@solidjs/signals 2.0.0-beta.25 → 2.0.0-beta.27

package/dist/dev.js

@@ -591,10 +591,14 @@ function resetErrorHalt() {
   halted = false;
   haltNotified = false;
 }
+// Identifies one child-traversal pass in `Queue.run` so a rescan after the
+// child list shifts can tell "already run this pass" from "still pending".
+let queueRunToken = 0;
 class Queue {
   _parent = null;
   _queues = [[], []];
   _children = [];
+  _ranAt = 0;
   created = clock;
   addChild(child) {
     this._children.push(child);
@@ -617,7 +621,27 @@ class Queue {
       this._queues[type - 1] = [];
       runQueue$1(effects, type);
     }
-    for (let i = 0; i < this._children.length; i++) this._children[i].run?.(type);
+    // Effects run here can dispose owners, and disposal removes queues from
+    // this list — the running child itself, an earlier sibling, or several at
+    // once. A plain index walk then skips whatever shifted into the cursor.
+    // Stamping each child before it runs makes the pass idempotent, so a shift
+    // can be recovered by rescanning from the front and every child still runs
+    // exactly once. Children appended mid-pass carry a stale stamp and run,
+    // matching the previous live-array behaviour.
+    const children = this._children;
+    const token = ++queueRunToken;
+    for (let i = 0; i < children.length; ) {
+      const child = children[i];
+      if (child._ranAt !== token) {
+        child._ranAt = token;
+        child.run?.(type);
+        if (children[i] !== child) {
+          i = 0;
+          continue;
+        }
+      }
+      i++;
+    }
   }
   enqueue(type, fn) {
     if (type) {
@@ -1091,11 +1115,10 @@ function transitionComplete(transition) {
       break;
     }
   }
-  // Override blockage lives with the engine. Absent hook = "no optimistic
-  // blockage", which is exact: only _optimisticWrite (engine) pushes to
-  // _optimisticNodes, so without the engine the loop was vacuous anyway.
-  if (done && transition._optimisticNodes.length && GlobalQueue._transitionBlocked(transition))
-    done = false;
+  // Override blockage lives with the engine (absent hook = "no optimistic
+  // blockage"); the hook's loops over _optimisticNodes/_optimisticStores are
+  // no-ops when the transition holds neither, so no pre-check is needed.
+  if (done && GlobalQueue._transitionBlocked?.(transition)) done = false;
   done && (transition._done = true);
   return done;
 }
@@ -1103,9 +1126,6 @@ function currentTransition(transition) {
   while (transition._done && typeof transition._done === "object") transition = transition._done;
   return transition;
 }
-function setActiveTransition(transition) {
-  activeTransition = transition;
-}
 function runInTransition(transition, fn) {
   const prevTransition = activeTransition;
   try {
@@ -1707,8 +1727,70 @@ function forEachDependent(el, fn) {
 // Queue a node to re-run on the next flush (used both when a pending source
 // settles and when an `isPending` observer must re-evaluate after a real error):
 // shared scheduling helper in heap.ts (tracked effects bypass the heap).
+// Settle-time counterpart of unlinkSubs' last-one-out check. A lazy node that
+// loses its last subscriber while STATUS_PENDING is exempt from autodispose
+// (the in-flight work is an observer), so whatever CLEARS that pending state
+// must run the release — otherwise the node stays linked and recomputes
+// forever with zero subscribers (#2934). The node's own promise/iterator
+// callbacks handle their own release (settleAutodispose in handleAsync); this
+// covers derivatively-pending dependents, which have no callbacks of their own.
+function releaseIfSettledUnobserved(node) {
+  node._fn &&
+    node._config & CONFIG_AUTO_DISPOSE &&
+    !node._subs &&
+    !(node._flags & REACTIVE_ZOMBIE) &&
+    !(node._statusFlags & STATUS_PENDING) &&
+    unobserved(node);
+}
+// Error-path sweep: notifyStatus(STATUS_ERROR) clears dependents' pending
+// sources through its own recursion (no per-node settle callback), so after
+// the propagation completes, walk the same graph for stranded lazy nodes.
+// Collect-then-release so unobserved() never unlinks under the walk.
+function releaseSettledDependents(el) {
+  let candidates;
+  const visited = new Set();
+  const visit = node => {
+    if (visited.has(node)) return;
+    visited.add(node);
+    if (!node._subs && node._config & CONFIG_AUTO_DISPOSE) (candidates ??= []).push(node);
+    forEachDependent(node, visit);
+  };
+  forEachDependent(el, visit);
+  if (candidates) for (const node of candidates) releaseIfSettledUnobserved(node);
+}
+// Error-dimension twin of settlePendingSource's blocked re-enqueue (#2949):
+// a node in STATUS_ERROR that recovers by recomputing to an UNCHANGED value
+// fires no value notification — the recovery is completely silent. But a
+// dependent that re-ran during the error window consumed its dirty flag and
+// committed nothing (the fresh sibling values it read were absorbed into an
+// errored run), so its committed value is stale. The propagated error is one
+// object identity down the whole dependent tree, and holding it is exactly
+// the "blocked on this error" marker — re-enqueue those holders so they
+// re-run: fresh values commit and flow, and a dependent with another
+// still-broken source simply re-errors. The async dimension needs no twin of
+// its own: recovery there passes through a pending window whose re-runners
+// set _blocked and ride settlePendingSource. Walks the full dependent graph
+// (releaseSettledDependents shape): identity holders can sit below an
+// intermediate whose own error state has since been scrubbed or replaced
+// (e.g. an error boundary's tree node).
+function settleErroredDependents(el, error) {
+  let scheduled = false;
+  const visited = new Set();
+  const visit = node => {
+    if (visited.has(node)) return;
+    visited.add(node);
+    if (node._error === error) {
+      enqueueSub(node);
+      scheduled = true;
+    }
+    forEachDependent(node, visit);
+  };
+  forEachDependent(el, visit);
+  if (scheduled) schedule();
+}
 function settlePendingSource(el) {
   let scheduled = false;
+  let released;
   const visited = new Set();
   // Companion updates no-op without the verdict layer (null hook).
   const updateCompanions = GlobalQueue._updatePendingSignal;
@@ -1729,10 +1811,17 @@ function settlePendingSource(el) {
         scheduled = true;
       }
       node._blocked = false;
+      // Fully settled with nobody watching: release candidate (#2934). Checked
+      // again at release time — deferred so unobserved() can't unlink subs
+      // lists this walk is still iterating.
+      if (!node._subs && node._config & CONFIG_AUTO_DISPOSE) (released ??= []).push(node);
     }
     forEachDependent(node, settle);
   };
   forEachDependent(el, settle);
+  // Release before the flush schedule below: unobserved() pulls the node back
+  // out of the heap, so the enqueueSub above never recomputes a released node.
+  if (released) for (const node of released) releaseIfSettledUnobserved(node);
   if (scheduled) schedule();
 }
 // Object-thenable detection (Promises/A+ shape).
@@ -1776,12 +1865,41 @@ function handleAsync(el, result, setter) {
   }
   el._inFlight = result;
   let syncValue;
+  // Settle-time transition re-entry. The loading rail is invisible to
+  // transactions (#2933): a boundary-caught first load never registers as an
+  // async reporter, so its settle — the boundary's fallback -> content
+  // reveal — must flow ambiently. The node can still carry a `_transition`
+  // stamp (pending-node bookkeeping rides through the stamping sites), and
+  // blindly re-entering that stamped, still-incomplete transaction stashed
+  // the reveal with it — a deadlock when the transaction's completion
+  // depended on the reveal (#2937). An ESCAPED first load did register and
+  // keeps transition scheduling; initialized (value-holding) pending settles
+  // are the transaction's reveal machinery and always re-enter.
+  const settleTransition = () => {
+    const transition = resolveTransition(el);
+    if (
+      transition &&
+      el._statusFlags & STATUS_UNINITIALIZED &&
+      !currentTransition(transition)._asyncReporters.has(el)
+    ) {
+      // Drop the stale stamp too: the plain settle write (setSignal) and the
+      // stash-path restamp both re-enter the transaction through it.
+      el._transition = null;
+      return;
+    }
+    globalQueue.initTransition(transition);
+  };
   const handleError = error => {
     if (el._inFlight !== result) return;
-    globalQueue.initTransition(resolveTransition(el));
+    settleTransition();
     // NotReadyError from rejected promises should be treated as pending, not error
-    notifyStatus(el, error instanceof NotReadyError ? STATUS_PENDING : STATUS_ERROR, error);
+    const stillPending = error instanceof NotReadyError;
+    notifyStatus(el, stillPending ? STATUS_PENDING : STATUS_ERROR, error);
     el._time = clock;
+    // A real error settles derivatively-pending dependents (notifyStatus
+    // cleared their pending sources), so stranded lazy ones release here —
+    // the error twin of settlePendingSource's release (#2934).
+    if (!stillPending) releaseSettledDependents(el);
   };
   const asyncWrite = (value, then) => {
     if (el._inFlight !== result) return;
@@ -1789,7 +1907,7 @@ function handleAsync(el, result, setter) {
     // skip this stale async result — the upcoming flush will recompute the node
     // with the new value, creating a fresh Promise that supersedes this one.
     if (el._flags & (REACTIVE_DIRTY | REACTIVE_OPTIMISTIC_DIRTY)) return;
-    globalQueue.initTransition(resolveTransition(el));
+    settleTransition();
     const wasUninitialized = !!(el._statusFlags & STATUS_UNINITIALIZED);
     trimStaleDeps(el);
     clearStatus(el);
@@ -1861,10 +1979,14 @@ function handleAsync(el, result, setter) {
   // work (a lazy async memo would otherwise tear down and re-execute — one
   // fetch per suspended re-read). Settling is that observer's release, so
   // it runs the same last-one-out check the other release sites run.
+  // Returns whether the node released, so the iterator branch can stop
+  // pulling values instead of pumping an unobserved stream forever (#2935).
   const settleAutodispose = () => {
     if (el._config & CONFIG_AUTO_DISPOSE && !el._subs && !(el._statusFlags & STATUS_PENDING)) {
       unobserved(el);
+      return true;
     }
+    return false;
   };
   if (thenable) {
     let resolved = false,
@@ -1916,6 +2038,12 @@ function handleAsync(el, result, setter) {
         if (isThenable(returned)) returned.then(undefined, () => {});
       } catch {}
     });
+    // Release check before each next pull: an unobserved lazy node must tear
+    // down (its cleanup above closes the iterator) instead of pumping the
+    // stream forever with zero subscribers (#2935).
+    const iterateOrRelease = () => {
+      if (!settleAutodispose()) iterate();
+    };
     const iterate = () => {
       let syncResult,
         syncError,
@@ -1932,7 +2060,7 @@ function handleAsync(el, result, setter) {
             return;
           } else if (!r.done) {
             hadValue = true;
-            asyncWrite(r.value, iterate);
+            asyncWrite(r.value, iterateOrRelease);
           } else {
             completed = true;
             if (hadValue) {
@@ -1942,6 +2070,7 @@ function handleAsync(el, result, setter) {
               // Empty completion settles like the immediately-done sync path.
               asyncWrite(undefined);
             }
+            settleAutodispose();
           }
         },
         e => {
@@ -1951,6 +2080,7 @@ function handleAsync(el, result, setter) {
           } else if (el._inFlight === result) {
             completed = true;
             handleError(e);
+            settleAutodispose();
           }
         }
       );
@@ -2169,6 +2299,10 @@ function recompute(el, create = false) {
   let isOptimisticDirty = !!(el._flags & REACTIVE_OPTIMISTIC_DIRTY);
   const hasOverride = el._overrideValue !== undefined && el._overrideValue !== NOT_PENDING;
   const wasUninitialized = !!(el._statusFlags & STATUS_UNINITIALIZED);
+  // Outgoing error, captured before the compute clears status: if this run
+  // recovers to an unchanged value, dependents still holding this object must
+  // be swept (settleErroredDependents, #2949).
+  const outgoingError = el._statusFlags & STATUS_ERROR ? el._error : undefined;
   // Re-ask classification lives in the verdict module; capture the flag before
   // the recompute wipes _flags below.
   const hadReask = (el._flags & REACTIVE_REASK) !== 0;
@@ -2351,6 +2485,13 @@ function recompute(el, create = false) {
         insertIntoHeapHeight(s._sub, queueFor(s._sub));
       }
     }
+    // Silent recovery: errored → unchanged value fires no notification, but
+    // dependents still holding the propagated error consumed their dirty flag
+    // in an errored run and may sit on stale commits (#2949). Changed-value
+    // recoveries ride insertSubs above; a comparator throw re-errored the node
+    // (el._error re-set), so this only runs on a genuinely clean recovery.
+    if (outgoingError !== undefined && !valueChanged && !el._error)
+      settleErroredDependents(el, outgoingError);
   }
   currentOptimisticLane = prevLane;
   const needsPendingCommit =
@@ -2759,15 +2900,19 @@ function read(el) {
       throw owner._error;
     }
   }
-  if (el._fn && el._statusFlags & STATUS_ERROR) {
+  // `owner` is the computed itself, or the firewall behind a store node —
+  // firewall-backed reads follow the same rules (memo parity, #2897 ruling):
+  // an errored derive throws for every late reader instead of silently
+  // serving node values (the seed, or last-good data after a failed refetch).
+  if (owner._fn && owner._statusFlags & STATUS_ERROR) {
     // Only a genuine reactive re-read may retry an errored async source:
     // - tracking: owned/tracked scope only (never events / `untrack` / effect side-effect phase)
     // - !pendingCheckActive: an `isPending` probe observes the error, never refetches
-    // - el._time < clock: only on a later cycle than the one the error was found
-    if (tracking && !pendingCheckActive && el._time < clock) {
-      recompute(el);
+    // - owner._time < clock: only on a later cycle than the one the error was found
+    if (tracking && !pendingCheckActive && owner._time < clock) {
+      recompute(owner);
       return read(el);
-    } else throw el._error;
+    } else throw owner._error;
   }
   if (snapshotCaptureActive && c && c._config & CONFIG_IN_SNAPSHOT_SCOPE) {
     const sv = el._snapshotValue;
@@ -4064,7 +4209,12 @@ function action(genFn) {
         ctx = currentTransition(ctx);
         const i = ctx._actions.indexOf(it);
         if (i >= 0) ctx._actions.splice(i, 1);
-        setActiveTransition(ctx);
+        // Re-adopt through initTransition like every other resumption site:
+        // a bare setActiveTransition leaves globalQueue._batch as a detached
+        // ambient batch, and anything registered before the scheduled flush
+        // (held writes on a merging transition, optimistic overrides,
+        // affects() marks) lands there with nothing to ever finalize it.
+        globalQueue.initTransition(ctx);
         schedule();
         failed ? reject(e) : resolve(v);
       };
@@ -4655,6 +4805,21 @@ function itemKey(item, keyFn) {
 function keyedMatch(a, b, keyFn) {
   return a === b || (isWrappable(a) && isWrappable(b) && keyFn(a) === keyFn(b));
 }
+// A pair of array slots may only be merged into when both sides are real store
+// children of the SAME container kind. An array and an object are different
+// shapes, and merging one into the other leaves the slot's proxy permanently
+// mismatched with its value (an array target holding an object, so
+// `Array.isArray`/spread/`map` lie). The object diff has always applied this
+// rule; the array paths reach the same recursion through `keyedMatch` /
+// positional pairing, where two keyless wrappables "match" regardless of kind.
+function recursablePair(previous, next) {
+  return (
+    isWrappable(previous) &&
+    isWrappable(next) &&
+    !(rawValuesUsed && (isRawValue(previous) || isRawValue(next))) &&
+    Array.isArray(previous) === Array.isArray(next)
+  );
+}
 // Array reconciliation updates the slots it visits, then swaps STORE_VALUE.
 // Previously tracked keys that are absent from `next` still need invalidating,
 // and `in` dependencies should follow the new value's membership. Use
@@ -4719,11 +4884,7 @@ function applyStateChild(next, prevRaw, target, keyFn) {
 // Reconcile a single array slot: recurse into a wrappable pair, otherwise replace
 // the node's value outright (covers object→primitive and primitive→object).
 function applyArrayItem(next, previous, target, node, keyFn) {
-  if (
-    isWrappable(next) &&
-    isWrappable(previous) &&
-    !(rawValuesUsed && (isRawValue(previous) || isRawValue(next)))
-  ) {
+  if (recursablePair(previous, next)) {
     const wrapped = wrap(previous, target);
     node && setSignal(node, wrapped);
     applyState(next, wrapped, keyFn);
@@ -4917,7 +5078,7 @@ function applyStateFast(next, target, keyFn) {
         // the recursion dispatch entirely. Raw-marked values are leaves:
         // replace the slot node instead of recursing.
         if (item !== next[start]) {
-          if (rawValuesUsed && (isRawValue(item) || isRawValue(next[start]))) {
+          if (!recursablePair(item, next[start])) {
             arrayNodes?.[start] && setSignal(arrayNodes[start], wrapValue(next[start], target));
           } else applyStateChild(next[start], item, target, keyFn);
         }
@@ -4979,11 +5140,7 @@ function applyStateFast(next, target, keyFn) {
     } else if (next.length) {
       for (let i = 0, len = next.length; i < len; i++) {
         const item = previous[i];
-        if (
-          isWrappable(item) &&
-          isWrappable(next[i]) &&
-          !(rawValuesUsed && (isRawValue(item) || isRawValue(next[i])))
-        ) {
+        if (recursablePair(item, next[i])) {
           if (item !== next[i]) applyStateChild(next[i], item, target, keyFn);
         } else {
           if (item !== next[i]) changed = true;
@@ -5093,8 +5250,8 @@ function applyStateSlow(next, target, keyFn) {
         );
         start++
       ) {
-        if (isWrappable(item) && isWrappable(next[start]) && item !== next[start]) {
-          if (rawValuesUsed && (isRawValue(item) || isRawValue(next[start]))) {
+        if (item !== next[start] && isWrappable(item) && isWrappable(next[start])) {
+          if (!recursablePair(item, next[start])) {
             nodes?.[start] && setSignal(nodes[start], wrapValue(next[start], target));
           } else applyState(next[start], wrap(item, target), keyFn);
         }
@@ -5156,11 +5313,7 @@ function applyStateSlow(next, target, keyFn) {
     } else if (next.length) {
       for (let i = 0, len = next.length; i < len; i++) {
         const item = getOverrideValue(previous, override, i, optOverride);
-        if (
-          isWrappable(item) &&
-          isWrappable(next[i]) &&
-          !(rawValuesUsed && (isRawValue(item) || isRawValue(next[i])))
-        ) {
+        if (recursablePair(item, next[i])) {
           if (item !== next[i]) applyState(next[i], wrap(item, target), keyFn);
         } else {
           if (item !== next[i]) changed = true;
@@ -5215,6 +5368,58 @@ function applyStateSlow(next, target, keyFn) {
 // No-key reconcile: every item reports "no key", which routes array diffs to
 // the positional branch and object descent to plain per-property merging.
 const NOKEY = () => null;
+// Identity-as-key: distinct objects never match, so every slot takes the diff's
+// "not the same entity" branch and is replaced by reference rather than merged
+// into. Slots holding the same raw on both sides still keep their proxy.
+const IDENTITY = item => item;
+/**
+ * Shared body of `reconcile()` and the projection commit. `replace` is the
+ * only difference: a projection commit is a value swap, not a merge — its root
+ * proxy is a cell handed out by `createProjection` that can never change
+ * reference, so a derive returning a different entity is not the slot mistake
+ * `reconcile()` throws on. Nothing below the root survives that swap, which is
+ * the rule the keyed diff already applies at a nested slot on a key mismatch.
+ *
+ * @internal
+ */
+function reconcileState(value, state, key, replace) {
+  if (state == null) throw new Error("Cannot reconcile null or undefined state");
+  // A projection commit whose derive returns a foreign store adopts it as the
+  // live backing (store-in-store chain — the same shape as a store-proxy
+  // seed): reads route through the inner store's own graph, so its updates
+  // flow with no re-derive, and a derive with no dependencies never recomputes
+  // (#2941). The diff below still runs against raw values so THIS store's
+  // existing subscribers see the swap; the live proxy is installed after.
+  // Shallow projections keep their raw-ingest contract and never chain.
+  let chain;
+  const target = replace ? state[$TARGET] : undefined;
+  if (target !== undefined) {
+    if (value?.[$TARGET] !== undefined && value[$TARGET] !== target && !target[STORE_SHALLOW]) {
+      if (target[STORE_VALUE] === value) return; // already chained to this store
+      chain = value;
+    }
+    // Re-diffing a previously chained backing goes through its raw — reads
+    // off the outgoing proxy would subscribe this computed to a store it is
+    // about to drop.
+    while (target[STORE_VALUE]?.[$TARGET] !== undefined)
+      target[STORE_VALUE] = unwrap(target[STORE_VALUE]);
+  }
+  if (key === null) applyState(value, state, NOKEY);
+  else {
+    let keyFn = typeof key === "string" ? item => item[key] : key;
+    const eq = keyFn(state);
+    if (eq !== undefined && keyFn(value) !== eq) {
+      if (!replace) throw new Error("Cannot reconcile states with different identity");
+      // Or the outgoing raw keeps resolving to this proxy and surfaces the
+      // incoming entity wherever it reappears in this family.
+      const t = state[$TARGET];
+      if (t && t[STORE_VALUE] !== unwrap(value)) t[STORE_LOOKUP]?.delete(t[STORE_VALUE]);
+      keyFn = IDENTITY;
+    }
+    applyState(value, state, keyFn);
+  }
+  if (chain !== undefined) target[STORE_VALUE] = chain;
+}
 /**
  * Returns a draft-mutating function that smart-merges `value` into a store,
  * preserving fine-grained reactivity: only changed leaves trigger updates.
@@ -5229,6 +5434,9 @@ const NOKEY = () => null;
  * the classic pattern for fixed-shape data that churns in place (dashboards,
  * monitors), where no keyed diff pass is needed or wanted.
  *
+ * Merging into a slot that holds a *different* entity throws — the caller
+ * picked the slot, so a key mismatch there is a bug.
+ *
  * @param value the next state to merge in
  * @param key property name (string) or extractor function for stable
  * identity (default `"id"`); pass `null` for positional merging
@@ -5247,18 +5455,7 @@ const NOKEY = () => null;
  * ```
  */
 function reconcile(value, key = "id") {
-  return state => {
-    if (state == null) throw new Error("Cannot reconcile null or undefined state");
-    if (key === null) {
-      applyState(value, state, NOKEY);
-      return;
-    }
-    const keyFn = typeof key === "string" ? item => item[key] : key;
-    const eq = keyFn(state);
-    if (eq !== undefined && keyFn(value) !== eq)
-      throw new Error("Cannot reconcile states with different identity");
-    applyState(value, state, keyFn);
-  };
+  return state => reconcileState(value, state, key, false);
 }
 
 function createProjectionInternal(fn, seed, options) {
@@ -5292,7 +5489,7 @@ function createProjectionInternal(fn, seed, options) {
   node = computed(
     () => {
       if (!node) node = getOwner();
-      runProjectionComputed(wrappedStore, fn, options?.key || "id");
+      runProjectionComputed(wrappedStore, fn, options?.key === undefined ? "id" : options.key);
     },
     options?.name ? { name: options.name } : undefined
   );
@@ -5307,6 +5504,10 @@ function createProjectionInternal(fn, seed, options) {
  * items keep their proxy identity — only added/removed items are
  * created/disposed.
  *
+ * If the derive returns a different entity than the one currently held (the
+ * `/users/1` → `/users/2` shape), the store swaps to it rather than merging,
+ * and nothing below it is treated as surviving.
+ *
  * Returns the projected store directly (no setter — reads only).
  *
  * Use this when you want the structural-sharing / per-property tracking
@@ -5319,7 +5520,8 @@ function createProjectionInternal(fn, seed, options) {
  * @param seed the backing store value to wrap and reconcile into
  * @param options `ProjectionOptions` — `name`, `key`. `key` defaults to
  *   `"id"`; specify it only when your data uses a different identity field
- *   (e.g. `{ key: "uuid" }` or `{ key: u => u.slug }`).
+ *   (e.g. `{ key: "uuid" }` or `{ key: u => u.slug }`), or `null` to merge
+ *   positionally with no keyed pass.
  *
  * @example
  * ```ts
@@ -5371,7 +5573,7 @@ function runProjectionComputed(wrappedStore, fn, key, wrapCommit, onDraftWrite)
     settled = true;
     const commit = v => {
       if (v === s || v === undefined) return;
-      const write = () => storeSetter(wrappedStore, reconcile(v, key));
+      const write = () => storeSetter(wrappedStore, s => reconcileState(v, s, key, true));
       wrapCommit ? wrapCommit(write) : write();
     };
     commit(handleAsync(owner, result, commit));
@@ -5543,6 +5745,14 @@ function isRawValue(value) {
 }
 function markRawOne(v) {
   if (isWrappable(v)) {
+    // A store proxy is already tracked elsewhere: the shallow boundary passes
+    // it through by reference (replaced, never edited — same slot semantics
+    // as a raw) instead of claiming it raw. The sticky mark is global, so
+    // marking a live proxy would make wrap() serve it verbatim through every
+    // OTHER store too — downstream deep stores then captured it instead of
+    // wrapping it in their own family, and their writes landed in the
+    // upstream store's override layer (#2932).
+    if (v[$TARGET] !== undefined) return;
     if (storeLookup.has(v))
       throw new Error(
         "shallow store: an ingested record is already tracked as a deep store — one value cannot present both wrapped and raw"
@@ -5596,11 +5806,38 @@ function wrapShallow(value) {
   markRawIngest(value);
   return p;
 }
+const OBJECT_PROTO = Object.prototype;
+// Per-prototype memo for the custom-proto branch of isWrappable: the verdict
+// is fully determined by the prototype (tag and Node lineage both live on
+// the chain), so each class pays the tag call once — not per read.
+const wrappableProtos = new WeakMap();
 function isWrappable(obj) {
   if (obj == null || typeof obj !== "object" || Object.isFrozen(obj)) return false;
-  // Dynamic Node check (kept dynamic so test/SSR overrides of `globalThis.Node`
-  // are observed at call time).
-  return typeof Node === "undefined" || !(obj instanceof Node);
+  // Plain data and user class instances wrap; platform objects never do
+  // (#2952). Native code brand-checks internal slots and throws through a
+  // proxy (`Map.prototype.size`, `Date.prototype.getTime`, ...), so
+  // collections and other built-ins can't honestly be stores — they get the
+  // markRaw-children contract automatically: served raw, mutations land raw,
+  // the property holding them still tracks (reassignment notifies). The tag
+  // check separates them structurally: user classes stringify as
+  // `[object Object]` while every native/host object carries its own brand
+  // (`[object Map]`, `[object Date]`, `[object Headers]`, ...), including
+  // subclasses, which inherit the tag. getPrototypeOf keeps the hot path
+  // (plain and null-proto objects) intrinsic-only — no property lookup.
+  const proto = Object.getPrototypeOf(obj);
+  if (proto === OBJECT_PROTO || proto === null) return true;
+  if (Array.isArray(obj)) return true;
+  let wrappable = wrappableProtos.get(proto);
+  if (wrappable === undefined) {
+    wrappable =
+      Object.prototype.toString.call(obj) === "[object Object]" &&
+      // Dynamic Node check (kept dynamic so test/SSR overrides of
+      // `globalThis.Node` are observed at call time): shimmed DOMs implement
+      // nodes as plain user classes, which pass the tag check.
+      (typeof Node === "undefined" || !(obj instanceof Node));
+    wrappableProtos.set(proto, wrappable);
+  }
+  return wrappable;
 }
 let writeOverride = false;
 function setWriteOverride(value) {
@@ -6072,8 +6309,11 @@ function armOptimisticStoreWrite(target, store) {
  * concurrent actions writing disjoint keys must revert independently, exactly
  * like optimistic signal nodes do via the transition's _optimisticNodes.
  * `activeTransition` is the write's transaction (action() opens it before the
- * body runs); null marks an ambient write that clears at plain flush end.
- * Same-key writes across actions keep last-write-wins layer semantics.
+ * body runs); null marks an ambient write, which clears at plain flush end —
+ * unless its flush's transition is blocked on the store's own in-flight truth
+ * (pending firewall, #2951), in which case it rides that transaction to
+ * settle. Same-key writes across actions keep last-write-wins layer
+ * semantics.
  */
 function stampOptimisticOwner(target, overrideKey, property) {
   if (overrideKey === STORE_OPTIMISTIC_OVERRIDE)
@@ -6124,17 +6364,37 @@ function notifyStoreProperty(target, property, mode, value, prev, prevHas) {
 }
 let Writing = null;
 /**
- * A derived store's seed is a draft for the derive function, never an
- * observable value (#2897): until the firewall first resolves there is
- * nothing to read, so every consumer path throws NotReady — tracked reads
- * through their node (core read()), and the untracked fall-throughs in the
- * traps through this guard. Returning the seed leaked it; returning
- * `undefined` would break non-nullable types. Callers exempt the firewall
- * itself (the derive function works its own draft while uninitialized).
+ * A derived store follows async memo rules (#2897 ruling): its seed is a
+ * draft for the derive function, never an observable value, and an errored
+ * derive is an error state, never a silent stale/seed serve. Until the
+ * firewall first resolves there is nothing to read, so every consumer path
+ * throws NotReady — tracked reads through their node (core read()), and the
+ * untracked fall-throughs in the traps through this guard. Returning the
+ * seed leaked it; returning `undefined` would break non-nullable types.
+ * Callers exempt the firewall itself (the derive function works its own
+ * draft while uninitialized).
+ *
+ * Error rail: a firewall carrying STATUS_ERROR throws its error for every
+ * late reader — memo parity, where read()'s error branch does the same for
+ * plain computeds. Rejection clears STATUS_UNINITIALIZED at commit, so
+ * without this check late readers silently got the seed while settle-time
+ * subscribers saw the error.
+ *
+ * Loading rail: the veto requires the firewall to still be in flight, not
+ * just flagged: STATUS_UNINITIALIZED's clear is deferred to batch commit,
+ * so during the settle flush a firewall that has already recomputed — and
+ * reconciled real values into STORE_VALUE — still carries the stale flag.
+ * STATUS_PENDING is the live bit (it clears eagerly at settle, mirroring
+ * core read()'s verdict), so gating on it stops the guard from throwing a
+ * fresh NotReadyError that nothing would ever sweep. #2944: mapArray's
+ * keyed diff reads items inside its internal owner (untracked by design)
+ * in exactly this window, and the stale throw wedged <For> permanently.
  */
-function throwIfUninitialized(target) {
+function throwIfUnreadable(target) {
   const firewall = target[STORE_FIREWALL];
-  if (firewall && firewall._statusFlags & STATUS_UNINITIALIZED)
+  if (!firewall) return;
+  const flags = firewall._statusFlags;
+  if (flags & STATUS_ERROR || (flags & STATUS_UNINITIALIZED && flags & STATUS_PENDING))
     throw firewall._error ?? new NotReadyError(firewall);
 }
 const storeTraps = {
@@ -6281,7 +6541,14 @@ const storeTraps = {
     }
     // Untracked fall-through (tracked reads already threw via their node in
     // read(); the dev strictRead error above wins first for memo parity).
-    if (!selfRead) throwIfUninitialized(target);
+    // Observer-present reads must NOT re-consult the flag here: during the
+    // settle flush the firewall has recomputed (first values live on the
+    // pending rail, served by read() above) but its UNINITIALIZED clear is
+    // deferred to batch commit — vetoing read()'s verdict with the stale flag
+    // threw a fresh NotReadyError for an already-settled source, which no
+    // sweep would ever release (#2938: projection over an async store wedged
+    // its Loading boundary on `undefined`).
+    if (!selfRead && !getObserver()) throwIfUnreadable(target);
     return isWrappable(value) ? wrap(value, target) : value;
   },
   has(target, property) {
@@ -6301,7 +6568,7 @@ const storeTraps = {
     if (getObserver()) {
       return read(getNode(target, nodes, property, has));
     }
-    throwIfUninitialized(target);
+    throwIfUnreadable(target);
     return has;
   },
   set(target, property, rawValue) {
@@ -6315,8 +6582,19 @@ const storeTraps = {
         const prevHas = prevLayer
           ? prevLayer[property] !== $DELETED
           : property in target[STORE_VALUE];
-        const value = unwrapStoreValue(rawValue);
-        if (target[STORE_SHALLOW] && isWrappable(value)) rawValues.add(value);
+        // Shallow slots hold store proxies verbatim (pass-through reference,
+        // never raw-marked — see markRawOne/#2932); everything else unwraps
+        // and marks as usual.
+        const passThrough = !!target[STORE_SHALLOW] && rawValue?.[$TARGET] !== undefined;
+        const value = passThrough ? rawValue : unwrapStoreValue(rawValue);
+        if (target[STORE_SHALLOW] && !passThrough && isWrappable(value)) {
+          // Flip the live gate too: a bare add was inert unless something else
+          // had already marked a raw somewhere (wrap() checks rawValuesUsed
+          // first), so the documented set-trap ingest mark silently no-oped in
+          // apps whose only shallow data arrived through writes.
+          rawValuesUsed = true;
+          rawValues.add(value);
+        }
         // Symbol-keyed writes on arrays are metadata, not index writes — never run
         // them through the numeric index/length machinery (`parseInt` on a symbol
         // throws). #2769
@@ -6457,7 +6735,7 @@ const storeTraps = {
       // path is exempt (like the get/has traps' writeOnly early returns):
       // the first landing's reconcile enumerates the store while
       // STATUS_UNINITIALIZED is still set — it IS the initialization.
-      if (!getObserver() && !writeOnly(target[$PROXY])) throwIfUninitialized(target);
+      if (!getObserver() && !writeOnly(target[$PROXY])) throwIfUnreadable(target);
     }
     // Merge optimistic override with regular override for key enumeration
     let keys = getKeys(target[STORE_VALUE], target[STORE_OVERRIDE], false);
@@ -6699,7 +6977,26 @@ function createOptimisticStore(first, second, options) {
   // STORE_OPTIMISTIC take the engine's write path, so install it before any
   // node can be created.
   installOptimisticEngine();
-  GlobalQueue._clearOptimisticStores ||= clearOptimisticStores;
+  if (!GlobalQueue._clearOptimisticStores) {
+    GlobalQueue._clearOptimisticStores = clearOptimisticStores;
+    // Store half of the engine's override blockage (#2951): signal-form
+    // createOptimistic carries the pending async and the override on ONE node,
+    // so transitionBlocked sees both; a derived optimistic STORE splits them —
+    // the layer sits on store targets while the in-flight truth lives on the
+    // firewall computed. Without this, the transition adopting a bare store
+    // write settled in the same flush that started the refetch and its settle
+    // consumed the layer mid-flight (follow-up writes then drafted from base,
+    // clobbering instead of composing). Optimistic state clears when truth
+    // lands or its transaction ends — never mid-refetch. Wrapped here (engine
+    // is already installed above) so store-free apps never carry the check.
+    const engineBlocked = GlobalQueue._transitionBlocked;
+    GlobalQueue._transitionBlocked = transition => {
+      for (const store of transition._optimisticStores) {
+        if ((store[$TARGET]?.[STORE_FIREWALL]?._statusFlags ?? 0) & STATUS_PENDING) return true;
+      }
+      return engineBlocked(transition);
+    };
+  }
   const derived = typeof first === "function";
   // Plain form: the second slot carries options.
   if (!derived && options === undefined) options = second;
@@ -6856,7 +7153,7 @@ function createOptimisticProjectionInternal(fn, initialValue, options) {
           runProjectionComputed(
             wrappedStore,
             fn,
-            options?.key || "id",
+            options?.key === undefined ? "id" : options.key,
             wrapCommit,
             clearProjectionOverride
           );