Problem

Nothing pumps the V8 platform's foreground task queues. v8::platform::PumpMessageLoop only ran inside the two debugger pause loops (JsV8InspectorClient/WorkerInspectorClient). In normal execution, every task V8 posts to its foreground runner just sat there:

• Atomics.waitAsync promises never resolved (their wakeup is a foreground task).
• GC finalization / heap tasks never ran.
• Streaming-compilation merge-backs never landed.

Separately, "get work onto the JS thread" had grown four bespoke mechanisms: tns::ExecuteOnRunLoop (CFRunLoopPerformBlock + wakeup), two raw perform-block bypasses in NativeScriptException.mm, Timers.cpp's per-timer CFRunLoopTimers, and ConcurrentQueue's runloop source for inbound worker messages. No shared ordering domain, and no per-entry microtask handling: with MicrotasksPolicy::kAuto, work that resolves a promise without entering JS (exactly the Atomics.waitAsync shape) stalls until unrelated JS runs.

Change: a per-runtime EventLoop with two lanes

Port of the Android runtime's event loop (NativeScript/android#2003), same API and contracts, CFRunLoop-native implementation. Each Runtime owns an EventLoop, bound to its home thread in CreateIsolate, accepting posts from any thread and buffering until bound. Work is routed by ordering contract:

Ordered lane — work whose ordering is observable against app-level runloop work. Every post is an anonymous "task due" token on ONE CFRunLoopTimer armed at the earliest pending due time; a due-now token gets a past fire date and fires on the next runloop pass, one token per fire. This keeps tokens in fire-date order with foreign NSTimers (exactly like the per-timer CFRunLoopTimers this replaces) and guarantees a full runloop pass between consecutive tokens — measured via the runtime's own before-waiting rejection-drain observer, a rejection injected mid-chain drains between steps (step 5 of 50), identical to the NSTimer-chain reference, so self-rescheduling setTimeout(0) chains starve neither rendering commits nor the autorelease pool nor the drain. Each token runs the earliest due item across the ordered entries and the OrderedTaskSource (Timers) — one due-ordered domain. First producer: __ns__queueMacrotask(cb), the seam future spec'd macrotasks (e.g. performance-observer callbacks) will use.

Internal lane — work in its own ordering domain: v8 platform foreground tasks (Atomics.waitAsync wakeups, GC tasks), worker→parent messages, exception/rejection deliveries. Rides a version-0 CFRunLoopSource plus one CFRunLoopTimer for delayed work. The source's perform callback runs exactly one due entry and re-signals itself while more are due, so bursts interleave with other runloop work instead of draining in one go — the CFRunLoop analogue of Android's one-eventfd-unit-per-poll. (Because the drain is queue-state-driven rather than unit-counted, Android's eventfd unit-accounting hazard has no iOS equivalent; the regression test is ported anyway.)

NativeScriptPlatform wraps the default platform (workers/jobs/time/tracing delegate to libplatform) and serves GetForegroundTaskRunner(isolate) from the isolate's EventLoop. The loop starts unbound and buffers (v8 requests the runner during Isolate::New); binding flushes. Each executed non-bare entry runs under Locker + isolate/handle/context scopes and ends with a microtask checkpoint — the kAuto-stall fix. Shutdown drops queued work and late posts.

Lane mapping rationale (vs Android's Java Handler + eventfd): iOS has no single app-level message queue — CFRunLoop services performed blocks and timers in different phases, so the ordered lane cannot be FIFO with both. It rides the timer phase: that is where the pre-existing per-timer CFRunLoopTimers lived, so cross-ordering against app NSTimers is preserved (fire-date order), and a due timer still yields a full runloop pass between fires. (A performed-block carrier was prototyped and rejected: blocks would be FIFO with ExecuteOnRunLoop-style posts, but same-instant ordering against NSTimers would flip phase — timers were never ordered against blocks on main either, so the timer phase is the least-surprise choice.) The internal lane is a version-0 CFRunLoopSource: the natural "own ordering domain" primitive, serviced with no ordering contract against blocks or timers, exactly the lane's contract. Both lanes are real mechanisms, not a collapsed queue, so subsystem code ports between the platforms without rethinking which lane it belongs to.

Timers merged into the ordered lane (with tombstones)

The per-timer CFRunLoopTimers (and the retain/release TimerContext machinery) are gone; timers post anonymous tokens through the EventLoop, and the token drain runs the earliest due item across timers and ordered macrotasks under one Locker acquisition (Timers implements OrderedTaskSource::RunIfEarliest). clearTimeout recalls the timer's token outright when it is still future-due (removing the armed wakeup — the same immediate cancellation CFRunLoopTimerInvalidate gave), and leaves a tombstone when the token has already matured (or was posted due-now), so no token gains surplus capacity to run a later-scheduled item ahead of foreign runloop work queued between the two token positions. The token wakeup timer runs one matured token per fire (re-armed with the past due time, firing again next pass), so foreign timers and blocks due between two matured tokens interleave by due time — the one-token-one-message fairness of the Android MessageQueue design. Interval catch-up semantics (NextTime: realign to startTime + k*frequency, matching the skipped-fire behavior of repeating CFRunLoopTimers) are preserved; intervals re-arm before the callback runs so a throwing callback can't kill them.

Consolidated onto the loop

• Worker.mm worker→parent message delivery and WorkerWrapper's two error-forwarding paths: ExecuteOnRunLoop → internal lane (1:1, including drop-after-shutdown; the sync flavor is preserved via a posted semaphore and Post*'s new bool posted/dropped return).
• ClassBuilder's cross-thread GcProtect/GcUnprotect: raw perform blocks → bare internal-lane entries (the closures do their own Locker ceremony; no per-entry checkpoint added on this hot path).
• NativeScriptException's two deferred @throw sites: bare entries that run with no V8 scopes and outside the loop's exception guard, so the NSException unwinds into the runloop frame exactly as before (the guard deliberately has no catch(...) — on Darwin that would swallow NSExceptions).
• Inspector pause loops: PumpMessageLoop → RunNestableV8Tasks() — bounded to entries present at call time; only nestable v8 tasks run while JS frames are on the stack; everything else fires from its own wakeup after resume.
• ModuleInternal's top-level-await spin pumps nestable tasks each iteration under the same contract (Atomics.waitAsync wakeups are non-nestable per v8's futex-emulation, so a TLA module blocked on one returns a TDZ namespace from synchronous require() and completes from the loop right after the turn — on main it never completed; dynamic import settles normally).
• Dead SetTimeout.cpp/.h (never initialized, main-queue-hardcoded) deleted.
• Left as-is: ConcurrentQueue (parent→worker inbound delivery on the worker's own loop — the Android port also kept its equivalent); the rejection drain stays observer-based (kCFRunLoopBeforeWaiting); the inspector's hardcoded CFRunLoopGetMain() waits.

Teardown / isolate-pointer reuse

~Runtime shuts the loop down inside its Locker block before any handle disposal; posts from other threads start dropping there. The platform registry entry is removed by a matched erase (IsolateDisposed(isolate, loop)) so a worker isolate that reuses a disposed isolate's address can't be evicted by the previous tenant's late destructor; CreateIsolate additionally refreshes a stopped loop found under its key, and the v8 task runner resolves the loop through the registry on every post so a refresh redirects already-handed-out runners.

Post-review hardening

CodeRabbit + an independent deep review; fixes applied: inspector pause loops resolve the loop via a non-creating lookup (a stale pause iteration could otherwise mint a registry entry for a disposed isolate); PostOrderedToken returns the key it actually recorded and clearTimeout recalls by it (an overdue timer's clear otherwise degraded to tombstone + spurious wakeup); the sync worker-post wait is released via an RAII completion even when Shutdown drops the entry unrun; the bind-time flush replays buffered tokens under their original keys so the recall contract survives pre-bind posts; null guards in Timers::Init/postToken.

Known/accepted notes from review: v8 tasks posted during Isolate::New for a worker that reuses a disposed isolate's address land in the stale stopped loop and are dropped until the immediate post-creation refresh (unfixable without a v8 hook; same shape as android#2003, and at-worst-parity with main where no foreground task ever ran). The tombstone branch is only reachable on an exact due-time tie (sub-nanosecond double), so the tombstone specs exercise token recall; the machinery is verified by review. Same open question as android#2003: microtask checkpoints now run after nestable tasks during debugger pauses (Blink parity).

Not in this PR

• Microtask policy is untouched (kAuto; each loop entry adds an explicit checkpoint). The kExplicit / continuations-always-resolve-on-the-runtime-thread design builds on this seam later.
• The NAPI branch (feat: Node-API (napi) surface for plugin developers #437) posts TSFN/async-work/finalizer blocks through ExecuteOnRunLoop; it migrates onto this loop separately.
• ExecuteOnRunLoop itself stays exported (no in-repo callers remain).

Tests

EventLoopTests.js (+ echo/waitAsync workers): Atomics.waitAsync notify/timeout/mismatch/promise-chain — the async cases hang without this change; natively-resolved promise microtasks run before a later macrotask (the kAuto-stall assertion); __ns__queueMacrotask async delivery, runs-after-microtasks, FIFO among itself and with __ns__setTimeout(0), TypeError on non-function; clear-tombstone specs (clear + re-schedule doesn't reorder, overdue clear doesn't fire a later timer early, interval survives unrelated clear); worker specs (message ordering, waitAsync inside a worker's own loop, reply racing an overdue waitAsync timeout, terminate-with-queued-work, 8× churn exercising the registry-refresh path).

Also covered: tombstone probes posting a real CFRunLoopPerformBlock between two timer tokens, an NSTimer interleave spec (a foreign timer due between two overdue native timers fires between them), and a yield spec driving a 50-step immediate-timer chain while asserting a foreign NSTimer, a main-queue block and the before-waiting rejection drain all land mid-chain.

Full suite: 1077 specs green before, 1101 green after (same simulator).