Runtime: add a deterministic mixed-resource scheduler pressure gate

Parent: #502 Builds on: #1027, #1028, #1032, #1033, #1034, #1035, #1036

Verified coverage gap

The complete 2,580-test plan passes on main at 1424aa2a29953a5f68fce2b64af1c6f475b2477f, and production-path tests now cover GC markers, native/Wasm compilation, Workers, shared-realm Threads, Atomics waits, module Workers, watchdog termination, test262 agents, OOM, and teardown individually.

The coordinator test inventory has no one deterministic state that overlaps all six typed resource classes with both internal-work classes and all three scratch domains. That leaves cross-domain queue priority, typed-slot/nested-work reuse, scratch denial, cancellation, blocking handoff, and final reconciliation dependent on separate tests rather than one fail-closed pressure witness.

Scope

• Add one bounded deterministic coordinator-level pressure test covering all six typed thread kinds.
• Overlap native and Wasm internal work from typed and untyped host threads.
• Hold admitted bytes in all three scratch domains, force an exact total-budget denial, then prove released capacity is immediately reusable.
• Exercise safety/foreground/background queues, pre-entry cancellation, a blocked-slot handoff, and ordinary completion in one run.
• Assert every current live/runnable/blocked/waiter/internal-work/scratch counter returns exactly to its baseline at teardown; monotonic event counters must advance by the expected amounts.
• Keep the test independent of wall-clock performance and real corpus availability; production-path semantic tests remain the subsystem oracles.

Definition of done

• The mixed test reaches a snapshot with all scheduler priorities represented, both internal-work classes active or queued, and every scratch domain live.
• Policy denial and later readmission preserve exact scratch ownership and rollback accounting.
• Cancellation and blocked-slot handoff preserve weighted priority/FIFO decisions without running canceled bodies.
• Final teardown reconciles all current counters exactly to baseline with no live thread, queue, work, or scratch ownership.
• Normal and unsuppressed TSan focused tests plus the full unit gate pass.
• #502 is updated with the landed commit and evidence.

Guardrails

No sleeps as synchronization, relaxed accounting assertions, synthetic bypass of the public coordinator APIs, unbounded wait, or benchmark timing claim.

Landed on main in be7ddc6.

The deterministic coordinator gate simultaneously:

• occupies the two runnable slots with concurrent-GC and shared-realm Thread classes;
• keeps native and Wasm internal work active through typed-slot reuse;
• holds all three scratch domains at the exact shared limit and proves policy denial plus later full readmission;
• queues the watchdog, test262 agent, script Worker, module Worker, and an untyped host compiler across all priorities;
• cancels one foreground and one background start without running their bodies;
• drives a real marker blocking transition, safety grant, host-work/Worker FIFO handoff, and ordinary completion;
• reconciles every current live/runnable/blocked/stack/waiter/work/scratch counter exactly to baseline.

Validation:

• focused normal: 10/10 fresh runs pass
• focused unsuppressed TSan: 10/10 fresh runs pass
• full unit suite: 2,580 passed; 1 skipped; 0 failed; 0 leaked
• zig build -j1: pass
• runtime-thread audit: 6 production sites, 156 reviewed test-only spawns
• docs link check: 378 files pass
• test262 flips: 0; this is test/documentation-only

Hosted Linux CI exposed a scheduling-sensitive oracle in the landed gate. Unit shard 0 reached the exact pressured state, but watchdog_runs remained 0 at the first handoff. The 4:2:1 cursor is process-wide, so the free slot may legally grant the older background host-work ticket before the safety ticket when the cursor enters this test at its background phase. Local focused runs happened to enter at a safety phase.

I am correcting the gate to accept and drive both legal first grants, while still requiring the older host-work ticket before the queued Worker, eventual watchdog service, cancellation correctness, and exact final reconciliation. This keeps the weighted scheduler contract under test without resetting hidden process state or weakening the production policy.

The hosted scheduling-sensitive oracle is fixed on main in 8297fbb.

The mixed-pressure gate now accepts the two legal first grants from the process-wide 4:2:1 cursor: immediate safety service, or the older background host-work ticket. When host work wins first, the test releases it and requires the next grant to service the continuously queued watchdog. In both paths it still proves host-work-before-Worker FIFO, cancellation, blocking handoff, scratch denial/readmission, and exact final reconciliation.

Validation:

• all 16 standalone runtime_threads.zig tests pass
• focused unsuppressed TSan test passes
• full sharded unit suite: 2,581 passed; 1 skipped; 0 failed; 0 leaked
• pinned BunPress manifest check passes
• docs link check: 378 files pass
• test262 flips: 0; this changes test and documentation only