diff --git a/_thread_tracer/__init__.py b/_thread_tracer/__init__.py
new file mode 100644
index 00000000..61fb6cda
--- /dev/null
+++ b/_thread_tracer/__init__.py
@@ -0,0 +1,10 @@
+"""Private experimental thread spawn tracer (not part of the public API)."""
+
+from _thread_tracer._types import ThreadSpawnStats, ThreadTracerError
+from _thread_tracer._windows_etw import WindowsThreadSpawnTracer
+
+__all__ = [
+    "ThreadSpawnStats",
+    "ThreadTracerError",
+    "WindowsThreadSpawnTracer",
+]
diff --git a/_thread_tracer/_parsing.py b/_thread_tracer/_parsing.py
new file mode 100644
index 00000000..14812ee3
--- /dev/null
+++ b/_thread_tracer/_parsing.py
@@ -0,0 +1,68 @@
+"""Pure-Python helpers to classify kernel thread ETW events."""
+
+import ctypes as ct
+import struct
+
+# Kernel thread event opcodes (EVENT_TRACE_TYPE_* for the Thread task).
+EVENT_TRACE_TYPE_START = 1
+EVENT_TRACE_TYPE_END = 2
+EVENT_TRACE_TYPE_DCSTART = 3
+EVENT_TRACE_TYPE_DCEND = 4
+
+_MIN_USER_DATA_LENGTH = 8
+
+
+def parse_kernel_thread_payload(user_data, user_data_length):
+    """Extract ``(process_id, thread_id)`` from a kernel Thread event payload.
+
+    The first two fields are stable across Thread event schema versions. Pointer
+    fields that follow are ignored because only the identifiers are needed.
+    """
+    if user_data is None or user_data_length < _MIN_USER_DATA_LENGTH:
+        return None
+
+    if isinstance(user_data, (bytes, bytearray)):
+        raw = user_data[:user_data_length]
+    else:
+        address = user_data
+        if not isinstance(address, int):
+            address = ct.cast(user_data, ct.c_void_p).value or 0
+        if not address:
+            return None
+        raw = ct.string_at(address, user_data_length)
+
+    if len(raw) < _MIN_USER_DATA_LENGTH:
+        return None
+    process_id, thread_id = struct.unpack_from("<II", raw, 0)
+    return process_id, thread_id
+
+
+def classify_kernel_thread_event(opcode, user_data, user_data_length, target_pid):
+    """Return a spawn classification for a kernel Thread event.
+
+    Returns one of:
+    - ``"spawn"`` for a thread start event in ``target_pid``
+    - ``"existing"`` for a DCStart rundown event in ``target_pid``
+    - ``None`` if the event should be ignored
+    """
+    if opcode not in (
+        EVENT_TRACE_TYPE_START,
+        EVENT_TRACE_TYPE_END,
+        EVENT_TRACE_TYPE_DCSTART,
+        EVENT_TRACE_TYPE_DCEND,
+    ):
+        return None
+
+    parsed = parse_kernel_thread_payload(user_data, user_data_length)
+    if parsed is None:
+        return None
+
+    process_id, _thread_id = parsed
+    if process_id != target_pid:
+        return None
+
+    if opcode == EVENT_TRACE_TYPE_START:
+        return "spawn"
+    if opcode == EVENT_TRACE_TYPE_DCSTART:
+        return "existing"
+    return None
diff --git a/_thread_tracer/_types.py b/_thread_tracer/_types.py
new file mode 100644
index 00000000..9a9bb975
--- /dev/null
+++ b/_thread_tracer/_types.py
@@ -0,0 +1,32 @@
+"""Private types for the experimental thread spawn tracer."""
+
+
+class ThreadSpawnStats(object):
+    """Statistics collected during a thread tracing window."""
+
+    __slots__ = ("spawn_count", "existing_thread_count", "thread_ids")
+
+    def __init__(self, spawn_count=0, existing_thread_count=0, thread_ids=None):
+        self.spawn_count = spawn_count
+        self.existing_thread_count = existing_thread_count
+        self.thread_ids = frozenset(thread_ids or ())
+
+    def __eq__(self, other):
+        if not isinstance(other, ThreadSpawnStats):
+            return NotImplemented
+        return (
+            self.spawn_count == other.spawn_count
+            and self.existing_thread_count == other.existing_thread_count
+            and self.thread_ids == other.thread_ids
+        )
+
+    def __repr__(self):
+        return (
+            "ThreadSpawnStats(spawn_count={0.spawn_count}, "
+            "existing_thread_count={0.existing_thread_count}, "
+            "thread_ids={0.thread_ids!r})"
+        ).format(self)
+
+
+class ThreadTracerError(OSError):
+    """Raised when the platform tracer cannot start or stop cleanly."""
diff --git a/_thread_tracer/_windows_etw.py b/_thread_tracer/_windows_etw.py
new file mode 100644
index 00000000..a7176511
--- /dev/null
+++ b/_thread_tracer/_windows_etw.py
@@ -0,0 +1,537 @@
+"""Windows kernel ETW tracer for counting thread spawn events.
+
+This is a private prototype built with ctypes only (no compiled extensions).
+It uses the ``NT Kernel Logger`` session with ``EVENT_TRACE_FLAG_THREAD`` and
+counts Thread Start / DCStart events for a target process PID.
+
+Administrator privileges are typically required.
+"""
+
+import ctypes as ct
+import ctypes.wintypes as wt
+import sys
+import threading
+import time
+
+from _thread_tracer._parsing import (
+    EVENT_TRACE_TYPE_DCSTART,
+    EVENT_TRACE_TYPE_START,
+    classify_kernel_thread_event,
+    parse_kernel_thread_payload,
+)
+from _thread_tracer._types import ThreadSpawnStats, ThreadTracerError
+
+ERROR_SUCCESS = 0
+ERROR_ALREADY_EXISTS = 183
+
+KERNEL_LOGGER_NAME = "NT Kernel Logger"
+SYSTEM_TRACE_PROVIDER_GUID = "{9E814AAD-3204-11D2-9A82-006008A86939}"
+
+EVENT_TRACE_FLAG_THREAD = 0x00000002
+EVENT_TRACE_REAL_TIME_MODE = 0x00000100
+EVENT_TRACE_SYSTEM_LOGGER_MODE = 0x02000000
+EVENT_TRACE_CONTROL_STOP = 1
+
+PROCESS_TRACE_MODE_REAL_TIME = 0x00000100
+PROCESS_TRACE_MODE_EVENT_RECORD = 0x10000000
+
+WNODE_FLAG_TRACED_GUID = 0x00020000
+
+TRACEHANDLE = ct.c_ulonglong
+INVALID_PROCESSTRACE_HANDLE = TRACEHANDLE(-1)
+
+
+class GUID(ct.Structure):
+    _fields_ = [
+        ("Data1", ct.c_uint32),
+        ("Data2", ct.c_uint16),
+        ("Data3", ct.c_uint16),
+        ("Data4", ct.c_ubyte * 8),
+    ]
+
+    @classmethod
+    def from_string(cls, guid_string):
+        guid = cls()
+        parts = guid_string.strip("{}").split("-")
+        guid.Data1 = int(parts[0], 16)
+        guid.Data2 = int(parts[1], 16)
+        guid.Data3 = int(parts[2], 16)
+        hex_data4 = parts[3] + parts[4]
+        for index in range(8):
+            guid.Data4[index] = int(hex_data4[index * 2 : index * 2 + 2], 16)
+        return guid
+
+
+class WNODE_HEADER(ct.Structure):
+    _fields_ = [
+        ("BufferSize", ct.c_ulong),
+        ("ProviderId", ct.c_ulong),
+        ("HistoricalContext", ct.c_uint64),
+        ("TimeStamp", wt.LARGE_INTEGER),
+        ("Guid", GUID),
+        ("ClientContext", ct.c_ulong),
+        ("Flags", ct.c_ulong),
+    ]
+
+
+class EVENT_DESCRIPTOR(ct.Structure):
+    _fields_ = [
+        ("Id", ct.c_ushort),
+        ("Version", ct.c_ubyte),
+        ("Channel", ct.c_ubyte),
+        ("Level", ct.c_ubyte),
+        ("Opcode", ct.c_ubyte),
+        ("Task", ct.c_ushort),
+        ("Keyword", ct.c_uint64),
+    ]
+
+
+class EVENT_HEADER(ct.Structure):
+    _fields_ = [
+        ("Size", ct.c_ushort),
+        ("HeaderType", ct.c_ushort),
+        ("Flags", ct.c_ushort),
+        ("EventProperty", ct.c_ushort),
+        ("ThreadId", ct.c_ulong),
+        ("ProcessId", ct.c_ulong),
+        ("TimeStamp", wt.LARGE_INTEGER),
+        ("ProviderId", GUID),
+        ("EventDescriptor", EVENT_DESCRIPTOR),
+        ("KernelTime", ct.c_ulong),
+        ("UserTime", ct.c_ulong),
+        ("ActivityId", GUID),
+    ]
+
+
+class ETW_BUFFER_CONTEXT(ct.Structure):
+    _fields_ = [
+        ("ProcessorNumber", ct.c_ubyte),
+        ("Alignment", ct.c_ubyte),
+        ("LoggerId", ct.c_ushort),
+    ]
+
+
+class EVENT_RECORD(ct.Structure):
+    _fields_ = [
+        ("EventHeader", EVENT_HEADER),
+        ("BufferContext", ETW_BUFFER_CONTEXT),
+        ("ExtendedDataCount", ct.c_ushort),
+        ("UserDataLength", ct.c_ushort),
+        ("ExtendedData", ct.c_void_p),
+        ("UserData", ct.c_void_p),
+        ("UserContext", ct.c_void_p),
+    ]
+
+
+class EVENT_TRACE_HEADER_CLASS(ct.Structure):
+    _fields_ = [
+        ("Type", ct.c_ubyte),
+        ("Level", ct.c_ubyte),
+        ("Version", ct.c_uint16),
+    ]
+
+
+class EVENT_TRACE_HEADER(ct.Structure):
+    _fields_ = [
+        ("Size", ct.c_ushort),
+        ("HeaderType", ct.c_ubyte),
+        ("MarkerFlags", ct.c_ubyte),
+        ("Class", EVENT_TRACE_HEADER_CLASS),
+        ("ThreadId", ct.c_ulong),
+        ("ProcessId", ct.c_ulong),
+        ("TimeStamp", wt.LARGE_INTEGER),
+        ("Guid", GUID),
+        ("ClientContext", ct.c_ulong),
+        ("Flags", ct.c_ulong),
+    ]
+
+
+class EVENT_TRACE(ct.Structure):
+    _fields_ = [
+        ("Header", EVENT_TRACE_HEADER),
+        ("InstanceId", ct.c_ulong),
+        ("ParentInstanceId", ct.c_ulong),
+        ("ParentGuid", GUID),
+        ("MofData", ct.c_void_p),
+        ("MofLength", ct.c_ulong),
+        ("ClientContext", ct.c_ulong),
+    ]
+
+
+class SYSTEMTIME(ct.Structure):
+    _fields_ = [
+        ("wYear", wt.WORD),
+        ("wMonth", wt.WORD),
+        ("wDayOfWeek", wt.WORD),
+        ("wDay", wt.WORD),
+        ("wHour", wt.WORD),
+        ("wMinute", wt.WORD),
+        ("wSecond", wt.WORD),
+        ("wMilliseconds", wt.WORD),
+    ]
+
+
+class TIME_ZONE_INFORMATION(ct.Structure):
+    _fields_ = [
+        ("Bias", ct.c_long),
+        ("StandardName", ct.c_wchar * 32),
+        ("StandardDate", SYSTEMTIME),
+        ("StandardBias", ct.c_long),
+        ("DaylightName", ct.c_wchar * 32),
+        ("DaylightDate", SYSTEMTIME),
+        ("DaylightBias", ct.c_long),
+    ]
+
+
+class TRACE_LOGFILE_HEADER(ct.Structure):
+    _fields_ = [
+        ("BufferSize", ct.c_ulong),
+        ("MajorVersion", ct.c_byte),
+        ("MinorVersion", ct.c_byte),
+        ("SubVersion", ct.c_byte),
+        ("SubMinorVersion", ct.c_byte),
+        ("ProviderVersion", ct.c_ulong),
+        ("NumberOfProcessors", ct.c_ulong),
+        ("EndTime", wt.LARGE_INTEGER),
+        ("TimerResolution", ct.c_ulong),
+        ("MaximumFileSize", ct.c_ulong),
+        ("LogFileMode", ct.c_ulong),
+        ("BuffersWritten", ct.c_ulong),
+        ("StartBuffers", ct.c_ulong),
+        ("PointerSize", ct.c_ulong),
+        ("EventsLost", ct.c_ulong),
+        ("CpuSpeedInMHz", ct.c_ulong),
+        ("LoggerName", ct.c_wchar_p),
+        ("LogFileName", ct.c_wchar_p),
+        ("TimeZone", TIME_ZONE_INFORMATION),
+        ("BootTime", wt.LARGE_INTEGER),
+        ("PerfFreq", wt.LARGE_INTEGER),
+        ("StartTime", wt.LARGE_INTEGER),
+        ("ReservedFlags", ct.c_ulong),
+        ("BuffersLost", ct.c_ulong),
+    ]
+
+
+class EVENT_TRACE_PROPERTIES(ct.Structure):
+    _fields_ = [
+        ("Wnode", WNODE_HEADER),
+        ("BufferSize", ct.c_ulong),
+        ("MinimumBuffers", ct.c_ulong),
+        ("MaximumBuffers", ct.c_ulong),
+        ("MaximumFileSize", ct.c_ulong),
+        ("LogFileMode", ct.c_ulong),
+        ("FlushTimer", ct.c_ulong),
+        ("EnableFlags", ct.c_ulong),
+        ("AgeLimit", ct.c_ulong),
+        ("NumberOfBuffers", ct.c_ulong),
+        ("FreeBuffers", ct.c_ulong),
+        ("EventsLost", ct.c_ulong),
+        ("BuffersWritten", ct.c_ulong),
+        ("LogBuffersLost", ct.c_ulong),
+        ("RealTimeBuffersLost", ct.c_ulong),
+        ("LoggerThreadId", wt.HANDLE),
+        ("LogFileNameOffset", ct.c_ulong),
+        ("LoggerNameOffset", ct.c_ulong),
+    ]
+
+
+class EVENT_TRACE_LOGFILE(ct.Structure):
+    pass
+
+
+if sys.platform == "win32":
+    EVENT_RECORD_CALLBACK = ct.WINFUNCTYPE(None, ct.POINTER(EVENT_RECORD))
+    _event_record_callback_type = EVENT_RECORD_CALLBACK
+else:
+    EVENT_RECORD_CALLBACK = None
+    _event_record_callback_type = ct.c_void_p
+
+EVENT_TRACE_LOGFILE._fields_ = [
+    ("LogFileName", ct.c_wchar_p),
+    ("LoggerName", ct.c_wchar_p),
+    ("CurrentTime", ct.c_longlong),
+    ("BuffersRead", ct.c_ulong),
+    ("ProcessTraceMode", ct.c_ulong),
+    ("CurrentEvent", EVENT_TRACE),
+    ("LogfileHeader", TRACE_LOGFILE_HEADER),
+    ("BufferCallback", ct.c_void_p),
+    ("BufferSize", ct.c_ulong),
+    ("Filled", ct.c_ulong),
+    ("EventsLost", ct.c_ulong),
+    ("EventRecordCallback", _event_record_callback_type),
+    ("IsKernelTrace", ct.c_ulong),
+    ("Context", ct.c_void_p),
+]
+
+_TRACERS_BY_CONTEXT = {}
+_TRACERS_LOCK = threading.Lock()
+
+if sys.platform == "win32":
+
+    @EVENT_RECORD_CALLBACK
+    def _event_record_callback(record_pointer):
+        record = record_pointer.contents
+        context = record.UserContext
+        if not context:
+            return
+        with _TRACERS_LOCK:
+            tracer = _TRACERS_BY_CONTEXT.get(context)
+        if tracer is None:
+            return
+        tracer._handle_event_record(record)
+
+else:
+    _event_record_callback = None
+
+
+_advapi32 = None
+StartTraceW = None
+ControlTraceW = None
+OpenTraceW = None
+ProcessTrace = None
+CloseTrace = None
+
+
+def _ensure_advapi32():
+    global _advapi32, StartTraceW, ControlTraceW, OpenTraceW, ProcessTrace, CloseTrace
+    if _advapi32 is not None:
+        return _advapi32
+
+    if sys.platform != "win32":
+        raise ThreadTracerError("Windows ETW tracer is only supported on Windows")
+
+    _advapi32 = ct.windll.advapi32
+
+    StartTraceW = _advapi32.StartTraceW
+    StartTraceW.argtypes = [
+        ct.POINTER(TRACEHANDLE),
+        ct.c_wchar_p,
+        ct.POINTER(EVENT_TRACE_PROPERTIES),
+    ]
+    StartTraceW.restype = ct.c_ulong
+
+    ControlTraceW = _advapi32.ControlTraceW
+    ControlTraceW.argtypes = [
+        TRACEHANDLE,
+        ct.c_wchar_p,
+        ct.POINTER(EVENT_TRACE_PROPERTIES),
+        ct.c_ulong,
+    ]
+    ControlTraceW.restype = ct.c_ulong
+
+    OpenTraceW = _advapi32.OpenTraceW
+    OpenTraceW.argtypes = [ct.POINTER(EVENT_TRACE_LOGFILE)]
+    OpenTraceW.restype = TRACEHANDLE
+
+    ProcessTrace = _advapi32.ProcessTrace
+    ProcessTrace.argtypes = [
+        ct.POINTER(TRACEHANDLE),
+        ct.c_ulong,
+        ct.c_void_p,
+        ct.c_void_p,
+    ]
+    ProcessTrace.restype = ct.c_ulong
+
+    CloseTrace = _advapi32.CloseTrace
+    CloseTrace.argtypes = [TRACEHANDLE]
+    CloseTrace.restype = ct.c_ulong
+    return _advapi32
+
+
+def _make_trace_properties(enable_flags):
+    max_str_len = 1024
+    buf_size = (
+        ct.sizeof(EVENT_TRACE_PROPERTIES) + 2 * ct.sizeof(ct.c_wchar) * max_str_len
+    )
+    buf = (ct.c_char * buf_size)()
+    props = ct.cast(ct.pointer(buf), ct.POINTER(EVENT_TRACE_PROPERTIES))
+
+    props.contents.Wnode.BufferSize = buf_size
+    props.contents.Wnode.Flags = WNODE_FLAG_TRACED_GUID
+    props.contents.Wnode.Guid = GUID.from_string(SYSTEM_TRACE_PROVIDER_GUID)
+    props.contents.BufferSize = 64
+    props.contents.LogFileMode = (
+        EVENT_TRACE_REAL_TIME_MODE | EVENT_TRACE_SYSTEM_LOGGER_MODE
+    )
+    props.contents.EnableFlags = enable_flags
+    props.contents.LoggerNameOffset = ct.sizeof(EVENT_TRACE_PROPERTIES)
+    return buf, props
+
+
+class _TraceStats(object):
+    def __init__(self):
+        self._lock = threading.Lock()
+        self.spawn_count = 0
+        self.existing_thread_count = 0
+        self._thread_ids = set()
+
+    def record(self, classification, thread_id):
+        with self._lock:
+            if classification == "spawn":
+                self.spawn_count += 1
+            elif classification == "existing":
+                self.existing_thread_count += 1
+            else:
+                return
+            self._thread_ids.add(thread_id)
+
+    def snapshot(self):
+        with self._lock:
+            return ThreadSpawnStats(
+                spawn_count=self.spawn_count,
+                existing_thread_count=self.existing_thread_count,
+                thread_ids=set(self._thread_ids),
+            )
+
+
+class WindowsThreadSpawnTracer(object):
+    """Count thread spawn events for a process using kernel ETW.
+
+    Parameters
+    ----------
+    pid : int
+        Target process identifier.
+    include_existing_threads : bool, default=False
+        If True, also count DCStart rundown events emitted for threads that
+        were already alive when tracing started.
+    """
+
+    def __init__(self, pid, include_existing_threads=False):
+        self.pid = int(pid)
+        self.include_existing_threads = include_existing_threads
+        self._stats = _TraceStats()
+        self._session_handle = TRACEHANDLE(0)
+        self._trace_handle = TRACEHANDLE(0)
+        self._trace_properties_buf = None
+        self._trace_properties = None
+        self._trace_logfile = None
+        self._logger_name = None
+        self._trace_context = None
+        self._consumer_thread = None
+        self._stop_event = threading.Event()
+        self._started = False
+        self._session_started = False
+
+    def __enter__(self):
+        self.start()
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        self.stop()
+        return False
+
+    def start(self):
+        if self._started:
+            raise ThreadTracerError("Tracer is already started")
+
+        _ensure_advapi32()
+        self._trace_properties_buf, self._trace_properties = _make_trace_properties(
+            EVENT_TRACE_FLAG_THREAD
+        )
+        status = StartTraceW(
+            ct.byref(self._session_handle),
+            KERNEL_LOGGER_NAME,
+            self._trace_properties,
+        )
+        if status == ERROR_ALREADY_EXISTS:
+            raise ThreadTracerError(
+                "The NT Kernel Logger session is already in use. Stop the "
+                "existing session or run with a single tracer instance."
+            )
+        if status != ERROR_SUCCESS:
+            raise ThreadTracerError(status, ct.FormatError(status))
+
+        self._session_started = True
+        time.sleep(0.1)
+        self._install_consumer()
+        self._started = True
+
+    def stop(self):
+        if not self._started:
+            return self._stats.snapshot()
+
+        self._stop_event.set()
+        time.sleep(0.2)
+        if self._trace_handle.value:
+            CloseTrace(self._trace_handle)
+            self._trace_handle = TRACEHANDLE(0)
+        if self._consumer_thread is not None:
+            self._consumer_thread.join(timeout=10)
+            self._consumer_thread = None
+        if self._trace_context is not None:
+            with _TRACERS_LOCK:
+                _TRACERS_BY_CONTEXT.pop(self._trace_context.value, None)
+            self._trace_context = None
+
+        if self._session_started:
+            status = ControlTraceW(
+                self._session_handle,
+                KERNEL_LOGGER_NAME,
+                self._trace_properties,
+                EVENT_TRACE_CONTROL_STOP,
+            )
+            if status != ERROR_SUCCESS:
+                raise ThreadTracerError(status, ct.FormatError(status))
+            self._session_started = False
+
+        self._started = False
+        return self._stats.snapshot()
+
+    def _install_consumer(self):
+        self._trace_logfile = EVENT_TRACE_LOGFILE()
+        self._logger_name = KERNEL_LOGGER_NAME
+        self._trace_logfile.LoggerName = self._logger_name
+        self._trace_logfile.ProcessTraceMode = (
+            PROCESS_TRACE_MODE_REAL_TIME | PROCESS_TRACE_MODE_EVENT_RECORD
+        )
+        self._trace_context = ct.c_void_p(id(self))
+        self._trace_logfile.Context = self._trace_context
+        with _TRACERS_LOCK:
+            _TRACERS_BY_CONTEXT[self._trace_context.value] = self
+        self._trace_logfile.EventRecordCallback = _event_record_callback
+
+        trace_handle = OpenTraceW(ct.byref(self._trace_logfile))
+        if trace_handle in (0, INVALID_PROCESSTRACE_HANDLE):
+            with _TRACERS_LOCK:
+                _TRACERS_BY_CONTEXT.pop(self._trace_context.value, None)
+            self._trace_context = None
+            raise ThreadTracerError(ct.get_last_error(), "OpenTraceW failed")
+        self._trace_handle = TRACEHANDLE(trace_handle)
+
+        self._consumer_thread = threading.Thread(
+            target=self._consume_trace,
+            name="threadpoolctl-etw-consumer",
+        )
+        self._consumer_thread.daemon = True
+        self._consumer_thread.start()
+
+    def _consume_trace(self):
+        handles = (TRACEHANDLE * 1)(self._trace_handle)
+        while not self._stop_event.is_set():
+            status = ProcessTrace(handles, 1, None, None)
+            if status != ERROR_SUCCESS:
+                break
+            if self._stop_event.is_set():
+                break
+
+    def _handle_event_record(self, record):
+        opcode = record.EventHeader.EventDescriptor.Opcode
+        if opcode not in (EVENT_TRACE_TYPE_START, EVENT_TRACE_TYPE_DCSTART):
+            return
+        if opcode == EVENT_TRACE_TYPE_DCSTART and not self.include_existing_threads:
+            return
+
+        classification = classify_kernel_thread_event(
+            opcode,
+            record.UserData,
+            record.UserDataLength,
+            self.pid,
+        )
+        if classification is None:
+            return
+
+        parsed = parse_kernel_thread_payload(record.UserData, record.UserDataLength)
+        if parsed is None:
+            return
+        _process_id, thread_id = parsed
+        self._stats.record(classification, thread_id)
diff --git a/tests/test_windows_thread_tracer.py b/tests/test_windows_thread_tracer.py
new file mode 100644
index 00000000..44582812
--- /dev/null
+++ b/tests/test_windows_thread_tracer.py
@@ -0,0 +1,56 @@
+import struct
+import sys
+
+import pytest
+
+from _thread_tracer._parsing import (
+    EVENT_TRACE_TYPE_DCSTART,
+    EVENT_TRACE_TYPE_END,
+    EVENT_TRACE_TYPE_START,
+    classify_kernel_thread_event,
+    parse_kernel_thread_payload,
+)
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="non-Windows import check")
+def test_windows_tracer_imports_without_error_on_non_windows():
+    from _thread_tracer import (
+        ThreadSpawnStats,
+        ThreadTracerError,
+        WindowsThreadSpawnTracer,
+    )
+
+    tracer = WindowsThreadSpawnTracer(1)
+    with pytest.raises(ThreadTracerError, match="only supported on Windows"):
+        tracer.start()
+
+
+def _pack_thread_payload(process_id, thread_id):
+    return struct.pack("<II", process_id, thread_id)
+
+
+@pytest.mark.parametrize(
+    "opcode,expected",
+    [
+        (EVENT_TRACE_TYPE_START, "spawn"),
+        (EVENT_TRACE_TYPE_DCSTART, "existing"),
+        (EVENT_TRACE_TYPE_END, None),
+    ],
+)
+def test_classify_kernel_thread_event(opcode, expected):
+    payload = _pack_thread_payload(4242, 99)
+    assert classify_kernel_thread_event(opcode, payload, len(payload), 4242) == expected
+
+
+def test_classify_kernel_thread_event_ignores_other_process():
+    payload = _pack_thread_payload(1111, 7)
+    assert (
+        classify_kernel_thread_event(
+            EVENT_TRACE_TYPE_START, payload, len(payload), 4242
+        )
+        is None
+    )
+
+
+def test_parse_kernel_thread_payload_rejects_short_buffers():
+    assert parse_kernel_thread_payload(b"\x01\x02\x03", 3) is None
diff --git a/tests/test_windows_thread_tracer_integration.py b/tests/test_windows_thread_tracer_integration.py
new file mode 100644
index 00000000..f925d0fd
--- /dev/null
+++ b/tests/test_windows_thread_tracer_integration.py
@@ -0,0 +1,304 @@
+import ctypes
+import os
+import subprocess
+import sys
+import textwrap
+import time
+from pathlib import Path
+
+import pytest
+
+from threadpoolctl import threadpool_info
+
+from _thread_tracer import ThreadTracerError, WindowsThreadSpawnTracer
+from tests.utils import cython_extensions_compiled
+
+pytestmark = [
+    pytest.mark.skipif(
+        sys.platform != "win32",
+        reason="Windows ETW integration tests require Windows",
+    ),
+    pytest.mark.skipif(
+        sys.platform == "win32" and not ctypes.windll.shell32.IsUserAnAdmin(),
+        reason="Windows ETW kernel tracing requires an elevated process",
+    ),
+]
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+TRACER_ATTACH_DELAY_SECONDS = 0.5
+TRACER_FLUSH_DELAY_SECONDS = 0.3
+# Attach after the child body has created and blocked its worker threads so ETW
+# rundown can observe them as pre-existing (DCStart) rather than new spawns.
+EXISTING_THREAD_TRACER_DELAY_SECONDS = TRACER_ATTACH_DELAY_SECONDS + 0.5
+SUBPROCESS_TIMEOUT_SECONDS = 60
+BLAS_THREAD_ENV_VARS = {
+    "OMP_NUM_THREADS": "1",
+    "OPENBLAS_NUM_THREADS": "4",
+    "MKL_NUM_THREADS": "4",
+}
+
+NOOP_CHILD_BODY = "pass"
+# Keep the child alive long enough for a delayed tracer attach when measuring
+# DCStart rundown events (see EXISTING_THREAD_TRACER_DELAY_SECONDS).
+NOOP_EXISTING_CHILD_BODY = """
+import time
+time.sleep(2)
+"""
+
+
+@pytest.fixture(scope="module")
+def noop_child_spawn_count():
+    """Spawn count for a traced child that only sleeps (no extra work)."""
+    stats = _run_traced_child(NOOP_CHILD_BODY)
+    return stats.spawn_count
+
+
+@pytest.fixture(scope="module")
+def noop_child_existing_thread_count():
+    """Existing-thread rundown count for a noop child traced after a delay."""
+    stats = _run_traced_child(
+        NOOP_EXISTING_CHILD_BODY,
+        include_existing_threads=True,
+        tracer_start_delay=EXISTING_THREAD_TRACER_DELAY_SECONDS,
+    )
+    return stats.existing_thread_count
+
+
+def _expected_pool_spawn_count(user_api):
+    thread_counts = [
+        module["num_threads"]
+        for module in threadpool_info()
+        if module.get("user_api") == user_api and module.get("num_threads")
+    ]
+    if not thread_counts:
+        pytest.skip("No {0} thread pool detected".format(user_api))
+    # Native pools report team size including the calling thread, while ETW
+    # Start events only observe newly created OS threads.
+    return max(1, max(thread_counts) - 1)
+
+
+def _assert_spawn_count_relative_to_baseline(
+    stats, baseline_spawn_count, extra_spawn_count
+):
+    expected_total = baseline_spawn_count + extra_spawn_count
+    assert stats.spawn_count == expected_total, (
+        "expected {expected_total} spawns "
+        "({baseline} noop baseline + {extra} extra), "
+        "got {actual} ({stats})".format(
+            expected_total=expected_total,
+            baseline=baseline_spawn_count,
+            extra=extra_spawn_count,
+            actual=stats.spawn_count,
+            stats=stats,
+        )
+    )
+
+
+def _assert_existing_count_relative_to_baseline(
+    stats, baseline_existing_count, extra_existing_count
+):
+    expected_total = baseline_existing_count + extra_existing_count
+    assert stats.existing_thread_count == expected_total, (
+        "expected {expected_total} existing threads "
+        "({baseline} noop baseline + {extra} extra), "
+        "got {actual} ({stats})".format(
+            expected_total=expected_total,
+            baseline=baseline_existing_count,
+            extra=extra_existing_count,
+            actual=stats.existing_thread_count,
+            stats=stats,
+        )
+    )
+
+
+def _configure_blas_thread_env():
+    for name, value in BLAS_THREAD_ENV_VARS.items():
+        os.environ[name] = value
+
+
+def _child_script(body):
+    return textwrap.dedent(
+        """
+        import time
+
+        time.sleep({attach_delay})
+        {body}
+        time.sleep({flush_delay})
+        """
+    ).format(
+        attach_delay=TRACER_ATTACH_DELAY_SECONDS,
+        body=textwrap.dedent(body).strip(),
+        flush_delay=TRACER_FLUSH_DELAY_SECONDS,
+    )
+
+
+def _run_traced_child(
+    body,
+    include_existing_threads=False,
+    tracer_start_delay=0,
+):
+    env = os.environ.copy()
+    pythonpath = env.get("PYTHONPATH", "")
+    env["PYTHONPATH"] = (
+        str(REPO_ROOT) if not pythonpath else str(REPO_ROOT) + os.pathsep + pythonpath
+    )
+
+    proc = subprocess.Popen(
+        [sys.executable, "-c", _child_script(body)],
+        cwd=str(REPO_ROOT),
+        env=env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+    if tracer_start_delay:
+        time.sleep(tracer_start_delay)
+    tracer = WindowsThreadSpawnTracer(
+        proc.pid,
+        include_existing_threads=include_existing_threads,
+    )
+    try:
+        tracer.start()
+    except ThreadTracerError as exc:
+        proc.kill()
+        proc.wait(timeout=SUBPROCESS_TIMEOUT_SECONDS)
+        pytest.fail("failed to start Windows ETW tracer: {0}".format(exc))
+
+    try:
+        stdout, stderr = proc.communicate(timeout=SUBPROCESS_TIMEOUT_SECONDS)
+        return_code = proc.returncode
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        stdout, stderr = proc.communicate(timeout=SUBPROCESS_TIMEOUT_SECONDS)
+        tracer.stop()
+        pytest.fail("timed out waiting for traced child process")
+
+    stats = tracer.stop()
+    if return_code != 0:
+        pytest.fail(
+            "traced child exited with code {0}\nstdout:\n{1}\nstderr:\n{2}".format(
+                return_code,
+                stdout,
+                stderr,
+            )
+        )
+    return stats
+
+
+def test_tracer_counts_python_thread_spawns(noop_child_spawn_count):
+    num_threads = 3
+    body = """
+    import threading
+
+    def work():
+        pass
+
+    threads = [threading.Thread(target=work) for _ in range({num_threads})]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join()
+    """.format(
+        num_threads=num_threads
+    )
+    stats = _run_traced_child(body)
+    _assert_spawn_count_relative_to_baseline(
+        stats,
+        noop_child_spawn_count,
+        num_threads,
+    )
+
+
+def test_tracer_counts_existing_python_threads(
+    noop_child_existing_thread_count,
+):
+    num_threads = 3
+    body = """
+    import threading
+    import time
+
+    hold = threading.Event()
+
+    def work():
+        hold.wait(timeout=10)
+
+    threads = [threading.Thread(target=work) for _ in range({num_threads})]
+    for thread in threads:
+        thread.start()
+    time.sleep(2)
+    hold.set()
+    for thread in threads:
+        thread.join()
+    """.format(
+        num_threads=num_threads
+    )
+    stats = _run_traced_child(
+        body,
+        include_existing_threads=True,
+        tracer_start_delay=EXISTING_THREAD_TRACER_DELAY_SECONDS,
+    )
+    _assert_existing_count_relative_to_baseline(
+        stats,
+        noop_child_existing_thread_count,
+        num_threads,
+    )
+
+
+@pytest.mark.skipif(
+    not cython_extensions_compiled,
+    reason="OpenMP test helper is not built",
+)
+def test_tracer_counts_openmp_thread_spawns(noop_child_spawn_count):
+    from tests._openmp_test_helper.openmp_helpers_inner import check_openmp_num_threads
+
+    os.environ["OMP_NUM_THREADS"] = "4"
+    check_openmp_num_threads(10)
+    expected_extra_spawn_count = _expected_pool_spawn_count("openmp")
+
+    body = """
+    import os
+
+    os.environ["OMP_NUM_THREADS"] = "4"
+    from tests._openmp_test_helper.openmp_helpers_inner import check_openmp_num_threads
+
+    used = check_openmp_num_threads(100)
+    assert used >= 1
+    """
+    stats = _run_traced_child(body)
+    _assert_spawn_count_relative_to_baseline(
+        stats,
+        noop_child_spawn_count,
+        expected_extra_spawn_count,
+    )
+
+
+def test_tracer_counts_blas_thread_spawns(noop_child_spawn_count):
+    pytest.importorskip("numpy")
+    _configure_blas_thread_env()
+
+    import numpy as np
+
+    rng = np.random.RandomState(0)
+    warmup = rng.rand(100, 100)
+    np.dot(warmup, warmup)
+    expected_extra_spawn_count = _expected_pool_spawn_count("blas")
+
+    body = """
+    import os
+
+    os.environ["OMP_NUM_THREADS"] = "1"
+    os.environ["OPENBLAS_NUM_THREADS"] = "4"
+    os.environ["MKL_NUM_THREADS"] = "4"
+
+    import numpy as np
+
+    rng = np.random.RandomState(0)
+    a = rng.rand(2000, 2000)
+    np.dot(a, a)
+    """
+    stats = _run_traced_child(body)
+    _assert_spawn_count_relative_to_baseline(
+        stats,
+        noop_child_spawn_count,
+        expected_extra_spawn_count,
+    )