2 files changed, 53 insertions, 3 deletions
diff --git a/internal/engine/lifecycle_test.go b/internal/engine/lifecycle_test.go
new file mode 100644
index 0000000..8cea97f
--- /dev/null
+++ b/internal/engine/lifecycle_test.go
@@ -0,0 +1,40 @@
+package engine
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestConcurrentTicksAreSerialized(t *testing.T) {
+	e := New()
+	count := 0
+	e.Subscribe(1, func() bool {
+		count++ // safe only when callbacks have a single owner
+		return true
+	})
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 100; j++ {
+				e.Tick()
+			}
+		}()
+	}
+	wg.Wait()
+	if count != 800 {
+		t.Fatalf("lost ticks: got %d, want 800", count)
+	}
+}
+
+func TestStopIsIdempotentAndRestartable(t *testing.T) {
+	e := New()
+	e.Stop()
+	defer e.Stop()
+	for i := 0; i < 100; i++ {
+		e.Start(60000)
+		e.Stop()
+		e.Stop()
+	}
+}
diff --git a/internal/engine/tick.go b/internal/engine/tick.go
index 7b9666b..00a9c60 100644
--- a/internal/engine/tick.go
+++ b/internal/engine/tick.go
@@ -17,6 +17,7 @@ type subscriber struct {
 }
 
 type Engine struct {
+	tickMu      sync.Mutex // serializes manual ticks and successive ticker runs
 	mu          sync.Mutex
 	subscribers map[uint64]*subscriber
 	nextID      uint64
@@ -61,19 +62,24 @@ func (e *Engine) Start(tickLengthMs int) {
 	}
 	e.ticker = time.NewTicker(time.Duration(tickLengthMs) * time.Millisecond)
 	e.stopCh = make(chan struct{})
+	// Capture this run's resources. A quick Stop/Start must not make the
+	// old goroutine consume the replacement ticker or stop channel.
+	ticker, stopCh := e.ticker, e.stopCh
 
 	go func() {
 		for {
 			select {
-			case <-e.ticker.C:
+			case <-ticker.C:
 				e.processTick()
-			case <-e.stopCh:
+			case <-stopCh:
 				return
 			}
 		}
 	}()
 }
 
+// Stop requests that the ticker loop exit. It is idempotent, but does not
+// wait for an in-flight callback; it is not a graceful-shutdown save barrier.
 func (e *Engine) Stop() {
 	e.mu.Lock()
 	defer e.mu.Unlock()
@@ -83,14 +89,18 @@ func (e *Engine) Stop() {
 	e.running = false
 	if e.stopCh != nil {
 		close(e.stopCh)
+		e.stopCh = nil
 	}
 }
 
 // Tick fires every due subscriber synchronously and returns. Subscribers
-// are invoked in ascending subscription-ID (registration) order.
+// are invoked in ascending subscription-ID (registration) order. Tick calls
+// are serialized; a callback must not call Tick recursively.
 func (e *Engine) Tick() { e.processTick() }
 
 func (e *Engine) processTick() {
+	e.tickMu.Lock()
+	defer e.tickMu.Unlock()
 	e.mu.Lock()
 	snapshot := make(map[uint64]*subscriber, len(e.subscribers))
 	for id, sub := range e.subscribers {