If _run dies between popping a job off the queue and resolving its future, that job belonged to neither _queue nor _pending, so the crash drain could not fail it and its submitter hung forever. Re-park it in _pending on the way out so _on_run_done fails it like everything else.