still blocks in \`…_finish\`, because it␊
+     * has no turns left to give (see \`__prepareWasmEnvCleanup\`).␊
+     *␊
+     * Feature-detected like every other export in this teardown, so an addon built␊
+     * against a napi crate that predates the split keeps the single blocking call.␊
+     * Returns nothing whenever the handshake finished without yielding, which keeps␊
+     * an idle disposal synchronous.␊
+     */␊
+    function __prepareWasmEnvCleanupWithTurns() {␊
+      if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {␊
+        return␊
+      }␊
+      const exports = __napiInstance?.exports␊
+      const begin = exports?.napi_prepare_wasm_env_cleanup_begin␊
+      const finish = exports?.napi_prepare_wasm_env_cleanup_finish␊
+      if (typeof begin !== 'function' || typeof finish !== 'function') {␊
+        // No split to use. The settlement drain still follows this, so the queue␊
+        // the single call leaves behind is expected rather than lost.␊
+        __emnapiWasmEnvCleanupYielding = true␊
+        try {␊
+          __prepareWasmEnvCleanup()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupYielding = false␊
+        }␊
+        return␊
+      }␊
+      const workPending = exports?.napi_wasm_runtime_work_pending␊
+      // The in-flight flag stays raised across the turns below, so a \`destroy()\`␊
+      // from one of the JavaScript handlers they run is the same no-op it is inside␊
+      // the single call: the barrier is up and the runtime is mid-teardown, and␊
+      // destroying between the halves would strand exactly what this delivers.␊
+      __emnapiWasmEnvCleanupPreparing = true␊
+      let live␊
+      try {␊
+        live = begin()␊
+      } catch (error) {␊
+        __emnapiWasmEnvCleanupPreparing = false␊
+        throw error␊
+      }␊
+      __emnapiWasmEnvCleanupRan = true␊
+      const finishCleanup = () => {␊
+        if (__emnapiWasmEnvCleanupPrepared) {␊
+          // Already closed by a caller that could not yield — the 'exit' teardown␊
+          // reached \`__prepareWasmEnvCleanup\` while this poll was parked. \`…_finish\`␊
+          // is idempotent, but the flags it lowers are not: running it again here␊
+          // would clear a \`preparing\` some later barrier had raised.␊
+          return␊
+        }␊
+        __finishParkedWasmEnvCleanup = undefined␊
+        try {␊
+          finish()␊
+        } finally {␊
+          __emnapiWasmEnvCleanupPreparing = false␊
+        }␊
+        __emnapiWasmEnvCleanupPrepared = true␊
+      }␊
+      if (!live || typeof workPending !== 'function') {␊
+        finishCleanup()␊
+        return␊
+      }␊
+      // Publish the closer before yielding: from here until \`finishCleanup\` runs,␊
+      // a caller that cannot yield is entitled to end this handshake itself.␊
+      __finishParkedWasmEnvCleanup = finishCleanup␊
+      return (async () => {␊
+        // Unbounded, exactly like the async-work drain below. The wait ends when␊
+        // the addon reports its runtime work finished; the turns spent here are␊
+        // what let that happen at all.␊
+        const pace = __createWasmRuntimePollPace()␊
+        for (;;) {␊
+          await __yieldWasmRuntimePollTurn(pace)␊
+          try {␊
+            if (!workPending()) {␊
+              return␊
+            }␊
+          } catch {␊
+            // A trap is the only way this fails, and a trapped instance has no␊
+            // reachable work left. Stop polling and finish.␊
+            return␊
+          }␊
+        }␊
+      })().then(finishCleanup, finishCleanup)␊
+    }␊
+    ␊
     // Turns to wait for while the addon still reports queued settlements. Reaching␊
     // zero is the only success. A counter still nonzero at this bound rejects the␊
     // disposal as retryable (\`ERR_NAPI_WASI_CLEANUP_PENDING\`) rather than␊
@@ -3535,6 +5212,19 @@ Generated by [AVA](https://avajs.dev).
     ␊
       __disposeCurrentThreadHosts()␊
       __prepareWasmEnvCleanup()␊
+      if (__isPreparingWasmEnvCleanup()) {␊
+        // Reached from inside the synchronous barrier — a promise hook one of the␊
+        // settlements above ran, which is the reentrancy the destroy wrapper␊
+        // exists for. \`Context.destroy()\` below would hit that wrapper's in-flight␊
+        // no-op and answer \`undefined\`, and recording that as a completed destroy␊
+        // is what makes the frame that *did* start the barrier skip the real one␊
+        // afterwards, leaving the context retained with its cleanup hooks unrun.␊
+        // Refuse instead: nothing is flagged, and that frame destroys for real the␊
+        // moment it returns. The deferred loader carries the same backstop. A␊
+        // parked handshake cannot get here — \`__prepareWasmEnvCleanup\` closes one␊
+        // rather than skipping it.␊
+        return␊
+      }␊
       const result = __emnapiContext.destroy()␊
       if (!__isThenable(result)) {␊
         __emnapiContextDestroyed = true␊
@@ -3808,11 +5498,7 @@ Generated by [AVA](https://avajs.dev).
       return __finishWasiDisposal()␊
     }␊
     ␊
-    function __cleanUpWasmEnvForWasiDisposal() {␊
-      // Run the pre-teardown barrier, then let the settlements it queued actually␊
-      // reach JavaScript, and only then destroy the environment. Doing these two␊
-      // back to back is what strands them.␊
-      __prepareWasmEnvCleanup()␊
+    function __drainWasmEnvForWasiDisposal() {␊
       const drainResult = __drainWasmEnvCleanup()␊
       if (__isThenable(drainResult)) {␊
         return Promise.resolve(drainResult).then(__continueWasiDisposal)␊
@@ -3820,6 +5506,18 @@ Generated by [AVA](https://avajs.dev).
       return __continueWasiDisposal()␊
     }␊
     ␊
+    function __cleanUpWasmEnvForWasiDisposal() {␊
+      // Run the pre-teardown barrier — yielding the turns its two-phase form asks␊
+      // for, when the addon has one — then let the settlements it queued actually␊
+      // reach JavaScript, and only then destroy the environment. Doing any two of␊
+      // these back to back is what strands them.␊
+      const prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+      if (__isThenable(prepareResult)) {␊
+        return Promise.resolve(prepareResult).then(__drainWasmEnvForWasiDisposal)␊
+      }␊
+      return __drainWasmEnvForWasiDisposal()␊
+    }␊
+    ␊
     function __startWasiDisposal() {␊
       // Outstanding \`napi_async_work\` goes first, while the environment is still␊
       // completely live: the completion callbacks run addon code, and everything␊
@@ -3980,14 +5678,36 @@ Generated by [AVA](https://avajs.dev).
       // be reached without the async-work drain below running first.␊
       function __rollbackWasmEnvForWasiInitialization() {␊
         const cleanupErrors = []␊
+        let prepareResult␊
+        try {␊
+          prepareResult = __prepareWasmEnvCleanupWithTurns()␊
+        } catch (cleanupError) {␊
+          cleanupErrors.push(cleanupError)␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
+        }␊
+        if (__isThenable(prepareResult)) {␊
+          return Promise.resolve(prepareResult).then(␊
+            () => __drainWasmEnvForWasiRollback(cleanupErrors),␊
+            (cleanupError) => {␊
+              cleanupErrors.push(cleanupError)␊
+              return __retainFailedWasiRollback(cleanupErrors)␊
+            },␊
+          )␊
+        }␊
+        return __drainWasmEnvForWasiRollback(cleanupErrors)␊
+      }␊
+    ␊
+      // The settlement drain of the rollback above, reached either straight away or␊
+      // after the barrier's two-phase form has yielded its turns. A barrier that␊
+      // did not finish never gets here: it retains instead, exactly as a drain that␊
+      // did not finish does.␊
+      function __drainWasmEnvForWasiRollback(cleanupErrors) {␊
         let drainResult␊
-        let settlementsUnreached = false␊
         try {␊
-          __prepareWasmEnvCleanup()␊
           drainResult = __drainWasmEnvCleanup()␊
         } catch (cleanupError) {␊
           cleanupErrors.push(cleanupError)␊
-          settlementsUnreached = true␊
+          return __retainFailedWasiRollback(cleanupErrors)␊
         }␊
         if (__isThenable(drainResult)) {␊
           return Promise.resolve(drainResult).then(␊
@@ -3998,9 +5718,6 @@ Generated by [AVA](https://avajs.dev).
             },␊
           )␊
         }␊
-        if (settlementsUnreached) {␊
-          return __retainFailedWasiRollback(cleanupErrors)␊
-        }␊
         return __destroyContextForWasiRollback(cleanupErrors)␊
       }␊
     ␊
@@ -4577,10 +6294,222 @@ Generated by [AVA](https://avajs.dev).
         __scheduleMacrotask(__callback)␊
         return␊
       }␊
-      try {␊
-        __setTimer(__callback, __delay)␊
-      } catch {␊
-        __scheduleMacrotask(__callback)␊
+      try {␊
+        __setTimer(__callback, __delay)␊
+      } catch {␊
+        __scheduleMacrotask(__callback)␊
+      }␊
+    }␊
+    ␊
+    // A real, referenced timer rather than a zero-delay macrotask, for the same␊
+    // reason the async-work wait uses one: this polls the addon instead of␊
+    // interleaving with the @emnapi/core dispatch, so a zero-delay turn would spin␊
+    // the loop instead of yielding it.␊
+    const __WASM_RUNTIME_WORK_POLL_INTERVAL_MS = 1␊
+    // Arrivals it takes before the poll paces on the host's timers alone. One␊
+    // proves nothing: a timer armed before the host's timers stopped still fires.␊
+    const __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS = 2␊
+    // How long a parked turn's own timer must already have been due before a␊
+    // backup that runs calls it dropped. Slack, not a deadline: a timer is due␊
+    // against the event loop's clock, which is read once per iteration, while␊
+    // these are \`Date.now()\` readings taken part-way through one, so the two␊
+    // drift apart by however long the loop has been inside the current iteration.␊
+    const __WASM_RUNTIME_WORK_POLL_STALL_MS = 50␊
+    // How long a backup itself waits. What is left of it after the slack and one␊
+    // interval — 149 ms — has to cover the *two* poll turns that can separate a␊
+    // parked turn from the last backup armed while the host's timers still␊
+    // worked, so the ceiling on a single turn is half of it. See the invariant on␊
+    // \`__armWasmRuntimePollStallBackup\`.␊
+    const __WASM_RUNTIME_WORK_POLL_BACKUP_MS = 200␊
+    ␊
+    /**␊
+     * Pacing state for one runtime-work poll.␊
+     *␊
+     * Per poll, never per module: whether the host's timers arrive is not a␊
+     * property of the module. A host can lose its timers between two disposals,␊
+     * and in the deferred shape every instance shares this module — one healthy␊
+     * instance must not disarm the fallback for the next one.␊
+     */␊
+    function __createWasmRuntimePollPace() {␊
+      return {␊
+        // Timers armed by *this* poll that have actually arrived.␊
+        arrivals: 0,␊
+        // The turn waiting on a timer alone *right now* — undefined whenever no␊
+        // turn is parked — and when that turn's own timer came due.␊
+        settleTurn: undefined,␊
+        turnTimerDueAt: 0,␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * The backup that ends a turn whose timer is never going to arrive.␊
+     *␊
+     * Once the poll paces on the timer alone it has nothing left to fall back on␊
+     * if the host's timers stop mid-poll: the turn that armed the dead timer is␊
+     * the turn that parks, and a parked poll schedules nothing that could notice.␊
+     * So every turn arms one of these before it yields, and each one compares due␊
+     * times instead of measuring how long the parked turn has been waiting.␊
+     *␊
+     * Invariant: a parked turn is ended by the newest backup that was armed while␊
+     * the host's timers still worked, and a backup ends a turn only when that␊
+     * turn's own timer was already due a whole window before the backup itself.␊
+     * Neither half turns on how far apart the arms happen to fall — what bounds␊
+     * the rescue is how far back that newest live backup is:␊
+     *␊
+     * - *Ends it.* Hosts run timers in due order, so a backup that runs while a␊
+     *   turn due a whole window earlier is still parked proves that turn's timer␊
+     *   was dropped rather than merely late. That same comparison is what leaves a␊
+     *   healthy host alone: there the turn's timer has already run and cleared␊
+     *   \`settleTurn\` before any backup due after it can look.␊
+     * - *Two turns back, not one.* A turn that ended does not prove its own timer␊
+     *   arrived: until \`…_TRUSTED_ARRIVALS\` is reached every turn arms both␊
+     *   primitives and the macrotask wins, so such a turn can end with its own␊
+     *   timer — and the backup armed one line before it — already dead. The␊
+     *   arrival that then flips the poll onto the timer alone can itself be a␊
+     *   timer armed before the host's timers died. So the turn that parks can sit␊
+     *   two turns past the last live arm, and the newest live backup is due␊
+     *   \`…_BACKUP_MS\` less *two* turn lengths after that turn's own timer.␊
+     *   Arming on every turn is what holds it to two, rather than however far back␊
+     *   a throttle last let one through.␊
+     * - *Ceiling.* Coverage therefore holds while two consecutive poll turns fit␊
+     *   inside \`…_BACKUP_MS\` less the slack and one interval: 149 ms, so 74 ms␊
+     *   per turn (measured: a 74 ms turn is still rescued, a 75 ms one parks).␊
+     *   Past that the turn stays parked and the disposal promise never settles.␊
+     *   The bound is deliberate: reaching it takes a host that drops timers␊
+     *   mid-poll *and* keeps every poll turn busy for more than 74 ms, and neither␊
+     *   Node nor WebContainer — the hosts that run the threaded artifact — does␊
+     *   the second.␊
+     *␊
+     * The poll then goes back to arming both primitives until two fresh arrivals␊
+     * prove the timers again. A host that stops running the timers it has␊
+     * *already* accepted leaves nothing to fire, and the disposal promise stays␊
+     * pending rather than wedging the thread — the same outcome as a blocking␊
+     * closure that never returns. Unreferenced wherever the host allows it: the␊
+     * poll's own turn timers are what keep the loop alive, never these.␊
+     */␊
+    function __armWasmRuntimePollStallBackup(__pace) {␊
+      const __setTimer = globalThis.setTimeout␊
+      if (typeof __setTimer !== 'function') {␊
+        // Nothing to back up: \`__scheduleTimer\` is on the macrotask channel␊
+        // already, and that one cannot park.␊
+        return␊
+      }␊
+      // Read before arming, so this never claims to be due earlier than the timer␊
+      // actually is: a backup ends a turn only when it is provably due after it.␊
+      const __dueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_BACKUP_MS␊
+      let __handle␊
+      try {␊
+        __handle = __setTimer(() => {␊
+          const __settleTurn = __pace.settleTurn␊
+          if (␊
+            !__settleTurn ||␊
+            __pace.turnTimerDueAt > __dueAt - __WASM_RUNTIME_WORK_POLL_STALL_MS␊
+          ) {␊
+            // No turn is parked, or the parked one's timer came due too close to␊
+            // this backup to call it dropped — it may still arrive, and the turn␊
+            // that armed it armed a backup due a whole window after *that*.␊
+            return␊
+          }␊
+          __pace.arrivals = 0␊
+          __pace.settleTurn = undefined␊
+          __settleTurn()␊
+        }, __WASM_RUNTIME_WORK_POLL_BACKUP_MS)␊
+      } catch {␊
+        return␊
+      }␊
+      if (__handle && typeof __handle.unref === 'function') {␊
+        try {␊
+          __handle.unref()␊
+        } catch {}␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * One turn of the runtime-work poll.␊
+     *␊
+     * \`__scheduleTimer\` falls back to the macrotask scheduler when \`setTimeout\` is␊
+     * missing or throws, but not when it is present, returns a handle and never␊
+     * fires — fake timers in a test suite that disposes from an \`afterEach\`, or a␊
+     * host whose timers belong to an IO context that is already gone. That host␊
+     * would park this poll forever, and the poll is unbounded, so nothing would␊
+     * ever call \`…_finish\`.␊
+     *␊
+     * Arm both primitives until timers armed by this poll have arrived twice, and␊
+     * let whichever lands first end the turn; the loser resolves nothing. A host␊
+     * with working timers therefore pays the double arming for the first turn or␊
+     * two — the macrotask wins the race, but the timers behind it still arrive and␊
+     * are counted — and paces on the timer alone from then on, instead of spinning␊
+     * the loop on a zero-delay queue. A host whose timers never arrive keeps both,␊
+     * and the macrotask is what keeps the poll moving. A host whose timers stop␊
+     * after proving themselves is caught by \`__armWasmRuntimePollStallBackup\`,␊
+     * which ends the parked turn and puts this poll back on both.␊
+     */␊
+    function __yieldWasmRuntimePollTurn(__pace) {␊
+      // Armed before the turn yields, and by every turn: what rescues a parked␊
+      // turn has to have been armed while the host's timers still worked, and the␊
+      // turn that parks is the one whose own timer is already dead.␊
+      __armWasmRuntimePollStallBackup(__pace)␊
+      return new Promise((resolve) => {␊
+        let __settled = false␊
+        const __settle = () => {␊
+          if (__settled) {␊
+            return␊
+          }␊
+          __settled = true␊
+          if (__pace.settleTurn === __settle) {␊
+            // Nothing is parked any more: a backup running later must not read a␊
+            // due time this turn has already answered.␊
+            __pace.settleTurn = undefined␊
+          }␊
+          resolve()␊
+        }␊
+        __scheduleTimer(() => {␊
+          __pace.arrivals++␊
+          __settle()␊
+        }, __WASM_RUNTIME_WORK_POLL_INTERVAL_MS)␊
+        // Read next to the arming it describes; see␊
+        // \`__armWasmRuntimePollStallBackup\` for what the two due times mean.␊
+        const __turnTimerDueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_INTERVAL_MS␊
+        if (__pace.arrivals < __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS) {␊
+          __scheduleMacrotask(__settle)␊
+          return␊
+        }␊
+        // Paced by the timer alone from here; the backup is what ends this turn if␊
+        // the timer never arrives.␊
+        __pace.settleTurn = __settle␊
+        __pace.turnTimerDueAt = __turnTimerDueAt␊
+      })␊
+    }␊
+    ␊
+    /**␊
+     * Yield event-loop turns until the addon reports its runtime work finished.␊
+     *␊
+     * The window between \`napi_prepare_wasm_env_cleanup_begin\` and␊
+     * \`…_finish\` — the turns are the entire point of splitting the barrier, because␊
+     * on a threaded artifact the work \`…_finish\` joins can itself be waiting for a␊
+     * JavaScript turn from this very thread.␊
+     *␊
+     * Unbounded, for the same reason the async-work wait above is: giving up means␊
+     * calling \`…_finish\`, which joins on this thread, and the work it would join is␊
+     * the work waiting for a turn from this thread — so a bound does not end the␊
+     * wait, it only moves it somewhere the JavaScript thread can no longer be␊
+     * reached. A blocking closure that never returns keeps the disposal promise␊
+     * pending instead. The host contract is in \`crates/async-runtime/README.md\`: a␊
+     * blocking closure must never wait on a JavaScript turn.␊
+     */␊
+    async function __pollWasmRuntimeWork(__workPending) {␊
+      const __pace = __createWasmRuntimePollPace()␊
+      for (;;) {␊
+        await __yieldWasmRuntimePollTurn(__pace)␊
+        try {␊
+          if (!__workPending()) {␊
+            return␊
+          }␊
+        } catch {␊
+          // A trap is the only way this fails, and a trapped instance has no␊
+          // reachable work left. Stop polling and finish.␊
+          return␊
+        }␊
       }␊
     }␊
     ␊
@@ -4955,7 +6884,9 @@ Generated by [AVA](https://avajs.dev).
             // hooks unrun. Refuse instead: nothing is flagged, the context stays␊
             // registered for managed beforeExit cleanup, and a later destroy still␊
             // works. dispose() coalesces reentrancy before it can get here, so this␊
-            // is the backstop for any other caller that manages to.␊
+            // is the backstop for any other caller that manages to. A handshake␊
+            // parked between the two halves of the barrier does not reach here —␊
+            // \`__prepareEnvCleanup\` closes one rather than skipping it.␊
             throw __createLifecycleReentryError('dispose')␊
           }␊
           __result = __emnapiContext.destroy()␊
@@ -5086,11 +7017,82 @@ Generated by [AVA](https://avajs.dev).
       let __wasmEnvCleanupRan = false␊
       let __wasmEnvCleanupPrepared = false␊
       let __wasmEnvCleanupPreparing = false␊
+      // The closer for a barrier parked between \`…_begin\` and \`…_finish\`, set only␊
+      // while that window is open. \`__wasmEnvCleanupPreparing\` cannot tell that␊
+      // apart from a purely synchronous frame, which must not be re-entered and␊
+      // which nothing outside it can finish; this window spans real event-loop␊
+      // turns, so a caller that cannot yield — the managed beforeExit teardown —␊
+      // can land inside it, and can close it. See \`__prepareEnvCleanup\`.␊
+      let __finishParkedEnvCleanup␊
+      // Raised while a caller that can still yield is driving the barrier, so the␊
+      // queue it leaves behind is expected rather than lost.␊
+      let __wasmEnvCleanupYielding = false␊
+      let __wasmEnvSettlementLossReported = false␊
       let __wasmEnvCleanupDrained = false␊
       let __wasmEnvCleanupDrainPromise␊
       const __isPreparingEnvCleanup = () => __wasmEnvCleanupPreparing␊
+      /**␊
+       * Say so when the barrier leaves settlements queued and nothing is left that␊
+       * could deliver them.␊
+       *␊
+       * Only \`dispose()\` and the initialization rollback yield the event-loop turns␊
+       * @emnapi/core needs to dispatch its queue. Every other caller of the barrier␊
+       * destroys in the same turn — a raw \`Context.destroy()\`, the managed␊
+       * beforeExit teardown — and \`Context.destroy()\` runs the threadsafe␊
+       * function's cleanup hook, which drains that queue with a null env and␊
+       * discards it. The promises those settlements were for then hang forever,␊
+       * silently.␊
+       *␊
+       * Loud, once, and never throwing: this runs from inside \`Context.destroy()\`,␊
+       * where throwing would take the whole teardown down with it. Destroying␊
+       * anyway is still the right trade — the queue is already unreachable by then.␊
+       */␊
+      const __reportUnreachedSettlements = () => {␊
+        if (__wasmEnvCleanupYielding || __wasmEnvSettlementLossReported) {␊
+          return␊
+        }␊
+        const __pending = __napiInstance?.exports.napi_wasm_env_cleanup_pending␊
+        if (typeof __pending !== 'function') {␊
+          return␊
+        }␊
+        let __queued␊
+        try {␊
+          __queued = __pending()␊
+        } catch {␊
+          return␊
+        }␊
+        if (!__queued) {␊
+          return␊
+        }␊
+        __wasmEnvSettlementLossReported = true␊
+        try {␊
+          const __consoleHost = globalThis.console␊
+          if (__consoleHost && typeof __consoleHost.error === 'function') {␊
+            __consoleHost.error(␊
+              'napi-rs: the wasm environment is being destroyed with ' +␊
+                __queued +␊
+                ' queued promise settlement(s). Context.destroy() discards them, so those promises never settle. Dispose the instance instead: only dispose() yields the event-loop turns the settlements need.',␊
+            )␊
+          }␊
+        } catch {}␊
+      }␊
       const __prepareEnvCleanup = () => {␊
-        if (__wasmEnvCleanupPrepared || __wasmEnvCleanupPreparing) {␊
+        if (__wasmEnvCleanupPrepared) {␊
+          return␊
+        }␊
+        // A handshake parked between its two halves is one this frame can close,␊
+        // and must: every caller of this is about to destroy the context, and the␊
+        // turns the poll is waiting for will not come. Closing it runs \`…_finish\`,␊
+        // which is the call that joins, so this degrades to exactly the single␊
+        // call below. Leaving it open destroys the context with the barrier still␊
+        // raised and the runtime never joined.␊
+        const __finishParked = __finishParkedEnvCleanup␊
+        if (__finishParked !== undefined) {␊
+          __finishParked()␊
+          __reportUnreachedSettlements()␊
+          return␊
+        }␊
+        if (__wasmEnvCleanupPreparing) {␊
           return␊
         }␊
         const __prepareWasmEnvCleanup =␊
@@ -5106,9 +7108,86 @@ Generated by [AVA](https://avajs.dev).
             __wasmEnvCleanupPreparing = false␊
           }␊
           __wasmEnvCleanupRan = true␊
+          __reportUnreachedSettlements()␊
         }␊
         __wasmEnvCleanupPrepared = true␊
       }␊
+      /**␊
+       * The barrier for the callers that can yield: \`__prepareEnvCleanup\` with real␊
+       * event-loop turns in the middle.␊
+       *␊
+       * \`napi_prepare_wasm_env_cleanup\` waits — it returns only once the addon's␊
+       * async runtime has quiesced, and the work it waits for can itself be waiting␊
+       * for a JavaScript turn from this thread. The addon's two-phase form splits␊
+       * that: \`…_begin\` stops the runtime without joining and reports whether␊
+       * anything is still live, \`napi_wasm_runtime_work_pending\` answers that again␊
+       * without blocking, and \`…_finish\` joins.␊
+       *␊
+       * The poll is unbounded — see \`__pollWasmRuntimeWork\` — but a caller that␊
+       * cannot yield closes the handshake itself rather than waiting for it, so␊
+       * \`…_finish\` still runs on every teardown path. Feature-detected like every␊
+       * other export here, and returns nothing whenever the handshake finished␊
+       * without yielding.␊
+       */␊
+      const __prepareEnvCleanupWithTurns = () => {␊
+        if (__wasmEnvCleanupPrepared || __wasmEnvCleanupPreparing) {␊
+          return␊
+        }␊
+        const __exports = __napiInstance?.exports␊
+        const __begin = __exports?.napi_prepare_wasm_env_cleanup_begin␊
+        const __finish = __exports?.napi_prepare_wasm_env_cleanup_finish␊
+        if (typeof __begin !== 'function' || typeof __finish !== 'function') {␊
+          // No split to use. The settlement drain still follows this, so the queue␊
+          // the single call leaves behind is expected rather than lost.␊
+          __wasmEnvCleanupYielding = true␊
+          try {␊
+            __prepareEnvCleanup()␊
+          } finally {␊
+            __wasmEnvCleanupYielding = false␊
+          }␊
+          return␊
+        }␊
+        const __workPending = __exports?.napi_wasm_runtime_work_pending␊
+        // The in-flight flag stays raised across the turns below, so a \`destroy()\`␊
+        // from one of the JavaScript handlers they run is the same no-op it is␊
+        // inside the single call: the barrier is up and the runtime is␊
+        // mid-teardown, and destroying between the halves would strand exactly what␊
+        // this delivers.␊
+        __wasmEnvCleanupPreparing = true␊
+        let __live␊
+        try {␊
+          __live = __begin()␊
+        } catch (__error) {␊
+          __wasmEnvCleanupPreparing = false␊
+          throw __error␊
+        }␊
+        __wasmEnvCleanupRan = true␊
+        const __finishEnvCleanup = () => {␊
+          if (__wasmEnvCleanupPrepared) {␊
+            // Already closed by a caller that could not yield. \`…_finish\` is␊
+            // idempotent, but the flags it lowers are not.␊
+            return␊
+          }␊
+          __finishParkedEnvCleanup = undefined␊
+          try {␊
+            __finish()␊
+          } finally {␊
+            __wasmEnvCleanupPreparing = false␊
+          }␊
+          __wasmEnvCleanupPrepared = true␊
+        }␊
+        if (!__live || typeof __workPending !== 'function') {␊
+          __finishEnvCleanup()␊
+          return␊
+        }␊
+        // Publish the closer before yielding: from here until \`__finishEnvCleanup\`␊
+        // runs, a caller that cannot yield is entitled to end this handshake.␊
+        __finishParkedEnvCleanup = __finishEnvCleanup␊
+        return __pollWasmRuntimeWork(__workPending).then(␊
+          __finishEnvCleanup,␊
+          __finishEnvCleanup,␊
+        )␊
+      }␊
       // The barrier + settlement drain, hoisted out of the context destroyer so the␊
       // drain can yield without widening the destroyer's reentry window. Both␊
       // yielding paths run it — dispose() and the initialization-failure rollback.␊
@@ -5121,6 +7200,20 @@ Generated by [AVA](https://avajs.dev).
       // is enough — and dispose() stays retryable after it rejects, so marking the␊
       // drain complete up front would make the retry skip it and destroy the context␊
       // with the barrier's settlements still queued.␊
+      const __drainAfterEnvCleanup = () => {␊
+        if (!__wasmEnvCleanupRan) {␊
+          return␊
+        }␊
+        const __drained = __drainWasmEnvCleanup(__napiInstance)␊
+        if (!__drained || typeof __drained.then !== 'function') {␊
+          __wasmEnvCleanupDrained = true␊
+          return␊
+        }␊
+        return __drained.then((__value) => {␊
+          __wasmEnvCleanupDrained = true␊
+          return __value␊
+        })␊
+      }␊
       const __prepareForDisposal = () => {␊
         if (__wasmEnvCleanupDrained) {␊
           return␊
@@ -5128,18 +7221,19 @@ Generated by [AVA](https://avajs.dev).
         if (__wasmEnvCleanupDrainPromise) {␊
           return __wasmEnvCleanupDrainPromise␊
         }␊
-        __prepareEnvCleanup()␊
-        if (!__wasmEnvCleanupRan) {␊
-          return␊
-        }␊
-        const __drained = __drainWasmEnvCleanup(__napiInstance)␊
-        if (!__drained || typeof __drained.then !== 'function') {␊
-          __wasmEnvCleanupDrained = true␊
+        // The barrier itself can yield now, so the memo below has to cover it too:␊
+        // a reentrant caller must join this handshake rather than start a second␊
+        // one while the first is parked between the two halves.␊
+        const __prepared = __prepareEnvCleanupWithTurns()␊
+        const __settled =␊
+          __prepared && typeof __prepared.then === 'function'␊
+            ? __prepared.then(__drainAfterEnvCleanup)␊
+            : __drainAfterEnvCleanup()␊
+        if (!__settled || typeof __settled.then !== 'function') {␊
           return␊
         }␊
-        const __tracked = __drained.then(␊
+        const __tracked = __settled.then(␊
           (__value) => {␊
-            __wasmEnvCleanupDrained = true␊
             __wasmEnvCleanupDrainPromise = undefined␊
             return __value␊
           },␊
@@ -6082,6 +8176,218 @@ Generated by [AVA](https://avajs.dev).
       }␊
     }␊
     ␊
+    // A real, referenced timer rather than a zero-delay macrotask, for the same␊
+    // reason the async-work wait uses one: this polls the addon instead of␊
+    // interleaving with the @emnapi/core dispatch, so a zero-delay turn would spin␊
+    // the loop instead of yielding it.␊
+    const __WASM_RUNTIME_WORK_POLL_INTERVAL_MS = 1␊
+    // Arrivals it takes before the poll paces on the host's timers alone. One␊
+    // proves nothing: a timer armed before the host's timers stopped still fires.␊
+    const __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS = 2␊
+    // How long a parked turn's own timer must already have been due before a␊
+    // backup that runs calls it dropped. Slack, not a deadline: a timer is due␊
+    // against the event loop's clock, which is read once per iteration, while␊
+    // these are \`Date.now()\` readings taken part-way through one, so the two␊
+    // drift apart by however long the loop has been inside the current iteration.␊
+    const __WASM_RUNTIME_WORK_POLL_STALL_MS = 50␊
+    // How long a backup itself waits. What is left of it after the slack and one␊
+    // interval — 149 ms — has to cover the *two* poll turns that can separate a␊
+    // parked turn from the last backup armed while the host's timers still␊
+    // worked, so the ceiling on a single turn is half of it. See the invariant on␊
+    // \`__armWasmRuntimePollStallBackup\`.␊
+    const __WASM_RUNTIME_WORK_POLL_BACKUP_MS = 200␊
+    ␊
+    /**␊
+     * Pacing state for one runtime-work poll.␊
+     *␊
+     * Per poll, never per module: whether the host's timers arrive is not a␊
+     * property of the module. A host can lose its timers between two disposals,␊
+     * and in the deferred shape every instance shares this module — one healthy␊
+     * instance must not disarm the fallback for the next one.␊
+     */␊
+    function __createWasmRuntimePollPace() {␊
+      return {␊
+        // Timers armed by *this* poll that have actually arrived.␊
+        arrivals: 0,␊
+        // The turn waiting on a timer alone *right now* — undefined whenever no␊
+        // turn is parked — and when that turn's own timer came due.␊
+        settleTurn: undefined,␊
+        turnTimerDueAt: 0,␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * The backup that ends a turn whose timer is never going to arrive.␊
+     *␊
+     * Once the poll paces on the timer alone it has nothing left to fall back on␊
+     * if the host's timers stop mid-poll: the turn that armed the dead timer is␊
+     * the turn that parks, and a parked poll schedules nothing that could notice.␊
+     * So every turn arms one of these before it yields, and each one compares due␊
+     * times instead of measuring how long the parked turn has been waiting.␊
+     *␊
+     * Invariant: a parked turn is ended by the newest backup that was armed while␊
+     * the host's timers still worked, and a backup ends a turn only when that␊
+     * turn's own timer was already due a whole window before the backup itself.␊
+     * Neither half turns on how far apart the arms happen to fall — what bounds␊
+     * the rescue is how far back that newest live backup is:␊
+     *␊
+     * - *Ends it.* Hosts run timers in due order, so a backup that runs while a␊
+     *   turn due a whole window earlier is still parked proves that turn's timer␊
+     *   was dropped rather than merely late. That same comparison is what leaves a␊
+     *   healthy host alone: there the turn's timer has already run and cleared␊
+     *   \`settleTurn\` before any backup due after it can look.␊
+     * - *Two turns back, not one.* A turn that ended does not prove its own timer␊
+     *   arrived: until \`…_TRUSTED_ARRIVALS\` is reached every turn arms both␊
+     *   primitives and the macrotask wins, so such a turn can end with its own␊
+     *   timer — and the backup armed one line before it — already dead. The␊
+     *   arrival that then flips the poll onto the timer alone can itself be a␊
+     *   timer armed before the host's timers died. So the turn that parks can sit␊
+     *   two turns past the last live arm, and the newest live backup is due␊
+     *   \`…_BACKUP_MS\` less *two* turn lengths after that turn's own timer.␊
+     *   Arming on every turn is what holds it to two, rather than however far back␊
+     *   a throttle last let one through.␊
+     * - *Ceiling.* Coverage therefore holds while two consecutive poll turns fit␊
+     *   inside \`…_BACKUP_MS\` less the slack and one interval: 149 ms, so 74 ms␊
+     *   per turn (measured: a 74 ms turn is still rescued, a 75 ms one parks).␊
+     *   Past that the turn stays parked and the disposal promise never settles.␊
+     *   The bound is deliberate: reaching it takes a host that drops timers␊
+     *   mid-poll *and* keeps every poll turn busy for more than 74 ms, and neither␊
+     *   Node nor WebContainer — the hosts that run the threaded artifact — does␊
+     *   the second.␊
+     *␊
+     * The poll then goes back to arming both primitives until two fresh arrivals␊
+     * prove the timers again. A host that stops running the timers it has␊
+     * *already* accepted leaves nothing to fire, and the disposal promise stays␊
+     * pending rather than wedging the thread — the same outcome as a blocking␊
+     * closure that never returns. Unreferenced wherever the host allows it: the␊
+     * poll's own turn timers are what keep the loop alive, never these.␊
+     */␊
+    function __armWasmRuntimePollStallBackup(__pace) {␊
+      const __setTimer = globalThis.setTimeout␊
+      if (typeof __setTimer !== 'function') {␊
+        // Nothing to back up: \`__scheduleTimer\` is on the macrotask channel␊
+        // already, and that one cannot park.␊
+        return␊
+      }␊
+      // Read before arming, so this never claims to be due earlier than the timer␊
+      // actually is: a backup ends a turn only when it is provably due after it.␊
+      const __dueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_BACKUP_MS␊
+      let __handle␊
+      try {␊
+        __handle = __setTimer(() => {␊
+          const __settleTurn = __pace.settleTurn␊
+          if (␊
+            !__settleTurn ||␊
+            __pace.turnTimerDueAt > __dueAt - __WASM_RUNTIME_WORK_POLL_STALL_MS␊
+          ) {␊
+            // No turn is parked, or the parked one's timer came due too close to␊
+            // this backup to call it dropped — it may still arrive, and the turn␊
+            // that armed it armed a backup due a whole window after *that*.␊
+            return␊
+          }␊
+          __pace.arrivals = 0␊
+          __pace.settleTurn = undefined␊
+          __settleTurn()␊
+        }, __WASM_RUNTIME_WORK_POLL_BACKUP_MS)␊
+      } catch {␊
+        return␊
+      }␊
+      if (__handle && typeof __handle.unref === 'function') {␊
+        try {␊
+          __handle.unref()␊
+        } catch {}␊
+      }␊
+    }␊
+    ␊
+    /**␊
+     * One turn of the runtime-work poll.␊
+     *␊
+     * \`__scheduleTimer\` falls back to the macrotask scheduler when \`setTimeout\` is␊
+     * missing or throws, but not when it is present, returns a handle and never␊
+     * fires — fake timers in a test suite that disposes from an \`afterEach\`, or a␊
+     * host whose timers belong to an IO context that is already gone. That host␊
+     * would park this poll forever, and the poll is unbounded, so nothing would␊
+     * ever call \`…_finish\`.␊
+     *␊
+     * Arm both primitives until timers armed by this poll have arrived twice, and␊
+     * let whichever lands first end the turn; the loser resolves nothing. A host␊
+     * with working timers therefore pays the double arming for the first turn or␊
+     * two — the macrotask wins the race, but the timers behind it still arrive and␊
+     * are counted — and paces on the timer alone from then on, instead of spinning␊
+     * the loop on a zero-delay queue. A host whose timers never arrive keeps both,␊
+     * and the macrotask is what keeps the poll moving. A host whose timers stop␊
+     * after proving themselves is caught by \`__armWasmRuntimePollStallBackup\`,␊
+     * which ends the parked turn and puts this poll back on both.␊
+     */␊
+    function __yieldWasmRuntimePollTurn(__pace) {␊
+      // Armed before the turn yields, and by every turn: what rescues a parked␊
+      // turn has to have been armed while the host's timers still worked, and the␊
+      // turn that parks is the one whose own timer is already dead.␊
+      __armWasmRuntimePollStallBackup(__pace)␊
+      return new Promise((resolve) => {␊
+        let __settled = false␊
+        const __settle = () => {␊
+          if (__settled) {␊
+            return␊
+          }␊
+          __settled = true␊
+          if (__pace.settleTurn === __settle) {␊
+            // Nothing is parked any more: a backup running later must not read a␊
+            // due time this turn has already answered.␊
+            __pace.settleTurn = undefined␊
+          }␊
+          resolve()␊
+        }␊
+        __scheduleTimer(() => {␊
+          __pace.arrivals++␊
+          __settle()␊
+        }, __WASM_RUNTIME_WORK_POLL_INTERVAL_MS)␊
+        // Read next to the arming it describes; see␊
+        // \`__armWasmRuntimePollStallBackup\` for what the two due times mean.␊
+        const __turnTimerDueAt = Date.now() + __WASM_RUNTIME_WORK_POLL_INTERVAL_MS␊
+        if (__pace.arrivals < __WASM_RUNTIME_WORK_POLL_TRUSTED_ARRIVALS) {␊
+          __scheduleMacrotask(__settle)␊
+          return␊
+        }␊
+        // Paced by the timer alone from here; the backup is what ends this turn if␊
+        // the timer never arrives.␊
+        __pace.settleTurn = __settle␊
+        __pace.turnTimerDueAt = __turnTimerDueAt␊
+      })␊
+    }␊
+    ␊
+    /**␊
+     * Yield event-loop turns until the addon reports its runtime work finished.␊
+     *␊
+     * The window between \`napi_prepare_wasm_env_cleanup_begin\` and␊
+     * \`…_finish\` — the turns are the entire point of splitting the barrier, because␊
+     * on a threaded artifact the work \`…_finish\` joins can itself be waiting for a␊
+     * JavaScript turn from this very thread.␊
+     *␊
+     * Unbounded, for the same reason the async-work wait above is: giving up means␊
+     * calling \`…_finish\`, which joins on this thread, and the work it would join is␊
+     * the work waiting for a turn from this thread — so a bound does not end the␊
+     * wait, it only moves it somewhere the JavaScript thread can no longer be␊
+     * reached. A blocking closure that never returns keeps the disposal promise␊
+     * pending instead. The host contract is in \`crates/async-runtime/README.md\`: a␊
+     * blocking closure must never wait on a JavaScript turn.␊
+     */␊
+    async function __pollWasmRuntimeWork(__workPending) {␊
+      const __pace = __createWasmRuntimePollPace()␊
+      for (;;) {␊
+        await __yieldWasmRuntimePollTurn(__pace)␊
+        try {␊
+          if (!__workPending()) {␊
+            return␊
+          }␊
+        } catch {␊
+          // A trap is the only way this fails, and a trapped instance has no␊
+          // reachable work left. Stop polling and finish.␊
+          return␊
+        }␊
+      }␊
+    }␊
+    ␊
     // How often to re-read \`napi_wasm_async_work_pending\` while waiting. The wait␊
     // ends when the addon reports zero, so this only decides how promptly disposal␊
     // notices — not how long it waits.␊
@@ -6454,7 +8760,9 @@ Generated by [AVA](https://avajs.dev).
             // hooks unrun. Refuse instead: nothing is flagged, the context stays␊
             // registered for managed beforeExit cleanup, and a later destroy still␊
             // works. dispose() coalesces reentrancy before it can get here, so this␊
-            // is the backstop for any other caller that manages to.␊
+            // is the backstop for any other caller that manages to. A handshake␊
+            // parked between the two halves of the barrier does not reach here —␊
+            // \`__prepareEnvCleanup\` closes one rather than skipping it.␊
             throw __createLifecycleReentryError('dispose')␊
           }␊
           __disposeHosts?.()␊
@@ -6605,11 +8913,82 @@ Generated by [AVA](https://avajs.dev).
       let __wasmEnvCleanupRan = false␊
       let __wasmEnvCleanupPrepared = false␊
       let __wasmEnvCleanupPreparing = false␊
+      // The closer for a barrier parked between \`…_begin\` and \`…_finish\`, set only␊
+      // while that window is open. \`__wasmEnvCleanupPreparing\` cannot tell that␊
+      // apart from a purely synchronous frame, which must not be re-entered and␊
+      // which nothing outside it can finish; this window spans real event-loop␊
+      // turns, so a caller that cannot yield — the managed beforeExit teardown —␊
+      // can land inside it, and can close it. See \`__prepareEnvCleanup\`.␊
+      let __finishParkedEnvCleanup␊
+      // Raised while a caller that can still yield is driving the barrier, so the␊
+      // queue it leaves behind is expected rather than lost.␊
+      let __wasmEnvCleanupYielding = false␊
+      let __wasmEnvSettlementLossReported = false␊
       let __wasmEnvCleanupDrained = false␊
       let __wasmEnvCleanupDrainPromise␊
       const __isPreparingEnvCleanup = () => __wasmEnvCleanupPreparing␊
+      /**␊
+       * Say so when the barrier leaves settlements queued and nothing is left that␊
+       * could deliver them.␊
+       *␊
+       * Only \`dispose()\` and the initialization rollback yield the event-loop turns␊
+       * @emnapi/core needs to dispatch its queue. Every other caller of the barrier␊
+       * destroys in the same turn — a raw \`Context.destroy()\`, the managed␊
+       * beforeExit teardown — and \`Context.destroy()\` runs the threadsafe␊
+       * function's cleanup hook, which drains that queue with a null env and␊
+       * discards it. The promises those settlements were for then hang forever,␊
+       * silently.␊
+       *␊
+       * Loud, once, and never throwing: this runs from inside \`Context.destroy()\`,␊
+       * where throwing would take the whole teardown down with it. Destroying␊
+       * anyway is still the right trade — the queue is already unreachable by then.␊
+       */␊
+      const __reportUnreachedSettlements = () => {␊
+        if (__wasmEnvCleanupYielding || __wasmEnvSettlementLossReported) {␊
+          return␊
+        }␊
+        const __pending = __napiInstance?.exports.napi_wasm_env_cleanup_pending␊
+        if (typeof __pending !== 'function') {␊
+          return␊
+        }␊
+        let __queued␊
+        try {␊
+          __queued = __pending()␊
+        } catch {␊
+          return␊
+        }␊
+        if (!__queued) {␊
+          return␊
+        }␊
+        __wasmEnvSettlementLossReported = true␊
+        try {␊
+          const __consoleHost = globalThis.console␊
+          if (__consoleHost && typeof __consoleHost.error === 'function') {␊
+            __consoleHost.error(␊
+              'napi-rs: the wasm environment is being destroyed with ' +␊
+                __queued +␊
+                ' queued promise settlement(s). Context.destroy() discards them, so those promises never settle. Dispose the instance instead: only dispose() yields the event-loop turns the settlements need.',␊
+            )␊
+          }␊
+        } catch {}␊
+      }␊
       const __prepareEnvCleanup = () => {␊
-        if (__wasmEnvCleanupPrepared || __wasmEnvCleanupPreparing) {␊
+        if (__wasmEnvCleanupPrepared) {␊
+          return␊
+        }␊
+        // A handshake parked between its two halves is one this frame can close,␊
+        // and must: every caller of this is about to destroy the context, and the␊
+        // turns the poll is waiting for will not come. Closing it runs \`…_finish\`,␊
+        // which is the call that joins, so this degrades to exactly the single␊
+        // call below. Leaving it open destroys the context with the barrier still␊
+        // raised and the runtime never joined.␊
+        const __finishParked = __finishParkedEnvCleanup␊
+        if (__finishParked !== undefined) {␊
+          __finishParked()␊
+          __reportUnreachedSettlements()␊
+          return␊
+        }␊
+        if (__wasmEnvCleanupPreparing) {␊
           return␊
         }␊
         const __prepareWasmEnvCleanup =␊
@@ -6625,9 +9004,86 @@ Generated by [AVA](https://avajs.dev).
             __wasmEnvCleanupPreparing = false␊
           }␊
           __wasmEnvCleanupRan = true␊
+          __reportUnreachedSettlements()␊
         }␊
         __wasmEnvCleanupPrepared = true␊
       }␊
+      /**␊
+       * The barrier for the callers that can yield: \`__prepareEnvCleanup\` with real␊
+       * event-loop turns in the middle.␊
+       *␊
+       * \`napi_prepare_wasm_env_cleanup\` waits — it returns only once the addon's␊
+       * async runtime has quiesced, and the work it waits for can itself be waiting␊
+       * for a JavaScript turn from this thread. The addon's two-phase form splits␊
+       * that: \`…_begin\` stops the runtime without joining and reports whether␊
+       * anything is still live, \`napi_wasm_runtime_work_pending\` answers that again␊
+       * without blocking, and \`…_finish\` joins.␊
+       *␊
+       * The poll is unbounded — see \`__pollWasmRuntimeWork\` — but a caller that␊
+       * cannot yield closes the handshake itself rather than waiting for it, so␊
+       * \`…_finish\` still runs on every teardown path. Feature-detected like every␊
+       * other export here, and returns nothing whenever the handshake finished␊
+       * without yielding.␊
+       */␊
+      const __prepareEnvCleanupWithTurns = () => {␊
+        if (__wasmEnvCleanupPrepared || __wasmEnvCleanupPreparing) {␊
+          return␊
+        }␊
+        const __exports = __napiInstance?.exports␊
+        const __begin = __exports?.napi_prepare_wasm_env_cleanup_begin␊
+        const __finish = __exports?.napi_prepare_wasm_env_cleanup_finish␊
+        if (typeof __begin !== 'function' || typeof __finish !== 'function') {␊
+          // No split to use. The settlement drain still follows this, so the queue␊
+          // the single call leaves behind is expected rather than lost.␊
+          __wasmEnvCleanupYielding = true␊
+          try {␊
+            __prepareEnvCleanup()␊
+          } finally {␊
+            __wasmEnvCleanupYielding = false␊
+          }␊
+          return␊
+        }␊
+        const __workPending = __exports?.napi_wasm_runtime_work_pending␊
+        // The in-flight flag stays raised across the turns below, so a \`destroy()\`␊
+        // from one of the JavaScript handlers they run is the same no-op it is␊
+        // inside the single call: the barrier is up and the runtime is␊
+        // mid-teardown, and destroying between the halves would strand exactly what␊
+        // this delivers.␊
+        __wasmEnvCleanupPreparing = true␊
+        let __live␊
+        try {␊
+          __live = __begin()␊
+        } catch (__error) {␊
+          __wasmEnvCleanupPreparing = false␊
+          throw __error␊
+        }␊
+        __wasmEnvCleanupRan = true␊
+        const __finishEnvCleanup = () => {␊
+          if (__wasmEnvCleanupPrepared) {␊
+            // Already closed by a caller that could not yield. \`…_finish\` is␊
+            // idempotent, but the flags it lowers are not.␊
+            return␊
+          }␊
+          __finishParkedEnvCleanup = undefined␊
+          try {␊
+            __finish()␊
+          } finally {␊
+            __wasmEnvCleanupPreparing = false␊
+          }␊
+          __wasmEnvCleanupPrepared = true␊
+        }␊
+        if (!__live || typeof __workPending !== 'function') {␊
+          __finishEnvCleanup()␊
+          return␊
+        }␊
+        // Publish the closer before yielding: from here until \`__finishEnvCleanup\`␊
+        // runs, a caller that cannot yield is entitled to end this handshake.␊
+        __finishParkedEnvCleanup = __finishEnvCleanup␊
+        return __pollWasmRuntimeWork(__workPending).then(␊
+          __finishEnvCleanup,␊
+          __finishEnvCleanup,␊
+        )␊
+      }␊
       // The barrier + settlement drain, hoisted out of the context destroyer so the␊
       // drain can yield without widening the destroyer's reentry window. Both␊
       // yielding paths run it — dispose() and the initialization-failure rollback.␊
@@ -6640,6 +9096,20 @@ Generated by [AVA](https://avajs.dev).
       // is enough — and dispose() stays retryable after it rejects, so marking the␊
       // drain complete up front would make the retry skip it and destroy the context␊
       // with the barrier's settlements still queued.␊
+      const __drainAfterEnvCleanup = () => {␊
+        if (!__wasmEnvCleanupRan) {␊
+          return␊
+        }␊
+        const __drained = __drainWasmEnvCleanup(__napiInstance)␊
+        if (!__drained || typeof __drained.then !== 'function') {␊
+          __wasmEnvCleanupDrained = true␊
+          return␊
+        }␊
+        return __drained.then((__value) => {␊
+          __wasmEnvCleanupDrained = true␊
+          return __value␊
+        })␊
+      }␊
       const __prepareForDisposal = () => {␊
         if (__wasmEnvCleanupDrained) {␊
           return␊
@@ -6647,18 +9117,19 @@ Generated by [AVA](https://avajs.dev).
         if (__wasmEnvCleanupDrainPromise) {␊
           return __wasmEnvCleanupDrainPromise␊
         }␊
-        __prepareEnvCleanup()␊
-        if (!__wasmEnvCleanupRan) {␊
-          return␊
-        }␊
-        const __drained = __drainWasmEnvCleanup(__napiInstance)␊
-        if (!__drained || typeof __drained.then !== 'function') {␊
-          __wasmEnvCleanupDrained = true␊
+        // The barrier itself can yield now, so the memo below has to cover it too:␊
+        // a reentrant caller must join this handshake rather than start a second␊
+        // one while the first is parked between the two halves.␊
+        const __prepared = __prepareEnvCleanupWithTurns()␊
+        const __settled =␊
+          __prepared && typeof __prepared.then === 'function'␊
+            ? __prepared.then(__drainAfterEnvCleanup)␊
+            : __drainAfterEnvCleanup()␊
+        if (!__settled || typeof __settled.then !== 'function') {␊
           return␊
         }␊
-        const __tracked = __drained.then(␊
+        const __tracked = __settled.then(␊
           (__value) => {␊
-            __wasmEnvCleanupDrained = true␊
             __wasmEnvCleanupDrainPromise = undefined␊
             return __value␊
           },␊
@@ -7265,7 +9736,31 @@ Generated by [AVA](https://avajs.dev).
       },␊
     })␊
     ␊
+    // When this wasm thread dies, raise the addon's crash flag before emnapi reports␊
+    // it. The loader thread may be inside wasm, in a cleanup call that waits on this␊
+    // thread; the flag is what those waits check between short slices, and once it␊
+    // is up they trap instead of waiting for good. It is a word in the shared wasm␊
+    // memory, and the loader posts a view of it (see␊
+    // napi_wasm_thread_crash_flag_address) after it instantiated the wasm, or right␊
+    // after it created this worker. No view, no flag: an addon built with an older␊
+    // napi, or a failure before the view arrived.␊
+    let __addonCrashFlag␊
+    const __beforeReportError = handler.beforeReportError␊
+    handler.beforeReportError = function (...args) {␊
+      if (__addonCrashFlag !== undefined) {␊
+        try {␊
+          Atomics.store(__addonCrashFlag, 0, 1)␊
+        } catch {}␊
+      }␊
+      return __beforeReportError.apply(this, args)␊
+    }␊
+    ␊
     globalThis.onmessage = function (e) {␊
+      const data = e && e.data␊
+      if (data && data.__napiRsAddonCrashFlag instanceof Int32Array) {␊
+        __addonCrashFlag = data.__napiRsAddonCrashFlag␊
+        return␊
+      }␊
       handler.handle(e)␊
     }␊
     `
@@ -7321,7 +9816,31 @@ Generated by [AVA](https://avajs.dev).
       }␊
     })␊
     ␊
+    // When this wasm thread dies, raise the addon's crash flag before emnapi reports␊
+    // it. The loader thread may be inside wasm, in a cleanup call that waits on this␊
+    // thread; the flag is what those waits check between short slices, and once it␊
+    // is up they trap instead of waiting for good. It is a word in the shared wasm␊
+    // memory, and the loader posts a view of it (see␊
+    // napi_wasm_thread_crash_flag_address) after it instantiated the wasm, or right␊
+    // after it created this worker. No view, no flag: an addon built with an older␊
+    // napi, or a failure before the view arrived.␊
+    let __addonCrashFlag␊
+    const __beforeReportError = handler.beforeReportError␊
+    handler.beforeReportError = function (...args) {␊
+      if (__addonCrashFlag !== undefined) {␊
+        try {␊
+          Atomics.store(__addonCrashFlag, 0, 1)␊
+        } catch {}␊
+      }␊
+      return __beforeReportError.apply(this, args)␊
+    }␊
+    ␊
     globalThis.onmessage = function (e) {␊
+      const data = e && e.data␊
+      if (data && data.__napiRsAddonCrashFlag instanceof Int32Array) {␊
+        __addonCrashFlag = data.__napiRsAddonCrashFlag␊
+        return␊
+      }␊
       handler.handle(e)␊
     }␊
     `
@@ -7385,7 +9904,31 @@ Generated by [AVA](https://avajs.dev).
       }␊
     })␊
     ␊
+    // When this wasm thread dies, raise the addon's crash flag before emnapi reports␊
+    // it. The loader thread may be inside wasm, in a cleanup call that waits on this␊
+    // thread; the flag is what those waits check between short slices, and once it␊
+    // is up they trap instead of waiting for good. It is a word in the shared wasm␊
+    // memory, and the loader posts a view of it (see␊
+    // napi_wasm_thread_crash_flag_address) after it instantiated the wasm, or right␊
+    // after it created this worker. No view, no flag: an addon built with an older␊
+    // napi, or a failure before the view arrived.␊
+    let __addonCrashFlag␊
+    const __beforeReportError = handler.beforeReportError␊
+    handler.beforeReportError = function (...args) {␊
+      if (__addonCrashFlag !== undefined) {␊
+        try {␊
+          Atomics.store(__addonCrashFlag, 0, 1)␊
+        } catch {}␊
+      }␊
+      return __beforeReportError.apply(this, args)␊
+    }␊
+    ␊
     globalThis.onmessage = function (e) {␊
+      const data = e && e.data␊
+      if (data && data.__napiRsAddonCrashFlag instanceof Int32Array) {␊
+        __addonCrashFlag = data.__napiRsAddonCrashFlag␊
+        return␊
+      }␊
       handler.handle(e)␊
     }␊
     `