From a7088be1c56c45ce08d3e4fbac37d9bc949dcb68 Mon Sep 17 00:00:00 2001
From: Kris Zyp <kriszyp@gmail.com>
Date: Wed, 8 Jul 2026 10:39:02 -0600
Subject: [PATCH 1/3] Dedicated per-database commit thread for async
 transaction commits

Async Transaction.commit() no longer posts one napi_create_async_work item
(libuv threadpool slot) per commit. Each database's DBDescriptor owns a
dedicated commit thread that runs the txn-log writeBatch + RocksDB commit +
commitFinished in dispatch order, so slow commits (write stalls, large
batches, txn-log contention) cannot occupy libuv slots and starve unrelated
async work (fs, dns, crypto, async gets). Measured: fs.stat p50 during a
heavy write burst 15.1ms -> 0.12ms at pool=4, with commit throughput at
parity or better in every leg.

ROCKSDB_JS_COMMIT_THREAD selects the mode: 0/false = legacy libuv path
(kill switch, same build A/B), default = single lane, 2 = experimental
two-lane txnlog->commit pipeline (kept selectable for real-workload
evaluation; slower than single lane on synthetic loads). The commit path is
split into executeLogWork/executeCommitWork stages shared by all modes, and
the worker drains its whole queue per wakeup (future aggregated-writev hook).

Completions are marshalled to the originating env via per-env tsfns held on
the descriptor under commitMutex; the commit thread calls them under that
mutex and a dying env's tsfn is released from the module env-cleanup hook
(DBRegistry::ReleaseCommitCompletionsByEnv), the same env-teardown
discipline as EventEmitter::notify (a per-commit tsfn acquire is not
sufficient - env teardown does not honor acquire counts). Regression test:
test/commit-teardown.test.ts with the ROCKSDB_JS_COMMIT_DELAY_MS seam;
crashes 3/3 without the cleanup-hook release.

Also adds commitPipeline.logQueueDepth/commitQueueDepth gauges to
db.getStats(), named commit threads (rocksdb-commit, rocksdb-txnlog) via a
new setThreadName platform helper, and docs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 AGENTS.md                               |  21 +
 docs/stats.md                           |   2 +
 src/binding/binding.cpp                 |   4 +
 src/binding/core/platform.cpp           |  20 +
 src/binding/core/platform.h             |   7 +
 src/binding/database/commit_worker.h    | 140 +++++++
 src/binding/database/db_descriptor.cpp  |  94 +++++
 src/binding/database/db_descriptor.h    |  75 ++++
 src/binding/database/db_handle.cpp      |  29 ++
 src/binding/database/db_registry.cpp    |  29 ++
 src/binding/database/db_registry.h      |   1 +
 src/binding/transaction/transaction.cpp | 532 ++++++++++++++++--------
 src/stats.ts                            |   2 +
 test/commit-teardown.test.ts            |  60 +++
 test/fixtures/fork-commit-teardown.mts  |  83 ++++
 test/stats.test.ts                      |   6 +-
 test/workers/commit-teardown-worker.mts |  28 ++
 17 files changed, 947 insertions(+), 186 deletions(-)
 create mode 100644 src/binding/database/commit_worker.h
 create mode 100644 test/commit-teardown.test.ts
 create mode 100644 test/fixtures/fork-commit-teardown.mts
 create mode 100644 test/workers/commit-teardown-worker.mts

diff --git a/AGENTS.md b/AGENTS.md
index 969a23a5..792e5903 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -122,12 +122,33 @@ C++ code that needs to emit to JS without a database context should call
 `emitGlobalEvent(key, data)` from `napi/global_events.h`. Use namespaced keys
 (`'transactionLog:warning'`) for internal events to avoid collisions with user-defined ones.
 
+### Commit execution
+
+Async `Transaction.commit()` does not use the libuv threadpool: each database
+has a dedicated commit thread (`CommitWorker`, owned by the shared
+`DBDescriptor`) that runs the txn-log write + RocksDB commit in dispatch order,
+so slow commits cannot starve fs/dns/crypto/async-get work sharing the libuv
+pool. `ROCKSDB_JS_COMMIT_THREAD` selects the mode (`0`/`false` = legacy libuv
+path, default = single lane, `2` = experimental two-lane txnlog→commit
+pipeline). Completions are marshalled back to the originating env via per-env
+tsfns held on the descriptor under `commitMutex`; the commit thread calls them
+under that mutex and a dying env's tsfn is released from the module env-cleanup
+hook (`DBRegistry::ReleaseCommitCompletionsByEnv`) — the same env-teardown
+discipline as `EventEmitter::notify` above. A per-commit tsfn acquire is NOT
+sufficient (env teardown does not honor tsfn acquire counts); see
+`test/commit-teardown.test.ts` and the `ROCKSDB_JS_COMMIT_DELAY_MS` test seam.
+
 ## Environment Variables
 
 - `ROCKSDB_VERSION` - Override RocksDB version (default from package.json, or 'latest')
 - `ROCKSDB_PATH` - Build from local RocksDB source instead of prebuilt
 - `MINIFY=1` - Enable minification of TypeScript bundle
 - `KEEP_FILES=1` - Don't delete temporary test databases for debugging purposes
+- `ROCKSDB_JS_COMMIT_THREAD` - Async-commit execution mode: `0`/`false` = legacy
+  libuv threadpool, unset = dedicated per-database commit thread (default),
+  `2` = experimental two-lane pipeline
+- `ROCKSDB_JS_COMMIT_DELAY_MS` - Test-only: delay on the commit thread before
+  each completion callback (widens teardown race windows)
 
 ## Test Structure
 
diff --git a/docs/stats.md b/docs/stats.md
index 7b8aa53b..60aa18b6 100644
--- a/docs/stats.md
+++ b/docs/stats.md
@@ -34,6 +34,8 @@ By default, `db.getStats()` returns properties only.
 
 | Name                                        | Description                                                                                                                                                                                                                   | Type   |
 | ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
+| `commitPipeline.commitQueueDepth`           | Number of async commits queued on the database's commit lane but not yet started (in the default single-lane mode this covers the whole commit: log write + RocksDB commit).                                                  | gauge  |
+| `commitPipeline.logQueueDepth`              | Number of async commits queued on the database's transaction-log lane but not yet started (always `0` in the default single-lane mode; see `ROCKSDB_JS_COMMIT_THREAD=2`).                                                     | gauge  |
 | `rocksdb.block-cache-capacity`              | Capacity in bytes of the block cache.                                                                                                                                                                                         | gauge  |
 | `rocksdb.block-cache-pinned-usage`          | Bytes occupied by pinned block cache entries.                                                                                                                                                                                 | gauge  |
 | `rocksdb.block-cache-usage`                 | Bytes currently used by block cache entries.                                                                                                                                                                                  | gauge  |
diff --git a/src/binding/binding.cpp b/src/binding/binding.cpp
index 99a4afc3..b9e02ce9 100644
--- a/src/binding/binding.cpp
+++ b/src/binding/binding.cpp
@@ -160,6 +160,10 @@ NAPI_MODULE_INIT() {
 		napi_env dyingEnv = static_cast<napi_env>(data);
 		rocksdb_js::GlobalEvents::getInstance().removeListenersByEnv(dyingEnv);
 		rocksdb_js::DBRegistry::RemoveListenersByEnv(dyingEnv);
+		// Release this env's commit-completion tsfns before Node frees the env's
+		// tsfns, so the shared commit thread stops marshalling into a torn-down
+		// env (mirrors the listener cleanup above).
+		rocksdb_js::DBRegistry::ReleaseCommitCompletionsByEnv(dyingEnv);
 
 		int32_t newRefCount = --moduleRefCount;
 		if (newRefCount == 0) {
diff --git a/src/binding/core/platform.cpp b/src/binding/core/platform.cpp
index 55519bdc..e2c6e00d 100644
--- a/src/binding/core/platform.cpp
+++ b/src/binding/core/platform.cpp
@@ -3,6 +3,7 @@
 #include <chrono>
 #include <filesystem>
 #include <limits>
+#include <string>
 #include <thread>
 #include "core/debug.h"
 #include "core/exception.h"
@@ -11,6 +12,7 @@
 #include <windows.h>
 #elif defined(__linux__)
 #include <sys/syscall.h>
+#include <pthread.h>
 #elif defined(__APPLE__)
 #include <pthread.h>
 #endif
@@ -31,6 +33,24 @@ size_t getThreadId() {
 #endif
 }
 
+void setThreadName(const char* name) {
+#if defined(__linux__)
+	// Linux caps thread names at 16 bytes including the null terminator.
+	::pthread_setname_np(::pthread_self(), name);
+#elif defined(__APPLE__)
+	::pthread_setname_np(name);
+#elif defined(_WIN32)
+	int len = ::MultiByteToWideChar(CP_UTF8, 0, name, -1, nullptr, 0);
+	if (len > 0) {
+		std::wstring wide(static_cast<size_t>(len), L'\0');
+		::MultiByteToWideChar(CP_UTF8, 0, name, -1, wide.data(), len);
+		::SetThreadDescription(::GetCurrentThread(), wide.c_str());
+	}
+#else
+	(void)name;
+#endif
+}
+
 std::chrono::system_clock::time_point convertFileTimeToSystemTime(
 	const std::filesystem::file_time_type& fileTime
 ) {
diff --git a/src/binding/core/platform.h b/src/binding/core/platform.h
index 2e57199f..0a6c89c6 100644
--- a/src/binding/core/platform.h
+++ b/src/binding/core/platform.h
@@ -9,6 +9,13 @@ namespace rocksdb_js {
 
 size_t getThreadId();
 
+/**
+ * Sets the current thread's name for diagnostics (visible in top, gdb, etc.).
+ * Best-effort and platform-guarded; names longer than the OS limit (15 chars
+ * on Linux) are truncated by the platform.
+ */
+void setThreadName(const char* name);
+
 std::chrono::system_clock::time_point convertFileTimeToSystemTime(const std::filesystem::file_time_type& fileTime);
 
 double getMonotonicTimestamp();
diff --git a/src/binding/database/commit_worker.h b/src/binding/database/commit_worker.h
new file mode 100644
index 00000000..555586ea
--- /dev/null
+++ b/src/binding/database/commit_worker.h
@@ -0,0 +1,140 @@
+#ifndef __COMMIT_WORKER_H__
+#define __COMMIT_WORKER_H__
+
+#include <condition_variable>
+#include <deque>
+#include <functional>
+#include <mutex>
+#include <thread>
+#include "core/debug.h"
+#include "core/platform.h"
+
+namespace rocksdb_js {
+
+/**
+ * A dedicated worker thread with a task queue, used for the per-database
+ * commit pipeline. Async transaction commits execute on these instead of the
+ * libuv threadpool so that slow commits (write stalls, large batches,
+ * transaction-log contention) cannot occupy libuv slots and starve unrelated
+ * async work (fs, dns, crypto, async gets). Completion is marshalled back to
+ * the calling env via a threadsafe function.
+ *
+ * Each database has a commit lane and, in two-lane mode, a transaction-log
+ * lane that writes the log batch before forwarding to the commit lane (see
+ * commitThreadMode() in transaction.cpp). Each lane preserves dispatch order —
+ * which keeps per-database commit order stable and serializes the
+ * transaction-log write mutex for free. RocksDB commits never block on one
+ * another's locks (pessimistic locks are acquired at put time, optimistic
+ * validation does not block), so a single commit lane cannot deadlock.
+ *
+ * The thread is started lazily on the first task and joined on shutdown after
+ * draining any queued tasks. Each run-loop wakeup drains the entire queue
+ * snapshot in one pass — the structural hook that later lets the log lane see
+ * every pending batch and aggregate them into one writev.
+ */
+struct CommitWorker final {
+	const char* threadName;
+	std::mutex mutex;
+	std::condition_variable cv;
+	std::deque<std::function<void()>> queue;
+	std::thread thread;
+	bool started = false;
+	bool stopped = false;
+
+	explicit CommitWorker(const char* threadName) : threadName(threadName) {}
+
+	~CommitWorker() {
+		this->shutdown();
+	}
+
+	/**
+	 * Enqueues a task, lazily starting the worker thread. If the worker has
+	 * already been shut down (descriptor closing), the task runs inline on the
+	 * calling thread; a commit will fail fast on the closing checks.
+	 */
+	void enqueue(std::function<void()> task) {
+		bool runInline = false;
+		bool wasEmpty = false;
+		{
+			std::lock_guard<std::mutex> lock(this->mutex);
+			if (this->stopped) {
+				runInline = true;
+			} else {
+				if (!this->started) {
+					this->started = true;
+					this->thread = std::thread([this]() { this->run(); });
+				}
+				wasEmpty = this->queue.empty();
+				this->queue.push_back(std::move(task));
+			}
+		}
+		if (runInline) {
+			DEBUG_LOG("%p CommitWorker::enqueue Worker stopped, running task inline\n", this);
+			task();
+		} else if (wasEmpty) {
+			// Only the empty->non-empty transition needs a wakeup: the worker
+			// drains the whole queue per wakeup and its wait predicate re-checks
+			// emptiness before blocking, so tasks appended to a non-empty queue
+			// are picked up without a signal. Profiling showed the per-enqueue
+			// pthread_cond_signal as a measurable JS-thread cost under load.
+			this->cv.notify_one();
+		}
+	}
+
+	/**
+	 * Number of queued (not yet started) tasks. Diagnostic only — the value is
+	 * stale the moment it is read.
+	 */
+	size_t depth() {
+		std::lock_guard<std::mutex> lock(this->mutex);
+		return this->queue.size();
+	}
+
+	/**
+	 * Drains any remaining queued tasks and joins the thread. Idempotent;
+	 * called from DBDescriptor::finishClose() and the destructor.
+	 */
+	void shutdown() {
+		std::thread toJoin;
+		{
+			std::lock_guard<std::mutex> lock(this->mutex);
+			this->stopped = true;
+			if (this->started) {
+				toJoin = std::move(this->thread);
+				this->started = false;
+			}
+		}
+		this->cv.notify_all();
+		if (toJoin.joinable()) {
+			DEBUG_LOG("%p CommitWorker::shutdown Draining and joining worker thread\n", this);
+			toJoin.join();
+		}
+	}
+
+private:
+	void run() {
+		setThreadName(this->threadName);
+		std::unique_lock<std::mutex> lock(this->mutex);
+		for (;;) {
+			this->cv.wait(lock, [this] { return this->stopped || !this->queue.empty(); });
+			if (this->queue.empty()) {
+				// stopped and fully drained
+				return;
+			}
+			// Drain the whole queue in one pass so tasks run without retaking
+			// the mutex per item (and so a future log-lane aggregation step can
+			// see the full pending batch).
+			std::deque<std::function<void()>> batch;
+			batch.swap(this->queue);
+			lock.unlock();
+			for (auto& task : batch) {
+				task();
+			}
+			lock.lock();
+		}
+	}
+};
+
+} // namespace rocksdb_js
+
+#endif
diff --git a/src/binding/database/db_descriptor.cpp b/src/binding/database/db_descriptor.cpp
index 5141b06c..dc3b66cd 100644
--- a/src/binding/database/db_descriptor.cpp
+++ b/src/binding/database/db_descriptor.cpp
@@ -162,6 +162,29 @@ void DBDescriptor::finishClose() {
 	}
 	DEBUG_LOG("%p DBDescriptor::close All operations complete \"%s\"\n", this, this->path.c_str());
 
+	// Drain the commit pipeline before flushing so its data is included in
+	// the flush. The log lane feeds the commit lane, so it must drain first;
+	// its final tasks enqueue onto the still-running commit lane (or run
+	// inline once that lane stops).
+	this->logWorker.shutdown();
+	this->commitWorker.shutdown();
+
+	// Release any remaining per-env commit-completion tsfns. An in-flight
+	// commit pins this descriptor (state -> txnHandle -> dbHandle -> descriptor),
+	// so reaching here means no commit is in flight; only idle (unref'd) tsfns
+	// for still-living envs can remain, and those envs will issue no further
+	// commits to this descriptor. Queued completions already handed to a tsfn
+	// are still delivered (napi_tsfn_release, not abort).
+	{
+		std::lock_guard<std::mutex> lock(this->commitMutex);
+		for (auto& [env, completion] : this->commitCompletions) {
+			if (completion.tsfn) {
+				::napi_release_threadsafe_function(completion.tsfn, napi_tsfn_release);
+			}
+		}
+		this->commitCompletions.clear();
+	}
+
 	// We want to ensure that all in-memory data is written to disk
 	this->flush();
 
@@ -237,6 +260,77 @@ void DBDescriptor::finishClose() {
 	this->db.reset();
 }
 
+napi_status DBDescriptor::registerCommitCompletion(napi_env env, napi_threadsafe_function_call_js callJs) {
+	std::lock_guard<std::mutex> lock(this->commitMutex);
+	CommitCompletion& completion = this->commitCompletions[env];
+	if (completion.tsfn == nullptr) {
+		napi_value resourceName;
+		napi_status status = ::napi_create_string_utf8(env, "rocksdb.commit", NAPI_AUTO_LENGTH, &resourceName);
+		if (status != napi_ok) {
+			return status;
+		}
+		// Created ref'd (thread count 1 for the commit thread), which is what we
+		// want with a commit about to be dispatched.
+		status = ::napi_create_threadsafe_function(
+			env,
+			nullptr,   // func: callJs does all the work
+			nullptr,   // async_resource
+			resourceName,
+			0,         // unlimited queue
+			1,         // initial thread count: the commit thread
+			nullptr,   // finalize data
+			nullptr,   // finalize cb
+			nullptr,   // context
+			callJs,
+			&completion.tsfn
+		);
+		if (status != napi_ok) {
+			this->commitCompletions.erase(env);
+			return status;
+		}
+	} else if (completion.pending == 0) {
+		// Waking from idle: keep the event loop alive until completion.
+		napi_status status = ::napi_ref_threadsafe_function(env, completion.tsfn);
+		if (status != napi_ok) {
+			return status;
+		}
+	}
+	completion.pending++;
+	return napi_ok;
+}
+
+bool DBDescriptor::dispatchCommitCompletion(napi_env env, void* state) {
+	std::lock_guard<std::mutex> lock(this->commitMutex);
+	auto it = this->commitCompletions.find(env);
+	if (it == this->commitCompletions.end() || it->second.tsfn == nullptr) {
+		// env was torn down / released; the caller drops the state.
+		return false;
+	}
+	napi_status status = ::napi_call_threadsafe_function(it->second.tsfn, state, napi_tsfn_nonblocking);
+	return status == napi_ok;
+}
+
+void DBDescriptor::finishCommitCompletion(napi_env env) {
+	std::lock_guard<std::mutex> lock(this->commitMutex);
+	auto it = this->commitCompletions.find(env);
+	if (it != this->commitCompletions.end() && --it->second.pending == 0 && it->second.tsfn != nullptr) {
+		// Idle: allow the event loop to exit.
+		::napi_unref_threadsafe_function(env, it->second.tsfn);
+	}
+}
+
+void DBDescriptor::releaseCommitCompletionsByEnv(napi_env env) {
+	std::lock_guard<std::mutex> lock(this->commitMutex);
+	auto it = this->commitCompletions.find(env);
+	if (it != this->commitCompletions.end()) {
+		if (it->second.tsfn != nullptr) {
+			// Queued completions are still delivered before the tsfn finalizes.
+			::napi_release_threadsafe_function(it->second.tsfn, napi_tsfn_release);
+		}
+		this->commitCompletions.erase(it);
+	}
+}
+
 /**
  * Registers a database resource to be closed when the descriptor is closed.
  *
diff --git a/src/binding/database/db_descriptor.h b/src/binding/database/db_descriptor.h
index 50e2f0ca..d9163830 100644
--- a/src/binding/database/db_descriptor.h
+++ b/src/binding/database/db_descriptor.h
@@ -4,8 +4,10 @@
 #include <memory>
 #include <node_api.h>
 #include <atomic>
+#include <mutex>
 #include <queue>
 #include <set>
+#include <unordered_map>
 #include <functional>
 #include "rocksdb/db.h"
 #include "rocksdb/statistics.h"
@@ -13,6 +15,7 @@
 #include "rocksdb/utilities/optimistic_transaction_db.h"
 #include "rocksdb/utilities/options_util.h"
 #include "options/db_options.h"
+#include "database/commit_worker.h"
 #include "transaction/transaction_handle.h"
 #include "transaction_log/transaction_log_store_registry.h"
 #include "core/platform.h"
@@ -157,6 +160,78 @@ struct DBDescriptor final : public std::enable_shared_from_this<DBDescriptor> {
 	 */
 	EventEmitter events;
 
+	/**
+	 * Commit lanes executing async transaction commits off the libuv
+	 * threadpool, shared by all envs/handles on this database. In the default
+	 * single-lane mode only commitWorker runs: each commit executes its log
+	 * write and RocksDB commit back to back in dispatch order (logWorker is
+	 * never started). In two-lane mode (ROCKSDB_JS_COMMIT_THREAD=2) the log
+	 * lane writes the transaction-log batch (a pass-through no-op for txns
+	 * with no log entries, preserving total order), then forwards to the
+	 * commit lane, letting the stages overlap across transactions while each
+	 * lane preserves order — see commitThreadMode() in transaction.cpp and
+	 * CommitWorker for the rationale.
+	 *
+	 * Declared commit-lane-first so member destruction (reverse order) tears
+	 * down the log lane before the commit lane it feeds; finishClose() shuts
+	 * both down explicitly in that order first.
+	 */
+	CommitWorker commitWorker{"rocksdb-commit"};
+	CommitWorker logWorker{"rocksdb-txnlog"};
+
+	/**
+	 * Per-env commit-completion plumbing. The commit thread is shared across
+	 * every env that opened this database, but each async commit's completion
+	 * must run on the env that issued it — so completions are marshalled back
+	 * via a threadsafe function created lazily per env.
+	 *
+	 * `commitMutex` guards both the commit thread's tsfn call
+	 * (`dispatchCommitCompletion`) and the release of an env's tsfn
+	 * (`releaseCommitCompletionsByEnv`, run from the module env-cleanup hook
+	 * when a worker env exits). Making the call while holding the mutex is what
+	 * keeps it safe against env teardown: a dying env's cleanup hook must take
+	 * the same mutex to release, and Node runs that hook before freeing the
+	 * env's tsfns — so the tsfn cannot be freed mid-call. This is the same
+	 * discipline `EventEmitter::notify` uses (HarperFast/harper#1370). A
+	 * per-commit `napi_acquire_threadsafe_function` does NOT close this window
+	 * (env teardown does not honor the tsfn-level acquire count).
+	 */
+	struct CommitCompletion {
+		napi_threadsafe_function tsfn = nullptr;
+		// In-flight commits for this env; drives ref/unref so the event loop is
+		// kept alive until completions run, but can still exit when idle.
+		uint32_t pending = 0;
+	};
+	std::mutex commitMutex;
+	std::unordered_map<napi_env, CommitCompletion> commitCompletions;
+
+	/**
+	 * JS thread. Ensures a completion tsfn exists for `env` (created with
+	 * `callJs`) and accounts a newly dispatched commit, ref-ing the tsfn as the
+	 * env goes from idle to busy. Call on the env's own JS thread before
+	 * enqueuing the commit.
+	 */
+	napi_status registerCommitCompletion(napi_env env, napi_threadsafe_function_call_js callJs);
+
+	/**
+	 * Commit thread. Delivers a completed commit's `state` to its originating
+	 * env. Returns false if that env's completion tsfn is gone (env torn down
+	 * or released) — the caller then drops the state.
+	 */
+	bool dispatchCommitCompletion(napi_env env, void* state);
+
+	/**
+	 * JS thread (completion callback). Accounts a finished commit, unref-ing the
+	 * tsfn when the env goes idle so the event loop can exit.
+	 */
+	void finishCommitCompletion(napi_env env);
+
+	/**
+	 * Module env-cleanup hook. Releases and forgets a dying env's completion
+	 * tsfn so the commit thread stops marshalling into a torn-down env.
+	 */
+	void releaseCommitCompletionsByEnv(napi_env env);
+
 private:
 	DBDescriptor(
 		const std::string& path,
diff --git a/src/binding/database/db_handle.cpp b/src/binding/database/db_handle.cpp
index e4b4e7c3..26db53a1 100644
--- a/src/binding/database/db_handle.cpp
+++ b/src/binding/database/db_handle.cpp
@@ -8,6 +8,10 @@ namespace rocksdb_js {
 
 namespace {
 
+// Commit-pipeline queue-depth gauges (see docs/stats.md).
+constexpr const char* COMMIT_PIPELINE_LOG_QUEUE_DEPTH_KEY = "commitPipeline.logQueueDepth";
+constexpr const char* COMMIT_PIPELINE_COMMIT_QUEUE_DEPTH_KEY = "commitPipeline.commitQueueDepth";
+
 bool lookupTxnlogSummaryStat(
 	const std::string& statName,
 	const TransactionLogStoreStats& total,
@@ -144,6 +148,20 @@ std::string DBHandle::getColumnFamilyName() const {
 }
 
 napi_value DBHandle::getStat(napi_env env, const std::string& statName) {
+	// commit-pipeline queue depths (per-database lanes, not RocksDB stats)
+	if (statName.rfind("commitPipeline.", 0) == 0) {
+		napi_value jsValue;
+		if (statName == COMMIT_PIPELINE_LOG_QUEUE_DEPTH_KEY) {
+			NAPI_STATUS_THROWS(::napi_create_double(env, static_cast<double>(this->descriptor->logWorker.depth()), &jsValue));
+		} else if (statName == COMMIT_PIPELINE_COMMIT_QUEUE_DEPTH_KEY) {
+			NAPI_STATUS_THROWS(::napi_create_double(env, static_cast<double>(this->descriptor->commitWorker.depth()), &jsValue));
+		} else {
+			// unknown commitPipeline.* key: never a RocksDB ticker/property
+			NAPI_STATUS_THROWS(::napi_get_undefined(env, &jsValue));
+		}
+		return jsValue;
+	}
+
 	// transaction log summary stats are computed here (not RocksDB tickers or
 	// column-family properties), so resolve them before anything else.
 	if (statName.rfind("txnlog.", 0) == 0) {
@@ -250,6 +268,17 @@ napi_value DBHandle::getStats(napi_env env, bool all) {
 		setTxnlogSummaryStatsOnObject(env, result, total, logCount);
 	}
 
+	// commit-pipeline queue depths
+	{
+		napi_value jsValue;
+		if (::napi_create_double(env, static_cast<double>(this->descriptor->logWorker.depth()), &jsValue) == napi_ok) {
+			::napi_set_named_property(env, result, COMMIT_PIPELINE_LOG_QUEUE_DEPTH_KEY, jsValue);
+		}
+		if (::napi_create_double(env, static_cast<double>(this->descriptor->commitWorker.depth()), &jsValue) == napi_ok) {
+			::napi_set_named_property(env, result, COMMIT_PIPELINE_COMMIT_QUEUE_DEPTH_KEY, jsValue);
+		}
+	}
+
 	return result;
 }
 
diff --git a/src/binding/database/db_registry.cpp b/src/binding/database/db_registry.cpp
index 108d31f8..55fec806 100644
--- a/src/binding/database/db_registry.cpp
+++ b/src/binding/database/db_registry.cpp
@@ -445,6 +445,35 @@ void DBRegistry::RemoveListenersByEnv(napi_env env) {
 	}
 }
 
+/**
+ * Release each descriptor's commit-completion tsfn owned by the given env.
+ * Called from the module env-cleanup hook so a worker thread exiting does not
+ * leave a threadsafe-fn the shared commit thread would later call into a
+ * torn-down env. Mirrors RemoveListenersByEnv: snapshot the descriptors under
+ * databasesMutex, then release outside the lock (releaseCommitCompletionsByEnv
+ * takes each descriptor's own commitMutex).
+ */
+void DBRegistry::ReleaseCommitCompletionsByEnv(napi_env env) {
+	if (!instance) {
+		return;
+	}
+
+	std::vector<std::shared_ptr<DBDescriptor>> descriptors;
+	{
+		std::lock_guard<std::mutex> lock(instance->databasesMutex);
+		descriptors.reserve(instance->databases.size());
+		for (auto& [_key, entry] : instance->databases) {
+			if (entry.descriptor) {
+				descriptors.push_back(entry.descriptor);
+			}
+		}
+	}
+
+	for (auto& descriptor : descriptors) {
+		descriptor->releaseCommitCompletionsByEnv(env);
+	}
+}
+
 /**
  * Shutdown will force all databases to flush in-memory data to disk and purge the registry.
  */
diff --git a/src/binding/database/db_registry.h b/src/binding/database/db_registry.h
index e88cb273..81347d6c 100644
--- a/src/binding/database/db_registry.h
+++ b/src/binding/database/db_registry.h
@@ -95,6 +95,7 @@ class DBRegistry final {
 	static void PurgeAll();
 	static napi_value RegistryStatus(napi_env env, napi_callback_info info);
 	static void RemoveListenersByEnv(napi_env env);
+	static void ReleaseCommitCompletionsByEnv(napi_env env);
 	static void Shutdown();
 	static size_t Size();
 };
diff --git a/src/binding/transaction/transaction.cpp b/src/binding/transaction/transaction.cpp
index 912ed122..9b4e3ee9 100644
--- a/src/binding/transaction/transaction.cpp
+++ b/src/binding/transaction/transaction.cpp
@@ -1,3 +1,7 @@
+#include <chrono>
+#include <cstdlib>
+#include <cstring>
+#include <thread>
 #include "database/database.h"
 #include "database/db_descriptor.h"
 #include "database/db_handle.h"
@@ -199,6 +203,294 @@ struct TransactionCommitState final : BaseAsyncState<std::shared_ptr<Transaction
 		hasLog(false) {}
 };
 
+/**
+ * Log-lane stage of the commit: validates the handle and writes the
+ * transaction-log batch (recording the committed position). Runs off the JS
+ * thread — on the database's log lane, or on a libuv threadpool thread in the
+ * legacy path (which runs both stages back to back). A pass-through no-op for
+ * transactions with no log entries so total dispatch order is preserved into
+ * the commit lane.
+ */
+static void executeLogWork(TransactionCommitState* state) {
+	auto txnHandle = state->handle;
+	if (!txnHandle) {
+		DEBUG_LOG("%p Transaction::Commit ERROR: Called with nullptr txnHandle\n", txnHandle.get());
+		state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
+	} else if (txnHandle->isCancelled()) {
+		DEBUG_LOG("%p Transaction::Commit ERROR: Called with txnHandle cancelled\n", txnHandle.get());
+		state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
+	} else if (!txnHandle->dbHandle) {
+		DEBUG_LOG("%p Transaction::Commit ERROR: Called with nullptr dbHandle\n", txnHandle.get());
+		state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
+	} else if (!txnHandle->dbHandle->opened()) {
+		DEBUG_LOG("%p Transaction::Commit ERROR: Called with dbHandle not opened\n", txnHandle.get());
+		state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
+	} else if (txnHandle->logEntryBatch) {
+		DEBUG_LOG("%p Transaction::Commit Committing log entries for transaction %u\n",
+			txnHandle.get(), txnHandle->id);
+		auto store = txnHandle->boundLogStore.lock();
+		if (store) {
+			try {
+				// write the batch to the store
+				store->writeBatch(*txnHandle->logEntryBatch, txnHandle->committedPosition);
+				// free the batch after writing to avoid memory leak
+				txnHandle->logEntryBatch.reset();
+				state->hasLog = true;
+			} catch (const std::exception& e) {
+				DEBUG_LOG("%p Transaction::Commit ERROR: writeBatch failed for transaction %u: %s\n", txnHandle.get(), txnHandle->id, e.what());
+				state->status = rocksdb::Status::Aborted(e.what());
+			}
+		} else {
+			DEBUG_LOG("%p Transaction::Commit ERROR: Log store not found for transaction %u\n", txnHandle.get(), txnHandle->id);
+			state->status = rocksdb::Status::Aborted("Log store not found for transaction");
+		}
+	}
+}
+
+/**
+ * Commit-lane stage of the commit: commits the RocksDB transaction and records
+ * the committed position against the RocksDB sequence number. Runs off the JS
+ * thread — on the database's commit lane, or on a libuv threadpool thread in
+ * the legacy path. Always runs after executeLogWork on the same state; skips
+ * the RocksDB commit if the log stage failed. This stage's commitFinished can
+ * run concurrently with the log lane's writeBatch for a later transaction —
+ * the store synchronizes the shared position state on dataSetsMutex (the same
+ * interleaving the legacy multi-threaded libuv path exercised).
+ */
+static void executeCommitWork(TransactionCommitState* state) {
+	auto txnHandle = state->handle;
+	// The log stage already failed the commit on any invalid-handle condition;
+	// only proceed past here with a usable handle.
+	if (txnHandle && txnHandle->dbHandle && txnHandle->dbHandle->descriptor) {
+		auto descriptor = txnHandle->dbHandle->descriptor;
+
+		// ensure the log stage (or handle validation) hasn't errored
+		if (state->status.ok()) {
+			state->status = txnHandle->txn->Commit();
+
+			// For coordinated retry: save slot pointers before
+			// releaseIntent() clears them so the complete callback
+			// can park on any new lock installed on those slots.
+			if (state->status.IsBusy() && txnHandle->coordinatedRetry) {
+				state->savedSlots = txnHandle->lockedVTSlots;
+			}
+
+			// Release VT locks that were installed at putSync/removeSync
+			// time, regardless of commit outcome (success or IsBusy).
+			if (!txnHandle->lockedVTSlots.empty()) {
+				txnHandle->releaseIntent();
+			}
+		}
+
+		if (txnHandle->committedPosition.logSequenceNumber > 0 && !state->status.IsBusy()) {
+			auto store = txnHandle->boundLogStore.lock();
+			if (store) {
+				store->commitFinished(txnHandle->committedPosition, descriptor->db->GetLatestSequenceNumber());
+			} else {
+				DEBUG_LOG("%p Transaction::Commit ERROR: Log store not found for transaction, log number: %u id: %u\n", txnHandle.get(), txnHandle->committedPosition.logSequenceNumber, txnHandle->id);
+				state->status = rocksdb::Status::Aborted("Log store not found for transaction");
+			}
+		}
+
+		if (state->status.ok()) {
+			DEBUG_LOG("%p Transaction::Commit Emitted committed event (txnId=%u)\n", txnHandle.get(), txnHandle->id);
+			txnHandle->state = TransactionState::Committed;
+			descriptor->notify("committed", nullptr);
+		} else if (state->status.IsBusy()) {
+			DEBUG_LOG("%p Transaction::Commit ERROR: Commit failed with IsBusy, resetting transaction\n", txnHandle.get());
+			// clear/delete the previous transaction and create a new transaction so that it can be retried
+			txnHandle->resetTransaction();
+		}
+	}
+	// signal that execute handler is complete
+	state->signalExecuteCompleted();
+}
+
+// forward declaration; defined after completeCommitWork
+static void commitCompletionCallJs(napi_env env, napi_value jsCallback, void* context, void* data);
+
+/**
+ * Completes the commit on the JS thread: resolves/rejects the commit promise,
+ * handles the coordinated-retry parking, and closes the transaction handle.
+ * Shared by the legacy async-work complete callback and the commit-thread
+ * tsfn callback. Does NOT free the state.
+ */
+static void completeCommitWork(napi_env env, TransactionCommitState* state) {
+	if (state->status.ok()) {
+		if (state->handle) {
+			DEBUG_LOG("%p Transaction::Commit Complete closing (txnId=%u)\n", state->handle.get(), state->handle->id);
+			state->handle->close();
+			DEBUG_LOG("%p Transaction::Commit Complete closed (txnId=%u)\n", state->handle.get(), state->handle->id);
+		} else {
+			DEBUG_LOG("%p Transaction::Commit Complete, but handle is null!\n", state->handle.get());
+		}
+
+		state->callResolve();
+	} else if (
+		state->status.IsBusy() &&
+		state->handle &&
+		state->handle->coordinatedRetry
+	) {
+		// Coordinated-retry path: signal RETRY_NOW to JS instead of
+		// rejecting. The native layer may park on an active VT lock
+		// before firing the resolve, so JS retries only after the
+		// conflicting transaction has released its write intent.
+		if (state->handle->state == TransactionState::Committing) {
+			state->handle->state = TransactionState::Pending;
+		}
+
+		// Transfer resolve/reject refs from state to a RetryNowContext
+		// so the TSFN finalize can clean them up.
+		auto* ctx = new RetryNowContext{state->resolveRef, state->rejectRef};
+		state->resolveRef = nullptr;
+		state->rejectRef = nullptr;
+
+		bool parked = false;
+		VerificationTable* vt = DBSettings::getInstance().getVerificationTableRaw();
+		for (auto* slot : state->savedSlots) {
+			// refTrackerIfLocked takes a temporary reference under the VT
+			// writer mutex, so the tracker cannot be freed by a concurrent
+			// releaseWriteIntent between loading the slot and referencing it
+			// (the old load-then-incref use-after-free).
+			LockTracker* t = vt ? vt->refTrackerIfLocked(slot) : nullptr;
+			if (!t) continue;
+
+			// Create a TSFN that calls resolve(RETRY_NOW) when fired.
+			napi_value resource_name;
+			::napi_create_string_latin1(env, "transaction.retry", NAPI_AUTO_LENGTH, &resource_name);
+			napi_threadsafe_function tsfn;
+			::napi_create_threadsafe_function(
+				env, nullptr, nullptr, resource_name,
+				0, 1,
+				ctx, retryNowFinalize,
+				ctx, retryNowCallJs,
+				&tsfn
+			);
+			::napi_unref_threadsafe_function(env, tsfn);
+
+			// Register wake callback; if the tracker already fired wake()
+			// before we got here, addWakeCallback returns false and we
+			// call+release the TSFN immediately (async on the JS thread).
+			bool registered = t->addWakeCallback([tsfn]() {
+				::napi_call_threadsafe_function(tsfn, nullptr, napi_tsfn_nonblocking);
+				::napi_release_threadsafe_function(tsfn, napi_tsfn_release);
+			});
+			if (!registered) {
+				::napi_call_threadsafe_function(tsfn, nullptr, napi_tsfn_nonblocking);
+				::napi_release_threadsafe_function(tsfn, napi_tsfn_release);
+			}
+
+			vt->unrefTracker(t);
+			parked = true;
+			break;
+		}
+
+		if (!parked) {
+			// No active lock found; resolve RETRY_NOW directly (we are on
+			// the JS thread in this complete callback).
+			napi_value global, resolveFn, retryVal;
+			::napi_get_global(env, &global);
+			::napi_get_reference_value(env, ctx->resolveRef, &resolveFn);
+			::napi_create_int32(env, RETRY_NOW_VALUE, &retryVal);
+			::napi_call_function(env, global, resolveFn, 1, &retryVal, nullptr);
+			::napi_delete_reference(env, ctx->resolveRef);
+			::napi_delete_reference(env, ctx->rejectRef);
+			delete ctx;
+		}
+		// If parked, ctx is owned by the TSFN finalize; do not free here.
+	} else {
+		// Normal error path: reset to Pending so JS can retry.
+		// Guard: keep Aborted if close() already set it (DB closing
+		// during commit) — don't let Transaction::Abort call Rollback()
+		// on a null txn.
+		if (state->handle && state->handle->state == TransactionState::Committing) {
+			state->handle->state = TransactionState::Pending;
+		}
+		napi_value error;
+		ROCKSDB_CREATE_ERROR_LIKE_VOID(error, state->status, "Transaction commit failed");
+		napi_value hasLogValue;
+		// #668: writeBatch is skipped on an IsBusy retry once the WAL batch is durable
+		// (committedPosition set), so state->hasLog is false this attempt. Fall back to
+		// committedPosition so the retry-on-busy heuristic still treats this as logged.
+		bool hasLog = state->hasLog ||
+			(state->handle && state->handle->committedPosition.logSequenceNumber > 0);
+		napi_status status = ::napi_get_boolean(env, hasLog, &hasLogValue);
+		if (status == napi_ok) {
+			::napi_set_named_property(env, error, "hasLog", hasLogValue);
+		}
+		state->callReject(error);
+	}
+}
+
+/**
+ * TSFN callback: completes a commit dispatched to the commit thread on the
+ * originating JS thread, accounts the completion (unref-ing the tsfn when the
+ * env goes idle), and frees the state.
+ */
+static void commitCompletionCallJs(napi_env env, napi_value jsCallback, void* context, void* data) {
+	TransactionCommitState* state = reinterpret_cast<TransactionCommitState*>(data);
+
+	// env is nullptr when the env is tearing down; nothing left to resolve and
+	// the descriptor's per-env tsfn is being released — do not touch napi.
+	if (env != nullptr) {
+		// Pin the descriptor across completion: completeCommitWork may close the
+		// txn handle (dropping the state's references), but we still need the
+		// descriptor for the pending accounting below. The state pins it here
+		// (state -> txnHandle -> dbHandle -> descriptor).
+		std::shared_ptr<DBDescriptor> descriptor =
+			(state->handle && state->handle->dbHandle) ? state->handle->dbHandle->descriptor : nullptr;
+		completeCommitWork(env, state);
+		if (descriptor) {
+			descriptor->finishCommitCompletion(env);
+		}
+	}
+
+	delete state;
+}
+
+/**
+ * How async commits are executed, selected by ROCKSDB_JS_COMMIT_THREAD:
+ * - `0` / `false`: legacy path — one libuv async-work item per commit.
+ * - unset / anything else: single dedicated commit thread per database
+ *   (default) — both the log write and the RocksDB commit run on the commit
+ *   lane. Best measured throughput (no inter-lane handoff, full cache
+ *   locality).
+ * - `2`: two-lane pipeline — the log lane writes the transaction-log batch,
+ *   then forwards to the commit lane for the RocksDB commit, letting the
+ *   stages overlap across transactions. Measured slower than single-lane on
+ *   synthetic loads (the per-txn handoff outweighs the overlap for small
+ *   commits); selectable for evaluation on real workloads.
+ */
+enum class CommitThreadMode { Legacy, SingleLane, TwoLane };
+
+static CommitThreadMode commitThreadMode() {
+	static const CommitThreadMode mode = []() {
+		const char* v = ::getenv("ROCKSDB_JS_COMMIT_THREAD");
+		if (v != nullptr && (::strcmp(v, "0") == 0 || ::strcmp(v, "false") == 0)) {
+			return CommitThreadMode::Legacy;
+		}
+		if (v != nullptr && ::strcmp(v, "2") == 0) {
+			return CommitThreadMode::TwoLane;
+		}
+		return CommitThreadMode::SingleLane;
+	}();
+	return mode;
+}
+
+/**
+ * Test-only seam: milliseconds the commit thread sleeps after executing the
+ * commit and before calling back into JS. Widens the window in which env
+ * teardown can race an in-flight commit completion so the worker-teardown
+ * test reproduces deterministically. Zero (unset) in production.
+ */
+static unsigned commitDelayMs() {
+	static const unsigned ms = []() -> unsigned {
+		const char* v = ::getenv("ROCKSDB_JS_COMMIT_DELAY_MS");
+		return v != nullptr ? static_cast<unsigned>(::atoi(v)) : 0;
+	}();
+	return ms;
+}
+
 /**
  * Commits the transaction.
  */
@@ -227,6 +519,59 @@ napi_value Transaction::Commit(napi_env env, napi_callback_info info) {
 	DEBUG_LOG("%p Transaction::Commit Setting state to committing\n", (*txnHandle).get(), (*txnHandle)->id);
 	(*txnHandle)->state = TransactionState::Committing;
 
+	auto dbHandle = (*txnHandle)->dbHandle;
+	CommitThreadMode mode = commitThreadMode();
+	if (mode != CommitThreadMode::Legacy && dbHandle && dbHandle->descriptor) {
+		// The commit lanes are owned by the descriptor and drained/joined before
+		// the descriptor is destroyed; and an in-flight commit's state pins the
+		// descriptor alive (state -> txnHandle -> dbHandle -> descriptor). So a
+		// raw pointer captured into the worker task is valid for the task's
+		// lifetime and cannot form a reference cycle with the worker thread.
+		DBDescriptor* descriptor = dbHandle->descriptor.get();
+
+		// Ensure this env has a completion tsfn and account the dispatch (refs
+		// the tsfn as the env goes idle->busy so the event loop stays alive).
+		NAPI_STATUS_THROWS(descriptor->registerCommitCompletion(env, commitCompletionCallJs));
+
+		// register the commit with the transaction handle so close() can wait
+		(*txnHandle)->registerAsyncWork();
+
+		// Commit-lane stage: RocksDB commit, then marshal the completion back
+		// to the originating env. dispatchCommitCompletion returns false if
+		// that env was torn down (e.g. worker terminate) — the completion has
+		// nowhere to run, so drop the state.
+		auto commitStage = [descriptor, state]() {
+			executeCommitWork(state);
+			if (unsigned delay = commitDelayMs()) {
+				std::this_thread::sleep_for(std::chrono::milliseconds(delay));
+			}
+			if (!descriptor->dispatchCommitCompletion(state->env, state)) {
+				DEBUG_LOG("%p Transaction::Commit commit thread: env gone, dropping completion\n", state);
+				delete state;
+			}
+		};
+
+		if (mode == CommitThreadMode::TwoLane) {
+			// Two-lane pipeline: the log lane writes the transaction-log batch,
+			// then forwards to the commit lane. Every commit passes through
+			// both lanes so total order is preserved.
+			descriptor->logWorker.enqueue([descriptor, state, commitStage]() {
+				executeLogWork(state);
+				descriptor->commitWorker.enqueue(commitStage);
+			});
+		} else {
+			// Single lane (default): both stages run back to back on the
+			// commit lane.
+			descriptor->commitWorker.enqueue([state, commitStage]() {
+				executeLogWork(state);
+				commitStage();
+			});
+		}
+
+		NAPI_RETURN_UNDEFINED();
+	}
+
+	// Legacy path: dispatch the commit to the libuv threadpool.
 	napi_value name;
 	NAPI_STATUS_THROWS(::napi_create_string_utf8(
 		env,
@@ -241,86 +586,8 @@ napi_value Transaction::Commit(napi_env env, napi_callback_info info) {
 		name,      // async_resource_name
 		[](napi_env doNotUse, void* data) { // execute
 			TransactionCommitState* state = reinterpret_cast<TransactionCommitState*>(data);
-			auto txnHandle = state->handle;
-			if (!txnHandle) {
-				DEBUG_LOG("%p Transaction::Commit ERROR: Called with nullptr txnHandle\n", txnHandle.get());
-				state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
-			} else if (txnHandle->isCancelled()) {
-				DEBUG_LOG("%p Transaction::Commit ERROR: Called with txnHandle cancelled\n", txnHandle.get());
-				state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
-			} else if (!txnHandle->dbHandle) {
-				DEBUG_LOG("%p Transaction::Commit ERROR: Called with nullptr dbHandle\n", txnHandle.get());
-				state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
-			} else if (!txnHandle->dbHandle->opened()) {
-				DEBUG_LOG("%p Transaction::Commit ERROR: Called with dbHandle not opened\n", txnHandle.get());
-				state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
-			} else {
-				auto descriptor = txnHandle->dbHandle->descriptor;
-				std::shared_ptr<TransactionLogStore> store = nullptr;
-
-				if (txnHandle->logEntryBatch) {
-					DEBUG_LOG("%p Transaction::Commit Committing log entries for transaction %u\n",
-						txnHandle.get(), txnHandle->id);
-					store = txnHandle->boundLogStore.lock();
-					if (store) {
-						try {
-							// write the batch to the store
-							store->writeBatch(*txnHandle->logEntryBatch, txnHandle->committedPosition);
-							// free the batch after writing to avoid memory leak
-							txnHandle->logEntryBatch.reset();
-							state->hasLog = true;
-						} catch (const std::exception& e) {
-							DEBUG_LOG("%p Transaction::Commit ERROR: writeBatch failed for transaction %u: %s\n", txnHandle.get(), txnHandle->id, e.what());
-							state->status = rocksdb::Status::Aborted(e.what());
-						}
-					} else {
-						DEBUG_LOG("%p Transaction::Commit ERROR: Log store not found for transaction %u\n", txnHandle.get(), txnHandle->id);
-						state->status = rocksdb::Status::Aborted("Log store not found for transaction");
-					}
-				}
-
-				// ensure we haven't errored above
-				if (state->status.ok()) {
-					state->status = txnHandle->txn->Commit();
-
-					// For coordinated retry: save slot pointers before
-					// releaseIntent() clears them so the complete callback
-					// can park on any new lock installed on those slots.
-					if (state->status.IsBusy() && txnHandle->coordinatedRetry) {
-						state->savedSlots = txnHandle->lockedVTSlots;
-					}
-
-					// Release VT locks that were installed at putSync/removeSync
-					// time, regardless of commit outcome (success or IsBusy).
-					if (!txnHandle->lockedVTSlots.empty()) {
-						txnHandle->releaseIntent();
-					}
-				}
-
-				if (txnHandle->committedPosition.logSequenceNumber > 0 && !state->status.IsBusy()) {
-					if (!store) {
-						store = txnHandle->boundLogStore.lock();
-					}
-					if (store) {
-						store->commitFinished(txnHandle->committedPosition, descriptor->db->GetLatestSequenceNumber());
-					} else {
-						DEBUG_LOG("%p Transaction::Commit ERROR: Log store not found for transaction, log number: %u id: %u\n", txnHandle.get(), txnHandle->committedPosition.logSequenceNumber, txnHandle->id);
-						state->status = rocksdb::Status::Aborted("Log store not found for transaction");
-					}
-				}
-
-				if (state->status.ok()) {
-					DEBUG_LOG("%p Transaction::Commit Emitted committed event (txnId=%u)\n", txnHandle.get(), txnHandle->id);
-					txnHandle->state = TransactionState::Committed;
-					descriptor->notify("committed", nullptr);
-				} else if (state->status.IsBusy()) {
-					DEBUG_LOG("%p Transaction::Commit ERROR: Commit failed with IsBusy, resetting transaction\n", txnHandle.get());
-					// clear/delete the previous transaction and create a new transaction so that it can be retried
-					txnHandle->resetTransaction();
-				}
-			}
-			// signal that execute handler is complete
-			state->signalExecuteCompleted();
+			executeLogWork(state);
+			executeCommitWork(state);
 		},
 		[](napi_env env, napi_status status, void* data) { // complete
 			TransactionCommitState* state = reinterpret_cast<TransactionCommitState*>(data);
@@ -332,110 +599,7 @@ napi_value Transaction::Commit(napi_env env, napi_callback_info info) {
 
 			// only process result if the work wasn't cancelled
 			if (status != napi_cancelled) {
-				if (state->status.ok()) {
-					if (state->handle) {
-						DEBUG_LOG("%p Transaction::Commit Complete closing (txnId=%u)\n", state->handle.get(), state->handle->id);
-						state->handle->close();
-						DEBUG_LOG("%p Transaction::Commit Complete closed (txnId=%u)\n", state->handle.get(), state->handle->id);
-					} else {
-						DEBUG_LOG("%p Transaction::Commit Complete, but handle is null!\n", state->handle.get());
-					}
-
-					state->callResolve();
-				} else if (
-					state->status.IsBusy() &&
-					state->handle &&
-					state->handle->coordinatedRetry
-				) {
-					// Coordinated-retry path: signal RETRY_NOW to JS instead of
-					// rejecting. The native layer may park on an active VT lock
-					// before firing the resolve, so JS retries only after the
-					// conflicting transaction has released its write intent.
-					if (state->handle->state == TransactionState::Committing) {
-						state->handle->state = TransactionState::Pending;
-					}
-
-					// Transfer resolve/reject refs from state to a RetryNowContext
-					// so the TSFN finalize can clean them up.
-					auto* ctx = new RetryNowContext{state->resolveRef, state->rejectRef};
-					state->resolveRef = nullptr;
-					state->rejectRef = nullptr;
-
-					bool parked = false;
-					VerificationTable* vt = DBSettings::getInstance().getVerificationTableRaw();
-					for (auto* slot : state->savedSlots) {
-						// refTrackerIfLocked takes a temporary reference under the VT
-						// writer mutex, so the tracker cannot be freed by a concurrent
-						// releaseWriteIntent between loading the slot and referencing it
-						// (the old load-then-incref use-after-free).
-						LockTracker* t = vt ? vt->refTrackerIfLocked(slot) : nullptr;
-						if (!t) continue;
-
-						// Create a TSFN that calls resolve(RETRY_NOW) when fired.
-						napi_value resource_name;
-						::napi_create_string_latin1(env, "transaction.retry", NAPI_AUTO_LENGTH, &resource_name);
-						napi_threadsafe_function tsfn;
-						::napi_create_threadsafe_function(
-							env, nullptr, nullptr, resource_name,
-							0, 1,
-							ctx, retryNowFinalize,
-							ctx, retryNowCallJs,
-							&tsfn
-						);
-						::napi_unref_threadsafe_function(env, tsfn);
-
-						// Register wake callback; if the tracker already fired wake()
-						// before we got here, addWakeCallback returns false and we
-						// call+release the TSFN immediately (async on the JS thread).
-						bool registered = t->addWakeCallback([tsfn]() {
-							::napi_call_threadsafe_function(tsfn, nullptr, napi_tsfn_nonblocking);
-							::napi_release_threadsafe_function(tsfn, napi_tsfn_release);
-						});
-						if (!registered) {
-							::napi_call_threadsafe_function(tsfn, nullptr, napi_tsfn_nonblocking);
-							::napi_release_threadsafe_function(tsfn, napi_tsfn_release);
-						}
-
-						vt->unrefTracker(t);
-						parked = true;
-						break;
-					}
-
-					if (!parked) {
-						// No active lock found; resolve RETRY_NOW directly (we are on
-						// the JS thread in this complete callback).
-						napi_value global, resolveFn, retryVal;
-						::napi_get_global(env, &global);
-						::napi_get_reference_value(env, ctx->resolveRef, &resolveFn);
-						::napi_create_int32(env, RETRY_NOW_VALUE, &retryVal);
-						::napi_call_function(env, global, resolveFn, 1, &retryVal, nullptr);
-						::napi_delete_reference(env, ctx->resolveRef);
-						::napi_delete_reference(env, ctx->rejectRef);
-						delete ctx;
-					}
-					// If parked, ctx is owned by the TSFN finalize; do not free here.
-				} else {
-					// Normal error path: reset to Pending so JS can retry.
-					// Guard: keep Aborted if close() already set it (DB closing
-					// during commit) — don't let Transaction::Abort call Rollback()
-					// on a null txn.
-					if (state->handle && state->handle->state == TransactionState::Committing) {
-						state->handle->state = TransactionState::Pending;
-					}
-					napi_value error;
-					ROCKSDB_CREATE_ERROR_LIKE_VOID(error, state->status, "Transaction commit failed");
-					napi_value hasLogValue;
-					// #668: writeBatch is skipped on an IsBusy retry once the WAL batch is durable
-					// (committedPosition set), so state->hasLog is false this attempt. Fall back to
-					// committedPosition so the retry-on-busy heuristic still treats this as logged.
-					bool hasLog = state->hasLog ||
-						(state->handle && state->handle->committedPosition.logSequenceNumber > 0);
-					napi_status status = ::napi_get_boolean(env, hasLog, &hasLogValue);
-					if (status == napi_ok) {
-						::napi_set_named_property(env, error, "hasLog", hasLogValue);
-					}
-					state->callReject(error);
-				}
+				completeCommitWork(env, state);
 			}
 
 			delete state;
diff --git a/src/stats.ts b/src/stats.ts
index aed205d6..5dee3234 100644
--- a/src/stats.ts
+++ b/src/stats.ts
@@ -49,6 +49,8 @@ export type StatsBasics = {
 	'txnlog.transactionsWritten': number;
 	'txnlog.bytesWritten': number;
 	'txnlog.replayGapBytes': number;
+	'commitPipeline.logQueueDepth': number;
+	'commitPipeline.commitQueueDepth': number;
 };
 
 export type StatsCuratedExtras = {
diff --git a/test/commit-teardown.test.ts b/test/commit-teardown.test.ts
new file mode 100644
index 00000000..9e53f6a8
--- /dev/null
+++ b/test/commit-teardown.test.ts
@@ -0,0 +1,60 @@
+import { generateDBPath } from './lib/util.js';
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+const fixturePath = join(__dirname, 'fixtures', 'fork-commit-teardown.mts');
+
+/**
+ * Runs the repro fixture in a child process so a native abort (SIGABRT/SIGSEGV)
+ * from an async-commit completion racing worker-env teardown surfaces as a
+ * signal / non-zero exit instead of taking down vitest. Loops a few iterations
+ * to give CI a useful detection rate while keeping wall time bounded.
+ */
+async function expectSurvives(iterations = process.versions.bun ? 1 : 2): Promise<void> {
+	for (let i = 0; i < iterations; i++) {
+		const { code, signal } = await spawnRepro(generateDBPath());
+		expect(signal, `iteration=${i}`).toBeNull();
+		expect(code, `iteration=${i}`).toBe(0);
+	}
+}
+
+function spawnRepro(
+	dbPath: string
+): Promise<{ code: number | null; signal: NodeJS.Signals | null }> {
+	return new Promise((resolve, reject) => {
+		const args =
+			process.versions.bun || process.versions.deno
+				? [fixturePath, dbPath]
+				: ['node_modules/tsx/dist/cli.mjs', fixturePath, dbPath];
+
+		// Widen the commit-thread completion window via the test seam so the
+		// completion-vs-teardown race reproduces deterministically; natural
+		// timing only surfaces it at production scale.
+		const child = spawn(process.execPath, args, {
+			env: { ...process.env, ROCKSDB_JS_COMMIT_DELAY_MS: '25' },
+		});
+
+		let stderr = '';
+		child.stderr?.on('data', (chunk) => {
+			stderr += chunk.toString();
+		});
+
+		child.on('close', (code, signal) => {
+			if (code !== 0 || signal) {
+				console.error(`Repro child stderr:\n${stderr}`);
+			}
+			resolve({ code, signal });
+		});
+		child.on('error', reject);
+	});
+}
+
+describe('Async commit completion vs. worker env teardown', () => {
+	it(
+		'should survive worker env teardown with commits in flight on the shared commit thread',
+		() => expectSurvives(),
+		// Worker spawn/teardown dominates wall time and is slow on macOS/Windows.
+		120_000
+	);
+});
diff --git a/test/fixtures/fork-commit-teardown.mts b/test/fixtures/fork-commit-teardown.mts
new file mode 100644
index 00000000..0f8adf0e
--- /dev/null
+++ b/test/fixtures/fork-commit-teardown.mts
@@ -0,0 +1,83 @@
+/**
+ * Isolated repro for async-commit completion vs. worker-env teardown.
+ *
+ * The async commit path dispatches each commit to the database's dedicated
+ * commit thread (owned by the shared DBDescriptor) and marshals the completion
+ * back to the originating env via a persistent threadsafe function. This
+ * fixture terminates a worker env while its commits are still queued/executing
+ * on that shared thread:
+ *
+ * 1. Main pins the shared DBDescriptor by opening the path for the whole run,
+ *    so the commit thread outlives each worker.
+ * 2. A committer worker (same path) streams async commits without awaiting
+ *    them, keeping many in-flight.
+ * 3. The parent terminates the worker mid-stream. Its commit tsfn is released
+ *    by the DBHandle finalizer, but the commit thread may still call it to
+ *    complete the worker's already-queued commits.
+ *
+ * The per-commit acquire on the commit tsfn keeps it alive until every
+ * dispatched commit has been completed (or the call has been observed to fail
+ * during teardown), so the commit thread never touches a finalized tsfn.
+ * Exit 0 = survived; a crash exits via signal / non-zero.
+ *
+ * Set ROCKSDB_JS_COMMIT_DELAY_MS (see the test) to widen the window so the
+ * race reproduces deterministically.
+ */
+import { RocksDatabase } from '../../src/index.js';
+import { createWorkerBootstrapScript } from '../lib/util.js';
+import { mkdirSync } from 'node:fs';
+import { setTimeout as delay } from 'node:timers/promises';
+import { Worker } from 'node:worker_threads';
+
+const dbPath = process.argv[2];
+
+if (!dbPath) {
+	console.error('Usage: fork-commit-teardown.mts <dbPath>');
+	process.exit(1);
+}
+
+mkdirSync(dbPath, { recursive: true });
+
+// Bun's worker spawn/teardown is far slower, so it runs fewer rounds; the race
+// is a runtime-agnostic native lifecycle bug and Node/Deno carry the primary
+// detection.
+const ROUNDS = process.versions.bun ? 15 : 40;
+
+function spawnCommitter(): Promise<Worker> {
+	return new Promise((resolve, reject) => {
+		const worker = new Worker(
+			createWorkerBootstrapScript('./test/workers/commit-teardown-worker.mts'),
+			{ eval: true, workerData: { path: dbPath } }
+		);
+		worker.once('message', (event: { ready?: boolean }) => {
+			if (event.ready) {
+				resolve(worker);
+			}
+		});
+		worker.once('error', reject);
+	});
+}
+
+async function run(): Promise<void> {
+	// Pin the shared descriptor (and its commit thread) for the whole run.
+	const db = RocksDatabase.open(dbPath);
+
+	for (let round = 0; round < ROUNDS; round++) {
+		const committer = await spawnCommitter();
+		// Let commits start landing on the commit thread, then tear the env down
+		// with commits still queued/in-flight.
+		await delay(3);
+		await committer.terminate();
+	}
+
+	db.close();
+}
+
+try {
+	await run();
+	console.log('SUCCESS');
+	process.exit(0);
+} catch (error) {
+	console.error('FAILED', error);
+	process.exit(1);
+}
diff --git a/test/stats.test.ts b/test/stats.test.ts
index df671fc6..796b7ec7 100644
--- a/test/stats.test.ts
+++ b/test/stats.test.ts
@@ -141,8 +141,10 @@ describe('Statistics', () => {
 			stats = db.getStats();
 			expect(stats).toBeDefined();
 			// the curated column-family set stays small; the always-present txnlog.*
-			// summary keys are counted separately.
-			const nonTxnlogKeys = Object.keys(stats).filter((key) => !key.startsWith('txnlog.'));
+			// and commitPipeline.* summary keys are counted separately.
+			const nonTxnlogKeys = Object.keys(stats).filter(
+				(key) => !key.startsWith('txnlog.') && !key.startsWith('commitPipeline.')
+			);
 			expect(nonTxnlogKeys.length).toBeLessThanOrEqual(25);
 
 			// internal stats
diff --git a/test/workers/commit-teardown-worker.mts b/test/workers/commit-teardown-worker.mts
new file mode 100644
index 00000000..4a6e8aa1
--- /dev/null
+++ b/test/workers/commit-teardown-worker.mts
@@ -0,0 +1,28 @@
+import { RocksDatabase } from '../../src/index.js';
+import { parentPort, workerData } from 'node:worker_threads';
+
+// Open the SAME path as the parent so the parent's handle pins the shared
+// DBDescriptor (and its commit thread) for the whole run. When this worker's
+// env is terminated, the descriptor — and its commit thread — survive on the
+// parent, so the commit thread can still try to complete this worker's queued
+// commits back into a torn-down env. That is the lifecycle the test exercises.
+const db = RocksDatabase.open(workerData.path);
+
+// Fire a bounded batch of async commits WITHOUT awaiting them, so a fixed
+// number are queued/executing on the shared commit thread. With
+// ROCKSDB_JS_COMMIT_DELAY_MS set, each completion is delayed on the commit
+// thread, so all of these are still in flight when the parent terminates this
+// env a few ms later. Bounded (not a continuous flood) so teardown and the
+// parent's final db.close() drain quickly.
+const IN_FLIGHT = 16;
+for (let i = 0; i < IN_FLIGHT; i++) {
+	db.transaction((txn) => {
+		txn.put(`k${i}`, i);
+	}).catch(() => {
+		// the env/db may be tearing down as the worker is terminated; ignore
+	});
+}
+
+// The in-flight commits ref the completion tsfn, keeping this env's loop alive
+// until the parent terminates it.
+parentPort?.postMessage({ ready: true });

From 3de337823a899010665891214a142484d90f6efe Mon Sep 17 00:00:00 2001
From: Kris Zyp <kriszyp@gmail.com>
Date: Wed, 8 Jul 2026 11:06:52 -0600
Subject: [PATCH 2/3] Address cross-model review findings on commit-thread
 lifecycle

- Env-gone drop paths (worker terminate with commits in flight) now close
  the transaction handle so the shared descriptor does not accumulate
  orphaned RocksDB transactions until database close; close() is
  cross-thread safe (skips napi_delete_reference off the owning thread).
- executeCommitWork fails the commit (Aborted) instead of silently
  resolving success when the handle/descriptor is torn out between the
  stages (reachable via DBHandle::close()'s timed-out async-work wait).
- registerCommitCompletion refuses (commitCompletionsClosed, set under
  commitMutex by finishClose's release pass) once the descriptor's
  completion plumbing has shut down; a commit racing another env's close
  falls back to the legacy libuv path instead of re-creating a tsfn that
  would never be released (which pinned that env's event loop forever).
- DestroyDB now claims the descriptor (beginClose) and leaves the registry
  entry in place until finishClose completes, mirroring CloseDB, so the
  env-cleanup hooks can always reach the descriptor and a concurrent
  OpenDB waits instead of re-opening a path whose files are being
  destroyed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/binding/database/db_descriptor.cpp  |  10 ++-
 src/binding/database/db_descriptor.h    |  11 ++-
 src/binding/database/db_registry.cpp    |  56 ++++++++++---
 src/binding/transaction/transaction.cpp | 101 +++++++++++++++---------
 4 files changed, 126 insertions(+), 52 deletions(-)

diff --git a/src/binding/database/db_descriptor.cpp b/src/binding/database/db_descriptor.cpp
index dc3b66cd..ed16d7f4 100644
--- a/src/binding/database/db_descriptor.cpp
+++ b/src/binding/database/db_descriptor.cpp
@@ -183,6 +183,10 @@ void DBDescriptor::finishClose() {
 			}
 		}
 		this->commitCompletions.clear();
+		// Block any later registerCommitCompletion (a commit racing this close
+		// from another env) from re-creating a tsfn that would never be
+		// released; such commits fall back to the legacy libuv path.
+		this->commitCompletionsClosed = true;
 	}
 
 	// We want to ensure that all in-memory data is written to disk
@@ -260,8 +264,12 @@ void DBDescriptor::finishClose() {
 	this->db.reset();
 }
 
-napi_status DBDescriptor::registerCommitCompletion(napi_env env, napi_threadsafe_function_call_js callJs) {
+napi_status DBDescriptor::registerCommitCompletion(napi_env env, napi_threadsafe_function_call_js callJs, bool& closed) {
 	std::lock_guard<std::mutex> lock(this->commitMutex);
+	closed = this->commitCompletionsClosed;
+	if (closed) {
+		return napi_ok;
+	}
 	CommitCompletion& completion = this->commitCompletions[env];
 	if (completion.tsfn == nullptr) {
 		napi_value resourceName;
diff --git a/src/binding/database/db_descriptor.h b/src/binding/database/db_descriptor.h
index d9163830..b3ed4e1c 100644
--- a/src/binding/database/db_descriptor.h
+++ b/src/binding/database/db_descriptor.h
@@ -204,14 +204,21 @@ struct DBDescriptor final : public std::enable_shared_from_this<DBDescriptor> {
 	};
 	std::mutex commitMutex;
 	std::unordered_map<napi_env, CommitCompletion> commitCompletions;
+	// Set (under commitMutex) by finishClose()'s release pass. Blocks any
+	// later registerCommitCompletion from re-creating a tsfn that would never
+	// be released (which would pin that env's event loop forever); a commit
+	// racing the close falls back to the legacy libuv path instead.
+	bool commitCompletionsClosed = false;
 
 	/**
 	 * JS thread. Ensures a completion tsfn exists for `env` (created with
 	 * `callJs`) and accounts a newly dispatched commit, ref-ing the tsfn as the
 	 * env goes from idle to busy. Call on the env's own JS thread before
-	 * enqueuing the commit.
+	 * enqueuing the commit. Sets `closed` (leaving the maps untouched) when the
+	 * descriptor's completion plumbing has already shut down — the caller must
+	 * then use the legacy commit path.
 	 */
-	napi_status registerCommitCompletion(napi_env env, napi_threadsafe_function_call_js callJs);
+	napi_status registerCommitCompletion(napi_env env, napi_threadsafe_function_call_js callJs, bool& closed);
 
 	/**
 	 * Commit thread. Delivers a completed commit's `state` to its originating
diff --git a/src/binding/database/db_registry.cpp b/src/binding/database/db_registry.cpp
index 55fec806..2a8c015d 100644
--- a/src/binding/database/db_registry.cpp
+++ b/src/binding/database/db_registry.cpp
@@ -128,18 +128,27 @@ void DBRegistry::DestroyDB(const std::string& path) {
 	DEBUG_LOG("%p DBRegistry::DestroyDB Destroying \"%s\"\n", instance.get(), path.c_str());
 
 	std::shared_ptr<DBDescriptor> descriptor;
+	std::shared_ptr<std::condition_variable> condition;
 
-	// Find and remove the descriptor from the registry
+	// Claim the descriptor under the lock but leave the entry in the map until
+	// the close completes (same discipline as CloseDB): the entry is how the
+	// env-cleanup hooks (RemoveListenersByEnv / ReleaseCommitCompletionsByEnv)
+	// find shared descriptors, so erasing before close would let a worker env
+	// tear down in that window without scrubbing its tsfns from this
+	// descriptor — the close's own release pass would then touch freed tsfns.
+	// It also keeps a concurrent OpenDB waiting on the entry's condition
+	// instead of re-opening the path while its files are being destroyed.
 	{
 		std::lock_guard<std::mutex> lock(instance->databasesMutex);
-		for (auto it = instance->databases.begin(); it != instance->databases.end(); ) {
-			if (it->first.path == path) {
-				descriptor = it->second.descriptor;
-				it = instance->databases.erase(it);
-				DEBUG_LOG("%p DBRegistry::DestroyDB Found and removed descriptor from registry (ref count = %ld)\n",
-					instance.get(), descriptor ? descriptor.use_count() : 0);
-			} else {
-				++it;
+		for (auto& [key, entry] : instance->databases) {
+			if (key.path == path && entry.descriptor) {
+				if (entry.descriptor->beginClose()) {
+					descriptor = entry.descriptor;
+					condition = entry.condition;
+					DEBUG_LOG("%p DBRegistry::DestroyDB Claimed descriptor close (ref count = %ld)\n",
+						instance.get(), descriptor.use_count());
+				}
+				break;
 			}
 		}
 	}
@@ -149,7 +158,23 @@ void DBRegistry::DestroyDB(const std::string& path) {
 		// This should release all DBHandle references
 		DEBUG_LOG("%p DBRegistry::DestroyDB Closing descriptor and all attached resources (ref count = %zu)\n",
 			instance.get(), descriptor.use_count());
-		descriptor->close();
+		descriptor->finishClose();
+
+		// Now that the close is complete, remove the path's entries and wake
+		// any OpenDB waiting on this path.
+		{
+			std::lock_guard<std::mutex> lock(instance->databasesMutex);
+			for (auto it = instance->databases.begin(); it != instance->databases.end(); ) {
+				if (it->first.path == path) {
+					it = instance->databases.erase(it);
+				} else {
+					++it;
+				}
+			}
+		}
+		if (condition) {
+			condition->notify_all();
+		}
 
 		// After closing, check if there are still lingering references
 		// Should only be our local reference (= 1) at this point
@@ -165,6 +190,17 @@ void DBRegistry::DestroyDB(const std::string& path) {
 		// This will trigger the destructor which properly closes the DB
 		DEBUG_LOG("%p DBRegistry::DestroyDB Releasing descriptor reference\n", instance.get());
 		descriptor.reset();
+	} else {
+		// No open descriptor claimed; remove any placeholder entries for the
+		// path (an entry mid-close is erased by its closer's guarded erase).
+		std::lock_guard<std::mutex> lock(instance->databasesMutex);
+		for (auto it = instance->databases.begin(); it != instance->databases.end(); ) {
+			if (it->first.path == path && !it->second.descriptor) {
+				it = instance->databases.erase(it);
+			} else {
+				++it;
+			}
+		}
 	}
 
 	// Now the database lock should be released, safe to destroy
diff --git a/src/binding/transaction/transaction.cpp b/src/binding/transaction/transaction.cpp
index 9b4e3ee9..1860f488 100644
--- a/src/binding/transaction/transaction.cpp
+++ b/src/binding/transaction/transaction.cpp
@@ -259,9 +259,15 @@ static void executeLogWork(TransactionCommitState* state) {
  */
 static void executeCommitWork(TransactionCommitState* state) {
 	auto txnHandle = state->handle;
-	// The log stage already failed the commit on any invalid-handle condition;
-	// only proceed past here with a usable handle.
-	if (txnHandle && txnHandle->dbHandle && txnHandle->dbHandle->descriptor) {
+	// The log stage already failed the commit on any invalid-handle condition,
+	// but the handle can also be torn out between the stages (e.g. a timed-out
+	// DBHandle::close() resetting the descriptor mid-pipeline). Never let a
+	// commit that was skipped here resolve as success.
+	if (!txnHandle || !txnHandle->dbHandle || !txnHandle->dbHandle->descriptor) {
+		if (state->status.ok()) {
+			state->status = rocksdb::Status::Aborted("Database closed during transaction commit operation");
+		}
+	} else {
 		auto descriptor = txnHandle->dbHandle->descriptor;
 
 		// ensure the log stage (or handle validation) hasn't errored
@@ -443,6 +449,13 @@ static void commitCompletionCallJs(napi_env env, napi_value jsCallback, void* co
 		if (descriptor) {
 			descriptor->finishCommitCompletion(env);
 		}
+	} else if (state->handle) {
+		// Still close the txn handle so it is removed from the descriptor's
+		// transactions map and the native RocksDB transaction is destroyed —
+		// the descriptor may be shared with (and outlive us on) other envs.
+		// close() is cross-thread safe: it skips its napi_delete_reference
+		// off the owning thread.
+		state->handle->close();
 	}
 
 	delete state;
@@ -521,6 +534,7 @@ napi_value Transaction::Commit(napi_env env, napi_callback_info info) {
 
 	auto dbHandle = (*txnHandle)->dbHandle;
 	CommitThreadMode mode = commitThreadMode();
+	bool completionsClosed = false;
 	if (mode != CommitThreadMode::Legacy && dbHandle && dbHandle->descriptor) {
 		// The commit lanes are owned by the descriptor and drained/joined before
 		// the descriptor is destroyed; and an in-flight commit's state pins the
@@ -531,44 +545,53 @@ napi_value Transaction::Commit(napi_env env, napi_callback_info info) {
 
 		// Ensure this env has a completion tsfn and account the dispatch (refs
 		// the tsfn as the env goes idle->busy so the event loop stays alive).
-		NAPI_STATUS_THROWS(descriptor->registerCommitCompletion(env, commitCompletionCallJs));
-
-		// register the commit with the transaction handle so close() can wait
-		(*txnHandle)->registerAsyncWork();
-
-		// Commit-lane stage: RocksDB commit, then marshal the completion back
-		// to the originating env. dispatchCommitCompletion returns false if
-		// that env was torn down (e.g. worker terminate) — the completion has
-		// nowhere to run, so drop the state.
-		auto commitStage = [descriptor, state]() {
-			executeCommitWork(state);
-			if (unsigned delay = commitDelayMs()) {
-				std::this_thread::sleep_for(std::chrono::milliseconds(delay));
-			}
-			if (!descriptor->dispatchCommitCompletion(state->env, state)) {
-				DEBUG_LOG("%p Transaction::Commit commit thread: env gone, dropping completion\n", state);
-				delete state;
+		// When the descriptor's completion plumbing has already shut down (a
+		// commit racing another env's close), fall through to the legacy path
+		// below rather than re-creating a tsfn the close will never release.
+		NAPI_STATUS_THROWS(descriptor->registerCommitCompletion(env, commitCompletionCallJs, completionsClosed));
+		if (!completionsClosed) {
+			// register the commit with the transaction handle so close() can wait
+			(*txnHandle)->registerAsyncWork();
+
+			// Commit-lane stage: RocksDB commit, then marshal the completion
+			// back to the originating env.
+			auto commitStage = [descriptor, state]() {
+				executeCommitWork(state);
+				if (unsigned delay = commitDelayMs()) {
+					std::this_thread::sleep_for(std::chrono::milliseconds(delay));
+				}
+				if (!descriptor->dispatchCommitCompletion(state->env, state)) {
+					// Env torn down (e.g. worker terminate) — the completion has
+					// nowhere to run. Close the txn handle (cross-thread safe) so
+					// the shared descriptor doesn't retain the transaction, then
+					// drop the state.
+					DEBUG_LOG("%p Transaction::Commit commit thread: env gone, dropping completion\n", state);
+					if (state->handle) {
+						state->handle->close();
+					}
+					delete state;
+				}
+			};
+
+			if (mode == CommitThreadMode::TwoLane) {
+				// Two-lane pipeline: the log lane writes the transaction-log
+				// batch, then forwards to the commit lane. Every commit passes
+				// through both lanes so total order is preserved.
+				descriptor->logWorker.enqueue([descriptor, state, commitStage]() {
+					executeLogWork(state);
+					descriptor->commitWorker.enqueue(commitStage);
+				});
+			} else {
+				// Single lane (default): both stages run back to back on the
+				// commit lane.
+				descriptor->commitWorker.enqueue([state, commitStage]() {
+					executeLogWork(state);
+					commitStage();
+				});
 			}
-		};
-
-		if (mode == CommitThreadMode::TwoLane) {
-			// Two-lane pipeline: the log lane writes the transaction-log batch,
-			// then forwards to the commit lane. Every commit passes through
-			// both lanes so total order is preserved.
-			descriptor->logWorker.enqueue([descriptor, state, commitStage]() {
-				executeLogWork(state);
-				descriptor->commitWorker.enqueue(commitStage);
-			});
-		} else {
-			// Single lane (default): both stages run back to back on the
-			// commit lane.
-			descriptor->commitWorker.enqueue([state, commitStage]() {
-				executeLogWork(state);
-				commitStage();
-			});
-		}
 
-		NAPI_RETURN_UNDEFINED();
+			NAPI_RETURN_UNDEFINED();
+		}
 	}
 
 	// Legacy path: dispatch the commit to the libuv threadpool.

From 8556c33e373830dd3c21c6a8ebf946554db9a27c Mon Sep 17 00:00:00 2001
From: Kris Zyp <kriszyp@gmail.com>
Date: Wed, 8 Jul 2026 12:06:34 -0600
Subject: [PATCH 3/3] Fix commit-teardown test timeout on slow-spawn platforms;
 truncate Linux thread names

- The teardown test's 40 rounds x 2 iterations exceed the 120s timeout on
  macOS/Windows CI runners (slow worker spawns + the delayed commit backlog
  each round leaves on the shared commit thread). Scale rounds/iterations by
  platform like the notify-teardown test does.
- pthread_setname_np on Linux fails with ERANGE (name not set at all) for
  names over 15 chars; truncate in setThreadName so long names still stick.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/binding/core/platform.cpp          |  9 +++++++--
 test/commit-teardown.test.ts           | 10 +++++++++-
 test/fixtures/fork-commit-teardown.mts | 14 ++++++++++----
 3 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/src/binding/core/platform.cpp b/src/binding/core/platform.cpp
index e2c6e00d..6d0009a0 100644
--- a/src/binding/core/platform.cpp
+++ b/src/binding/core/platform.cpp
@@ -1,4 +1,5 @@
 #include <cmath>
+#include <cstring>
 #include <atomic>
 #include <chrono>
 #include <filesystem>
@@ -35,8 +36,12 @@ size_t getThreadId() {
 
 void setThreadName(const char* name) {
 #if defined(__linux__)
-	// Linux caps thread names at 16 bytes including the null terminator.
-	::pthread_setname_np(::pthread_self(), name);
+	// Linux caps thread names at 16 bytes including the null terminator;
+	// longer names fail with ERANGE (not truncated), so truncate ourselves.
+	char truncated[16];
+	::strncpy(truncated, name, sizeof(truncated) - 1);
+	truncated[sizeof(truncated) - 1] = '\0';
+	::pthread_setname_np(::pthread_self(), truncated);
 #elif defined(__APPLE__)
 	::pthread_setname_np(name);
 #elif defined(_WIN32)
diff --git a/test/commit-teardown.test.ts b/test/commit-teardown.test.ts
index 9e53f6a8..c7fdefc0 100644
--- a/test/commit-teardown.test.ts
+++ b/test/commit-teardown.test.ts
@@ -11,7 +11,15 @@ const fixturePath = join(__dirname, 'fixtures', 'fork-commit-teardown.mts');
  * signal / non-zero exit instead of taking down vitest. Loops a few iterations
  * to give CI a useful detection rate while keeping wall time bounded.
  */
-async function expectSurvives(iterations = process.versions.bun ? 1 : 2): Promise<void> {
+// One iteration where worker spawns are slow (Bun; macOS/Windows CI), two on
+// Linux Node — see the fixture's ROUNDS note.
+async function expectSurvives(
+	iterations = process.versions.bun ||
+	process.platform === 'darwin' ||
+	process.platform === 'win32'
+		? 1
+		: 2
+): Promise<void> {
 	for (let i = 0; i < iterations; i++) {
 		const { code, signal } = await spawnRepro(generateDBPath());
 		expect(signal, `iteration=${i}`).toBeNull();
diff --git a/test/fixtures/fork-commit-teardown.mts b/test/fixtures/fork-commit-teardown.mts
index 0f8adf0e..35ff119e 100644
--- a/test/fixtures/fork-commit-teardown.mts
+++ b/test/fixtures/fork-commit-teardown.mts
@@ -38,10 +38,16 @@ if (!dbPath) {
 
 mkdirSync(dbPath, { recursive: true });
 
-// Bun's worker spawn/teardown is far slower, so it runs fewer rounds; the race
-// is a runtime-agnostic native lifecycle bug and Node/Deno carry the primary
-// detection.
-const ROUNDS = process.versions.bun ? 15 : 40;
+// Worker spawn/teardown dominates the wall time and each round queues
+// ROCKSDB_JS_COMMIT_DELAY_MS x IN_FLIGHT of delayed commit work on the shared
+// commit thread, so round count is scaled down where spawns are slow (Bun
+// everywhere; macOS/Windows CI runners). The race is a runtime-agnostic
+// native lifecycle bug and Linux Node carries the primary detection rate.
+const ROUNDS = process.versions.bun
+	? 10
+	: process.platform === 'darwin' || process.platform === 'win32'
+		? 16
+		: 40;
 
 function spawnCommitter(): Promise<Worker> {
 	return new Promise((resolve, reject) => {