From 5ba5dd951f2c9799ffe1c1c655600d7b7768f43a Mon Sep 17 00:00:00 2001
From: Harold Cindy <120691094+HaroldCindy@users.noreply.github.com>
Date: Fri, 14 Aug 2026 13:51:09 -0700
Subject: [PATCH 1/2] Start adding components of the `Execute` module

These components basically comprise the innards of what used to
exist solely within the private codebase's `LLScriptExecuteLuau`.

In the future `LLScriptExecuteLuau` will be a small wrapper around
these building blocks instead. It's a lot easier to have them here
when trying to build out things like VM sharing, GC pacing changes,
pre-emption tweaks, etc.
---
 CMakeLists.txt                     |   11 +-
 Executor/include/Luau/ByteStream.h |  137 ++
 Executor/include/Luau/Executor.h   |  438 ++++++
 Executor/include/Luau/Script.h     |  238 ++++
 Executor/src/Executor.cpp          |  299 +++++
 Executor/src/Logging.cpp           |   64 +
 Executor/src/Script.cpp            |  930 +++++++++++++
 Makefile                           |   15 +-
 Sources.cmake                      |   12 +
 VM/include/lua.h                   |   68 +-
 VM/src/ares.cpp                    |   33 +-
 VM/src/ares.h                      |    7 +-
 VM/src/ldo.cpp                     |   49 +-
 VM/src/lllevents.cpp               |    4 +-
 VM/src/llltimers.cpp               |    8 +-
 build-cmd.sh                       |    3 +
 tests/SLExecutor.test.cpp          | 2017 ++++++++++++++++++++++++++++
 17 files changed, 4261 insertions(+), 72 deletions(-)
 create mode 100644 Executor/include/Luau/ByteStream.h
 create mode 100644 Executor/include/Luau/Executor.h
 create mode 100644 Executor/include/Luau/Script.h
 create mode 100644 Executor/src/Executor.cpp
 create mode 100644 Executor/src/Logging.cpp
 create mode 100644 Executor/src/Script.cpp
 create mode 100644 tests/SLExecutor.test.cpp

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 5b9881b2..d1149009 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -61,6 +61,7 @@ if (LUAU_BUILD_SHARED)
     add_library(Luau.Analysis SHARED)
     add_library(Luau.CodeGen SHARED)
     add_library(Luau.VM SHARED)
+    add_library(Luau.Executor SHARED)
     add_library(Luau.Require SHARED)
     add_library(isocline SHARED)
 else()
@@ -75,6 +76,7 @@ else()
     add_library(Luau.Analysis STATIC)
     add_library(Luau.CodeGen STATIC)
     add_library(Luau.VM STATIC)
+    add_library(Luau.Executor STATIC)
     add_library(Luau.Require STATIC)
     add_library(isocline STATIC)
 endif()
@@ -161,6 +163,12 @@ target_compile_features(Luau.VM PRIVATE cxx_std_17)
 target_include_directories(Luau.VM PUBLIC VM/include "${PACKAGE_INCLUDE_DIR}")
 target_link_libraries(Luau.VM PUBLIC Luau.Common)
 
+# ServerLua: per-script execution engine shared with the script host
+target_compile_features(Luau.Executor PUBLIC cxx_std_17)
+target_include_directories(Luau.Executor PUBLIC Executor/include)
+target_link_libraries(Luau.Executor PUBLIC Luau.VM)
+target_link_libraries(Luau.Executor PRIVATE Luau.VM.Internals)
+
 target_compile_features(Luau.Require PUBLIC cxx_std_17)
 target_include_directories(Luau.Require PUBLIC Require/include)
 target_link_libraries(Luau.Require PUBLIC Luau.Config Luau.VM)
@@ -219,6 +227,7 @@ target_compile_options(Luau.CLI.lib PRIVATE ${LUAU_OPTIONS})
 target_compile_options(Luau.LSLBuiltins PRIVATE ${LUAU_OPTIONS})
 target_compile_options(Luau.CodeGen PRIVATE ${LUAU_OPTIONS})
 target_compile_options(Luau.VM PRIVATE ${LUAU_OPTIONS})
+target_compile_options(Luau.Executor PRIVATE ${LUAU_OPTIONS})
 target_compile_options(isocline PRIVATE ${LUAU_OPTIONS} ${ISOCLINE_OPTIONS})
 
 if(LUAU_EXTERN_C)
@@ -345,7 +354,7 @@ if(LUAU_BUILD_TESTS)
     target_compile_definitions(Luau.Conformance PRIVATE DOCTEST_CONFIG_DOUBLE_STRINGIFY DOCTEST_CONFIG_USE_STD_HEADERS)
     target_include_directories(Luau.Conformance PRIVATE extern VM/src "${PACKAGE_INCLUDE_DIR}")
     target_link_directories(Luau.Conformance PRIVATE "${PACKAGE_LIB_DIR}")
-    target_link_libraries(Luau.Conformance PRIVATE Luau.Analysis Luau.Bytecode Luau.Inliner Luau.Compiler Luau.CodeGen Luau.VM Luau.LSLBuiltins "${TAILSLIDE_LIBRARY}")
+    target_link_libraries(Luau.Conformance PRIVATE Luau.Analysis Luau.Bytecode Luau.Inliner Luau.Compiler Luau.CodeGen Luau.VM Luau.Executor Luau.LSLBuiltins "${TAILSLIDE_LIBRARY}")
 
     if(CMAKE_SYSTEM_NAME MATCHES "Android|iOS")
         set(LUAU_CONFORMANCE_SOURCE_DIR "Client/Luau/tests/conformance")
diff --git a/Executor/include/Luau/ByteStream.h b/Executor/include/Luau/ByteStream.h
new file mode 100644
index 00000000..81d68e2d
--- /dev/null
+++ b/Executor/include/Luau/ByteStream.h
@@ -0,0 +1,137 @@
+// ServerLua: little-endian bytestream primitives for the wrappers we place
+// around ares-serialized state. I regret some of my design decisions here
+// and this probably should not need to be part of the public API.
+#pragma once
+
+#include <cstdint>
+#include <cstring>
+#include <string>
+
+namespace Luau
+{
+namespace Executor
+{
+
+struct ByteWriter
+{
+    std::string& out;
+
+    void writeU8(uint8_t value) { out.push_back((char)value); }
+
+    void writeU32(uint32_t value)
+    {
+        for (int i = 0; i < 4; ++i)
+            writeU8((uint8_t)(value >> (i * 8)));
+    }
+
+    void writeS32(int32_t value) { writeU32((uint32_t)value); }
+
+    void writeU64(uint64_t value)
+    {
+        writeU32((uint32_t)value);
+        writeU32((uint32_t)(value >> 32));
+    }
+
+    void writeF32(float value)
+    {
+        uint32_t rep;
+        memcpy(&rep, &value, sizeof(rep));
+        writeU32(rep);
+    }
+
+    void writeF64(double value)
+    {
+        uint64_t rep;
+        memcpy(&rep, &value, sizeof(rep));
+        writeU64(rep);
+    }
+
+    void writeBytes(const char* data, size_t len) { out.append(data, len); }
+
+    // Length-prefixed, so it round-trips embedded nulls
+    void writeString(const char* data, size_t len)
+    {
+        writeU32((uint32_t)len);
+        writeBytes(data, len);
+    }
+
+    void writeString(const std::string& value) { writeString(value.data(), value.size()); }
+};
+
+struct ByteReader
+{
+    const char* data;
+    size_t remaining;
+
+    bool readBytes(void* dest, size_t len)
+    {
+        if (len > remaining)
+            return false;
+        memcpy(dest, data, len);
+        data += len;
+        remaining -= len;
+        return true;
+    }
+
+    bool readU8(uint8_t& value) { return readBytes(&value, sizeof(value)); }
+
+    bool readU32(uint32_t& value)
+    {
+        uint8_t buf[4];
+        if (!readBytes(buf, sizeof(buf)))
+            return false;
+        value = (uint32_t)buf[0] | ((uint32_t)buf[1] << 8) | ((uint32_t)buf[2] << 16) | ((uint32_t)buf[3] << 24);
+        return true;
+    }
+
+    bool readS32(int32_t& value)
+    {
+        uint32_t rep;
+        if (!readU32(rep))
+            return false;
+        value = (int32_t)rep;
+        return true;
+    }
+
+    bool readU64(uint64_t& value)
+    {
+        uint32_t low;
+        uint32_t high;
+        if (!readU32(low) || !readU32(high))
+            return false;
+        value = (uint64_t)low | ((uint64_t)high << 32);
+        return true;
+    }
+
+    bool readF32(float& value)
+    {
+        uint32_t rep;
+        if (!readU32(rep))
+            return false;
+        memcpy(&value, &rep, sizeof(value));
+        return true;
+    }
+
+    bool readF64(double& value)
+    {
+        uint64_t rep;
+        if (!readU64(rep))
+            return false;
+        memcpy(&value, &rep, sizeof(value));
+        return true;
+    }
+
+    bool readString(std::string& value)
+    {
+        uint32_t len;
+        if (!readU32(len) || len > remaining)
+            return false;
+        value.assign(data, len);
+        data += len;
+        remaining -= len;
+        return true;
+    }
+};
+
+} // namespace Executor
+} // namespace Luau
diff --git a/Executor/include/Luau/Executor.h b/Executor/include/Luau/Executor.h
new file mode 100644
index 00000000..6c6d9d40
--- /dev/null
+++ b/Executor/include/Luau/Executor.h
@@ -0,0 +1,438 @@
+// ServerLua: per-script execution engine shared with the script host.
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "lua.h"
+
+namespace Luau
+{
+namespace Executor
+{
+
+// Memory category for allocations that should not be billed to the script
+constexpr int kSystemMemcat = 0;
+// Memory category for allocations attributable to the script instance
+constexpr int kUserMemcat = LUA_FIRST_USER_MEMCAT;
+// Default (and normal maximum) per-script memory limit
+constexpr int kDefaultMemoryLimit = 1024 * 128;
+
+// Identifies which class a persisted payload belongs to, and which layout it
+// used. Bump `version` whenever that class's fields change.
+struct StateFingerprint
+{
+    char tag[4];
+    uint32_t version;
+};
+
+// Log levels for LogCallback
+enum class LogLevel : uint8_t
+{
+    Debug = 0,
+    Info,
+    Warn,
+};
+
+// Parameters that define the sealed image consumed by buildImage()
+struct ImageConfig
+{
+    // Luau bytecode with any host asset header already stripped off
+    const char* bytecode = nullptr;
+    size_t bytecodeSize = 0;
+    bool isLSL = false;
+    uint32_t apiVersion = 0;
+    // We want to leave open the possibility that we can change bytecode behind
+    // people's backs for upgrading reasons. Keep around the amount we want to
+    // actually "charge" them for the bytecode size for memory accounting purposes
+    // so this doesn't break scripts.
+    size_t chargedBytecodeSize = 0;
+    const char* chunkname = "=lua_script";
+    // Identifier used in build log messages. Probably an asset UUID.
+    const char* name = "";
+};
+
+// Per-placement parameters that can differ between two scripts running the
+// same asset, consumed by instantiateScript().
+struct ScriptConfig
+{
+    // Opaque identifier used as the log source for the script's messages
+    const char* scriptId = "";
+    int memoryLimit = kDefaultMemoryLimit;
+    // Opaque per-script host context copied onto the Script. In lscript terms,
+    // this is the `LLScriptExecuteLuau` instance.
+    void* hostContext = nullptr;
+};
+
+class IEnvironment;
+class IImage;
+class IProvisioner;
+class Script;
+
+// Receives an engine log message, already formatted. `source` identifies the
+// origin for attribution and throttling.
+using LogCallback = void (*)(LogLevel level, const char* source, const char* message);
+
+// Process-wide log sink, same shape as `Luau::assertHandler()`. Messages are
+// dropped while it's null.
+inline LogCallback& logCallback()
+{
+    static LogCallback callback = nullptr;
+    return callback;
+}
+
+// Format a message and hand it to the installed LogCallback. `source`
+// identifies the origin for attribution and throttling.
+void logDebug(const char* source, const char* fmt, ...) LUA_PRINTF_ATTR(2, 3);
+void logInfo(const char* source, const char* fmt, ...) LUA_PRINTF_ATTR(2, 3);
+void logWarn(const char* source, const char* fmt, ...) LUA_PRINTF_ATTR(2, 3);
+
+// Give the embedder a chance to plop their own things into the environment before it's
+// fully set up. This is called before GC fixing / ares perms registration.
+using PopulateEnvironmentCallback = void (*)(IEnvironment& environment, lua_State* L);
+
+// Host callback wiring, identical for every script of a provisioner.
+struct HostCallbacks
+{
+    lua_clockProvider clockProvider = nullptr;
+    lua_clockProvider performanceClockProvider = nullptr;
+    lua_randomProvider randomProvider = nullptr;
+    lua_setTimerEventCallback setTimerEventCb = nullptr;
+    lua_eventHandlerRegistrationCallback eventHandlerRegistrationCb = nullptr;
+    lua_clockProvider quantaClockProvider = nullptr;
+    PopulateEnvironmentCallback populateEnvironment = nullptr;
+};
+
+// An environment is... basically just a Lua VM with some particular settings. It's
+// intended for multiple of these to be able to be living at any given moment, one
+// for LSL, one for a particular version of the Lua API, etc.
+class IEnvironment
+{
+public:
+    virtual ~IEnvironment() = default;
+
+    virtual IProvisioner& getProvisioner() const = 0;
+    virtual bool isLSL() const = 0;
+    virtual uint32_t getAPIVersion() const = 0;
+
+    // The root lua_State this environment owns. Images' clone threads and
+    // forkservers all hang off it
+    virtual lua_State* getBaseState() const = 0;
+    // Threaddata seed for every non-script thread in the VM (base state,
+    // forkservers, build-time clones)
+    virtual lua_SLRuntimeState& getRuntimeState() = 0;
+};
+
+// The environment a `Provisioner` mints by default. Public so a host can
+// subclass it and hand its own back from `Provisioner::makeEnvironment()`.
+class Environment : public IEnvironment
+{
+public:
+    Environment(IProvisioner& provisioner, bool is_lsl, uint32_t api_version);
+    ~Environment() override;
+
+    Environment(const Environment&) = delete;
+    Environment& operator=(const Environment&) = delete;
+
+    IProvisioner& getProvisioner() const override { return mProvisioner; }
+    bool isLSL() const override { return mIsLSL; }
+    uint32_t getAPIVersion() const override { return mAPIVersion; }
+
+    lua_State* getBaseState() const override { return mBaseState; }
+
+    // `kind` stays `LUA_SLSTATE_BARE` so the engine callbacks know there is
+    // no `Script` behind our threads.
+    lua_SLRuntimeState& getRuntimeState() override { return mRuntimeState; }
+
+    // Stands the VM up. Run by the provisioner immediately after construction,
+    // so a subclass' constructor goes first and has nothing built to trip over.
+    // Templated on the script type because `lua_Callbacks` is per-VM, so the
+    // handlers have to be chosen here rather than per script.
+    template<typename S>
+    void build()
+    {
+        lua_State* L = openVM();
+        S::installVMCallbacks(L);
+
+        // Assigned last so nothing can reach a VM that isn't wired up yet
+        mBaseState = L;
+    }
+
+private:
+    // Everything up to the callbacks, kept out of the template so the library
+    // setup stays in the .cpp
+    lua_State* openVM();
+
+    IProvisioner& mProvisioner;
+    bool mIsLSL = false;
+    uint32_t mAPIVersion = 0;
+
+    lua_SLRuntimeState mRuntimeState;
+    lua_State* mBaseState = nullptr;
+};
+
+// A particular Instance of a given script's run state. Effectively, this is just
+// an RAII helper that holds onto a `lua_State*` in the registry and unrefs it
+// when it dies. Necessarily separate from `Script` because `Script`s need to keep
+// a stable object identity across reset() / deserialize(). Instance is probably
+// not a very descriptive name...
+class Instance
+{
+public:
+    Instance() = default;
+
+    // Adopts `thread`, releasing registry ref `ref` against `anchor_state` on
+    // destruction.
+    Instance(lua_State* thread, lua_State* anchor_state, int ref)
+        : mThread(thread)
+        , mAnchorState(anchor_state)
+        , mRef(ref)
+    {
+    }
+
+    Instance(const Instance&) = delete;
+    Instance& operator=(const Instance&) = delete;
+
+    Instance(Instance&& other) noexcept
+        : mThread(other.mThread)
+        , mAnchorState(other.mAnchorState)
+        , mRef(other.mRef)
+    {
+        other.mThread = nullptr;
+        other.mAnchorState = nullptr;
+        other.mRef = LUA_NOREF;
+    }
+
+    Instance& operator=(Instance&& other) noexcept
+    {
+        if (this != &other)
+        {
+            // Clear out our thread, we're taking another.
+            releaseThread();
+
+            mThread = other.mThread;
+            mAnchorState = other.mAnchorState;
+            mRef = other.mRef;
+            other.mThread = nullptr;
+            other.mAnchorState = nullptr;
+            other.mRef = LUA_NOREF;
+        }
+        return *this;
+    }
+
+    ~Instance() { releaseThread(); }
+
+    explicit operator bool() const { return mThread != nullptr; }
+    lua_State* thread() const { return mThread; }
+
+private:
+    void releaseThread()
+    {
+        if (mThread != nullptr)
+        {
+            // Unrefing it should cause it to be swept up by GC.
+            lua_unref(mAnchorState, mRef);
+        }
+        mThread = nullptr;
+        mAnchorState = nullptr;
+        mRef = LUA_NOREF;
+    }
+
+    lua_State* mThread = nullptr;
+    lua_State* mAnchorState = nullptr;
+    int mRef = LUA_NOREF;
+};
+
+
+class IImage
+{
+public:
+    virtual ~IImage() = default;
+
+    virtual bool isValid() const = 0;
+    // Load-failure message when isValid() is false
+    virtual const std::string& getError() const = 0;
+    virtual const std::string& getName() const = 0;
+    virtual IEnvironment& getEnvironment() const = 0;
+    virtual IProvisioner& getProvisioner() const = 0;
+    virtual bool isLSL() const = 0;
+    virtual uint32_t getAPIVersion() const = 0;
+
+    // Forks off an instance using the forkserver, either with the default
+    // state blob, or a provided one if we're resuming.
+    virtual Instance forkInstance(lua_SLRuntimeState* owner, const std::string* blob = nullptr) = 0;
+
+    // Serializes `instance` against this image's forkserver into `out`
+    virtual bool serializeInstance(const Instance& instance, std::string& out) = 0;
+
+    // The environment's bare runtime state, seed for each Script's live copy
+    virtual const lua_SLRuntimeState& getRuntimeState() const = 0;
+
+    // Full asset size charged against every script of this image
+    virtual size_t getChargedBytecodeSize() const = 0;
+
+    // Pristine pre-fork objects excluded from per-script memory accounting
+    virtual const lua_OpaqueGCObjectSet& getFreeObjects() const = 0;
+};
+
+// The image a `Provisioner` mints by default. Public so a host can subclass it
+// and hand its own back from `Provisioner::makeImage()`.
+class Image : public IImage
+{
+public:
+    Image(std::shared_ptr<IEnvironment> environment, const ImageConfig& config);
+    ~Image() override;
+
+    Image(const Image&) = delete;
+    Image& operator=(const Image&) = delete;
+
+    bool isValid() const override { return mForkerState != nullptr; }
+    const std::string& getError() const override { return mError; }
+    const std::string& getName() const override { return mName; }
+    IEnvironment& getEnvironment() const override { return *mEnvironment; }
+    IProvisioner& getProvisioner() const override { return mEnvironment->getProvisioner(); }
+    bool isLSL() const override { return mIsLSL; }
+    uint32_t getAPIVersion() const override { return mAPIVersion; }
+
+    Instance forkInstance(lua_SLRuntimeState* owner, const std::string* blob) override;
+    bool serializeInstance(const Instance& instance, std::string& out) override;
+
+    const lua_SLRuntimeState& getRuntimeState() const override { return mEnvironment->getRuntimeState(); }
+    size_t getChargedBytecodeSize() const override { return mChargedBytecodeSize; }
+    const lua_OpaqueGCObjectSet& getFreeObjects() const override { return mFreeObjects; }
+
+    // Loads the bytecode and stands up the forkserver. Run by the provisioner
+    // immediately after construction, same as `Environment::build()`. A failure
+    // leaves `isValid()` false with `getError()` explaining, and the
+    // environment still usable.
+    void build(const ImageConfig& config);
+
+private:
+    // Source string for log messages
+    const char* logSource() const { return mName.c_str(); }
+
+    // Keeps the environment alive for as long as the image exists
+    std::shared_ptr<IEnvironment> mEnvironment;
+
+    bool mIsLSL = false;
+    uint32_t mAPIVersion = 0;
+
+    // Ares forkserver thread holding the pristine post-load snapshot,
+    // anchored in the environment's registry
+    lua_State* mForkerState = nullptr;
+    int mForkerRef = LUA_NOREF;
+    // Pristine pre-fork objects excluded from per-script memory accounting
+    lua_OpaqueGCObjectSet mFreeObjects;
+
+    size_t mChargedBytecodeSize = 0;
+    std::string mName;
+    std::string mError;
+};
+
+
+class IProvisioner
+{
+public:
+    virtual ~IProvisioner() = default;
+
+    virtual const HostCallbacks& getCallbacks() const = 0;
+
+    virtual std::shared_ptr<IEnvironment> createEnvironment(bool is_lsl, uint32_t api_version) = 0;
+    virtual std::shared_ptr<IImage> buildImage(std::shared_ptr<IEnvironment> environment, const ImageConfig& config) = 0;
+    virtual std::shared_ptr<Script> instantiateScript(const std::shared_ptr<IImage>& image, const ScriptConfig& config) = 0;
+};
+
+// `S` is the script type this provisioner mints. Both the factory and the VM
+// callbacks come from it, so they cannot disagree - the handlers
+// `S::installVMCallbacks` installs downcast what `Script::fromLuaState()`
+// returns, and that only holds while every script here really is an `S`.
+template<typename S = Script>
+class Provisioner : public IProvisioner
+{
+public:
+    explicit Provisioner(const HostCallbacks& callbacks)
+        : mCallbacks(callbacks)
+    {
+        if (mCallbacks.quantaClockProvider == nullptr)
+            mCallbacks.quantaClockProvider = defaultQuantaClock;
+    }
+
+    Provisioner(const Provisioner&) = delete;
+    Provisioner& operator=(const Provisioner&) = delete;
+
+    const HostCallbacks& getCallbacks() const override { return mCallbacks; }
+
+    std::shared_ptr<IEnvironment> createEnvironment(bool is_lsl, uint32_t api_version) override
+    {
+        std::shared_ptr<Environment> environment = makeEnvironment(is_lsl, api_version);
+        environment->build<S>();
+        return environment;
+    }
+
+    std::shared_ptr<IImage> buildImage(std::shared_ptr<IEnvironment> environment, const ImageConfig& config) override
+    {
+        if (environment == nullptr || &environment->getProvisioner() != this)
+        {
+            logWarn(config.name ? config.name : "", "Refusing to build image in an environment provisioned elsewhere");
+            return nullptr;
+        }
+        if (environment->isLSL() != config.isLSL || environment->getAPIVersion() != config.apiVersion)
+        {
+            logWarn(config.name ? config.name : "", "Refusing to build image in an environment of a different flavor");
+            return nullptr;
+        }
+
+        std::shared_ptr<Image> image = makeImage(std::move(environment), config);
+        image->build(config);
+        return image;
+    }
+
+    std::shared_ptr<Script> instantiateScript(const std::shared_ptr<IImage>& image, const ScriptConfig& config) override
+    {
+        if (image == nullptr || &image->getProvisioner() != this)
+        {
+            logWarn("", "Refusing to instantiate image provisioned elsewhere");
+            return nullptr;
+        }
+        if (!image->isValid())
+        {
+            logWarn(image->getName().c_str(), "Refusing to instantiate invalid image");
+            return nullptr;
+        }
+
+        return std::make_shared<S>(image, config);
+    }
+
+    // Convenience method so you don't have to do the above manually.
+    std::shared_ptr<Script> provisionScript(const ImageConfig& image_config, const ScriptConfig& script_config)
+    {
+        std::shared_ptr<IImage> image = buildImage(createEnvironment(image_config.isLSL, image_config.apiVersion), image_config);
+        if (image == nullptr)
+            return nullptr;
+
+        // instantiateScript() logs the refusal for an invalid image
+        return instantiateScript(image, script_config);
+    }
+
+protected:
+    // Override to mint your own types. The tiers hold each other by interface,
+    // so a subclass is free to return anything deriving from these, and to
+    // downcast what it gets back from `Script::fromLuaState()` and friends.
+    virtual std::shared_ptr<Environment> makeEnvironment(bool is_lsl, uint32_t api_version)
+    {
+        return std::make_shared<Environment>(*this, is_lsl, api_version);
+    }
+
+    virtual std::shared_ptr<Image> makeImage(std::shared_ptr<IEnvironment> environment, const ImageConfig& config)
+    {
+        return std::make_shared<Image>(std::move(environment), config);
+    }
+
+private:
+    static double defaultQuantaClock([[maybe_unused]] lua_State* L) { return lua_clock(); }
+
+    HostCallbacks mCallbacks;
+};
+
+} // namespace Executor
+} // namespace Luau
diff --git a/Executor/include/Luau/Script.h b/Executor/include/Luau/Script.h
new file mode 100644
index 00000000..e842431c
--- /dev/null
+++ b/Executor/include/Luau/Script.h
@@ -0,0 +1,238 @@
+// ServerLua: the per-script runtime instance driven by the script host.
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "lua.h"
+
+#include "Luau/ByteStream.h"
+#include "Luau/Executor.h"
+
+namespace Luau
+{
+namespace Executor
+{
+
+enum class HandlerRunStatus : uint8_t
+{
+    // Handler ran to completion, handler thread was reset
+    Ok = 0,
+    // Handler was preempted or yielded mid-execution, resume it later
+    Preempted,
+    // LSL only. handler requested a state change and finished, newState holds
+    // the new state number
+    StateChange,
+    // Handler errored, fault fields were updated, handler thread was reset
+    Fault,
+    // The script has no handler for this event
+    NotRun,
+    // There's already a handler function staged, we can't run this.
+    Refused,
+};
+
+enum class FaultKind : uint8_t
+{
+    None = 0,
+    Runtime,
+    OutOfMemory,
+    Timeout,
+    UnexpectedYield,
+    Unknown = 255,
+};
+
+struct RunResult
+{
+    HandlerRunStatus status = HandlerRunStatus::Ok;
+    int newState = 0;
+    // True when this run cleanly completed the SLua main function, so the
+    // host can finalize its view of the handler registrations exactly once.
+    bool mainFunctionCompleted = false;
+};
+
+// Payload format written by Script::serializeState(). The version covers the
+// whole layout, so a subclass that appends its own fields has to bump its own
+// fingerprint whenever this one moves.
+constexpr StateFingerprint kScriptStateFingerprint{{'E', 'X', 'E', 'C'}, 1};
+
+// We need to carry around the error messages in our state, but
+// the messages can be arbitrarily large. Cap them.
+constexpr size_t kMaxPersistedFaultLen = 2048;
+
+// Callback used to push args after an event handler function to
+// prepare it to be called.
+using PushArgsFn = void (*)(lua_State* handler, void* ctx);
+
+// Our analogue of the LLScriptExecute object present in indra.
+class Script : protected lua_SLRuntimeState
+{
+public:
+    Script(const std::shared_ptr<IImage>& image, const ScriptConfig& config);
+
+    virtual ~Script();
+
+    Script(const Script&) = delete;
+    Script& operator=(const Script&) = delete;
+
+    IProvisioner& getProvisioner() const { return mImage->getProvisioner(); }
+    IImage& getImage() const { return *mImage; }
+    IEnvironment& getEnvironment() const { return mImage->getEnvironment(); }
+    bool isLSL() const { return mIsLSL; }
+    uint32_t getAPIVersion() const { return mAPIVersion; }
+
+    // Recover the script from any thread in its instance tree
+    static Script* fromLuaState(lua_State* L);
+
+    // Installs the interrupt, userthread and allocation callbacks a script
+    // needs onto a freshly created VM. Generally done when the environment
+    // is created.
+    static void installVMCallbacks(lua_State* L);
+
+    lua_State* getInstanceState() const { return mInstance.thread(); }
+    // The handler thread while a handler is executing, null otherwise. Lets us
+    // distinguish between the engine-created top-level handler thread and any
+    // descendant threads created by the script.
+    lua_State* getHandlerState() const { return mHandlerState; }
+    // True while a forked instance exists (reset()/restoreState() succeeded)
+    bool hasInstance() const { return (bool)mInstance; }
+
+    // Forks the image's pristine default state into a fresh instance. Only
+    // valid while no instance exists, same as restoreState().
+    bool loadDefaultState();
+
+    // Drops any live instance and returns the script to the image's default
+    // state. Unlike loadDefaultState(), this is valid at any time.
+    bool reset();
+
+    // Start a run window for `quanta` seconds
+    void beginRunWindow(double quanta);
+    // True once the engine has decided the current run window is over, sticky
+    // for the rest of the window.
+    bool isYieldDue() const { return mYieldDue; }
+
+    // Level-triggered forced preemption, port of the host's
+    // `getReset() || !mIsEnabled` check. The host both sets and clears it.
+    void setForceYield(bool force) { mForceYield = force; }
+
+    void *getHostContext() const { return mHostContext; }
+
+    // Call an event handler associated with the given state, works for both
+    // LSL and Lua.
+    RunResult callEventHandler(int lsl_state, const char* event_name, PushArgsFn pushArgs, void* push_args_ctx = nullptr);
+    // Resumes a previously preempted handler (or the staged SLua main function)
+    RunResult resumeEventHandler();
+    // True when the handler thread holds a resumable in-progress handler
+    bool isHandlerActive() const;
+    // Discards a resumable in-progress handler without completing it, so a
+    // host can recover from disagreement about whether a handler is in
+    // flight. A no-op when nothing is resumable.
+    void abortHandler();
+
+    bool isMainFunctionComplete() const { return mMainFunctionComplete; }
+
+    // Always returns false for Lua scripts, only used for LSL.
+    bool hasLSLEventHandler(int lsl_state, const char* event_name);
+
+    bool serializeState(std::string& out);
+
+    // Rebuilds the instance from a serializeState() payload. Only valid while
+    // no valid instance exists.
+    bool restoreState(const char* data, size_t len);
+
+    int getUsedMemory();
+    bool setMemoryLimit(int memory_limit);
+    void setMemoryLimitUnsafe(int memory_limit);
+    int getMemoryLimit() const { return mMemoryLimit; }
+
+    FaultKind getFaultKind() const { return mFaultKind; }
+    const std::string& getFaultString() const { return mFaultString; }
+    // Fault message plus a debug traceback when one was available
+    const std::string& getExtendedFaultString() const { return mExtendedFaultString; }
+    void clearFault();
+    void setFault(FaultKind kind, const char* fault_string, const char* extended = nullptr);
+
+    // How long we've been told to sleep. Never decremented, only zeroed out when the scheduler
+    // decides we're done the sleep.
+    float getSleep() const { return mSleep; }
+    void setSleep(float sleep) { mSleep = sleep; }
+
+protected:
+    // Written at the head of every payload this class produces, and required to
+    // match on restore. Subclasses return their own so a payload meant for
+    // another class is refused before anything is forked.
+    virtual StateFingerprint getStateFingerprint() const { return kScriptStateFingerprint; }
+
+    // Durable subclass state, written after our own fields. A subclass partway
+    // down a hierarchy chains to its base before writing or reading its own.
+    virtual bool serializeExtra(ByteWriter&) const { return true; }
+    virtual bool restoreExtra(ByteReader&) { return true; }
+
+    static void interruptHandler(lua_State* L, int gc);
+    static int memoryLimitCallback(lua_State* L, size_t osize, size_t nsize);
+    static void userThreadCallback(lua_State* LP, lua_State* L);
+
+    // Source string for log messages, so subclasses log with the same attribution
+    const char* logSource() const { return mScriptId.c_str(); }
+
+private:
+    class ExecutionScope;
+    class HandlerScope;
+
+    void tryYield(lua_State* L, double elapsed, bool mandatory = false);
+    void setLuaFaultFromStatus(lua_State* L, int status);
+    RunResult handleEventHandlerStatus(int status);
+    void destroyHandlerThread();
+    void pushEventHandlerFunction(lua_State* L, int lsl_state, const char* event_name);
+
+    // Opaque per-script host context copied onto the Script. In lscript terms,
+    // this is the `LLScriptExecuteLuau` instance.
+    void* mHostContext = nullptr;
+
+    // Keeps the image (and through it the environment) alive for as long
+    // as the script exists
+    std::shared_ptr<IImage> mImage;
+
+    // Cached properties from the parent `IImage` to reduce pointer chasing
+    bool mIsLSL = false;
+    uint32_t mAPIVersion = 0;
+    size_t mChargedBytecodeSize = 0;
+    std::string mScriptId;
+
+    // Underlying state instance currently associated with this Script container.
+    // The state itself may be nullptr as a sentinel to indicate that we're not
+    // currently able to run this (e.g. due to a script fault, or not yet started)
+    Instance mInstance;
+    // Points at the handler thread only while a handler is executing
+    lua_State* mHandlerState = nullptr;
+
+    int mMemoryLimit = kDefaultMemoryLimit;
+    int mExactSize = 0;
+    int mMaxPossibleSize = 0;
+    bool mExactSizeDirty = true;
+
+    // Monotonic stopwatch used for quanta-elapsed measurement, seeded from the
+    // provisioner's.
+    lua_clockProvider mQuantaClockProvider = nullptr;
+
+    // When did we start running
+    double mWindowStart = 0.0;
+    // How long are we supposed to run?
+    double mQuanta = 0.0;
+    float mSleep = 0.0f;
+    // The engine has decided that the run window is over.
+    bool mYieldDue = false;
+    // We already threw a catchable error trying to force a yield.
+    bool mMandatoryYieldRaised = false;
+    bool mInExecution = false;
+    bool mMainFunctionComplete = false;
+    // The host has indicated that a yield should happen at the next interrupt.
+    // TODO: Hmm. Seems whe might be able to merge this with `mYieldDue` if we're smart.
+    bool mForceYield = false;
+
+    FaultKind mFaultKind = FaultKind::None;
+    std::string mFaultString;
+    std::string mExtendedFaultString;
+};
+
+} // namespace Executor
+} // namespace Luau
diff --git a/Executor/src/Executor.cpp b/Executor/src/Executor.cpp
new file mode 100644
index 00000000..563f0754
--- /dev/null
+++ b/Executor/src/Executor.cpp
@@ -0,0 +1,299 @@
+#include "Luau/Executor.h"
+#include "Luau/Script.h"
+
+#include <utility>
+
+#include "lualib.h"
+#include "llsl.h"
+
+#include "lstate.h"
+
+namespace Luau
+{
+namespace Executor
+{
+
+static const luaL_Reg kSafeLuaLibs[] = {
+    {"", luaopen_base},
+    {LUA_COLIBNAME, luaopen_coroutine},
+    {LUA_TABLIBNAME, luaopen_table},
+    {LUA_OSLIBNAME, luaopen_os},
+    {LUA_STRLIBNAME, luaopen_string},
+    {LUA_MATHLIBNAME, luaopen_math},
+    {LUA_DBLIBNAME, luaopen_debug},
+    {LUA_UTF8LIBNAME, luaopen_utf8},
+    {LUA_BITLIBNAME, luaopen_bit32},
+    // Erm, this is basically never safe to expose directly.
+    // {LUA_ERISLIBNAME, luaopen_eris},
+    {LUA_BUFFERLIBNAME, luaopen_buffer},
+    {LUA_VECLIBNAME, luaopen_vector},
+    {LUA_CJSONLIBNAME, luaopen_cjson},
+    {LUA_LLBASE64LIBNAME, luaopen_llbase64},
+    {NULL, NULL},
+};
+
+// These have to be removed so that people can't mess with globals dynamically
+// and de-optimize the script.
+static const char* const kGlobalsToRemove[] = {
+    "getfenv",
+    "setfenv",
+};
+
+// A replacement for `coroutine.running()` that won't return handles for the
+// handler thread or the instance root. Mostly to stop people manually
+// `resume()`ing or `close()`ing them.
+static int lcorolib_running(lua_State* L)
+{
+    Script* script = Script::fromLuaState(L);
+    if (script && (L == script->getHandlerState() || L == script->getInstanceState()))
+    {
+        // You're not allowed to touch these
+        lua_pushnil(L);
+        return 1;
+    }
+
+    if (lua_pushthread(L))
+        lua_pushnil(L);
+    return 1;
+}
+
+// A replacement for `gcinfo()` that reports the calling script's memory
+// rather than the whole VM's, which would leak co-resident scripts' usage.
+static int gcinfo(lua_State* L)
+{
+    // User code only ever runs on script threads
+    Script* script = Script::fromLuaState(L);
+    if (script == nullptr)
+        return 0;
+
+    // Luau expects this to be in KB with no fractional part
+    // Let the fractional component through since bytes matter for us :)
+    lua_pushnumber(L, (double)script->getUsedMemory() / 1024);
+    return 1;
+}
+
+// Basically `luaL_openlibs()`, but the specific subset we consider safe.
+static void open_safe_libs(lua_State* L)
+{
+    lua_checkstack(L, 10);
+    for (const luaL_Reg* lib = kSafeLuaLibs; lib->func; lib++)
+    {
+        lua_pushcfunction(L, lib->func, NULL);
+        lua_pushstring(L, lib->name);
+        lua_call(L, 1, 0);
+    }
+
+    for (const char* to_remove : kGlobalsToRemove)
+    {
+        lua_pushnil(L);
+        lua_setglobal(L, to_remove);
+    }
+
+    lua_pushcfunction(L, gcinfo, "gcinfo");
+    lua_setglobal(L, "gcinfo");
+
+    // Now replace `coroutine.running()` with our bodged version.
+    lua_getglobal(L, "coroutine");
+    lua_pushcfunction(L, lcorolib_running, "lcorolib_running");
+    lua_rawsetfield(L, -2, "running");
+    lua_pop(L, 1);
+}
+
+Environment::Environment(IProvisioner& provisioner, bool is_lsl, uint32_t api_version)
+    : mProvisioner(provisioner)
+    , mIsLSL(is_lsl)
+    , mAPIVersion(api_version)
+{
+    mRuntimeState.slIdentifier = is_lsl ? LUA_LSL_IDENTIFIER : LUA_SL_IDENTIFIER;
+}
+
+Environment::~Environment()
+{
+    if (mBaseState)
+    {
+        lua_close(mBaseState);
+    }
+}
+
+lua_State* Environment::openVM()
+{
+    lua_State* L = luaL_newstate();
+    lua_setthreaddata(L, &getRuntimeState());
+
+    open_safe_libs(L);
+
+    // Both of these return their tables, pop them.
+    luaopen_sl(L, false);
+    if (mIsLSL)
+    {
+        luaopen_lsl(L);
+        lua_pop(L, 1);
+    }
+    luaopen_ll(L, false);
+    lua_pop(L, 1);
+    LUAU_ASSERT(lua_gettop(L) == 0);
+
+    const PopulateEnvironmentCallback populate = getProvisioner().getCallbacks().populateEnvironment;
+    if (populate != nullptr)
+        populate(*this, L);
+    LUAU_ASSERT(lua_gettop(L) == 0);
+
+    // Protect core libraries and metatables from modification
+    luaL_sandbox(L);
+
+    // Register constants we need for serialization
+    eris_register_perms(L, true);
+    eris_register_perms(L, false);
+
+    lua_fixallcollectable(L);
+
+    return L;
+}
+
+Image::Image(std::shared_ptr<IEnvironment> environment, const ImageConfig& config)
+    : mEnvironment(std::move(environment))
+    , mIsLSL(config.isLSL)
+    , mAPIVersion(config.apiVersion)
+    , mChargedBytecodeSize(config.chargedBytecodeSize)
+    , mName(config.name ? config.name : "")
+{
+}
+
+Image::~Image()
+{
+    if (mForkerState)
+    {
+        lua_unref(mEnvironment->getBaseState(), mForkerRef);
+    }
+}
+
+void Image::build(const ImageConfig& config)
+{
+    lua_State* L = mEnvironment->getBaseState();
+
+    if (config.bytecode == nullptr || config.bytecodeSize == 0)
+    {
+        mError = "Invalid bytecode";
+        return;
+    }
+    LUAU_ASSERT(lua_gettop(L) == 0);
+
+    // Make sure we create the thread with a user memcat!
+    lua_State* clone_base = nullptr;
+    {
+        MemcatGuard guard{L, kUserMemcat};
+        clone_base = lua_newthread(L);
+    }
+    // Uses the active memcat on `clone_base` to create the globals table.
+    luaL_sandboxthread(clone_base);
+
+    int result;
+    {
+        // Protos and their constituent constants need to be loaded with the user memcat.
+        // This works out because even if things are interned cross-script, we know which
+        // user memcat objects should be considered "free" for the user, generally constants.
+        MemcatGuard guard{clone_base, kUserMemcat};
+        result = luau_load(clone_base, config.chunkname ? config.chunkname : "=lua_script", config.bytecode, config.bytecodeSize, 0);
+    }
+    if (result != 0)
+    {
+        const char* error_str = lua_tostring(clone_base, -1);
+        mError = error_str ? error_str : "unknown error";
+        logWarn(logSource(), "Failed to load Luau bytecode: %s", mError.c_str());
+        // Drop the clone thread, the environment stays usable
+        lua_pop(L, 1);
+        return;
+    }
+
+    // pristine pre-fork objects
+    mFreeObjects = lua_collectfreeobjects(clone_base);
+    lua_State* forker = eris_make_forkserver(clone_base);
+    // Anchor the forkserver in the registry
+    mForkerRef = lua_ref(L, -1);
+    // And now we're fine to pop the forker and clone.
+    lua_pop(L, 2);
+    LUAU_ASSERT(lua_gettop(L) == 0);
+
+    // Assigned last so isValid() only flips once the whole build succeeded
+    mForkerState = forker;
+}
+
+Instance Image::forkInstance(lua_SLRuntimeState* owner, const std::string* blob)
+{
+    lua_State* base = mEnvironment->getBaseState();
+
+    if (blob != nullptr)
+    {
+        // Push the serialized state for the forker to rehydrate from
+        lua_pushlstring(mForkerState, blob->data(), blob->size());
+    }
+
+    // `owner` is passed down so any newly-created threads in here get associated with `owner`. Generally
+    // `owner` is a `Script` requesting an instance due to a load or reset.
+    lua_State* thread = eris_fork_thread(mForkerState, blob == nullptr, kUserMemcat, owner);
+
+    if (thread == nullptr)
+    {
+        const char* error_str = lua_tostring(mForkerState, -1);
+        if (blob == nullptr)
+        {
+            // Forking the pristine instance failing is an engine bug rather
+            // than anything a script can provoke.
+            logWarn(logSource(), "Failed to deserialize default state: %s", error_str ? error_str : "unknown error");
+            lua_dumpstack(mForkerState);
+        }
+        else
+        {
+            logWarn(logSource(), "Failed to parse script state %s", error_str ? error_str : "unknown error");
+        }
+        lua_pop(mForkerState, 1);
+        return Instance();
+    }
+
+    LUAU_ASSERT(lua_tothread(base, -1) == thread);
+    // We got something we can use, anchor it to the registry and make an Instance out of it.
+    Instance instance(thread, base, lua_ref(base, -1));
+    lua_pop(base, 1);
+
+    return instance;
+}
+
+bool Image::serializeInstance(const Instance& instance, std::string& out)
+{
+    // The string-serialized state ends up on the forker thread
+    int start_forker_top = lua_gettop(mForkerState);
+    int status = eris_serialize_thread(mForkerState, instance.thread());
+
+    if (status != LUA_OK)
+    {
+        // Top of the stack should be the error message
+        const char* error_str = status == LUA_ERRRUN ? lua_tostring(mForkerState, -1) : nullptr;
+        if (error_str != nullptr)
+        {
+            logWarn(logSource(), "Failed to serialize script state %s", error_str);
+        }
+        else
+        {
+            logWarn(logSource(), "Failed to serialize script state with error code %d", status);
+        }
+        // Pop off anything that might have been pushed on by an error handler
+        lua_settop(mForkerState, start_forker_top);
+        return false;
+    }
+
+    size_t data_len;
+    const char* data = lua_tolstring(mForkerState, -1, &data_len);
+    if (data == nullptr)
+    {
+        logWarn(logSource(), "Serialized script state is not a string");
+        lua_settop(mForkerState, start_forker_top);
+        return false;
+    }
+    out.assign(data, data_len);
+    // Get rid of the string copy managed by Lua
+    lua_pop(mForkerState, 1);
+    return true;
+}
+
+} // namespace Executor
+} // namespace Luau
diff --git a/Executor/src/Logging.cpp b/Executor/src/Logging.cpp
new file mode 100644
index 00000000..b035e03b
--- /dev/null
+++ b/Executor/src/Logging.cpp
@@ -0,0 +1,64 @@
+#include "Luau/Executor.h"
+
+#include <cstdarg>
+#include <cstdio>
+#include <string>
+
+namespace Luau
+{
+namespace Executor
+{
+
+static std::string vformat(const char* fmt, va_list args)
+{
+    va_list measure;
+    va_copy(measure, args);
+    int needed = vsnprintf(nullptr, 0, fmt, measure);
+    va_end(measure);
+
+    if (needed <= 0)
+        return std::string();
+
+    std::string out;
+    out.resize((size_t)needed + 1);
+    vsnprintf(&out[0], out.size(), fmt, args);
+    out.pop_back();
+    return out;
+}
+
+static void vlog(LogLevel level, const char* source, const char* fmt, va_list args)
+{
+    LogCallback callback = logCallback();
+    if (callback == nullptr)
+        return;
+
+    std::string message = vformat(fmt, args);
+    callback(level, source, message.c_str());
+}
+
+void logDebug(const char* source, const char* fmt, ...)
+{
+    va_list args;
+    va_start(args, fmt);
+    vlog(LogLevel::Debug, source, fmt, args);
+    va_end(args);
+}
+
+void logInfo(const char* source, const char* fmt, ...)
+{
+    va_list args;
+    va_start(args, fmt);
+    vlog(LogLevel::Info, source, fmt, args);
+    va_end(args);
+}
+
+void logWarn(const char* source, const char* fmt, ...)
+{
+    va_list args;
+    va_start(args, fmt);
+    vlog(LogLevel::Warn, source, fmt, args);
+    va_end(args);
+}
+
+} // namespace Executor
+} // namespace Luau
diff --git a/Executor/src/Script.cpp b/Executor/src/Script.cpp
new file mode 100644
index 00000000..e2b56da0
--- /dev/null
+++ b/Executor/src/Script.cpp
@@ -0,0 +1,930 @@
+#include "Luau/Script.h"
+
+#include <algorithm>
+#include <cstdio>
+#include <cstring>
+#include <exception>
+
+#include "lualib.h"
+#include "llsl.h"
+
+#include "lstate.h"
+
+namespace Luau
+{
+namespace Executor
+{
+
+// Buckets unrecognized persisted fault kinds instead of trusting the byte
+static FaultKind validate_fault_kind(uint8_t kind)
+{
+    if (kind <= (uint8_t)FaultKind::UnexpectedYield || kind == (uint8_t)FaultKind::Unknown)
+        return (FaultKind)kind;
+    return FaultKind::Unknown;
+}
+
+// basically just lua_resume, but it catches hard OoM errors too.
+static int safe_lua_resume(lua_State* L, lua_State* from, int nargs)
+{
+    try
+    {
+        return lua_resume(L, from, nargs);
+    }
+    catch (lua_exception& ex)
+    {
+        // What can escape lua_resume's protected path is an allocation failure
+        // at the memory limit while the error object is being materialized.
+        if (ex.getStatus() == LUA_ERRMEM)
+        {
+            return LUA_ERRMEM;
+        }
+        throw;
+    }
+}
+
+// Used when we're executing something in the current scope. Generally
+// only used via its subclass `HandlerScope` except in the LSL ctor case.
+class Script::ExecutionScope
+{
+public:
+    explicit ExecutionScope(Script* execute)
+        : mExecute(execute)
+    {
+        LUAU_ASSERT(!execute->mInExecution);
+        execute->mInExecution = true;
+        // If we started running this then we expect there to be allocations.
+        // The exact size is almost certainly going to be dirty.
+        execute->mExactSizeDirty = true;
+    }
+    ~ExecutionScope()
+    {
+        mExecute->mInExecution = false;
+        mExecute->mExactSizeDirty = true;
+    }
+
+private:
+    Script* mExecute;
+};
+
+// Cleans up handler context when throwing
+// Handler context is a lot more sensitive and we _really_ don't want to mess it up,
+// so we use RAII to ensure it's always sane when the stack is unwound.
+class Script::HandlerScope
+{
+public:
+    HandlerScope(Script* execute, bool new_thread)
+        : mExecute(execute)
+        , mExecutionScope(execute)
+    {
+        lua_State* instance = execute->mInstance.thread();
+        if (new_thread)
+        {
+            // Handler thread lives permanently at position 1 on the instance and gets
+            // reset via lua_resetthread between handlers - no allocation needed here.
+            LUAU_ASSERT(lua_gettop(instance) == 1);
+            LUAU_ASSERT(lua_isthreadreset(lua_tothread(instance, 1)));
+        }
+        else
+        {
+            LUAU_ASSERT(lua_gettop(instance) == 1);
+        }
+
+        LUAU_ASSERT(!execute->mHandlerState);
+        execute->mHandlerState = lua_tothread(instance, 1);
+        LUAU_ASSERT(execute->mHandlerState != nullptr);
+    }
+    ~HandlerScope()
+    {
+        mExecute->mHandlerState = nullptr;
+    }
+
+private:
+    Script* mExecute;
+    ExecutionScope mExecutionScope;
+};
+
+Script::Script(const std::shared_ptr<IImage>& image, const ScriptConfig& config)
+    // Each script gets (well, _is_) its own lua_SLRuntimeState.
+    : lua_SLRuntimeState(image->getRuntimeState())
+    , mHostContext(config.hostContext)
+    , mImage(image)
+    , mIsLSL(image->isLSL())
+    , mAPIVersion(image->getAPIVersion())
+    , mChargedBytecodeSize(image->getChargedBytecodeSize())
+    , mScriptId(config.scriptId ? config.scriptId : "")
+    , mMemoryLimit(config.memoryLimit)
+{
+    LUAU_ASSERT(image->isValid());
+
+    // This will mark our `lua_State` (and those of any of our child threads) as being owned
+    // by a `Script`, and that `L->userdata` may be cast to a `Script*` to get back to `this`
+    // from our `mInstance`'s `lua_State`.
+    slStateKind = LUA_SLSTATE_SCRIPT;
+
+    // Copy all these callbacks into members so we have quick access.
+    const HostCallbacks& callbacks = image->getProvisioner().getCallbacks();
+    clockProvider = callbacks.clockProvider;
+    performanceClockProvider = callbacks.performanceClockProvider;
+    randomProvider = callbacks.randomProvider;
+    setTimerEventCb = callbacks.setTimerEventCb;
+    eventHandlerRegistrationCb = callbacks.eventHandlerRegistrationCb;
+    mQuantaClockProvider = callbacks.quantaClockProvider;
+}
+
+Script::~Script()
+{
+    LUAU_ASSERT(!mHandlerState && !mInExecution);
+    // Nothing to do: mInstance releases its anchor before mImage lets go of
+    // the VM, by member declaration order.
+}
+
+// static
+void Script::installVMCallbacks(lua_State* L)
+{
+    lua_Callbacks* callbacks = lua_callbacks(L);
+    callbacks->interrupt = Script::interruptHandler;
+    callbacks->userthread = Script::userThreadCallback;
+    callbacks->beforeallocate = Script::memoryLimitCallback;
+}
+
+// Given an arbitrary `lua_State*`, see if it can be traced back to a
+// particular `Script`
+Script* Script::fromLuaState(lua_State* L)
+{
+    auto* runtime_state = static_cast<lua_SLRuntimeState*>(L->userdata);
+    if (runtime_state == nullptr)
+        return nullptr;
+    if ((runtime_state->slIdentifier & LUA_SL_IDENTIFIER_MASK) != LUA_SL_IDENTIFIER)
+        return nullptr;
+    if (runtime_state->slStateKind != LUA_SLSTATE_SCRIPT)
+        return nullptr;
+    return static_cast<Script*>(runtime_state);
+}
+
+bool Script::reset()
+{
+    LUAU_ASSERT(!mInExecution);
+
+    // Whatever was running is forfeit, so we always satisfy loadDefaultState()'s
+    // "no live instance" precondition.
+    mInstance = Instance();
+
+    return loadDefaultState();
+}
+
+bool Script::loadDefaultState()
+{
+    LUAU_ASSERT(!mInExecution);
+
+    if (mInstance)
+    {
+        logWarn(logSource(), "Refusing to load the default state over a live script instance");
+        setFault(FaultKind::Runtime, "invalid script state");
+        return false;
+    }
+
+    mMaxPossibleSize = 0;
+    mExactSize = 0;
+    mExactSizeDirty = true;
+    mYieldDue = false;
+    mMandatoryYieldRaised = false;
+    mSleep = 0.0f;
+    // in LSL we treat the main function as complete, since it runs
+    // while loading the image.
+    mMainFunctionComplete = mIsLSL;
+    clearFault();
+
+    // Alright, let's fork off a new instance
+    mInstance = mImage->forkInstance(this);
+    if (!mInstance)
+    {
+        setFault(FaultKind::Runtime, "Failed to fork script instance");
+        return false;
+    }
+    lua_State* instance = mInstance.thread();
+
+    // Attach the LLEvents/LLTimers managers for SLua
+    if (!mIsLSL)
+    {
+        luaSL_createeventmanager(instance);
+        lua_pushvalue(instance, -1);
+        lua_pushvalue(instance, -1);
+        lua_setglobal(instance, "LLEvents");
+        lua_setglobal(instance, LLEVENTS_GLOBAL_NAME);
+
+        luaSL_createtimermanager(instance);
+        lua_pushvalue(instance, -1);
+        lua_setglobal(instance, "LLTimers");
+        lua_setglobal(instance, LLTIMERS_GLOBAL_NAME);
+    }
+
+    if (mIsLSL)
+    {
+        // Let the "constructor" run for trivial LSL scripts
+        int status;
+        {
+            ExecutionScope script_scope(this);
+            // Make sure allocs are attributed to the user script
+            MemcatGuard guard{instance, kUserMemcat};
+            status = safe_lua_resume(instance, nullptr, 0);
+        }
+
+        // If the constructor failed or yielded... something terrible happened.
+        if (status != LUA_OK)
+        {
+            setLuaFaultFromStatus(instance, status);
+            // This is most likely to happen if someone induces OoMs due to list construction in the constructor.
+            logWarn(logSource(), "LSL constructor failed somehow?");
+            mInstance = Instance();
+            return false;
+        }
+
+        // Create persistent handler thread. Stack is empty after constructor.
+        lua_newthread(instance);
+        LUAU_ASSERT(lua_getmemcat(lua_tothread(instance, 1)) == kUserMemcat);
+    }
+    else
+    {
+        // Create persistent handler thread and move the main function onto it.
+        // The main function may define locals that handlers close over, but that's fine:
+        // lua_resetthread calls luaF_close which migrates open upvalues to heap-allocated
+        // copies, so handler closures in LLEvents/globals continue to work.
+        lua_newthread(instance);
+        lua_insert(instance, 1);
+        LUAU_ASSERT(lua_getmemcat(lua_tothread(instance, 1)) == kUserMemcat);
+        lua_xmove(instance, lua_tothread(instance, 1), 1);
+    }
+
+    LUAU_ASSERT(lua_gettop(instance) == 1);
+    return true;
+}
+
+void Script::beginRunWindow(double quanta)
+{
+    LUAU_ASSERT(mInstance);
+    mYieldDue = false;
+    mMandatoryYieldRaised = false;
+    mWindowStart = mQuantaClockProvider(mInstance.thread());
+    mQuanta = quanta;
+}
+
+RunResult Script::callEventHandler(int lsl_state, const char* event_name, PushArgsFn pushArgs, void* push_args_ctx)
+{
+    if (isHandlerActive())
+    {
+        logWarn(logSource(), "Ignoring call to %s handler while another handler is resumable", event_name);
+        return {HandlerRunStatus::Refused, 0};
+    }
+
+    // Track the new thread as mHandlerState and make sure it's cleaned up correctly
+    HandlerScope handler_scope(this, true);
+    MemcatGuard memcat_guard{mInstance.thread(), kUserMemcat};
+
+    int status = LUA_OK;
+
+    // Wrap setup in try/catch - stack growth or string operations can throw
+    // LUA_ERRMEM if the script is at its memory limit.
+    try
+    {
+        if (!mIsLSL)
+        {
+            lua_getfield(mHandlerState, LUA_REGISTRYINDEX, LLEVENTS_HANDLEEVENT_KEY);
+            lua_getglobal(mHandlerState, LLEVENTS_GLOBAL_NAME);
+        }
+        else
+        {
+            pushEventHandlerFunction(mHandlerState, lsl_state, event_name);
+        }
+
+        if (!lua_isfunction(mHandlerState, 1))
+        {
+            // Either the host dispatched an event this script never handled,
+            // or a handler global was replaced with a non-function.
+            destroyHandlerThread();
+            logWarn(logSource(), "No %s handler to call", event_name);
+            return {HandlerRunStatus::NotRun, 0};
+        }
+
+        if (!mIsLSL)
+        {
+            // LLEvents needs a string event name before the args
+            lua_pushstring(mHandlerState, event_name);
+        }
+    }
+    catch (lua_exception& err)
+    {
+        // probably a memory error...
+        status = err.getStatus();
+    }
+
+    if (status != LUA_OK)
+        return handleEventHandlerStatus(status);
+
+    const int arg_base = lua_gettop(mHandlerState);
+    LUAU_ASSERT(arg_base == (mIsLSL ? 1 : 3));
+
+    // push any arguments that need to be pushed onto the stack
+    if (pushArgs)
+    {
+        try
+        {
+            pushArgs(mHandlerState, push_args_ctx);
+        }
+        catch (lua_exception& err)
+        {
+            // Sometimes we can't even allocate enough memory for the error message,
+            // so Lua has to throw.
+            status = err.getStatus();
+        }
+    }
+
+    if (status != LUA_OK)
+        return handleEventHandlerStatus(status);
+
+    int num_args = lua_gettop(mHandlerState) - arg_base;
+
+    if (!mIsLSL)
+    {
+        // Need to take `self` and `event_name` into account when calling into `LLEvents`!
+        num_args += 2;
+    }
+
+    status = safe_lua_resume(mHandlerState, nullptr, num_args);
+    return handleEventHandlerStatus(status);
+}
+
+RunResult Script::resumeEventHandler()
+{
+    // Resuming a reset handler thread would hand lua_resume an empty stack
+    if (!isHandlerActive())
+    {
+        logWarn(logSource(), "Ignoring resume with no resumable handler");
+        return {HandlerRunStatus::Refused, 0};
+    }
+
+    HandlerScope handler_scope(this, false);
+    MemcatGuard memcat_guard{mInstance.thread(), kUserMemcat};
+
+    int status = safe_lua_resume(mHandlerState, nullptr, 0);
+    return handleEventHandlerStatus(status);
+}
+
+bool Script::isHandlerActive() const
+{
+    if (!mInstance || lua_gettop(mInstance.thread()) < 1)
+        return false;
+    lua_State* handler = lua_tothread(mInstance.thread(), 1);
+    return handler != nullptr && !lua_isthreadreset(handler);
+}
+
+void Script::setLuaFaultFromStatus(lua_State* L, int status)
+{
+    if (status == LUA_OK)
+        return;
+
+    // Don't clobber an existing fault if we already have one
+    if (mFaultKind != FaultKind::None)
+        return;
+
+    // Acts as a signal that we've registered all of our event handlers, and
+    // don't need to be greedy anymore. Crashed scripts tell no tales.
+    mMainFunctionComplete = true;
+
+    if (status == LUA_YIELD)
+    {
+        mFaultKind = FaultKind::UnexpectedYield;
+        mFaultString = "unexpected yield";
+        mExtendedFaultString = "";
+    }
+    else if (status == LUA_BREAK)
+    {
+        mFaultKind = FaultKind::Timeout;
+        mFaultString = "exceeded time limit";
+        mExtendedFaultString = "";
+    }
+    else if (status == LUA_ERRMEM || lua_isstring(L, -1))
+    {
+        size_t len;
+        const char* msg;
+        if (status == LUA_ERRMEM)
+        {
+            msg = "not enough memory";
+            len = strlen(msg);
+        }
+        else
+            msg = lua_tolstring(L, -1, &len);
+        std::string fault_string{msg, len};
+
+        if (status == LUA_ERRMEM)
+        {
+            mFaultKind = FaultKind::OutOfMemory;
+            mFaultString = fault_string;
+        }
+        else if (mMandatoryYieldRaised)
+        {
+            mFaultKind = FaultKind::Timeout;
+            mFaultString = "exceeded time limit";
+        }
+        else
+        {
+            mFaultKind = FaultKind::Runtime;
+            mFaultString = "runtime error";
+        }
+
+        mExtendedFaultString = fault_string;
+        const char* traceback = lua_debugtrace(L);
+        if (traceback != nullptr)
+        {
+            mExtendedFaultString += "\n";
+            mExtendedFaultString += traceback;
+        }
+
+        logInfo(logSource(), "Script error: %s", msg);
+    }
+    else
+    {
+        mFaultKind = FaultKind::Unknown;
+        mFaultString = "Unknown runtime error";
+        mExtendedFaultString = "";
+    }
+}
+
+RunResult Script::handleEventHandlerStatus(int status)
+{
+    switch (status)
+    {
+    case LUA_OK:
+    {
+        if (mFaultKind != FaultKind::None)
+        {
+            destroyHandlerThread();
+            return {HandlerRunStatus::Fault, 0};
+        }
+        // Report the completion on the transition only, so the host acts on
+        // it exactly once. LSL starts out complete and never reports.
+        bool first_completion = !mMainFunctionComplete;
+        mMainFunctionComplete = true;
+        destroyHandlerThread();
+        return {HandlerRunStatus::Ok, 0, first_completion};
+    }
+    case LUA_YIELD:
+        if (mFaultKind != FaultKind::None)
+        {
+            destroyHandlerThread();
+            return {HandlerRunStatus::Fault, 0};
+        }
+        if (mIsLSL && lua_gettop(mHandlerState) == 1)
+        {
+            // Just yielded a new state number, mark this handler finished.
+            // Setting the next state register and state_exit queueing are the
+            // host's job.
+            int isnum = 0;
+            int new_state = (int)lua_tounsignedx(mHandlerState, 1, &isnum);
+            if (!isnum)
+            {
+                setFault(FaultKind::Runtime, "invalid state change");
+                destroyHandlerThread();
+                return {HandlerRunStatus::Fault, 0};
+            }
+            destroyHandlerThread();
+            return {HandlerRunStatus::StateChange, new_state};
+        }
+        return {HandlerRunStatus::Preempted, 0};
+    case LUA_BREAK:
+        if (mFaultKind != FaultKind::None)
+        {
+            destroyHandlerThread();
+            return {HandlerRunStatus::Fault, 0};
+        }
+        return {HandlerRunStatus::Preempted, 0};
+    default:
+        setLuaFaultFromStatus(mHandlerState, status);
+        destroyHandlerThread();
+        return {HandlerRunStatus::Fault, 0};
+    }
+}
+
+void Script::destroyHandlerThread()
+{
+    lua_State* instance = mInstance.thread();
+    LUAU_ASSERT(lua_gettop(instance) == 1 && lua_tothread(instance, 1) == mHandlerState);
+    lua_resetthread(lua_tothread(instance, 1));
+    mHandlerState = nullptr;
+}
+
+void Script::abortHandler()
+{
+    LUAU_ASSERT(!mInExecution);
+    if (!isHandlerActive())
+        return;
+    lua_resetthread(lua_tothread(mInstance.thread(), 1));
+}
+
+void Script::pushEventHandlerFunction(lua_State* L, int lsl_state, const char* event_name)
+{
+    LUAU_ASSERT(mIsLSL);
+
+    // We don't want any allocs here to count against the user
+    MemcatGuard guard{L, kSystemMemcat};
+
+    // Figure out what the function name for this handler should be
+    char eh_global_name[256] = {0};
+    snprintf(eh_global_name, sizeof(eh_global_name), "_e%d/%s", lsl_state, event_name);
+    lua_getglobal(L, eh_global_name);
+}
+
+bool Script::hasLSLEventHandler(int lsl_state, const char* event_name)
+{
+    if (!mInstance)
+        return false;
+
+    if (!mIsLSL)
+        return false;
+
+    lua_State* instance = mInstance.thread();
+    pushEventHandlerFunction(instance, lsl_state, event_name);
+    bool has_handler = lua_isfunction(instance, -1);
+    lua_pop(instance, 1);
+    return has_handler;
+}
+
+bool Script::serializeState(std::string& out)
+{
+    LUAU_ASSERT(!mInExecution);
+
+    out.clear();
+
+    if (!mInstance)
+        return false;
+
+    std::string ares_blob;
+    if (!mImage->serializeInstance(mInstance, ares_blob))
+        return false;
+
+    const StateFingerprint fingerprint = getStateFingerprint();
+
+    ByteWriter writer{out};
+    writer.writeBytes(fingerprint.tag, sizeof(fingerprint.tag));
+    writer.writeU32(fingerprint.version);
+    writer.writeF32(mSleep);
+    // The limit drifts at runtime (llSetMemoryLimit), so it is engine state
+    // the payload must carry
+    writer.writeU32((uint32_t)mMemoryLimit);
+    writer.writeU8((uint8_t)mFaultKind);
+    writer.writeString(mFaultString);
+    writer.writeString(mExtendedFaultString.data(), std::min(mExtendedFaultString.size(), kMaxPersistedFaultLen));
+    writer.writeU8((uint8_t)mMainFunctionComplete);
+    writer.writeString(ares_blob);
+
+    // The image flavor this state came off, so restoring it into the wrong
+    // image fails here rather than somewhere inside Ares
+    writer.writeU8((uint8_t)mIsLSL);
+    writer.writeU32(mAPIVersion);
+
+    return serializeExtra(writer);
+}
+
+bool Script::restoreState(const char* data, size_t len)
+{
+    LUAU_ASSERT(!mInExecution);
+
+    // Parse the whole payload before touching anything, so a bad one leaves
+    // us exactly as we were
+    ByteReader reader{data, len};
+    uint32_t version = 0;
+    float sleep = 0.0f;
+    uint32_t memory_limit = 0;
+    uint8_t fault_kind = 0;
+    std::string fault_string;
+    std::string extended_fault_string;
+    uint8_t main_function_complete = 0;
+    std::string ares_blob;
+    uint8_t is_lsl = 0;
+    uint32_t api_version = 0;
+
+    const StateFingerprint fingerprint = getStateFingerprint();
+
+    char tag[sizeof(fingerprint.tag)];
+    if (!reader.readBytes(tag, sizeof(tag)) || memcmp(tag, fingerprint.tag, sizeof(tag)) != 0)
+    {
+        logWarn(logSource(), "Script state has no recognisable header");
+        setFault(FaultKind::Runtime, "invalid script state");
+        return false;
+    }
+    // Payloads from older builds still load. ones from a newer build we can
+    // only refuse, since we don't know what moved.
+    if (!reader.readU32(version) || version > fingerprint.version)
+    {
+        logWarn(logSource(), "Unsupported script state version %u", version);
+        setFault(FaultKind::Runtime, "invalid script state");
+        return false;
+    }
+// Every field fails the same way, keep each read to one line
+#define READ_OR_BAIL(read_expr) \
+    do \
+    { \
+        if (!(read_expr)) \
+        { \
+            logWarn(logSource(), "Script state is truncated"); \
+            setFault(FaultKind::Runtime, "invalid script state"); \
+            return false; \
+        } \
+    } while (false)
+
+    READ_OR_BAIL(reader.readF32(sleep));
+    READ_OR_BAIL(reader.readU32(memory_limit));
+    READ_OR_BAIL(reader.readU8(fault_kind));
+    READ_OR_BAIL(reader.readString(fault_string));
+    READ_OR_BAIL(reader.readString(extended_fault_string));
+    READ_OR_BAIL(reader.readU8(main_function_complete));
+    READ_OR_BAIL(reader.readString(ares_blob));
+    READ_OR_BAIL(reader.readU8(is_lsl));
+    READ_OR_BAIL(reader.readU32(api_version));
+
+#undef READ_OR_BAIL
+    if ((is_lsl != 0) != mIsLSL || api_version != mAPIVersion)
+    {
+        logWarn(logSource(), "Script state is for a different flavor (lsl %d, api %u)", (int)is_lsl, api_version);
+        setFault(FaultKind::Runtime, "invalid script state");
+        return false;
+    }
+
+    if (memory_limit <= 0 || memory_limit > INT32_MAX)
+    {
+        logWarn(logSource(), "Script state carries an unusable memory limit");
+        setFault(FaultKind::Runtime, "invalid script state");
+        return false;
+    }
+
+    if (mInstance)
+    {
+        logWarn(logSource(), "Refusing to restore state over a live script instance");
+        setFault(FaultKind::Runtime, "invalid script state");
+        return false;
+    }
+
+    mInstance = mImage->forkInstance(this, &ares_blob);
+    if (!mInstance)
+    {
+        setFault(FaultKind::Runtime, "invalid script state");
+        return false;
+    }
+
+    // Subclass state comes last, once there's a live instance for it to key off.
+    // Anything left over means we didn't understand the whole payload.
+    if (!restoreExtra(reader) || reader.remaining != 0)
+    {
+        logWarn(logSource(), "Script state's trailing section is unusable");
+        setFault(FaultKind::Runtime, "invalid script state");
+        mInstance = Instance();
+        return false;
+    }
+
+    mSleep = sleep;
+    setMemoryLimitUnsafe((int)memory_limit);
+    mFaultKind = validate_fault_kind(fault_kind);
+    mFaultString = fault_string;
+    mExtendedFaultString = extended_fault_string;
+    mMainFunctionComplete = main_function_complete != 0;
+    mMaxPossibleSize = 0;
+    mExactSize = 0;
+    mExactSizeDirty = true;
+    return true;
+}
+
+// static
+void Script::interruptHandler(lua_State* L, int gc)
+{
+    // GC pauses aren't safe to yield on.
+    if (gc >= 0)
+    {
+        return;
+    }
+
+    Script* execute = fromLuaState(L);
+
+    // Meh, not even running a script.
+    if (!execute || !execute->mInExecution)
+        return;
+
+    if (execute->mIsLSL && execute->mHandlerState == nullptr)
+    {
+        // Meh. We're in the startup phase. Don't try to yield, LSL never needs it.
+        return;
+    }
+
+    LUAU_ASSERT(execute->mHandlerState);
+    // A handler thread that hasn't been resumed has no frame to yield from, so getting
+    // here means the host's event setup path reached the VM somehow.
+    LUAU_ASSERT(execute->mHandlerState->isactive);
+
+    if (execute->mSleep > 0.0f || execute->mForceYield)
+    {
+        execute->tryYield(L, 0.0, true);
+        return;
+    }
+
+    double elapsed = execute->mQuantaClockProvider(L) - execute->mWindowStart;
+    if (elapsed > execute->mQuanta)
+    {
+        execute->tryYield(L, elapsed);
+    }
+}
+
+// static
+void Script::userThreadCallback(lua_State* LP, lua_State* L)
+{
+    if (LP == nullptr)
+    {
+        // Thread destruction case
+        return;
+    }
+    // Copy thread data pointer to the child thread
+    lua_setthreaddata(L, lua_getthreaddata(LP));
+}
+
+// static
+// Helper callback that enforces reachability-based memory limits
+int Script::memoryLimitCallback(lua_State* L, size_t osize, size_t nsize)
+{
+    Script* execute = fromLuaState(L);
+
+    // Meh, not even running a script.
+    if (!execute || !execute->mInExecution)
+        return 0;
+
+    if (!execute->mInstance)
+    {
+        // It's not deserialized yet, meh.
+        return 0;
+    }
+
+    // This is a net shrink in memory, not relevant for our limiting logic. We can't assume that
+    // memory being freed has anything to do with us, given that the GC can work on things unrelated
+    // to the currently executing task.
+    // TODO: Perhaps this will no longer be the case once we're stricter about how / when GC runs?
+    if (osize >= nsize)
+        return 0;
+
+    size_t net_gain = nsize - osize;
+
+    // A single allocation larger than the whole limit can never fit, reject it
+    // here so the int-typed accounting below can't overflow.
+    if (net_gain > (size_t)execute->mMemoryLimit)
+        return 1;
+
+    // Figure out the actual current size of the heap if we didn't already have it,
+    // or the alloc would push us over the limit given the current approximate size.
+    execute->mMaxPossibleSize += (int)net_gain;
+
+    if (execute->mExactSize == 0 || (execute->mMaxPossibleSize > execute->mMemoryLimit))
+    {
+        // Max possible size is now over the memory limit, or we didn't have a "actual"
+        // base memory measurement before. Recalculate "actual" memory usage.
+        size_t current_size = lua_userthreadsize(execute->mInstance.thread(), &execute->mImage->getFreeObjects()) + execute->mChargedBytecodeSize;
+        execute->mExactSize = execute->mMaxPossibleSize = (int)current_size;
+        int new_size = execute->mExactSize + (int)net_gain;
+        if (new_size > execute->mMemoryLimit)
+            return 1;
+
+        execute->mMaxPossibleSize = execute->mExactSize = new_size;
+    }
+
+    return 0;
+}
+
+static inline float calculate_slowness_punishment(double quanta, double elapsed)
+{
+    // Punish the script by forcing it to sleep 5x as long as it ran over its quanta
+    constexpr float PUNISHMENT_MULTIPLIER = 5.0f;
+    return (float)(std::max(elapsed - quanta, 0.0) * PUNISHMENT_MULTIPLIER);
+}
+
+void Script::tryYield(lua_State* L, double elapsed, bool mandatory)
+{
+    YieldableStatus interrupt_status = luaSL_may_interrupt(L);
+    // Some quantas are extremely small, so don't punish if they were overrun due to blocking code.
+    // Use a higher threshold for punishment in those cases.
+    double punish_quanta = std::max(mQuanta, 0.001);
+
+    if (interrupt_status == YieldableStatus::OK)
+    {
+        // Reaching a yieldable point means any catchable mandatory-yield error
+        // was caught and the script handed control back, so it has earned
+        // another catchable attempt rather than the kill.
+        mMandatoryYieldRaised = false;
+
+        // If the script was really abusive we need to punish it.
+        // NB: This is mostly a copy of the existing Mono logic, except we only apply
+        //  the punishment when the script is actually able to yield, rather than continuously
+        //  try to punish the script over and over.
+        if (elapsed > (punish_quanta * 3.0))
+        {
+            if (!mYieldDue)
+                mSleep += calculate_slowness_punishment(punish_quanta, elapsed);
+            logInfo(logSource(), "Punishing abusive script that took %f on quanta of %f", elapsed, mQuanta);
+        }
+        // This will get us out of the host's `runQuanta()` loop
+        mYieldDue = true;
+        lua_break(L);
+    }
+    else
+    {
+        // Okay, we couldn't yield, but might it be time for capital punishment?
+        if (elapsed > (punish_quanta * 3.5))
+        {
+            // It's very easy for people to intentionally write un-yieldable code. Punish them
+            // by killing their evil script. Yield is now mandatory.
+            logInfo(logSource(), "Making yield mandatory due to quanta overrun");
+            mandatory = true;
+        }
+
+        if (mandatory)
+        {
+            // Even if they eventually recover from the error, they'll have to eat
+            // this cost eventually.
+            if (!mYieldDue)
+                mSleep += calculate_slowness_punishment(punish_quanta, elapsed);
+
+            // This will get us out of the host's `runQuanta()` loop
+            mYieldDue = true;
+
+            if (!mMandatoryYieldRaised)
+            {
+                // We're going to be polite. Throw a typical Lua error to try to
+                // get back to a yieldable place in the script.
+                mMandatoryYieldRaised = true;
+                luaL_errorL(L, "Failed to perform mandatory yield");
+            }
+
+            // Here we are again. Okay, time to do an uncatchable killerror.
+            // By convention, this renders the script inoperable rather than
+            // letting the script run wild. Set the fault, make the kill.
+            std::string extended = "Failed to perform mandatory yield";
+            const char* traceback = lua_debugtrace(L);
+            if (traceback != nullptr)
+            {
+                extended += "\n";
+                extended += traceback;
+            }
+            setFault(FaultKind::Timeout, "exceeded time limit", extended.c_str());
+
+            lua_killerror(L, "Failed to perform mandatory yield");
+        }
+    }
+}
+
+int Script::getUsedMemory()
+{
+    int bc_size = (int)mChargedBytecodeSize;
+    if (!mInstance)
+        return bc_size;
+
+    // This check is basically free if we're not currently running and we haven't allocated
+    // since it was last calculated
+    if (!mExactSizeDirty && !mInExecution && mMaxPossibleSize == mExactSize)
+        return mExactSize;
+
+    mExactSize = mMaxPossibleSize = (int)lua_userthreadsize(mInstance.thread(), &mImage->getFreeObjects()) + bc_size;
+    mExactSizeDirty = false;
+    return mExactSize;
+}
+
+bool Script::setMemoryLimit(int memory_limit)
+{
+    int current_memory = getUsedMemory();
+    // Shrinking the limit is okay even if we're above the typical limit.
+    if (memory_limit >= current_memory && (memory_limit <= kDefaultMemoryLimit || memory_limit <= mMemoryLimit))
+    {
+        mMemoryLimit = memory_limit;
+        return true;
+    }
+    return false;
+}
+
+void Script::setMemoryLimitUnsafe(int memory_limit)
+{
+    mMemoryLimit = std::max(0, memory_limit);
+}
+
+void Script::clearFault()
+{
+    mFaultKind = FaultKind::None;
+    mFaultString.clear();
+    mExtendedFaultString.clear();
+}
+
+void Script::setFault(FaultKind kind, const char* fault_string, const char* extended)
+{
+    // Don't clobber an existing fault if we already have one
+    if (mFaultKind != FaultKind::None)
+        return;
+    // Well if we have a fault, then the main function is _definitely_ done executing.
+    mMainFunctionComplete = true;
+    mFaultKind = kind;
+    mFaultString = fault_string ? fault_string : "";
+    mExtendedFaultString = extended ? extended : "";
+}
+
+} // namespace Executor
+} // namespace Luau
diff --git a/Makefile b/Makefile
index 4336094c..32e9f68e 100644
--- a/Makefile
+++ b/Makefile
@@ -52,6 +52,11 @@ CJSON_OBJECTS=$(CJSON_SOURCES:%=$(BUILD)/%.o)
 APR_SOURCES=$(wildcard VM/src/apr/*.cpp)
 APR_OBJECTS=$(APR_SOURCES:%=$(BUILD)/%.o)
 
+# ServerLua: per-script execution engine
+EXECUTOR_SOURCES=$(wildcard Executor/src/*.cpp)
+EXECUTOR_OBJECTS=$(EXECUTOR_SOURCES:%=$(BUILD)/%.o)
+EXECUTOR_TARGET=$(BUILD)/libluauexecutor.a
+
 REQUIRE_SOURCES=$(wildcard Require/src/*.cpp)
 REQUIRE_OBJECTS=$(REQUIRE_SOURCES:%=$(BUILD)/%.o)
 REQUIRE_TARGET=$(BUILD)/libluaurequire.a
@@ -101,7 +106,7 @@ ifneq ($(opt),)
 	TESTS_ARGS+=-O$(opt)
 endif
 
-OBJECTS=$(COMMON_OBJECTS) $(AST_OBJECTS) $(COMPILER_OBJECTS) $(BYTECODE_OBJECTS) $(JITINLINER_OBJECTS) $(CONFIG_OBJECTS) $(ANALYSIS_OBJECTS) $(CODEGEN_OBJECTS) $(VM_OBJECTS) $(REQUIRE_OBJECTS) $(ISOCLINE_OBJECTS) $(TESTS_OBJECTS) $(REPL_CLI_OBJECTS) $(ANALYZE_CLI_OBJECTS) $(COMPILE_CLI_OBJECTS) $(BYTECODE_CLI_OBJECTS) $(TEST_LINK_VM_OBJECTS) $(TEST_LINK_CODEGEN_OBJECTS) $(FUZZ_OBJECTS) $(CJSON_OBJECTS) $(APR_OBJECTS)
+OBJECTS=$(COMMON_OBJECTS) $(AST_OBJECTS) $(COMPILER_OBJECTS) $(BYTECODE_OBJECTS) $(JITINLINER_OBJECTS) $(CONFIG_OBJECTS) $(ANALYSIS_OBJECTS) $(CODEGEN_OBJECTS) $(VM_OBJECTS) $(EXECUTOR_OBJECTS) $(REQUIRE_OBJECTS) $(ISOCLINE_OBJECTS) $(TESTS_OBJECTS) $(REPL_CLI_OBJECTS) $(ANALYZE_CLI_OBJECTS) $(COMPILE_CLI_OBJECTS) $(BYTECODE_CLI_OBJECTS) $(TEST_LINK_VM_OBJECTS) $(TEST_LINK_CODEGEN_OBJECTS) $(FUZZ_OBJECTS) $(CJSON_OBJECTS) $(APR_OBJECTS)
 EXECUTABLE_ALIASES = slua slua-analyze slua-compile slua-bytecode slua-tests
 
 # `LUAU_CONFORMANCE_SOURCE_DIR` is configured at build time
@@ -184,11 +189,12 @@ $(CONFIG_OBJECTS): CXXFLAGS+=-std=c++17 -IConfig/include -ICommon/include -IAst/
 $(ANALYSIS_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IAst/include -IAnalysis/include -IConfig/include -IBytecode/include -ICompiler/include -IVM/include
 $(CODEGEN_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -ICodeGen/include -IVM/include -IVM/src # Code generation needs VM internals
 $(VM_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IVM/include -Istage/packages/include -I VM/cjson
+$(EXECUTOR_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IExecutor/include -IVM/include -IVM/src
 $(APR_OBJECTS): CXXFLAGS+=-std=c++17 -Wno-unused-function -Wno-char-subscripts -IVM/include -ICommon/include
 $(CJSON_OBJECTS): CXXFLAGS+=-std=c++17 -Wno-unused-function -Wno-char-subscripts -IVM/include -ICommon/include -I VM/cjson
 $(REQUIRE_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IVM/include -IAst/include -IConfig/include -IRequire/include
 $(ISOCLINE_OBJECTS): CXXFLAGS+=-Wno-unused-function -Iextern/isocline/include
-$(TESTS_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IAst/include -IBytecode/include -IInliner/include -ICompiler/include -IConfig/include -IAnalysis/include -ICodeGen/include -IVM/include -IVM/src -IRequire/include -ICLI/include -Iextern -ILSLBuiltins/include -Istage/packages/include -DDOCTEST_CONFIG_DOUBLE_STRINGIFY -DDOCTEST_CONFIG_USE_STD_HEADERS -DLUAU_CONFORMANCE_SOURCE_DIR=$(LUAU_CONFORMANCE_SOURCE_DIR)
+$(TESTS_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IAst/include -IBytecode/include -IInliner/include -ICompiler/include -IConfig/include -IAnalysis/include -ICodeGen/include -IVM/include -IVM/src -IExecutor/include -IRequire/include -ICLI/include -Iextern -ILSLBuiltins/include -Istage/packages/include -DDOCTEST_CONFIG_DOUBLE_STRINGIFY -DDOCTEST_CONFIG_USE_STD_HEADERS -DLUAU_CONFORMANCE_SOURCE_DIR=$(LUAU_CONFORMANCE_SOURCE_DIR)
 $(REPL_CLI_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IAst/include -IBytecode/include -IInliner/include -ICompiler/include -IVM/include -ICodeGen/include -IRequire/include -Iextern -Iextern/isocline/include -ICLI/include -ILSLBuiltins/include -Istage/packages/include
 $(ANALYZE_CLI_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IAst/include -IAnalysis/include -IConfig/include -IRequire/include -IVM/include -Iextern -ICLI/include -ILSLBuiltins/include -Istage/packages/include
 $(COMPILE_CLI_OBJECTS): CXXFLAGS+=-std=c++17 -ICommon/include -IAst/include -IBytecode/include -ICompiler/include -IVM/include -ICodeGen/include -ICLI/include -ILSLBuiltins/include -Istage/packages/include -I$(BUILD)
@@ -278,7 +284,7 @@ slua-tests: $(TESTS_TARGET) $(TEST_LINK_VM_TARGET) $(TEST_LINK_CODEGEN_TARGET)
 	ln -fs $(TESTS_TARGET) $@
 
 # executable targets
-$(TESTS_TARGET): $(TESTS_OBJECTS) $(ANALYSIS_TARGET) $(COMPILER_TARGET) $(JITINLINER_TARGET) $(BYTECODE_TARGET) $(AST_TARGET) $(CODEGEN_TARGET) $(VM_TARGET) $(REQUIRE_TARGET) $(CONFIG_TARGET) $(ISOCLINE_TARGET) $(COMMON_TARGET)
+$(TESTS_TARGET): $(TESTS_OBJECTS) $(ANALYSIS_TARGET) $(COMPILER_TARGET) $(JITINLINER_TARGET) $(BYTECODE_TARGET) $(AST_TARGET) $(CODEGEN_TARGET) $(EXECUTOR_TARGET) $(VM_TARGET) $(REQUIRE_TARGET) $(CONFIG_TARGET) $(ISOCLINE_TARGET) $(COMMON_TARGET)
 $(REPL_CLI_TARGET): $(REPL_CLI_OBJECTS) $(COMPILER_TARGET) $(JITINLINER_TARGET) $(BYTECODE_TARGET) $(AST_TARGET) $(CODEGEN_TARGET) $(VM_TARGET) $(REQUIRE_TARGET) $(CONFIG_TARGET) $(ISOCLINE_TARGET) $(COMMON_TARGET)
 $(ANALYZE_CLI_TARGET): $(ANALYZE_CLI_OBJECTS) $(ANALYSIS_TARGET) $(AST_TARGET) $(COMPILER_TARGET) $(BYTECODE_TARGET) $(VM_TARGET) $(REQUIRE_TARGET) $(CONFIG_TARGET) $(COMMON_TARGET)
 $(COMPILE_CLI_TARGET): $(COMPILE_CLI_OBJECTS) $(COMPILER_TARGET) $(BYTECODE_TARGET) $(AST_TARGET) $(CODEGEN_TARGET) $(VM_TARGET) $(COMMON_TARGET)
@@ -314,10 +320,11 @@ $(CONFIG_TARGET): $(CONFIG_OBJECTS)
 $(ANALYSIS_TARGET): $(ANALYSIS_OBJECTS)
 $(CODEGEN_TARGET): $(CODEGEN_OBJECTS)
 $(VM_TARGET): $(VM_OBJECTS) $(CJSON_OBJECTS) $(APR_OBJECTS)
+$(EXECUTOR_TARGET): $(EXECUTOR_OBJECTS)
 $(REQUIRE_TARGET): $(REQUIRE_OBJECTS)
 $(ISOCLINE_TARGET): $(ISOCLINE_OBJECTS)
 
-$(COMMON_TARGET) $(AST_TARGET) $(BYTECODE_TARGET) $(JITINLINER_TARGET) $(COMPILER_TARGET) $(CONFIG_TARGET) $(ANALYSIS_TARGET) $(CODEGEN_TARGET) $(VM_TARGET) $(REQUIRE_TARGET) $(ISOCLINE_TARGET):
+$(COMMON_TARGET) $(AST_TARGET) $(BYTECODE_TARGET) $(JITINLINER_TARGET) $(COMPILER_TARGET) $(CONFIG_TARGET) $(ANALYSIS_TARGET) $(CODEGEN_TARGET) $(VM_TARGET) $(EXECUTOR_TARGET) $(REQUIRE_TARGET) $(ISOCLINE_TARGET):
 	ar rcs $@ $^
 
 # generated header for embedded builtins
diff --git a/Sources.cmake b/Sources.cmake
index e5567696..75911291 100644
--- a/Sources.cmake
+++ b/Sources.cmake
@@ -491,6 +491,17 @@ target_sources(Luau.VM PRIVATE
     VM/src/apr/apr_base64.h
 )
 
+# ServerLua: Luau.Executor Sources
+target_sources(Luau.Executor PRIVATE
+    Executor/include/Luau/ByteStream.h
+    Executor/include/Luau/Executor.h
+    Executor/include/Luau/Script.h
+
+    Executor/src/Executor.cpp
+    Executor/src/Logging.cpp
+    Executor/src/Script.cpp
+)
+
 target_sources(isocline PRIVATE
     extern/isocline/include/isocline.h
     extern/isocline/src/isocline.c
@@ -668,6 +679,7 @@ if(TARGET Luau.Conformance)
         tests/IrLowering.test.cpp
         tests/SharedCodeAllocator.test.cpp
         tests/SLConformance.test.cpp
+        tests/SLExecutor.test.cpp
         tests/main.cpp)
 
     if (LUAU_USE_TAILSLIDE)
diff --git a/VM/include/lua.h b/VM/include/lua.h
index 740c5453..32adf359 100644
--- a/VM/include/lua.h
+++ b/VM/include/lua.h
@@ -5,6 +5,7 @@
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <exception>
 #include <istream>
 #include <ostream>
 #include <unordered_set>
@@ -22,6 +23,12 @@
 #define LUA_SL_IDENTIFIER_MASK 0xFFff0000
 #define LUA_LSL_IDENTIFIER 0xd34df007
 
+// ServerLua: what subclasses a lua_SLRuntimeState. A VM's non-script threads
+// (base state, forkservers) carry a bare runtime state. consult this before
+// downcasting threaddata to anything richer.
+#define LUA_SLSTATE_BARE 0
+#define LUA_SLSTATE_SCRIPT 1
+
 struct lua_State;
 
 typedef bool (*lua_eventHandlerRegistrationCallback)(lua_State *L, const char *event_name, bool registered);
@@ -33,11 +40,11 @@ typedef double (*lua_clockProvider)(lua_State *L);
 // _secure_ random values.
 typedef bool (*lua_randomProvider)(lua_State *L, uint8_t* dst, size_t len);
 
-// This is meant to be shared between instances of the same script and should
-// NOT have any instance-specific data on it!
+// Shared by every thread in one script instance's thread tree.
 typedef struct lua_SLRuntimeState
 {
     unsigned int slIdentifier = LUA_LSL_IDENTIFIER;
+    unsigned char slStateKind = LUA_SLSTATE_BARE;
     int uuidWeakTab = -1;
     int uuidCompressedWeakTab = -1;
     lua_eventHandlerRegistrationCallback eventHandlerRegistrationCb = nullptr;
@@ -624,6 +631,58 @@ LUA_API int lua_unref(lua_State* L, int ref);
 
 #define lua_pushfstring(L, fmt, ...) lua_pushfstringL(L, fmt, ##__VA_ARGS__)
 
+// ServerLua: lua_exception is effectively part of the API
+//  surface since it can escape C API calls in exception builds.
+//  Wish this were not the case, but it is so. Thus, we've
+//  moved it here so it can be matched on by library consumers.
+class lua_exception : public std::exception
+{
+public:
+    lua_exception(lua_State* L, int status)
+        : L(L)
+        , status(status)
+    {
+    }
+
+    const char* what() const throw() override
+    {
+        // LUA_ERRRUN passes error object on the stack
+        // ServerLua: LUA_ERRKILL also passes error object on the stack
+        if (status == LUA_ERRRUN || status == LUA_ERRKILL)
+            if (const char* str = lua_tostring(L, -1))
+                return str;
+
+        switch (status)
+        {
+        case LUA_ERRRUN:
+            return "lua_exception: runtime error";
+        case LUA_ERRSYNTAX:
+            return "lua_exception: syntax error";
+        case LUA_ERRMEM:
+            return "lua_exception: not enough memory";
+        case LUA_ERRERR:
+            return "lua_exception: error in error handling";
+        case LUA_ERRKILL: // ServerLua: Uncatchable termination error
+            return "lua_exception: script terminated";
+        default:
+            return "lua_exception: unexpected exception status";
+        }
+    }
+
+    int getStatus() const
+    {
+        return status;
+    }
+
+    const lua_State* getThread() const
+    {
+        return L;
+    }
+
+private:
+    lua_State* L;
+    int status;
+};
 
 /*
 ** =======================================================================
@@ -724,7 +783,10 @@ static void populateperms(lua_State *L, bool forUnpersist)
 
 LUA_API lua_State *eris_make_forkserver(lua_State *Lsrc);
 
-LUA_API lua_State *eris_fork_thread(lua_State *Lforker, uint8_t default_state, uint8_t memcat);
+// `threaddata`, when set, is stamped as the threaddata of every thread in the
+// unpersisted tree as it is created. Threads the tree spawns later at runtime
+// inherit it through the userthread callback.
+LUA_API lua_State *eris_fork_thread(lua_State *Lforker, uint8_t default_state, uint8_t memcat, void *threaddata = nullptr);
 LUA_API int eris_serialize_thread(lua_State *Lforker, lua_State *L);
 LUA_API void eris_set_compile_func(void (*compile_func)(lua_State*, int));
 LUA_API void eris_dump(lua_State* L, std::ostream *writer);
diff --git a/VM/src/ares.cpp b/VM/src/ares.cpp
index 68db438d..72c51795 100644
--- a/VM/src/ares.cpp
+++ b/VM/src/ares.cpp
@@ -323,6 +323,10 @@ typedef struct UnpersistInfo {
   size_t vector_components;
   uint32_t version;
   std::streamoff stream_size; // -1 if unknown (non-seekable stream)
+  /* When set, stamped as the threaddata of every thread of the unpersisted
+   * tree; threads the tree spawns later inherit it through the userthread
+   * callback. */
+  void *threaddata;
 } UnpersistInfo;
 
 /* Info shared in persist and unpersist. */
@@ -2684,6 +2688,9 @@ u_thread(Info *info) {                                                 /* ... */
 
   eris_checkstack(info->L, 3);
   thread = lua_newthread(info->L);                              /* ... thread */
+  if (info->u.upi.threaddata != NULL) {
+    lua_setthreaddata(thread, info->u.upi.threaddata);
+  }
   registerobject(info);
 
   // The created thread's globals table is currently shared with info->L, which
@@ -3698,7 +3705,7 @@ unchecked_persist(lua_State *L, std::ostream *writer) {
 }
 
 static void
-unchecked_unpersist(lua_State *L, std::istream *reader) {/* perms str? */
+unchecked_unpersist(lua_State *L, std::istream *reader, void *threaddata) {/* perms str? */
   // pause GC for the duration of deserialization - some objects we're creating aren't rooted
   // Also prevents beforeallocate callbacks from being invoked during setup
   ScopedDisableGC _disable_gc(L);
@@ -3712,6 +3719,7 @@ unchecked_unpersist(lua_State *L, std::istream *reader) {/* perms str? */
   info.generatePath = kGeneratePath;
   info.persisting = false;
   info.u.upi.reader = reader;
+  info.u.upi.threaddata = threaddata;
 
   // Determine stream size for validation, -1 if non-seekable
   std::streampos cur = reader->tellg();
@@ -3837,9 +3845,15 @@ l_unpersist(lua_State *L) {                               /* perms? str? ...? */
   const char *buff = luaL_checklstring(L, 2, &buff_len);
   std::istringstream reader(std::string(buff, buff_len));
   reader.seekg(0);
+
+  /* Optional threaddata for the unpersisted thread tree, passed as a light
+   * userdata by eris_fork_thread; not reachable from scripts since the eris
+   * library is never exposed to them. Only an untagged light userdata is a
+   * pointer here (tagged ones are values, e.g. LSL-mode integers). */
+  void *threaddata = lua_tolightuserdatatagged(L, 3, 0);
   lua_settop(L, 2);                                              /* perms str */
 
-  unchecked_unpersist(L, &reader);                       /* perms str rootobj */
+  unchecked_unpersist(L, &reader, threaddata);           /* perms str rootobj */
 
   return 1;
 }
@@ -3940,7 +3954,7 @@ eris_undump(lua_State *L, std::istream *reader) {                   /* perms? */
     luaL_error(L, "too many arguments");
   }
   luaL_checktype(L, 1, LUA_TTABLE);                                  /* perms */
-  unchecked_unpersist(L, reader);                            /* perms rootobj */
+  unchecked_unpersist(L, reader, NULL);                      /* perms rootobj */
 }
 
 /** ======================================================================== */
@@ -3957,14 +3971,15 @@ eris_persist(lua_State *L, int perms, int value) {                    /* ...? */
 }
 
 LUA_API int
-eris_unpersist(lua_State *L, int perms, int value) {                   /* ... */
+eris_unpersist(lua_State *L, int perms, int value, void *threaddata) {  /* ... */
   perms = lua_absindex(L, perms);
   value = lua_absindex(L, value);
-  eris_checkstack(L, 3);
+  eris_checkstack(L, 4);
   lua_pushcfunction(L, l_unpersist, "l_unpersist");
   lua_pushvalue(L, perms);                           /* ... l_unpersist perms */
   lua_pushvalue(L, value);                       /* ... l_unpersist perms str */
-  return lua_pcall(L, 2, 1, 0);
+  lua_pushlightuserdata(L, threaddata); /* ... l_unpersist perms str threaddata */
+  return lua_pcall(L, 3, 1, 0);
 }
 
 LUA_API void
@@ -4115,7 +4130,7 @@ eris_make_forkserver(lua_State *L) {
 }
 
 LUA_API lua_State*
-eris_fork_thread(lua_State *Lforker, uint8_t default_state, uint8_t memcat) {
+eris_fork_thread(lua_State *Lforker, uint8_t default_state, uint8_t memcat, void *threaddata) {
                                                /* Lforker: state default_ser? */
   eris_assert(lua_getmemcat(Lforker) == 0);
   lua_State *GL = lua_mainthread(Lforker);
@@ -4136,7 +4151,9 @@ eris_fork_thread(lua_State *Lforker, uint8_t default_state, uint8_t memcat) {
   // Make sure any objects we create during deserialization are created with the desired memcat
   lua_setmemcat(Lforker, memcat);
 
-  int status = eris_unpersist(Lforker, -1, -2); /* Lforker: state serialized uperms new_th */
+  // `threaddata` rides along on the unpersist info and is stamped onto every
+  // thread of the unpersisted tree as it is created (u_thread).
+  int status = eris_unpersist(Lforker, -1, -2, threaddata); /* Lforker: state serialized uperms new_th */
 
   // Done, set the memcat back to the main one.
   lua_setmemcat(Lforker, 0);
diff --git a/VM/src/ares.h b/VM/src/ares.h
index 2bbc63af..a6a355ba 100644
--- a/VM/src/ares.h
+++ b/VM/src/ares.h
@@ -85,9 +85,12 @@ LUA_API int eris_persist(lua_State* L, int perms, int value);
  * containing persisted data at the specified index 'value'. It will push the
  * resulting value onto the stack on success.
  *
+ * `threaddata`, when set, is stamped as the threaddata of every thread
+ * created while unpersisting.
+ *
  * [-0, +1, e]
  */
-LUA_API int eris_unpersist(lua_State* L, int perms, int value);
+LUA_API int eris_unpersist(lua_State* L, int perms, int value, void *threaddata = nullptr);
 
 /**
  * Pushes the current value of a setting onto the stack.
@@ -129,7 +132,7 @@ LUA_API void eris_set_setting(lua_State *L, const char *name, int value);
 
 LUA_API lua_State *eris_make_forkserver(lua_State *Lsrc);
 
-LUA_API lua_State *eris_fork_thread(lua_State *Lforker, uint8_t default_state, uint8_t memcat);
+LUA_API lua_State *eris_fork_thread(lua_State *Lforker, uint8_t default_state, uint8_t memcat, void *threaddata);
 LUA_API int eris_serialize_thread(lua_State *Lforker, lua_State *L);
 LUA_API void eris_set_compile_func(void (*compile_func)(lua_State*, int));
 
diff --git a/VM/src/ldo.cpp b/VM/src/ldo.cpp
index abc287f2..8a4ed0f5 100644
--- a/VM/src/ldo.cpp
+++ b/VM/src/ldo.cpp
@@ -74,54 +74,7 @@ l_noret luaD_throw(lua_State* L, int errcode)
     abort();
 }
 #else
-class lua_exception : public std::exception
-{
-public:
-    lua_exception(lua_State* L, int status)
-        : L(L)
-        , status(status)
-    {
-    }
-
-    const char* what() const throw() override
-    {
-        // LUA_ERRRUN passes error object on the stack
-        // ServerLua: LUA_ERRKILL also passes error object on the stack
-        if (status == LUA_ERRRUN || status == LUA_ERRKILL)
-            if (const char* str = lua_tostring(L, -1))
-                return str;
-
-        switch (status)
-        {
-        case LUA_ERRRUN:
-            return "lua_exception: runtime error";
-        case LUA_ERRSYNTAX:
-            return "lua_exception: syntax error";
-        case LUA_ERRMEM:
-            return "lua_exception: " LUA_MEMERRMSG;
-        case LUA_ERRERR:
-            return "lua_exception: " LUA_ERRERRMSG;
-        case LUA_ERRKILL: // ServerLua: Uncatchable termination error
-            return "lua_exception: script terminated";
-        default:
-            return "lua_exception: unexpected exception status";
-        }
-    }
-
-    int getStatus() const
-    {
-        return status;
-    }
-
-    const lua_State* getThread() const
-    {
-        return L;
-    }
-
-private:
-    lua_State* L;
-    int status;
-};
+// ServerLua: lua_exception is declared in lua.h. See note there.
 
 int luaD_rawrunprotected(lua_State* L, Pfunc f, void* ud)
 {
diff --git a/VM/src/lllevents.cpp b/VM/src/lllevents.cpp
index b7f150d8..3c0f3660 100644
--- a/VM/src/lllevents.cpp
+++ b/VM/src/lllevents.cpp
@@ -261,7 +261,7 @@ static int llevents_on(lua_State *L)
     {
         lua_pop(L, 1);
         // Okay, this is something that didn't have handlers before
-        auto *sl_state = LUAU_GET_SL_VM_STATE(lua_mainthread(L));
+        auto *sl_state = LUAU_GET_SL_VM_STATE(L);
         if (sl_state->eventHandlerRegistrationCb != nullptr && !sl_state->eventHandlerRegistrationCb(L, event_name, true))
         {
             // Event handler check failed, let the user know
@@ -293,7 +293,7 @@ static int llevents_on(lua_State *L)
 
 static int llevents_off(lua_State *L)
 {
-    auto *sl_state = LUAU_GET_SL_VM_STATE(lua_mainthread(L));
+    auto *sl_state = LUAU_GET_SL_VM_STATE(L);
 
     auto *llevents = (const lua_LLEvents *)lua_touserdatatagged(L, 1, UTAG_LLEVENTS);
     if (!llevents)
diff --git a/VM/src/llltimers.cpp b/VM/src/llltimers.cpp
index 4fbb4c6b..521122bc 100644
--- a/VM/src/llltimers.cpp
+++ b/VM/src/llltimers.cpp
@@ -115,7 +115,7 @@ int luaSL_createtimermanager(lua_State *L)
 
 static int lltimers_on(lua_State *L)
 {
-    auto *sl_state = LUAU_GET_SL_VM_STATE(lua_mainthread(L));
+    auto *sl_state = LUAU_GET_SL_VM_STATE(L);
 
     auto *lltimers = (lua_LLTimers *)lua_touserdatatagged(L, 1, UTAG_LLTIMERS);
     if (!lltimers)
@@ -171,7 +171,7 @@ static int lltimers_on(lua_State *L)
 
 static int lltimers_once(lua_State *L)
 {
-    auto *sl_state = LUAU_GET_SL_VM_STATE(lua_mainthread(L));
+    auto *sl_state = LUAU_GET_SL_VM_STATE(L);
 
     auto *lltimers = (lua_LLTimers *)lua_touserdatatagged(L, 1, UTAG_LLTIMERS);
     if (!lltimers)
@@ -382,7 +382,7 @@ static void unregister_timer_wrapper(lua_State *L, lua_LLTimers *lltimers)
 // Accepts LLTimers userdata as parameter and manages its own stack
 static void schedule_next_tick(lua_State *L, lua_LLTimers *lltimers)
 {
-    auto *sl_state = LUAU_GET_SL_VM_STATE(lua_mainthread(L));
+    auto *sl_state = LUAU_GET_SL_VM_STATE(L);
 
     if (!sl_state->setTimerEventCb)
         return; // No callback set, can't schedule
@@ -509,7 +509,7 @@ DEFINE_YIELDABLE(lltimers_tick, 0)
         LUAU_ASSERT(lua_gettop(L) == HANDLER_FUNC);
     }
 
-    auto *sl_state = LUAU_GET_SL_VM_STATE(lua_mainthread(L));
+    auto *sl_state = LUAU_GET_SL_VM_STATE(L);
     lua_checkstack(L, 10);
 
     YIELD_DISPATCH_BEGIN(phase, slots);
diff --git a/build-cmd.sh b/build-cmd.sh
index 5e768dd7..53bd8474 100755
--- a/build-cmd.sh
+++ b/build-cmd.sh
@@ -43,6 +43,7 @@ pushd "$top"
     cp -v luacode.h "$stage/include/luau/"
     popd
     cp -rv "Common/include/Luau" "$stage/include/luau/"
+    cp -v "Executor/include/Luau/Executor.h" "Executor/include/Luau/Script.h" "Executor/include/Luau/ByteStream.h" "$stage/include/luau/Luau/"
 
     # Don't litter the source directory with build artifacts
     mkdir -p "$stage/build"
@@ -78,6 +79,7 @@ pushd "$top"
             cp -v "Release/Luau.Compiler.lib" "$stage/lib/release/"
             cp -v "Release/Luau.Config.lib" "$stage/lib/release/"
             cp -v "Release/Luau.VM.lib" "$stage/lib/release/"
+            cp -v "Release/Luau.Executor.lib" "$stage/lib/release/"
             cp -v "Release/Luau.Common.lib" "$stage/lib/release/"
 
             cp -v Release/slua.exe "$stage/bin/"
@@ -100,6 +102,7 @@ pushd "$top"
             cp -v "libLuau.Compiler.a" "$stage/lib/release"
             cp -v "libLuau.Config.a" "$stage/lib/release"
             cp -v "libLuau.VM.a" "$stage/lib/release"
+            cp -v "libLuau.Executor.a" "$stage/lib/release"
 
             cp -v "slua" "$stage/bin/"
 
diff --git a/tests/SLExecutor.test.cpp b/tests/SLExecutor.test.cpp
new file mode 100644
index 00000000..3250f222
--- /dev/null
+++ b/tests/SLExecutor.test.cpp
@@ -0,0 +1,2017 @@
+// This is largely a copy of the lscript_execute_luau integration tests from
+// `server`, but with the caveat that I allowed AI to rewrite them to fit the new
+// API surface and not depend on `tut`. We still have the existing integration
+// tests that will cover any deviation _anyway_, so... this is all just gravy.
+#include "lua.h"
+#include "lualib.h"
+#include "Luau/Executor.h"
+#include "Luau/Script.h"
+#include "llsl.h"
+
+#include "Luau/Compiler.h"
+
+#include "doctest.h"
+#include "ScopedFlags.h"
+
+#ifdef LUAU_USE_TAILSLIDE
+#include "Luau/LSLCompiler.h"
+#endif
+
+#include <map>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+using namespace Luau::Executor;
+
+// Provisioner with deterministic fakes: a virtual clock that advances by
+// clock_step on every reading, plus capture of print output and dynamic
+// handler registrations.
+struct TestProvisioner : Provisioner<>
+{
+    double clock = 0.0;
+    double clock_step = 0.0;
+    // The script-visible stopwatch LLTimers schedules against. Deliberately
+    // separate from the quanta clock above, which advances on every reading.
+    double script_clock = 0.0;
+    double last_timer_interval = -1.0;
+    std::vector<std::string> printed;
+    std::vector<std::string> registrations;
+
+    // Subclasses pass their own callbacks, composed off makeCallbacks()
+    explicit TestProvisioner(const HostCallbacks& callbacks = makeCallbacks())
+        : Provisioner<>(callbacks)
+    {
+    }
+
+    static HostCallbacks makeCallbacks()
+    {
+        HostCallbacks callbacks;
+        callbacks.clockProvider = script_clock_provider;
+        callbacks.performanceClockProvider = script_clock_provider;
+        callbacks.setTimerEventCb = set_timer_event;
+        callbacks.eventHandlerRegistrationCb = handler_registration;
+        callbacks.quantaClockProvider = quanta_clock;
+        callbacks.populateEnvironment = populate_environment;
+        return callbacks;
+    }
+
+    static void populate_environment(IEnvironment& environment, lua_State* L)
+    {
+        lua_pushcfunction(L, capture_print, "capture_print");
+        lua_setglobal(L, "print");
+    }
+
+    static double quanta_clock(lua_State* L)
+    {
+        TestProvisioner& host = of(L);
+        host.clock += host.clock_step;
+        return host.clock;
+    }
+
+    static double script_clock_provider(lua_State* L)
+    {
+        return TestProvisioner::of(L).script_clock;
+    }
+
+    // In real usage this would schedule a timer event with the sim; here we
+    // just record what the VM asked for and drive ticks by hand.
+    static void set_timer_event(lua_State* L, double interval)
+    {
+        TestProvisioner::of(L).last_timer_interval = interval;
+    }
+
+    // Recovers the host the way a real host C callback has to: from the
+    // lua_State the VM handed it.
+    static TestProvisioner& of(lua_State* L)
+    {
+        Script* executor = Script::fromLuaState(L);
+        REQUIRE(executor != nullptr);
+        return static_cast<TestProvisioner&>(executor->getProvisioner());
+    }
+
+    static int capture_print(lua_State* L)
+    {
+        TestProvisioner::of(L).printed.emplace_back(luaL_checkstring(L, 1));
+        return 0;
+    }
+
+    static bool handler_registration(lua_State* L, const char* event_name, bool registered)
+    {
+        TestProvisioner::of(L).registrations.push_back(std::string(registered ? "+" : "-") + event_name);
+        return true;
+    }
+};
+
+static ImageConfig makeImageConfig(const std::string& bytecode, bool is_lsl = false, uint32_t api_version = 0)
+{
+    ImageConfig config;
+    config.bytecode = bytecode.data();
+    config.bytecodeSize = bytecode.size();
+    config.chargedBytecodeSize = bytecode.size();
+    config.isLSL = is_lsl;
+    config.apiVersion = api_version;
+    config.chunkname = is_lsl ? "=lsl_script" : "=lua_script";
+    config.name = "test_script";
+    return config;
+}
+
+static ScriptConfig makeScriptConfig()
+{
+    ScriptConfig config;
+    config.scriptId = "test_script";
+    return config;
+}
+
+/*
+** One-line drivers for the begin-window-then-call pairs the engine API is
+** built around. Each opens a FRESH run window; tests exercising the window
+** itself call the engine directly. The `Raw` variants hand the status back;
+** the plain ones REQUIRE the status the test expects (Ok unless said
+** otherwise) so call sites don't have to.
+*/
+static RunResult dispatchRaw(Script& exec, int lsl_state, const char* event_name, PushArgsFn push_args = nullptr, void* ctx = nullptr, double quanta = 1.0)
+{
+    exec.beginRunWindow(quanta);
+    return exec.callEventHandler(lsl_state, event_name, push_args, ctx);
+}
+
+static RunResult resumeRaw(Script& exec, double quanta = 1.0)
+{
+    exec.beginRunWindow(quanta);
+    return exec.resumeEventHandler();
+}
+
+static RunResult dispatch(Script& exec, int lsl_state, const char* event_name, HandlerRunStatus expect = HandlerRunStatus::Ok,
+    PushArgsFn push_args = nullptr, void* ctx = nullptr, double quanta = 1.0)
+{
+    RunResult result = dispatchRaw(exec, lsl_state, event_name, push_args, ctx, quanta);
+    CAPTURE(event_name);
+    REQUIRE(result.status == expect);
+    return result;
+}
+
+static RunResult dispatch(Script& exec, const char* event_name, HandlerRunStatus expect = HandlerRunStatus::Ok, PushArgsFn push_args = nullptr,
+    void* ctx = nullptr, double quanta = 1.0)
+{
+    return dispatch(exec, 0, event_name, expect, push_args, ctx, quanta);
+}
+
+static RunResult resume(Script& exec, double quanta = 1.0, HandlerRunStatus expect = HandlerRunStatus::Ok)
+{
+    RunResult result = resumeRaw(exec, quanta);
+    REQUIRE(result.status == expect);
+    return result;
+}
+
+// Runs the staged SLua main function (or a resumable handler) to completion,
+// opening a fresh run window before every resume.
+static RunResult resumeToCompletion(Script& exec, double quanta, HandlerRunStatus expect = HandlerRunStatus::Ok, int* preemptions = nullptr)
+{
+    RunResult result{HandlerRunStatus::Preempted, 0};
+    while (result.status == HandlerRunStatus::Preempted)
+    {
+        result = resumeRaw(exec, quanta);
+        if (preemptions && result.status == HandlerRunStatus::Preempted)
+            ++(*preemptions);
+    }
+    REQUIRE(result.status == expect);
+    return result;
+}
+
+// Whole-log comparison for the host's capture vectors (printed, registrations)
+static void checkCapture(const std::vector<std::string>& actual, std::initializer_list<const char*> expected)
+{
+    REQUIRE(actual.size() == expected.size());
+    size_t index = 0;
+    for (const char* want : expected)
+    {
+        CAPTURE(index);
+        CHECK(actual[index] == want);
+        ++index;
+    }
+}
+
+// serializeState()/restoreState() with success asserted, for tests where the
+// round trip itself is not what's under test
+static std::string serialize(Script& exec)
+{
+    std::string payload;
+    REQUIRE(exec.serializeState(payload));
+    return payload;
+}
+
+static void restore(Script& exec, const std::string& payload)
+{
+    REQUIRE(exec.restoreState(payload.data(), payload.size()));
+}
+
+// Compiles source for the requested flavor
+static std::string compileSource(const char* source, bool is_lsl)
+{
+#ifdef LUAU_USE_TAILSLIDE
+    if (is_lsl)
+        return compileLSL(source);
+#endif
+    return Luau::compile(source);
+}
+
+// Bundles a TestProvisioner with the script it provisions, so tests can stand a
+// script up in one line (default 1:1:1 topology via provisionScript(); sharing
+// tests compose the factories directly). loadDefaultState()/reset()/
+// restoreState() stay explicit in the tests since lifecycle ordering is
+// usually part of what is under test.
+struct TestScript
+{
+    TestProvisioner host;
+    std::shared_ptr<Script> owned;
+    Script& exec;
+
+    explicit TestScript(const std::string& bytecode, bool is_lsl = false, uint32_t api_version = 0)
+        : owned(host.provisionScript(makeImageConfig(bytecode, is_lsl, api_version), makeScriptConfig()))
+        , exec(*owned)
+    {
+        REQUIRE(owned != nullptr);
+    }
+
+    // Compiles `source` first (with the LSL compiler when is_lsl)
+    explicit TestScript(const char* source, bool is_lsl = false, uint32_t api_version = 0)
+        : TestScript(compileSource(source, is_lsl), is_lsl, api_version)
+    {
+    }
+
+    // Initial load with the failure asserted, for tests not exercising it
+    void loadDefaultState()
+    {
+        REQUIRE(exec.loadDefaultState());
+    }
+
+    // reset() with the failure asserted, for tests not exercising reset itself
+    void reset()
+    {
+        REQUIRE(exec.reset());
+    }
+
+    // Load and run the SLua main function, which must complete in one window
+    void start()
+    {
+        loadDefaultState();
+        resume(exec);
+    }
+};
+
+// Builds an image the test expects to load
+static std::shared_ptr<IImage> makeImage(TestProvisioner& host, const std::shared_ptr<IEnvironment>& env, const std::string& bytecode)
+{
+    std::shared_ptr<IImage> image = host.buildImage(env, makeImageConfig(bytecode));
+    REQUIRE(image != nullptr);
+    REQUIRE(image->isValid());
+    return image;
+}
+
+// Same, in a fresh environment of its own
+static std::shared_ptr<IImage> makeImage(TestProvisioner& host, const std::string& bytecode)
+{
+    return makeImage(host, host.createEnvironment(false, 0), bytecode);
+}
+
+// Instantiates a script on `image` and runs its main function to completion
+static std::shared_ptr<Script> startScript(TestProvisioner& host, const std::shared_ptr<IImage>& image)
+{
+    std::shared_ptr<Script> script = host.instantiateScript(image, makeScriptConfig());
+    REQUIRE(script != nullptr);
+    REQUIRE(script->loadDefaultState());
+    resume(*script);
+    return script;
+}
+
+// Runs `bytecode` to completion on a throwaway script and returns its
+// serialized payload; the restoreState() tests all start from one of these.
+static std::string donorPayload(const std::string& bytecode)
+{
+    TestScript donor(bytecode);
+    donor.start();
+    return serialize(donor.exec);
+}
+
+// Delivers a timer tick the way the sim would: advance the script clock, then
+// dispatch a `timer` event and run the callbacks to completion.
+static void tickTimers(TestScript& ts, double script_time)
+{
+    ts.host.script_clock = script_time;
+    RunResult result = dispatchRaw(ts.exec, 0, "timer");
+    if (result.status == HandlerRunStatus::Preempted)
+        resumeToCompletion(ts.exec, 1.0);
+    else
+        REQUIRE(result.status == HandlerRunStatus::Ok);
+}
+
+// Reads an integer global off a script's instance
+static int readIntGlobal(Script& script, const char* name)
+{
+    lua_State* instance = script.getInstanceState();
+    lua_getglobal(instance, name);
+    int value = lua_tointeger(instance, -1);
+    lua_pop(instance, 1);
+    return value;
+}
+
+// Every test runs under the SLua feature flags, and leaves the process-global
+// log hook unset for the next test
+struct SLuaFixture
+{
+    ScopedSLuaFlags slua_flags;
+
+    ~SLuaFixture()
+    {
+        logCallback() = nullptr;
+    }
+};
+
+TEST_SUITE_BEGIN("SLExecutor");
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor invalid bytecode")
+{
+    std::string bytecode = "definitely not luau bytecode";
+    TestProvisioner host;
+    std::shared_ptr<IEnvironment> env = host.createEnvironment(false, 0);
+    std::shared_ptr<IImage> image = host.buildImage(env, makeImageConfig(bytecode));
+    CHECK_FALSE(image->isValid());
+    // The load error is surfaced for the host's compile-error reporting
+    CHECK_FALSE(image->getError().empty());
+    CHECK(host.instantiateScript(image, makeScriptConfig()) == nullptr);
+    CHECK(host.provisionScript(makeImageConfig(bytecode), makeScriptConfig()) == nullptr);
+
+    // A failed load leaves the environment usable
+    std::string good = Luau::compile(R"(
+        counter = 1
+    )");
+    makeImage(host, env, good);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor log callback receives engine messages")
+{
+    struct CapturedLog
+    {
+        LogLevel level;
+        std::string source;
+        std::string message;
+    };
+    static std::vector<CapturedLog> captured;
+    captured.clear();
+
+    logCallback() = [](LogLevel level, const char* source, const char* message)
+    {
+        captured.push_back({level, source, message});
+    };
+
+    TestProvisioner host;
+    CHECK(host.instantiateScript(nullptr, makeScriptConfig()) == nullptr);
+    REQUIRE(captured.size() == 1);
+    CHECK(captured[0].level == LogLevel::Warn);
+    CHECK(captured[0].source == "");
+    CHECK(captured[0].message == "Refusing to instantiate image provisioned elsewhere");
+
+    // A message with format arguments, attributed to the image's name
+    std::shared_ptr<IEnvironment> env = host.createEnvironment(false, 0);
+    std::shared_ptr<IImage> image = host.buildImage(env, makeImageConfig("definitely not luau bytecode"));
+    REQUIRE_FALSE(image->isValid());
+    REQUIRE(captured.size() == 2);
+    CHECK(captured[1].level == LogLevel::Warn);
+    CHECK(captured[1].source == "test_script");
+    CHECK(captured[1].message == "Failed to load Luau bytecode: " + image->getError());
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor provisioner topologies")
+{
+    std::string bytecode = Luau::compile(R"(
+        counter = 1
+    )");
+
+    SUBCASE("cross-provisioner refusals")
+    {
+        TestProvisioner host;
+        std::shared_ptr<IEnvironment> env = host.createEnvironment(false, 0);
+        std::shared_ptr<IImage> image = makeImage(host, env, bytecode);
+
+        // A provisioner never builds into or instantiates from another
+        // provisioner's tiers
+        TestProvisioner other_host;
+        CHECK(other_host.buildImage(env, makeImageConfig(bytecode)) == nullptr);
+        CHECK(other_host.instantiateScript(image, makeScriptConfig()) == nullptr);
+
+        // Nor does an image build into an environment of another flavor
+        CHECK(host.buildImage(env, makeImageConfig(bytecode, false, 1)) == nullptr);
+    }
+
+    SUBCASE("one environment hosts multiple images")
+    {
+        std::string bytecode2 = Luau::compile(R"(
+            counter = 2
+        )");
+        TestProvisioner host;
+        std::shared_ptr<IEnvironment> env = host.createEnvironment(false, 0);
+        std::weak_ptr<IEnvironment> env_watch = env;
+        std::shared_ptr<IImage> image1 = makeImage(host, env, bytecode);
+        std::shared_ptr<IImage> image2 = makeImage(host, env, bytecode2);
+
+        // Drop the host's environment handle; the images keep it alive.
+        // This is the cache pattern: retain weakly, lock-or-rebuild.
+        env.reset();
+        REQUIRE_FALSE(env_watch.expired());
+
+        std::shared_ptr<Script> first = startScript(host, image1);
+        std::shared_ptr<Script> second = startScript(host, image2);
+
+        // Each script ran its own image's bytecode
+        CHECK(readIntGlobal(*first, "counter") == 1);
+        CHECK(readIntGlobal(*second, "counter") == 2);
+
+        // Releasing the scripts and images lets the environment expire --
+        // the lifetime is governed solely by what still uses it
+        first.reset();
+        second.reset();
+        image1.reset();
+        REQUIRE_FALSE(env_watch.expired());
+        image2.reset();
+        CHECK(env_watch.expired());
+    }
+
+    SUBCASE("one image hosts multiple script instances")
+    {
+        std::string mutable_bytecode = Luau::compile(R"(
+            counter = (counter or 0) + 1
+        )");
+        TestProvisioner host;
+        std::shared_ptr<IImage> image = makeImage(host, mutable_bytecode);
+        std::shared_ptr<Script> first = startScript(host, image);
+        std::shared_ptr<Script> second = startScript(host, image);
+
+        lua_pushinteger(first->getInstanceState(), 100);
+        lua_setglobal(first->getInstanceState(), "counter");
+        CHECK(readIntGlobal(*first, "counter") == 100);
+        CHECK(readIntGlobal(*second, "counter") == 1);
+
+        REQUIRE(first->reset());
+        CHECK(readIntGlobal(*second, "counter") == 1);
+    }
+
+    SUBCASE("serialize and restore between scripts sharing an environment")
+    {
+        TestProvisioner host;
+        std::shared_ptr<IImage> image = makeImage(host, bytecode);
+        std::shared_ptr<Script> first = startScript(host, image);
+
+        std::string payload = serialize(*first);
+
+        // A fresh script of the same image picks the payload up while the
+        // donor keeps running in the same environment
+        std::shared_ptr<Script> second = host.instantiateScript(image, makeScriptConfig());
+        REQUIRE(second != nullptr);
+        restore(*second, payload);
+        CHECK(second->isMainFunctionComplete());
+        CHECK(readIntGlobal(*second, "counter") == 1);
+        CHECK(readIntGlobal(*first, "counter") == 1);
+    }
+
+    SUBCASE("provisionScript builds a fresh environment per script")
+    {
+        TestProvisioner host;
+        std::shared_ptr<Script> first = host.provisionScript(makeImageConfig(bytecode), makeScriptConfig());
+        std::shared_ptr<Script> second = host.provisionScript(makeImageConfig(bytecode), makeScriptConfig());
+        REQUIRE(first != nullptr);
+        REQUIRE(second != nullptr);
+        CHECK(&first->getEnvironment() != &second->getEnvironment());
+    }
+}
+
+// A host that shares one image per distinct bytecode by composing the public
+// factories; a real host would key on its asset identity instead.
+struct CachingTestHost : TestProvisioner
+{
+    std::map<std::string, std::shared_ptr<IImage>> image_cache;
+
+    std::shared_ptr<Script> provision(const std::string& bytecode)
+    {
+        std::shared_ptr<IImage>& image = image_cache[bytecode];
+        if (image == nullptr)
+            image = buildImage(createEnvironment(false, 0), makeImageConfig(bytecode));
+        return instantiateScript(image, makeScriptConfig());
+    }
+
+    // Drops cached images no Script is using; nothing evicts on the host's behalf
+    size_t releaseUnusedImages()
+    {
+        size_t dropped = 0;
+        for (auto it = image_cache.begin(); it != image_cache.end();)
+        {
+            if (it->second.use_count() == 1)
+            {
+                it = image_cache.erase(it);
+                ++dropped;
+            }
+            else
+            {
+                ++it;
+            }
+        }
+        return dropped;
+    }
+};
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor host-side image caching")
+{
+    std::string bytecode = Luau::compile(R"(
+        counter = (counter or 0) + 1
+    )");
+    std::string bytecode2 = Luau::compile(R"(
+        counter = 2
+    )");
+
+    CachingTestHost host;
+    std::shared_ptr<Script> first = host.provision(bytecode);
+    std::shared_ptr<Script> second = host.provision(bytecode);
+    std::shared_ptr<Script> other = host.provision(bytecode2);
+    REQUIRE(first != nullptr);
+    REQUIRE(second != nullptr);
+    REQUIRE(other != nullptr);
+
+    CHECK(&first->getImage() == &second->getImage());
+    CHECK(&first->getEnvironment() == &second->getEnvironment());
+    CHECK(&first->getImage() != &other->getImage());
+
+    // The cache owns its entries: releasing the scripts leaves the image
+    // resident, and only the host's sweep drops it
+    std::weak_ptr<IImage> watch = host.image_cache[bytecode];
+    first.reset();
+    second.reset();
+    CHECK_FALSE(watch.expired());
+    // The other asset is still in use, so the sweep leaves it alone
+    CHECK(host.releaseUnusedImages() == 1);
+    CHECK(watch.expired());
+
+    std::shared_ptr<Script> again = host.provision(bytecode);
+    REQUIRE(again != nullptr);
+    CHECK(host.image_cache.count(bytecode) == 1);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor co-resident scripts account memory independently")
+{
+    // Parks a large table in a global on demand, so one instance can grow
+    // while its neighbour in the same VM sits idle
+    std::string bytecode = Luau::compile(R"(
+        function LLEvents.moving_start()
+            local hoard = {}
+            for i = 1, 500 do
+                hoard[i] = string.rep("x", 64) .. tostring(i)
+            end
+            kept = hoard
+            reading = gcinfo()
+        end
+        function LLEvents.moving_end()
+            reading = gcinfo()
+        end
+    )");
+
+    TestProvisioner host;
+    std::shared_ptr<IImage> image = makeImage(host, bytecode);
+    std::shared_ptr<Script> first = startScript(host, image);
+    std::shared_ptr<Script> second = startScript(host, image);
+
+    int first_baseline = first->getUsedMemory();
+    int second_baseline = second->getUsedMemory();
+
+    // Same image, so the bytecode is charged to both in full rather than split
+    // between them, and two fresh instances of it start out level
+    CHECK(first_baseline >= (int)bytecode.size());
+    CHECK(second_baseline >= (int)bytecode.size());
+    CHECK(first_baseline == second_baseline);
+
+    dispatch(*first, "moving_start");
+
+    // The allocation lands on the script that made it
+    CHECK(first->getUsedMemory() > first_baseline + 30000);
+
+    // ... and not on its neighbour. Running a handler on the idle script is
+    // what dirties its cached size, so this is a real re-measurement of the
+    // instance rather than the number read back above.
+    dispatch(*second, "moving_end");
+    CHECK(second->getUsedMemory() < second_baseline + 1000);
+
+    // gcinfo() is the script-visible face of the same accounting: each script
+    // reads its own size in KB, not the shared VM's. The second reading was
+    // taken after the hoard existed, so a VM-wide gcinfo would have counted
+    // it in both.
+    CHECK(readIntGlobal(*first, "reading") > readIntGlobal(*second, "reading") + 25);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor interleaves co-resident scripts")
+{
+    std::string slow_bytecode = Luau::compile(R"(
+        total = 0
+        for i = 1, 20000 do
+            total += i
+        end
+    )");
+    std::string quick_bytecode = Luau::compile(R"(
+        counter = 7
+    )");
+
+    TestProvisioner host;
+    std::shared_ptr<IEnvironment> env = host.createEnvironment(false, 0);
+    std::shared_ptr<Script> slow = host.instantiateScript(makeImage(host, env, slow_bytecode), makeScriptConfig());
+    std::shared_ptr<Script> quick = host.instantiateScript(makeImage(host, env, quick_bytecode), makeScriptConfig());
+    REQUIRE(slow != nullptr);
+    REQUIRE(quick != nullptr);
+    REQUIRE(slow->loadDefaultState());
+    REQUIRE(quick->loadDefaultState());
+
+    // Preempt the first script mid-main
+    host.clock_step = 0.001;
+    resume(*slow, 0.005, HandlerRunStatus::Preempted);
+    CHECK(slow->isHandlerActive());
+
+    // Run the other one in the same VM to completion while it sits suspended
+    host.clock_step = 0.0;
+    resume(*quick);
+    CHECK(readIntGlobal(*quick, "counter") == 7);
+
+    // The suspended instance picks up exactly where it left off
+    CHECK(slow->isHandlerActive());
+    resumeToCompletion(*slow, 1.0);
+    CHECK(readIntGlobal(*slow, "total") == 200010000);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor refuses to dispatch over a resumable handler")
+{
+    TestScript ts(R"(
+        function LLEvents.moving_start()
+            print("moving")
+        end
+    )");
+    ts.loadDefaultState();
+    Script& exec = ts.exec;
+
+    // The staged main owns the handler thread until it has run, so an event
+    // dispatched on top of it is refused rather than run against its stack;
+    // a host that cannot tell Refused apart from the other statuses cannot
+    // assert on its own sequencing bugs.
+    dispatch(exec, "moving_start", HandlerRunStatus::Refused);
+    CHECK(ts.host.printed.empty());
+
+    resume(exec);
+
+    dispatch(exec, "moving_start");
+    checkCapture(ts.host.printed, {"moving"});
+
+    // Resuming when there is nothing to resume is the host's sequencing bug,
+    // and reports as such rather than as a missing handler
+    CHECK(exec.resumeEventHandler().status == HandlerRunStatus::Refused);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor abortHandler discards a resumable handler")
+{
+    TestScript ts(R"(
+        ran = 0
+        function LLEvents.moving_start()
+            ran += 1
+            for i = 1, 100000 do end
+            ran += 100
+        end
+    )");
+    ts.start();
+
+    // Preempt the handler mid-loop, then abort it instead of resuming
+    ts.host.clock_step = 0.001;
+    dispatch(ts.exec, "moving_start", HandlerRunStatus::Preempted, nullptr, nullptr, 0.005);
+    REQUIRE(ts.exec.isHandlerActive());
+
+    ts.host.clock_step = 0.0;
+    ts.exec.abortHandler();
+    CHECK_FALSE(ts.exec.isHandlerActive());
+
+    // Aborting again is a no-op
+    ts.exec.abortHandler();
+
+    // The aborted handler's tail never ran, and the thread is clean enough
+    // to dispatch on again
+    RunResult rerun = dispatch(ts.exec, "moving_start");
+    // Main-function completion was already reported, never again
+    CHECK_FALSE(rerun.mainFunctionCompleted);
+    CHECK(readIntGlobal(ts.exec, "ran") == 102);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor yield-due is scoped to the run window")
+{
+    TestScript ts(R"(
+        function LLEvents.moving_start()
+            local total = 0
+            for i = 1, 20000 do
+                total += i
+            end
+        end
+        function LLEvents.moving_end()
+        end
+    )");
+    ts.start();
+    Script& exec = ts.exec;
+
+    // Everything below runs in ONE window, so the engine is driven directly
+    // rather than through the fresh-window helpers.
+    // Force a preemption without burning virtual time, so the rest of the
+    // window is only bounded by the flag under test
+    exec.beginRunWindow(1.0);
+    exec.setForceYield(true);
+    REQUIRE(exec.callEventHandler(0, "moving_start", nullptr).status == HandlerRunStatus::Preempted);
+    CHECK(exec.isYieldDue());
+
+    // Finishing that handler and running another one in the same window leaves
+    // the flag set: it describes the window, not the last call
+    exec.setForceYield(false);
+    REQUIRE(exec.resumeEventHandler().status == HandlerRunStatus::Ok);
+    CHECK(exec.isYieldDue());
+    REQUIRE(exec.callEventHandler(0, "moving_end", nullptr).status == HandlerRunStatus::Ok);
+    CHECK(exec.isYieldDue());
+
+    // Only a fresh window clears it
+    exec.beginRunWindow(1.0);
+    CHECK_FALSE(exec.isYieldDue());
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor a host-set fault completes the main function")
+{
+    // A script the host kills will never register the rest of its handlers, so
+    // the host has to be free to start masking its events
+    TestScript ts(R"(
+        counter = 1
+    )");
+    ts.loadDefaultState();
+
+    CHECK_FALSE(ts.exec.isMainFunctionComplete());
+    ts.exec.setFault(FaultKind::Runtime, "killed by host");
+    CHECK(ts.exec.isMainFunctionComplete());
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor carries host context and the charged bytecode size")
+{
+    std::string bytecode = Luau::compile(R"(
+        marker = 1
+    )");
+
+    int host_object = 42;
+    TestProvisioner host;
+
+    ImageConfig image_config = makeImageConfig(bytecode);
+    // The host charges the whole asset, headers included, not just the slice it
+    // handed over to be loaded
+    image_config.chargedBytecodeSize = bytecode.size() + 4096;
+
+    ScriptConfig script_config = makeScriptConfig();
+    script_config.hostContext = &host_object;
+    script_config.memoryLimit = 64 * 1024;
+
+    std::shared_ptr<Script> script = host.provisionScript(image_config, script_config);
+    REQUIRE(script != nullptr);
+    CHECK(script->getHostContext() == &host_object);
+    CHECK(script->getMemoryLimit() == 64 * 1024);
+
+    // The charge applies before an instance exists and after it does
+    CHECK(script->getUsedMemory() >= (int)(bytecode.size() + 4096));
+    REQUIRE(script->loadDefaultState());
+    resume(*script);
+    CHECK(script->getUsedMemory() >= (int)(bytecode.size() + 4096));
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor SLua lifecycle")
+{
+    TestScript ts(R"(
+        local greeting = "hello"
+        print(greeting)
+    )");
+    ts.loadDefaultState();
+
+    // The main function is staged on the handler thread as the state_entry handler
+    CHECK(ts.exec.isHandlerActive());
+    resume(ts.exec);
+    CHECK_FALSE(ts.exec.isHandlerActive());
+    checkCapture(ts.host.printed, {"hello"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor quanta preemption")
+{
+    TestScript ts(R"(
+        local total = 0
+        for i = 1, 30 do
+            total += i
+        end
+        print("finished")
+    )");
+    ts.loadDefaultState();
+    Script& exec = ts.exec;
+
+    // Each interrupt advances the clock 1ms against a 5ms quanta, so every run
+    // window covers a handful of loop iterations before the engine breaks.
+    ts.host.clock_step = 0.001;
+    resume(exec, 0.005, HandlerRunStatus::Preempted);
+    CHECK(exec.isYieldDue());
+    CHECK(exec.isHandlerActive());
+
+    int preemptions = 0;
+    resumeToCompletion(exec, 0.005, HandlerRunStatus::Ok, &preemptions);
+    CHECK(preemptions >= 1);
+    // Preemption at ~1.2x quanta stays well under the 3x punishment threshold
+    CHECK(exec.getSleep() == 0.0f);
+    checkCapture(ts.host.printed, {"finished"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor slowness punishment")
+{
+    TestScript ts(R"(
+        local total = 0
+        for i = 1, 100 do
+            total += i
+        end
+        print("finished")
+    )");
+    ts.loadDefaultState();
+
+    SUBCASE("punished past 3x quanta")
+    {
+        // First interrupt sees 10ms elapsed against a 1ms quanta: past the 3x
+        // threshold, so the engine adds (elapsed - quanta) * 5 of sleep.
+        ts.host.clock_step = 0.01;
+        resume(ts.exec, 0.001, HandlerRunStatus::Preempted);
+        CHECK(ts.exec.getSleep() == doctest::Approx((0.01 - 0.001) * 5.0).epsilon(0.01));
+    }
+
+    SUBCASE("tiny quantas use the punishment floor")
+    {
+        // 2ms elapsed overruns the 0.1ms quanta but stays under 3x the 1ms
+        // punishment floor, so the overrun is forgiven.
+        ts.host.clock_step = 0.002;
+        resume(ts.exec, 0.0001, HandlerRunStatus::Preempted);
+        CHECK(ts.exec.getSleep() == 0.0f);
+    }
+
+    SUBCASE("reset clears accumulated punishment")
+    {
+        ts.host.clock_step = 0.01;
+        resume(ts.exec, 0.001, HandlerRunStatus::Preempted);
+        REQUIRE(ts.exec.getSleep() > 0.0f);
+
+        ts.reset();
+        CHECK(ts.exec.getSleep() == 0.0f);
+    }
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor mandatory yield kill")
+{
+    SUBCASE("unyieldable metamethod")
+    {
+        TestScript ts(R"(
+            local mt = {}
+            mt.__index = function(t, k)
+                local i = 0
+                while true do
+                    i += 1
+                end
+            end
+            local obj = setmetatable({}, mt)
+            print(obj.missing)
+        )");
+        ts.loadDefaultState();
+        Script& exec = ts.exec;
+
+        // The mocked clock jumps a full second per reading, so every interrupt is
+        // already past 3.5x the 1ms punishment floor. Interrupts at yieldable
+        // points just preempt; the script is only killed once execution is inside
+        // the metamethod frame, where a yield can't be injected.
+        ts.host.clock_step = 1.0;
+        resumeToCompletion(exec, 0.0001, HandlerRunStatus::Fault);
+        CHECK(exec.getFaultKind() == FaultKind::Timeout);
+        CHECK(exec.getFaultString() == "exceeded time limit");
+        CHECK(exec.getExtendedFaultString().find("Failed to perform mandatory yield") != std::string::npos);
+        CHECK(exec.getSleep() > 0.0f);
+    }
+
+    SUBCASE("a caught mandatory yield lets the script recover")
+    {
+        // The first mandatory yield of an unyieldable stretch is catchable, so
+        // a script whose pcall sits outside that stretch gets to report the
+        // failure. It unwinds back into yieldable code, where the next
+        // interrupt preempts it normally, so the host keeps control and the
+        // script is only out the sleep punishment.
+        TestScript ts(R"(
+            local mt = {}
+            mt.__index = function(t, k)
+                local i = 0
+                while true do
+                    i += 1
+                end
+            end
+            local obj = setmetatable({}, mt)
+            local ok, err = pcall(function()
+                return obj.missing
+            end)
+            print(`swallowed {err}`)
+        )");
+        ts.loadDefaultState();
+        Script& exec = ts.exec;
+
+        // Each clock reading advances 0.5x quanta, so every window makes
+        // progress before its first over-quanta interrupt, and the
+        // metamethod's back-edge interrupts walk elapsed past the 3.5x
+        // threshold. The loop serves the accumulated sleep punishment the
+        // way a real host would (the host owns the countdown); leaving it
+        // pending would force a mandatory break at every interrupt and
+        // livelock the resume loop. Capped so a regression fails instead
+        // of hanging.
+        ts.host.clock_step = 0.001;
+        bool punished = false;
+        RunResult result{HandlerRunStatus::Preempted, 0};
+        for (int resumes = 0; result.status == HandlerRunStatus::Preempted && resumes < 1000; ++resumes)
+        {
+            exec.setSleep(0.0f);
+            result = resumeRaw(exec, 0.002);
+            // Read before the next iteration serves it
+            punished = punished || exec.getSleep() > 0.0f;
+        }
+        CHECK(result.status == HandlerRunStatus::Ok);
+        CHECK(exec.getFaultKind() == FaultKind::None);
+        CHECK(punished);
+        REQUIRE(ts.host.printed.size() == 1);
+        CHECK(ts.host.printed[0].find("Failed to perform mandatory yield") != std::string::npos);
+    }
+
+    SUBCASE("looping on the caught error is not survivable")
+    {
+        // The adversarial shape the escalation exists for: the retry loop lives
+        // *inside* the metamethod frame, where a yield can't be injected, so
+        // the script never reaches a yieldable point between catches and the
+        // throw and the pcall's catch both happen within one lua_resume. No
+        // catchable error breaks that -- the host's resume loop would never
+        // regain control -- so the second mandatory yield of the stretch kills
+        // uncatchably.
+        TestScript ts(R"(
+            local mt = {}
+            mt.__index = function(t, k)
+                while true do
+                    pcall(function()
+                        local i = 0
+                        while true do
+                            i += 1
+                        end
+                    end)
+                end
+            end
+            local obj = setmetatable({}, mt)
+            print(obj.missing)
+        )");
+        ts.loadDefaultState();
+
+        ts.host.clock_step = 1.0;
+        resumeToCompletion(ts.exec, 0.0001, HandlerRunStatus::Fault);
+        CHECK(ts.exec.getFaultKind() == FaultKind::Timeout);
+        CHECK(ts.exec.getFaultString() == "exceeded time limit");
+        // The script never got to observe the kill
+        CHECK(ts.host.printed.empty());
+    }
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor pending sleep preempts")
+{
+    TestScript ts(R"(
+        local total = 0
+        for i = 1, 100 do
+            total += i
+        end
+        print("finished")
+    )");
+    ts.loadDefaultState();
+
+    ts.exec.setSleep(1.0f);
+    resume(ts.exec, 1.0, HandlerRunStatus::Preempted);
+    CHECK(ts.exec.isYieldDue());
+    // Sleep-driven preemption carries no punishment
+    CHECK(ts.exec.getSleep() == 1.0f);
+
+    ts.exec.setSleep(0.0f);
+    resumeToCompletion(ts.exec, 1.0);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor memory limit")
+{
+    std::string bytecode = Luau::compile(R"(
+        local parts = {}
+        for i = 1, 400 do
+            parts[i] = string.rep("x", 100) .. tostring(i)
+        end
+        held_parts = parts
+        print("allocated")
+    )");
+
+    TestScript ts(bytecode);
+    ts.loadDefaultState();
+    Script& exec = ts.exec;
+
+    SUBCASE("allocations under the limit succeed and are measured")
+    {
+        int baseline = exec.getUsedMemory();
+        CHECK(baseline >= (int)bytecode.size());
+
+        resume(exec);
+
+        // 400 strings of 100+ bytes must show up in the reachability scan
+        CHECK(exec.getUsedMemory() >= baseline + 40000);
+
+        // Limit validity rules: never below current use, never raised above the
+        // cap, shrinking from an unsafe raise is allowed
+        CHECK_FALSE(exec.setMemoryLimit(exec.getUsedMemory() - 1));
+        CHECK_FALSE(exec.setMemoryLimit(kDefaultMemoryLimit + 1));
+        CHECK(exec.setMemoryLimit(kDefaultMemoryLimit));
+        exec.setMemoryLimitUnsafe(kDefaultMemoryLimit * 2);
+        CHECK(exec.getMemoryLimit() == kDefaultMemoryLimit * 2);
+        CHECK(exec.setMemoryLimit(kDefaultMemoryLimit + 4096));
+    }
+
+    SUBCASE("exceeding the limit faults with out-of-memory")
+    {
+        exec.setMemoryLimitUnsafe(exec.getUsedMemory() + 8192);
+        resume(exec, 1.0, HandlerRunStatus::Fault);
+        CHECK(exec.getFaultKind() == FaultKind::OutOfMemory);
+        CHECK(exec.getFaultString() == "not enough memory");
+        CHECK(ts.host.printed.empty());
+
+        // A faulted script can be reset and run again under a sane limit
+        exec.setMemoryLimitUnsafe(kDefaultMemoryLimit);
+        ts.reset();
+        CHECK(exec.getFaultKind() == FaultKind::None);
+        resume(exec);
+    }
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor LLEvents dispatch")
+{
+    // A non-detected event, so the pushed arguments reach the handler verbatim
+    // (detected events get their count arg replaced with a table of
+    // detected-event wrappers before dispatch)
+    TestScript ts(R"(
+        LLEvents:on("link_message", function(...)
+            local args = {...}
+            print(`{select("#", ...)}:{args[1]}:{args[2]}:{args[3]}`)
+        end)
+    )");
+    ts.loadDefaultState();
+
+    // Run the main function; it registers the link_message handler dynamically
+    resume(ts.exec);
+    checkCapture(ts.host.registrations, {"+link_message"});
+
+    // The engine counts what the callback pushed rather than being told
+    dispatch(ts.exec, "link_message", HandlerRunStatus::Ok, [](lua_State* handler, void*) {
+        luaSL_pushnativeinteger(handler, 7);
+        lua_pushstring(handler, "hello");
+        luaSL_pushnativeinteger(handler, -3);
+    });
+    checkCapture(ts.host.printed, {"3:7:hello:-3"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor pushes args outside a resume")
+{
+    // Args are marshalled before the handler thread is resumed, so nothing on that
+    // path may reach the VM and try to yield from a thread with no frame. The
+    // interrupt handler asserts on it; this drives `luaSL_pushuuidstring`, the
+    // argument type that touches a metatabled table on its way in.
+    TestScript ts(R"(
+        LLEvents:on("dataserver", function(query_id, data)
+            print(`{typeof(query_id)}/{data}`)
+        end)
+    )");
+    ts.loadDefaultState();
+
+    resume(ts.exec);
+
+    // A pending forced yield makes the first interrupt mandatory, so one reaching
+    // the marshalling would kill the script rather than pass unnoticed. The first
+    // one that does fire lands in `handleEvent`, which is yieldable.
+    ts.exec.setForceYield(true);
+
+    RunResult result = dispatchRaw(ts.exec, 0, "dataserver", [](lua_State* handler, void*) {
+        luaSL_pushuuidstring(handler, "8d4a1e26-3f2b-4c7d-9a15-6e0b3c8f2d41");
+        lua_pushstring(handler, "payload");
+    });
+    REQUIRE(result.status == HandlerRunStatus::Preempted);
+    CHECK(ts.exec.getFaultKind() == FaultKind::None);
+    CHECK(ts.host.printed.empty());
+
+    ts.exec.setForceYield(false);
+    resumeToCompletion(ts.exec, 1.0);
+    checkCapture(ts.host.printed, {"uuid/payload"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor dynamic handler unregistration")
+{
+    TestScript ts(R"(
+        local function handler() end
+        LLEvents:on("touch_start", handler)
+        LLEvents:off("touch_start", handler)
+    )");
+    ts.loadDefaultState();
+
+    resume(ts.exec);
+
+    checkCapture(ts.host.registrations, {"+touch_start", "-touch_start"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor timers")
+{
+    SUBCASE("basic once timer")
+    {
+        TestScript ts(R"(
+            LLTimers:once(1.5, function(scheduled_time, interval)
+                assert(interval == nil, "once timer should have nil interval")
+                assert(math.abs(scheduled_time - 1.5) < 0.001, "scheduled_time should be 1.5")
+                print("PASS")
+            end)
+        )");
+        ts.loadDefaultState();
+
+        resume(ts.exec);
+        // The VM asked the host to wake it when the timer comes due
+        CHECK(ts.host.last_timer_interval >= 0.0);
+
+        tickTimers(ts, 2.0);
+        checkCapture(ts.host.printed, {"PASS"});
+    }
+
+    SUBCASE("zero delay timer")
+    {
+        TestScript ts(R"(
+            LLTimers:once(0.0, function(scheduled_time, interval)
+                assert(interval == nil, "once timer should have nil interval")
+                assert(math.abs(scheduled_time - 0.0) < 0.001, "zero delay scheduled for T=0")
+                print("PASS")
+            end)
+        )");
+        ts.loadDefaultState();
+
+        resume(ts.exec);
+
+        tickTimers(ts, 0.1);
+        checkCapture(ts.host.printed, {"PASS"});
+    }
+
+    SUBCASE("every timer uses absolute scheduling")
+    {
+        TestScript ts(R"(
+            fire_times = {}
+            LLTimers:every(1.0, function(scheduled_time, interval)
+                assert(interval == 1.0, "every timer interval should be 1.0")
+                table.insert(fire_times, scheduled_time)
+            end)
+        )");
+        ts.loadDefaultState();
+
+        resume(ts.exec);
+
+        // :every fires at most once per tick and does not catch up missed slots;
+        // after the T=5.2 tick the cadence resets to 5.2 + 1.0 = 6.2
+        tickTimers(ts, 1.1);
+        tickTimers(ts, 2.5);
+        tickTimers(ts, 5.2);
+        tickTimers(ts, 6.5);
+
+        lua_State* script = ts.exec.getInstanceState();
+        lua_getglobal(script, "fire_times");
+        REQUIRE(lua_istable(script, -1));
+        CHECK(lua_objlen(script, -1) == 4);
+        const double expected[] = {1.0, 2.0, 3.0, 6.2};
+        for (int i = 0; i < 4; ++i)
+        {
+            lua_rawgeti(script, -1, i + 1);
+            CHECK(lua_tonumber(script, -1) == doctest::Approx(expected[i]).epsilon(0.001));
+            lua_pop(script, 1);
+        }
+        lua_pop(script, 1);
+    }
+
+    SUBCASE("cancelled timer does not fire")
+    {
+        TestScript ts(R"(
+            local function timer1() print("TIMER1") end
+            local function timer2() print("TIMER2") end
+            LLTimers:once(1.0, timer1)
+            LLTimers:once(1.0, timer2)
+            LLTimers:off(timer1)
+        )");
+        ts.loadDefaultState();
+
+        resume(ts.exec);
+
+        tickTimers(ts, 2.0);
+        checkCapture(ts.host.printed, {"TIMER2"});
+    }
+
+    SUBCASE("concurrent timers fire in definition order")
+    {
+        TestScript ts(R"(
+            LLTimers:once(2.0, function() print("C") end)
+            LLTimers:once(1.0, function() print("A") end)
+            LLTimers:once(1.5, function() print("B1") end)
+            LLTimers:once(1.5, function() print("B2") end)
+            LLTimers:once(3.0, function() print("D") end)
+        )");
+        ts.loadDefaultState();
+
+        resume(ts.exec);
+
+        // All are due at this tick, so they fire in definition order
+        tickTimers(ts, 4.0);
+        checkCapture(ts.host.printed, {"C", "A", "B1", "B2", "D"});
+    }
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor out of memory during event dispatch")
+{
+    SUBCASE("handler setup with no memory left")
+    {
+        TestScript ts(R"(
+            held = buffer.create(1024 * 100)
+            LLEvents:on("touch_start", function() print("HANDLER RAN") end)
+        )");
+        ts.loadDefaultState();
+        Script& exec = ts.exec;
+
+        resume(exec);
+        CHECK(exec.getUsedMemory() > 1024 * 100);
+
+        // Leave barely any headroom, so allocations during dispatch fail
+        exec.setMemoryLimitUnsafe(exec.getUsedMemory() + 128);
+        dispatch(exec, "touch_start", HandlerRunStatus::Fault);
+        CHECK(exec.getFaultKind() == FaultKind::OutOfMemory);
+        CHECK(ts.host.printed.empty());
+    }
+
+    SUBCASE("oversized argument push faults gracefully")
+    {
+        TestScript ts(R"(
+            LLEvents:on("dataserver", function(s) print("HANDLER RAN") end)
+        )");
+        ts.loadDefaultState();
+        Script& exec = ts.exec;
+
+        resume(exec);
+
+        // Enough headroom for handler setup, nowhere near enough for the argument
+        exec.setMemoryLimitUnsafe(exec.getUsedMemory() + 2048);
+        dispatch(exec, "dataserver", HandlerRunStatus::Fault, [](lua_State* handler, void*) {
+            std::string huge(1024 * 100, 'x');
+            lua_pushlstring(handler, huge.data(), huge.size());
+        });
+        CHECK(exec.getFaultKind() == FaultKind::OutOfMemory);
+        // The handler body must never have run
+        CHECK(ts.host.printed.empty());
+    }
+}
+
+static int untracked_cfunc(lua_State* L)
+{
+    return 0;
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor unserializable global is refused without exploding")
+{
+    TestScript first(R"(
+        counter = 1
+    )");
+    first.start();
+
+    // A C function on the user-mutable globals has no perms entry
+    lua_State* script = first.exec.getInstanceState();
+    lua_pushcfunction(script, untracked_cfunc, "untracked_cfunc");
+    lua_setglobal(script, "foobar");
+
+    std::string payload;
+    CHECK_FALSE(first.exec.serializeState(payload));
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor invalid restore")
+{
+    std::string bytecode = Luau::compile(R"(
+        counter = 1
+    )");
+
+    std::string payload = donorPayload(bytecode);
+    TestScript second(bytecode);
+
+    SUBCASE("corrupt payload is refused without exploding")
+    {
+        REQUIRE(payload.size() > 16);
+
+        // Corrupt the Ares data inside an otherwise well-formed payload, so the
+        // header parses and the failure comes out of the fork. The flavor stamp
+        // is the last five bytes, so stay clear of it or the envelope rejects
+        // the payload before the fork is ever reached.
+        std::string corrupt_ares = payload;
+        corrupt_ares[corrupt_ares.size() - 6] ^= 0xFF;
+        corrupt_ares[corrupt_ares.size() / 2] ^= 0xFF;
+
+        CHECK_FALSE(second.exec.restoreState(corrupt_ares.data(), corrupt_ares.size()));
+        CHECK(second.exec.getFaultKind() != FaultKind::None);
+
+        // Serializing afterwards must not explode; it just reports failure
+        std::string after;
+        CHECK_FALSE(second.exec.serializeState(after));
+    }
+
+    SUBCASE("malformed payloads are rejected before anything is torn down")
+    {
+        // Wrong magic, bad version, empty, and truncated at several lengths
+        std::string bad_magic = payload;
+        bad_magic[0] = 'B';
+        CHECK_FALSE(second.exec.restoreState(bad_magic.data(), bad_magic.size()));
+
+        std::string bad_version = payload;
+        bad_version[4] = (char)(kScriptStateFingerprint.version + 99);
+        CHECK_FALSE(second.exec.restoreState(bad_version.data(), bad_version.size()));
+
+        CHECK_FALSE(second.exec.restoreState("", 0));
+        for (size_t len : {size_t(4), size_t(8), size_t(16), payload.size() / 2, payload.size() - 1})
+            CHECK_FALSE(second.exec.restoreState(payload.data(), len));
+
+        // Nothing was torn down, so a good payload still loads and runs
+        second.exec.clearFault();
+        restore(second.exec, payload);
+        CHECK(second.exec.getFaultKind() == FaultKind::None);
+    }
+
+    SUBCASE("restore directly after instantiate succeeds")
+    {
+        // Restoring persisted state is the common production start path, so
+        // restoreState() must not require a throwaway reset() fork in between
+        restore(second.exec, payload);
+        CHECK(second.exec.getFaultKind() == FaultKind::None);
+        CHECK(second.exec.isMainFunctionComplete());
+
+        CHECK(readIntGlobal(second.exec, "counter") == 1);
+    }
+
+    SUBCASE("restore over a live instance is refused")
+    {
+        // A live instance means the caller would be implicitly discarding a
+        // running script; that sequencing is a host bug, so it is refused
+        second.loadDefaultState();
+        CHECK_FALSE(second.exec.restoreState(payload.data(), payload.size()));
+        CHECK(second.exec.getFaultKind() == FaultKind::Runtime);
+
+        // The refusal leaves the live instance untouched and runnable
+        second.exec.clearFault();
+        resume(second.exec);
+    }
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor sleep and fault survive a round trip")
+{
+    // The payload carries the script instance plus the sleep and fault it was
+    // holding, so the host stores one opaque blob and cannot drop half of it.
+    std::string bytecode = Luau::compile(R"(
+        counter = 1
+    )");
+    TestScript first(bytecode);
+    first.start();
+
+    first.exec.setSleep(0.25f);
+    first.exec.setFault(FaultKind::Runtime, "runtime error", "boom\nstacktrace");
+
+    std::string payload = serialize(first.exec);
+
+    TestScript second(bytecode);
+    REQUIRE(second.exec.getSleep() == 0.0f);
+    REQUIRE(second.exec.getFaultKind() == FaultKind::None);
+
+    restore(second.exec, payload);
+    CHECK(second.exec.getSleep() == 0.25f);
+    CHECK(second.exec.getFaultKind() == FaultKind::Runtime);
+    CHECK(second.exec.getFaultString() == "runtime error");
+    CHECK(second.exec.getExtendedFaultString() == "boom\nstacktrace");
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor persistence envelope validation")
+{
+    std::string bytecode = Luau::compile(R"(
+        counter = 1
+    )");
+
+    SUBCASE("a state from another flavor is refused")
+    {
+        // Caught in the envelope rather than somewhere inside Ares
+        std::string payload = donorPayload(bytecode);
+
+        TestScript other(bytecode, false, 1);
+        CHECK_FALSE(other.exec.restoreState(payload.data(), payload.size()));
+        CHECK(other.exec.getFaultKind() == FaultKind::Runtime);
+        CHECK_FALSE(other.exec.hasInstance());
+    }
+
+    SUBCASE("the persisted traceback is capped")
+    {
+        TestScript first(bytecode);
+        first.start();
+        std::string huge_trace(kMaxPersistedFaultLen * 4, 'x');
+        first.exec.setFault(FaultKind::Runtime, "runtime error", huge_trace.c_str());
+
+        std::string payload = serialize(first.exec);
+
+        TestScript second(bytecode);
+        restore(second.exec, payload);
+        CHECK(second.exec.getExtendedFaultString().size() == kMaxPersistedFaultLen);
+    }
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor memory limit survives a round trip")
+{
+    std::string bytecode = Luau::compile(R"(
+        counter = 1
+    )");
+    TestScript first(bytecode);
+    first.start();
+
+    // The limit drifts at runtime (llSetMemoryLimit), so the payload must
+    // carry it: a restored script continuing with the instantiate-time
+    // default would silently regain headroom the host took away.
+    constexpr int kLoweredLimit = 96 * 1024;
+    REQUIRE(first.exec.setMemoryLimit(kLoweredLimit));
+
+    std::string payload = serialize(first.exec);
+
+    TestScript second(bytecode);
+    REQUIRE(second.exec.getMemoryLimit() == kDefaultMemoryLimit);
+    restore(second.exec, payload);
+    CHECK(second.exec.getMemoryLimit() == kLoweredLimit);
+}
+
+// A Script carrying durable state of its own, standing in for a host's
+// analogue of `LLScriptData`.
+class StatefulScript : public Script
+{
+public:
+    using Script::Script;
+
+    int32_t counter = 0;
+    std::string label;
+    int interrupts = 0;
+
+    static void installVMCallbacks(lua_State* L)
+    {
+        Script::installVMCallbacks(L);
+        lua_callbacks(L)->interrupt = counting_interrupt;
+    }
+
+protected:
+    StateFingerprint getStateFingerprint() const override { return {{'S', 'T', 'F', 'L'}, 1}; }
+
+    bool serializeExtra(ByteWriter& writer) const override
+    {
+        writer.writeS32(counter);
+        writer.writeString(label);
+        return true;
+    }
+
+    bool restoreExtra(ByteReader& reader) override { return reader.readS32(counter) && reader.readString(label); }
+
+private:
+    static void counting_interrupt(lua_State* L, int gc)
+    {
+        // Sound because makeScript() is the only way a script reaches this VM
+        auto* script = static_cast<StatefulScript*>(Script::fromLuaState(L));
+        if (script != nullptr)
+            ++script->interrupts;
+
+        Script::interruptHandler(L, gc);
+    }
+};
+
+class StatefulEnvironment : public Environment
+{
+public:
+    StatefulEnvironment(IProvisioner& provisioner, bool is_lsl, uint32_t api_version)
+        : Environment(provisioner, is_lsl, api_version)
+        , flavor(is_lsl ? "lsl" : "lua")
+    {
+    }
+
+    std::string flavor;
+};
+
+class StatefulImage : public Image
+{
+public:
+    StatefulImage(std::shared_ptr<IEnvironment> environment, const ImageConfig& config)
+        : Image(std::move(environment), config)
+        , raw_bytecode_size(config.bytecodeSize)
+    {
+    }
+
+    // Image only retains the charged size, not what was actually handed to it
+    size_t raw_bytecode_size = 0;
+};
+
+// Replaces every tier. TestProvisioner's callbacks recover it by downcasting
+// getProvisioner() to itself, so a provisioner of other types needs its own.
+struct StatefulProvisioner : Provisioner<StatefulScript>
+{
+    double clock = 0.0;
+    double clock_step = 0.0;
+    int environments_made = 0;
+    int images_made = 0;
+
+    StatefulProvisioner()
+        : Provisioner<StatefulScript>(makeCallbacks())
+    {
+    }
+
+    static HostCallbacks makeCallbacks()
+    {
+        HostCallbacks callbacks;
+        callbacks.quantaClockProvider = quanta_clock;
+        return callbacks;
+    }
+
+    static double quanta_clock(lua_State* L)
+    {
+        Script* executor = Script::fromLuaState(L);
+        REQUIRE(executor != nullptr);
+
+        auto& host = static_cast<StatefulProvisioner&>(executor->getProvisioner());
+        host.clock += host.clock_step;
+        return host.clock;
+    }
+
+    // The only place the downcast happens, since everything this provisioner
+    // mints comes through makeScript()
+    std::shared_ptr<StatefulScript> provision(const std::string& bytecode)
+    {
+        return std::static_pointer_cast<StatefulScript>(provisionScript(makeImageConfig(bytecode), makeScriptConfig()));
+    }
+
+    std::shared_ptr<StatefulScript> start(const std::string& bytecode)
+    {
+        std::shared_ptr<StatefulScript> script = provision(bytecode);
+        REQUIRE(script != nullptr);
+        REQUIRE(script->loadDefaultState());
+        resume(*script);
+        return script;
+    }
+
+protected:
+    std::shared_ptr<Environment> makeEnvironment(bool is_lsl, uint32_t api_version) override
+    {
+        ++environments_made;
+        return std::make_shared<StatefulEnvironment>(*this, is_lsl, api_version);
+    }
+
+    std::shared_ptr<Image> makeImage(std::shared_ptr<IEnvironment> environment, const ImageConfig& config) override
+    {
+        ++images_made;
+        return std::make_shared<StatefulImage>(std::move(environment), config);
+    }
+};
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor subclass state survives a round trip")
+{
+    // Long enough to take a loop back-edge interrupt, short enough to finish
+    // inside one window
+    std::string bytecode = Luau::compile(R"(
+        local total = 0
+        for i = 1, 10000 do
+            total += i
+        end
+        counter = 1
+    )");
+
+    StatefulProvisioner host;
+    std::shared_ptr<StatefulScript> first = host.start(bytecode);
+
+    // Every tier is recoverable as the host's own type without the engine
+    // knowing any of them exist
+    CHECK(host.environments_made == 1);
+    CHECK(host.images_made == 1);
+    CHECK(static_cast<StatefulEnvironment&>(first->getEnvironment()).flavor == "lua");
+    CHECK(static_cast<StatefulImage&>(first->getImage()).raw_bytecode_size == bytecode.size());
+    // Chaining to ours left the run window intact, so the script still finished
+    CHECK(first->interrupts > 0);
+
+    first->counter = 42;
+    first->label = "held";
+
+    std::string payload = serialize(*first);
+
+    // The subclass's fields ride in the same payload as the instance, so the
+    // host cannot store one without the other
+    std::shared_ptr<StatefulScript> second = host.provision(bytecode);
+    REQUIRE(second != nullptr);
+    REQUIRE(second->counter == 0);
+
+    restore(*second, payload);
+    CHECK(second->counter == 42);
+    CHECK(second->label == "held");
+    CHECK(readIntGlobal(*second, "counter") == 1);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor refuses a payload from another script class")
+{
+    std::string bytecode = Luau::compile(R"(
+        counter = 1
+    )");
+
+    StatefulProvisioner host;
+    std::string stateful_payload = serialize(*host.start(bytecode));
+    std::string plain_payload = donorPayload(bytecode);
+
+    // The fingerprint at the head of the payload says whose it is, so neither
+    // class gets far enough to fork an instance out of the other's state
+    TestScript plain(bytecode);
+    CHECK_FALSE(plain.exec.restoreState(stateful_payload.data(), stateful_payload.size()));
+    CHECK(plain.exec.getFaultKind() == FaultKind::Runtime);
+    CHECK_FALSE(plain.exec.hasInstance());
+
+    std::shared_ptr<StatefulScript> stateful = host.provision(bytecode);
+    REQUIRE(stateful != nullptr);
+    CHECK_FALSE(stateful->restoreState(plain_payload.data(), plain_payload.size()));
+    CHECK(stateful->getFaultKind() == FaultKind::Runtime);
+    CHECK_FALSE(stateful->hasInstance());
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor main function completion")
+{
+    std::string bytecode = Luau::compile(R"(
+        local total = 0
+        for i = 1, 100000 do
+            total += i
+        end
+        done = total
+    )");
+
+    TestScript first(bytecode);
+    first.loadDefaultState();
+    // The staged main function has not run yet
+    CHECK_FALSE(first.exec.isMainFunctionComplete());
+
+    // Preempt the main mid-loop and serialize the suspended instance
+    first.host.clock_step = 0.001;
+    RunResult preempted = resume(first.exec, 0.005, HandlerRunStatus::Preempted);
+    CHECK_FALSE(first.exec.isMainFunctionComplete());
+    CHECK_FALSE(preempted.mainFunctionCompleted);
+
+    std::string payload = serialize(first.exec);
+
+    // The flag travels with the payload: a restored mid-main instance is
+    // still incomplete and only flips once the main finishes there
+    TestScript second(bytecode);
+    restore(second.exec, payload);
+    CHECK_FALSE(second.exec.isMainFunctionComplete());
+
+    // The completion is reported on the transition, and only once
+    RunResult completed = resumeToCompletion(second.exec, 1.0);
+    CHECK(completed.mainFunctionCompleted);
+    CHECK(second.exec.isMainFunctionComplete());
+
+    // A payload from a completed main restores with the flag already set
+    std::string done_payload = serialize(second.exec);
+    TestScript third(bytecode);
+    CHECK_FALSE(third.exec.isMainFunctionComplete());
+    restore(third.exec, done_payload);
+    CHECK(third.exec.isMainFunctionComplete());
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor script runtime errors")
+{
+    TestScript ts(R"(
+        local missing = nil
+        missing.field = 1
+        print("unreachable")
+    )");
+    ts.loadDefaultState();
+    Script& exec = ts.exec;
+
+    // A script that dies inside its main function will never register the rest
+    // of its handlers, so the host has to be free to start masking its events
+    CHECK_FALSE(exec.isMainFunctionComplete());
+    resume(exec, 1.0, HandlerRunStatus::Fault);
+    CHECK(exec.isMainFunctionComplete());
+    CHECK(exec.getFaultKind() == FaultKind::Runtime);
+    CHECK(exec.getFaultString() == "runtime error");
+    // Extended info carries the message plus a traceback
+    CHECK(exec.getExtendedFaultString().find("attempt to index nil with 'field'") != std::string::npos);
+    CHECK(ts.host.printed.empty());
+    CHECK_FALSE(exec.isHandlerActive());
+
+    // Clearing the fault and resetting makes the script runnable again
+    ts.reset();
+    CHECK(exec.getFaultKind() == FaultKind::None);
+    CHECK(exec.getExtendedFaultString().empty());
+}
+
+// A host that exposes a host_kill() global, standing in for any ll.* call
+// that faults the script from the host side (host-initiated kill).
+struct KillingTestHost : TestProvisioner
+{
+    KillingTestHost()
+        : TestProvisioner(makeCallbacks())
+    {
+    }
+
+    static HostCallbacks makeCallbacks()
+    {
+        HostCallbacks callbacks = TestProvisioner::makeCallbacks();
+        callbacks.populateEnvironment = populate_environment;
+        return callbacks;
+    }
+
+    // Composed rather than overridden: the base population is called through
+    // explicitly
+    static void populate_environment(IEnvironment& environment, lua_State* L)
+    {
+        TestProvisioner::populate_environment(environment, L);
+        lua_pushcfunction(L, host_kill, "host_kill");
+        lua_setglobal(L, "host_kill");
+    }
+
+    // This mimics an `ll.*()` function in indra that sets a fault manually.
+    static int host_kill(lua_State* L)
+    {
+        Script* executor = Script::fromLuaState(L);
+        REQUIRE(executor != nullptr);
+        executor->setFault(FaultKind::Runtime, "killed by host");
+        if (executor->getFaultKind() != FaultKind::None)
+            lua_killerror(L, executor->getFaultString().c_str());
+        return 0;
+    }
+};
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor host kill aborts the handler")
+{
+    std::string bytecode = Luau::compile(R"(
+        pcall(host_kill)
+        print("still alive")
+    )");
+    KillingTestHost host;
+    std::shared_ptr<Script> script = host.provisionScript(makeImageConfig(bytecode), makeScriptConfig());
+    REQUIRE(script != nullptr);
+    REQUIRE(script->loadDefaultState());
+
+    resume(*script, 1.0, HandlerRunStatus::Fault);
+    CHECK(script->getFaultKind() == FaultKind::Runtime);
+    CHECK(script->getFaultString() == "killed by host");
+    CHECK_FALSE(script->isHandlerActive());
+    // The kill preempted everything after the host_kill() call
+    CHECK(host.printed.empty());
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor does not autocall a state_entry global")
+{
+    // For SLua the main function *is* state_entry; a global of that name must
+    // never be invoked on top of it.
+    TestScript ts(R"(
+        function state_entry()
+            print("SHOULD NOT RUN")
+        end
+    )");
+    ts.loadDefaultState();
+
+    resume(ts.exec);
+    CHECK(ts.host.printed.empty());
+
+    ts.reset();
+    resume(ts.exec);
+    CHECK(ts.host.printed.empty());
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor reclaims batched allocations")
+{
+    // Each batch is garbage by the time the next one is built, so a script that
+    // allocates far more than its limit in total still fits if the GC keeps up.
+    TestScript ts(R"(
+        for batch = 1, 40 do
+            local parts = {}
+            for i = 1, 200 do
+                parts[i] = string.rep("x", 100) .. tostring(i)
+            end
+        end
+        print("survived")
+    )");
+    ts.loadDefaultState();
+
+    resume(ts.exec);
+    CHECK(ts.exec.getFaultKind() == FaultKind::None);
+    checkCapture(ts.host.printed, {"survived"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor coroutines survive preemption")
+{
+    TestScript ts(R"(
+        local co = coroutine.create(function(n)
+            local total = 0
+            for i = 1, n do
+                total += i
+                if i % 10 == 0 then
+                    coroutine.yield(total)
+                end
+            end
+            return total
+        end)
+
+        local last = 0
+        while coroutine.status(co) ~= "dead" do
+            local ok, value = coroutine.resume(co, 50)
+            assert(ok, "coroutine resume failed")
+            if value then last = value end
+        end
+        print(`{last}`)
+    )");
+    ts.loadDefaultState();
+
+    // Preempt repeatedly while a user coroutine is mid-flight
+    ts.host.clock_step = 0.001;
+    int preemptions = 0;
+    resumeToCompletion(ts.exec, 0.003, HandlerRunStatus::Ok, &preemptions);
+    CHECK(preemptions >= 1);
+    checkCapture(ts.host.printed, {"1275"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor hides engine threads from coroutine.running")
+{
+    TestScript script(R"(
+        in_main = coroutine.running() == nil and 1 or 0
+        in_coro = coroutine.wrap(function()
+            return coroutine.running() ~= nil and 1 or 0
+        end)()
+    )");
+    script.start();
+    // The staged main runs on the handler thread, which the bodged
+    // coroutine.running() hides; a user coroutine still sees itself
+    CHECK(readIntGlobal(script.exec, "in_main") == 1);
+    CHECK(readIntGlobal(script.exec, "in_coro") == 1);
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor failed LSL constructor leaves no instance")
+{
+    // Compiled LSL should never error during construction, but the engine
+    // cannot assume the bytecode is well-behaved. A failed load must not leave
+    // a live instance behind: restoreState() is documented as valid after a
+    // failed load, and refuses to run over a live instance.
+    std::string bytecode = Luau::compile(R"(
+        error("constructor boom")
+    )");
+    TestScript ts(bytecode, true);
+
+    CHECK_FALSE(ts.exec.loadDefaultState());
+    CHECK(ts.exec.getFaultKind() == FaultKind::Runtime);
+    CHECK(!ts.exec.hasInstance());
+}
+
+#ifdef LUAU_USE_TAILSLIDE
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor LSL lifecycle and reset")
+{
+    TestScript ts(R"(
+        integer counter = 5;
+        default {
+            state_entry() {
+                counter = counter + 1;
+                if (counter == 6) {
+                    print("six");
+                } else {
+                    print("other");
+                }
+            }
+        }
+    )", true);
+    ts.loadDefaultState();
+    Script& exec = ts.exec;
+
+    CHECK(exec.hasLSLEventHandler(0, "state_entry"));
+    CHECK_FALSE(exec.hasLSLEventHandler(0, "touch_start"));
+    // An event with no handler behind it reports that nothing ran, rather than
+    // looking like a handler that completed
+    dispatch(exec, "touch_start", HandlerRunStatus::NotRun);
+    // The LSL constructor already ran during reset; no handler is staged
+    CHECK_FALSE(exec.isHandlerActive());
+    CHECK(exec.isMainFunctionComplete());
+
+    dispatch(exec, "state_entry");
+
+    // Globals persist between handler invocations of the same instance
+    dispatch(exec, "state_entry");
+
+    // A reset re-forks a pristine instance and reruns the constructor
+    ts.reset();
+    dispatch(exec, "state_entry");
+
+    checkCapture(ts.host.printed, {"six", "other", "six"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor LSL state change")
+{
+    TestScript ts(R"(
+        default {
+            state_entry() {
+                state other;
+            }
+        }
+        state other {
+            state_entry() {
+                print("in_other");
+            }
+        }
+    )", true);
+    ts.loadDefaultState();
+    Script& exec = ts.exec;
+
+    RunResult result = dispatch(exec, "state_entry", HandlerRunStatus::StateChange);
+    CHECK(result.newState != 0);
+    CHECK_FALSE(exec.isHandlerActive());
+
+    // State register bookkeeping is the host's job; dispatch into the new state
+    REQUIRE(exec.hasLSLEventHandler(result.newState, "state_entry"));
+    dispatch(exec, result.newState, "state_entry");
+    checkCapture(ts.host.printed, {"in_other"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor state change survives serialization")
+{
+    std::string bytecode = compileLSL(R"(
+        default {
+            state_entry() {
+                state other;
+            }
+        }
+        state other {
+            state_entry() {
+                print("in_other");
+            }
+        }
+    )");
+
+    TestScript first(bytecode, true);
+    first.loadDefaultState();
+
+    RunResult result = dispatch(first.exec, "state_entry", HandlerRunStatus::StateChange);
+    int new_state = result.newState;
+
+    // The host owns the state registers, so it serializes with the pending
+    // change recorded on its side and dispatches into the new state after
+    // restoring.
+    std::string payload = serialize(first.exec);
+
+    TestScript second(bytecode, true);
+    restore(second.exec, payload);
+
+    REQUIRE(second.exec.hasLSLEventHandler(new_state, "state_entry"));
+    dispatch(second.exec, new_state, "state_entry");
+    checkCapture(second.host.printed, {"in_other"});
+}
+
+TEST_CASE_FIXTURE(SLuaFixture, "SLExecutor serialize mid-handler roundtrip")
+{
+    std::string bytecode = compileLSL(R"(
+        default {
+            state_entry() {
+                integer i = 0;
+                while (i < 200) {
+                    i = i + 1;
+                }
+                print("done");
+            }
+        }
+    )");
+
+    TestScript first(bytecode, true);
+    first.loadDefaultState();
+
+    // Preempt the handler mid-loop
+    first.host.clock_step = 0.001;
+    dispatch(first.exec, "state_entry", HandlerRunStatus::Preempted, nullptr, nullptr, 0.005);
+    REQUIRE(first.exec.isHandlerActive());
+    CHECK(first.host.printed.empty());
+
+    std::string payload = serialize(first.exec);
+    CHECK(!payload.empty());
+
+    // Rehydrate the suspended handler in a second engine built from the same
+    // bytecode and run it to completion there
+    TestScript second(bytecode, true);
+    restore(second.exec, payload);
+    REQUIRE(second.exec.isHandlerActive());
+
+    resumeToCompletion(second.exec, 1.0);
+    CHECK_FALSE(second.exec.isHandlerActive());
+    checkCapture(second.host.printed, {"done"});
+    // The original instance never reached the print
+    CHECK(first.host.printed.empty());
+}
+
+#endif // LUAU_USE_TAILSLIDE
+
+TEST_SUITE_END();

From 71af4f55e1fb48848732cc61ba6c16ef89c668ba Mon Sep 17 00:00:00 2001
From: Harold Cindy <120691094+HaroldCindy@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:13:55 -0700
Subject: [PATCH 2/2] Use existing vformat implementation from StringUtils

---
 Executor/src/Logging.cpp | 20 ++------------------
 1 file changed, 2 insertions(+), 18 deletions(-)

diff --git a/Executor/src/Logging.cpp b/Executor/src/Logging.cpp
index b035e03b..77847f1a 100644
--- a/Executor/src/Logging.cpp
+++ b/Executor/src/Logging.cpp
@@ -1,7 +1,8 @@
 #include "Luau/Executor.h"
 
+#include "Luau/StringUtils.h"
+
 #include <cstdarg>
-#include <cstdio>
 #include <string>
 
 namespace Luau
@@ -9,23 +10,6 @@ namespace Luau
 namespace Executor
 {
 
-static std::string vformat(const char* fmt, va_list args)
-{
-    va_list measure;
-    va_copy(measure, args);
-    int needed = vsnprintf(nullptr, 0, fmt, measure);
-    va_end(measure);
-
-    if (needed <= 0)
-        return std::string();
-
-    std::string out;
-    out.resize((size_t)needed + 1);
-    vsnprintf(&out[0], out.size(), fmt, args);
-    out.pop_back();
-    return out;
-}
-
 static void vlog(LogLevel level, const char* source, const char* fmt, va_list args)
 {
     LogCallback callback = logCallback();