fix(incremental): a dead unit is dropped inside catch_unwind; pool drop joins deterministically; the leaf's more is pinned

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

context/test-evidence/improvise-incremental.md

@@ -1015,9 +1015,12 @@ Four workers, 200 kicks, the worker count stays four and is zero after `finish`.
 worker returns on a wake with an empty queue) fails it. Rivals W3 and W4 (a lost `notify_all` in
 `kick` or `finish`) fail it by the watchdog.
 
-### a_pool_that_is_dropped_stops_its_threads
+### a_pool_that_is_dropped_waits_for_its_workers
 
-Dropping a pool leaves no worker. Rival W2 (an empty `Drop`) fails it.
+A unit sleeps 300 ms in its turn; the pool is dropped while it runs. Drop must join, so the turn
+has finished and no worker is left when it returns. The first version counted workers after the
+drop, which a `Drop` that did not join could pass by timing. Rival D2 (shutdown without join)
+fails it every time.
 
 ### a_full_edge_does_not_make_its_sender_spin
 
@@ -1027,9 +1030,11 @@ turns.
 
 ### a_unit_whose_kicks_coalesced_still_drains_its_edge
 
-Two commands cross before the projection's kicks are served, with a budget of 1. The projection
-must ask to run again; the second frame is otherwise never read. Rival M5 fails it (and
-`placed_circuits_equal_one_circuit_for_any_workers_and_order`). The same clause on the aggregate
+Two frames reach the projection's edge while the projection is never run (it is claimed and
+handed back unrun), then it is kicked once with a budget of 1. It must ask to run again, or the
+second frame is never read. The first version let the units alternate, which hid the clause and
+made the evidence wrong; rival M5 now fails this test as well as
+`placed_circuits_equal_one_circuit_for_any_workers_and_order`. The same clause on the aggregate
 is redundant, because the projection's progress kicks it back; removing it passes everything, so
 it was deleted.
 
@@ -1047,3 +1052,17 @@ it by the watchdog.
 ### a_dag_on_virtual_workers_in_any_order_equals_one_circuit
 
 The same graph under a random claim and hand-back order of 1 to 8 virtual workers.
+
+### a_unit_whose_drop_panics_does_not_hang_or_shrink_the_pool
+
+`bury` dropped the dead unit outside any catch_unwind, so a unit whose drop panics killed its
+worker after the bookkeeping: on a one-worker pool the next queued unit never ran and
+`Pool::finish` hung (a 5 s watchdog). The drop is now caught. The test checks the one worker is
+still alive, the dead unit is reported and the other unit ran. Rival D1 fails it.
+
+### dropping_a_pool_while_unwinding_does_not_abort
+
+`Pool::drop` joined with `expect`, so a dead worker double-panicked while the host unwound and
+aborted the process. Now a dead worker is a panic only when not already panicking. With the drop
+caught no worker dies, so the test also passes without that guard (rival D3 does not fail it);
+the guard is defence for a worker lost another way, and is not pinned.