@@ -779,13 +779,22 @@ graph walk, and — doubled, at 120 seconds — the boot backstop, so the waits
 stay ordered: transport timeouts < module deadline < boot backstop. The local
 entry's short yield is deliberately *not* derived from that constant: it is an
 independent one-second literal in `BootEntryEvaluationOptions`, with
-`return-pending` behavior and no looper slicing. An HTTP entry instead gets the
-full deadline, throws on expiry, and does slice the looper, because the tooling
-driving it needs the rejection reason synchronously. The backstop itself is
-`HoldBootBackstop` in
-`Runtime.cpp`, called from both `Runtime::RunModule` overloads; it pumps
-nestable V8 tasks, microtask checkpoints and `ALooper_pollOnce` until the entry
-and all async graph work settle.
+`return-pending` behavior. An HTTP entry instead gets the full deadline and
+throws on expiry, because the tooling driving it needs the rejection reason
+synchronously. The backstop itself is `HoldBootBackstop` in `Runtime.cpp`,
+called from both `Runtime::RunModule` overloads; it pumps the isolate's event
+loop in place (`EventLoop::PumpUntil`) until the entry and all async graph
+work settle.
+
+Every pump on Android — a pumping require, the graph walk, the boot backstop —
+runs the same `EventLoop::PumpUntil` slice: nestable V8 tasks, a microtask
+checkpoint, and the loop's own **ordered lane drained directly** (JS timers
+ride Java `Handler` messages, which cannot dispatch while the pump's JS frames
+hold the thread — the drain is what lets an entry or a pumped graph parked on
+`setTimeout` settle in-pump). The pump never re-enters the platform looper, so
+on Android `pumpRunLoop` is validated and carried but adds nothing beyond that
+baseline; the option's cross-platform meaning and its warnings above are
+unchanged.
 
 Workers copy the loader vocabulary from the parent at spawn
 (`CaptureLoaderVocabulary` on the parent's thread, `InstallLoaderVocabulary`
 
@@ -8,6 +8,7 @@
 
 #include <algorithm>
 #include <cerrno>
+#include <chrono>
 #include <cmath>
 #include <cstring>
 #include <ctime>
@@ -133,9 +134,10 @@ void EventLoop::BindToCurrentThread() {
 
     // flush work buffered before the home thread was known
     auto now = now_ms();
-    for (size_t i = 0; i < internal_.immediate.size(); i++) {
+    for (auto& entry : internal_.immediate) {
         uint64_t value = 1;
         write(eventFd_, &value, sizeof(value));
+        entry.unitIssued = true;
     }
     ArmTimerLocked(now);
     for (auto& entry : ordered_.immediate) {
@@ -204,6 +206,7 @@ void EventLoop::PostInternalLocked(Entry entry, double delayMs) {
     auto now = now_ms();
     if (delayMs <= 0) {
         entry.time = now;
+        entry.unitIssued = eventFd_ != -1;
         internal_.immediate.push_back(std::move(entry));
         if (eventFd_ != -1) {
             uint64_t value = 1;
@@ -451,6 +454,28 @@ double EventLoop::PeekDueLocked(Lane& lane, double now) {
     return due;
 }
 
+double EventLoop::PeekDueFilteredLocked(Lane& lane, bool nestableOnly, bool v8Only, double now) {
+    auto matches = [&](const Entry& e) {
+        return (!nestableOnly || e.nestable) && (!v8Only || e.task != nullptr);
+    };
+    double due = -1;
+    for (const auto& e : lane.immediate) {
+        if (matches(e)) {
+            due = e.time;
+            break;
+        }
+    }
+    for (const auto& pair : lane.delayed) {
+        if (pair.first > now) {
+            break;
+        }
+        if (matches(pair.second) && (due < 0 || pair.first < due)) {
+            due = pair.first;
+        }
+    }
+    return due;
+}
+
 void EventLoop::ArmTimerLocked(double now) {
     if (timerFd_ == -1) {
         return;
@@ -503,11 +528,15 @@ void EventLoop::RunOneInternal() {
             return;
         }
         entry = TakeDueLocked(internal_, false, false, true, now_ms());
-    }
-    if (entry == nullptr) {
-        // leftover unit: the work it represented ran early from a nested loop
-        // drain
-        return;
+        if (entry == nullptr) {
+            // leftover unit: the work it represented ran early from a direct
+            // drain - this dispatch just consumed it, so it is no longer
+            // WaitForInternalWork's to swallow
+            if (leftoverUnits_ > 0) {
+                leftoverUnits_--;
+            }
+            return;
+        }
     }
     RunEntry(*entry);
 }
@@ -527,49 +556,121 @@ void EventLoop::RunNestableV8Tasks() {
             if (stopped_) {
                 return;
             }
+            const size_t delayedBefore = internal_.delayed.size();
             entry = TakeDueLocked(internal_, true, true, false, now_ms());
-        }
-        if (entry == nullptr) {
-            return;
+            if (entry == nullptr) {
+                return;
+            }
+            if (entry->unitIssued) {
+                leftoverUnits_++;
+            }
+            if (internal_.delayed.size() != delayedBefore) {
+                // a drained delayed entry may leave the timerfd armed (or
+                // expired unread) for it; rearming to the queue's new
+                // earliest also discards the stale expiration
+                ArmTimerLocked(now_ms());
+            }
         }
         // the pause loops call this from inside v8 inspector frames - a C++
         // exception must not unwind through them
         RunGuarded([&] { RunEntry(*entry); });
     }
 }
 
-void EventLoop::RunOrderedTask() {
-    // one anonymous token = one due slot across the whole ordered domain:
-    // pick the earliest due item among the ordered entries and the timer
-    // source, whichever it is. Timers and entries only ever run on this
-    // thread, so the peeked winner can't be taken by anyone else before we
-    // re-lock (a concurrent post can only add later work).
+bool EventLoop::RunOneOrderedDue() {
+    // one due slot across the whole ordered domain: pick the earliest due
+    // item among the ordered entries and the timer source, whichever it is.
+    // Timers and entries only ever run on this thread, so the peeked winner
+    // can't be taken by anyone else before we re-lock (a concurrent post can
+    // only add later work).
     auto now = now_ms();
     double entryDue;
     {
         std::lock_guard<std::mutex> lock(mutex_);
         if (stopped_) {
-            return;
+            return false;
         }
         entryDue = PeekDueLocked(ordered_, now);
     }
     if (timerSource_ != nullptr && timerSource_->RunIfEarliest(now, entryDue)) {
-        return;
+        return true;
     }
     if (entryDue < 0) {
-        // leftover token: nothing in the domain is due yet
-        return;
+        // leftover token, or an idle drain: nothing in the domain is due yet
+        return false;
     }
     std::unique_ptr<Entry> entry;
     {
         std::lock_guard<std::mutex> lock(mutex_);
         if (stopped_) {
-            return;
+            return false;
         }
         entry = TakeDueLocked(ordered_, false, false, false, now_ms());
     }
-    if (entry != nullptr) {
-        RunEntry(*entry);
+    if (entry == nullptr) {
+        return false;
+    }
+    RunEntry(*entry);
+    return true;
+}
+
+void EventLoop::RunOrderedTask() {
+    // one anonymous token = one due slot; a token whose item a pump drained
+    // early finds nothing due and dies here
+    RunOneOrderedDue();
+}
+
+int EventLoop::RunDueOrderedEntries() {
+    // Bounded slice: a callback that keeps minting due-now work (a
+    // setTimeout(0) chain) must not pin the calling pump past its own
+    // deadline checks, so the drain yields after a few milliseconds and the
+    // pump comes back for the rest on its next iteration.
+    constexpr double kSliceMs = 8.0;
+    const double start = now_ms();
+    int ran = 0;
+    while (RunOneOrderedDue()) {
+        ran++;
+        if (now_ms() - start >= kSliceMs) {
+            break;
+        }
+    }
+    return ran;
+}
+
+EventLoop::PumpResult EventLoop::PumpUntil(double deadlineSeconds,
+                                           const std::function<bool()>& settled) {
+    const auto deadline = std::chrono::steady_clock::now() +
+                          std::chrono::duration<double>(deadlineSeconds);
+    for (;;) {
+        if (settled()) {
+            return PumpResult::kSettled;
+        }
+        if (isolate_ != nullptr && isolate_->IsExecutionTerminating()) {
+            return PumpResult::kTerminated;
+        }
+        if (IsStopped()) {
+            // a stopped loop drops every post, so nothing can settle anymore
+            return PumpResult::kTerminated;
+        }
+        if (std::chrono::steady_clock::now() >= deadline) {
+            return PumpResult::kDeadline;
+        }
+        RunNestableV8Tasks();
+        {
+            // work may enqueue microtasks without entering JS; scopes are
+            // re-entrant, so callers already holding them pay nothing
+            v8::Locker locker(isolate_);
+            v8::Isolate::Scope isolateScope(isolate_);
+            v8::HandleScope handleScope(isolate_);
+            isolate_->PerformMicrotaskCheckpoint();
+        }
+        const int ranOrdered = RunDueOrderedEntries();
+        if (settled()) {
+            return PumpResult::kSettled;
+        }
+        if (ranOrdered == 0) {
+            WaitForInternalWork(10);
+        }
     }
 }
 
@@ -589,12 +690,44 @@ bool EventLoop::IsInLooperCallback() { return t_looperCallbackDepth > 0; }
 void EventLoop::WaitForInternalWork(int timeoutMs) {
     struct pollfd fds[2];
     nfds_t count = 0;
+    bool sleepOnly = false;
     {
         std::lock_guard<std::mutex> lock(mutex_);
-        if (eventFd_ != -1) fds[count++] = {eventFd_, POLLIN, 0};
-        if (timerFd_ != -1) fds[count++] = {timerFd_, POLLIN, 0};
+        if (stopped_) {
+            sleepOnly = true;
+        } else {
+            const double now = now_ms();
+            // Drainable work already due: the caller's drain runs it, waiting
+            // would only add latency. The filter must match RunNestableV8Tasks
+            // (nestable v8 tasks only) — a due entry the pump cannot take must
+            // not turn the wait into a no-op.
+            if (PeekDueFilteredLocked(internal_, /*nestableOnly=*/true, /*v8Only=*/true, now) >=
+                0) {
+                return;
+            }
+            // units whose entries a direct drain already consumed keep the
+            // eventfd readable; swallow them or the poll below returns
+            // immediately on every call
+            while (leftoverUnits_ > 0 && eventFd_ != -1) {
+                uint64_t value;
+                if (read(eventFd_, &value, sizeof(value)) != sizeof(value)) {
+                    break;
+                }
+                leftoverUnits_--;
+            }
+            // A due entry the drain cannot take (non-nestable task, plain fn
+            // post) pins its unread unit in the eventfd, so the fds cannot go
+            // quiet — polling them would spin. Plain sleep is the only honest
+            // wait until the looper resumes and runs it.
+            if (PeekDueLocked(internal_, now) >= 0) {
+                sleepOnly = true;
+            } else {
+                if (eventFd_ != -1) fds[count++] = {eventFd_, POLLIN, 0};
+                if (timerFd_ != -1) fds[count++] = {timerFd_, POLLIN, 0};
+            }
+        }
     }
-    if (count == 0) {
+    if (sleepOnly || count == 0) {
         usleep(static_cast<useconds_t>(timeoutMs) * 1000);
         return;
     }
@@ -635,6 +768,7 @@ int EventLoop::TimerFdCallback(int fd, int events, void* data) {
             }
             if (!pair.second.signaled) {
                 pair.second.signaled = true;
+                pair.second.unitIssued = true;
                 due++;
             }
         }
 
@@ -197,12 +197,41 @@ class EventLoop {
     /**
      * Blocks the calling thread until this loop's internal lane has work (the
      * eventfd or timerfd is readable) or `timeoutMs` elapses, whichever comes
-     * first, without consuming either fd and without entering the looper - so
-     * it is safe where IsInLooperCallback forbids polling. Pumps pair it with
-     * RunNestableV8Tasks, which drains the queue directly.
+     * first, without entering the looper - so it is safe where
+     * IsInLooperCallback forbids polling. Returns immediately when internal
+     * work is already due. Eventfd units left over from entries a direct
+     * drain (RunNestableV8Tasks) consumed are swallowed first, so the wait
+     * only wakes for new work instead of spinning on stale readability.
      */
     void WaitForInternalWork(int timeoutMs);
 
+    /**
+     * Runs every ordered-lane item that is due NOW - Java-token entries and
+     * timer-source items alike, in due order - directly from the calling
+     * (home) thread, without waiting for their Handler messages. The messages
+     * still arrive later and die as leftover tokens: a token whose item was
+     * drained early finds nothing due and no-ops, and its claim cell is
+     * retired by the dispatch gate as usual. Bounded to a short slice so a
+     * callback minting due-now work (a setTimeout(0) chain) cannot pin the
+     * caller past its own deadline checks. Returns the number of items run.
+     */
+    int RunDueOrderedEntries();
+
+    enum class PumpResult { kSettled, kDeadline, kTerminated };
+
+    /**
+     * Drives this loop in place on the home thread until `settled()` returns
+     * true or `deadlineSeconds` elapses: nestable v8 tasks, a microtask
+     * checkpoint, and due ordered-lane work per iteration, idling in
+     * WaitForInternalWork between slices. The one pump primitive behind
+     * module evaluation, the graph walk, and the boot backstop - JS frames
+     * are on the stack throughout, so non-nestable v8 tasks and plain
+     * internal posts stay queued, exactly as in the inspector pause loops.
+     * Returns kTerminated when the isolate is terminating or the loop has
+     * been shut down; `settled` may throw and the exception propagates.
+     */
+    PumpResult PumpUntil(double deadlineSeconds, const std::function<bool()>& settled);
+
     /**
      * Runs at most one due ordered-lane entry, then performs a microtask
      * checkpoint. Invoked by Java EventLoopHandler.handleMessage once per
@@ -228,6 +257,10 @@ class EventLoop {
         // this entry (written when its timerfd deadline fired), so a later
         // timer fire must not issue a second one
         bool signaled = false;
+        // internal entries only: an eventfd unit backs this entry, so a
+        // direct (unit-free) drain that consumes it must count the unit as
+        // leftover for WaitForInternalWork to swallow
+        bool unitIssued = false;
     };
     struct Lane {
         std::deque<Entry> immediate;
@@ -248,9 +281,15 @@ class EventLoop {
                                                 bool requireSignaledDelayed, double now);
     // earliest due entry time in the lane, or a negative value if none is due
     static double PeekDueLocked(Lane& lane, double now);
+    // same, but only over entries matching TakeDueLocked's nestable/v8 filter
+    static double PeekDueFilteredLocked(Lane& lane, bool nestableOnly, bool v8Only, double now);
     void ArmTimerLocked(double now);
     void RunEntry(Entry& entry);
     void RunOneInternal();
+    // one due slot across the ordered domain (entries + timer source); true
+    // when a slot was consumed. The body behind both RunOrderedTask (one call
+    // per Java token) and RunDueOrderedEntries (looped by the pumps).
+    bool RunOneOrderedDue();
 
     static int EventFdCallback(int fd, int events, void* data);
     static int TimerFdCallback(int fd, int events, void* data);
@@ -307,6 +346,10 @@ class EventLoop {
     int eventFd_ = -1;
     int timerFd_ = -1;
     bool stopped_ = false;
+    // units written to eventFd_ whose entries a direct drain already ran;
+    // consumed by WaitForInternalWork (or by an EventFdCallback that finds
+    // nothing due). Guarded by mutex_.
+    uint64_t leftoverUnits_ = 0;
 
     // process-wide JNI cache, written once under the first bind's lock (the
     // main runtime binds before any worker thread exists)