@solidjs/signals 2.0.0-rc.0 → 2.0.0-rc.2

package/dist/prod/store/next/store.js

@@ -0,0 +1,1499 @@
+import { unwrapOverride, $REFRESH, CONFIG_OWNED_WRITE, NOT_PENDING, CONFIG_OPTIMISTIC, STATUS_UNINITIALIZED, STATUS_ERROR, CONFIG_CHILDREN_FORBIDDEN } from "../../core/constants.js";
+
+import { setSignal, isEqual, read, pendingCheckActive, readNodeFast, READ_SLOW, signal, ext } from "../../core/core.js";
+
+import { projectionWriteActive, setProjectionWriteActive, schedule, setStoreCommitHook } from "../../core/scheduler.js";
+
+import { getObserver, getOwner } from "../../core/owner.js";
+
+import { $TARGET, isWrappable, markRawIngest, $PROXY, getWriteOverride, markRawOne, witnessAffectsMark, $TRACK, affectsScopesLive, inheritAffectsMarks, $AFFECTS, rawValuesUsed, isRawValue, setNextAffectsNodeResolver } from "../store.js";
+
+import { storeNextLookup, optHooks, ownedRaw, devAssertNeverUserMutation } from "./target.js";
+
+/**
+ * Store rewrite — increment 2: plain deep stores with pending-backing writes.
+ * Contract: INTERNALS-STORE-STATE.md.
+ *
+ * Write model (RUL-1, unified): the first draft write to a target creates its
+ * pending backing `pb` — a descriptor-preserving CoW clone. The draft mutates
+ * `pb` natively (array methods, defineProperty, deletes all just work).
+ * Reads: drafts and owner-context reads see `pb`; context-free reads see the
+ * committed `b` until flush. At flush commit (core's storeCommitHook), each
+ * written target folds: diff old `b` vs new backing notifies exactly the
+ * changed keys through equality-gated nodes, then `b` becomes the new
+ * backing. Setter return-value replacement parks the UNOWNED incoming object
+ * in `pb` — adoption: fold swaps it in, ownership resets (2026-08-16c).
+ *
+ * Nodes carry no pending state — they are pure subscription points; `pb` is
+ * the pending home. Laziness: a written target with no subscriptions folds as
+ * a pointer swap with zero node work.
+ */
+// ---------------------------------------------------------------------------
+// wrap / dedupe
+/** Pre-shaped constructor for OBJECT proxy targets: V8 tips a bare `{}` into
+ * dictionary mode once ~19 named properties are assigned onto it (the #3044
+ * `ovl`/`del` fields crossed that line — every trap's field read became a
+ * hash lookup, a 15% deep-dbmon tick regression). Declaring every field in a
+ * constructor pre-allocates in-object slots so the map stays fast, with
+ * headroom for future fields. The prototype is reset to `Object.prototype`
+ * so proxy-forwarded semantics (getPrototypeOf, constructor) are exactly a
+ * plain object's. Array targets keep the bare-`[]` path — they must carry
+ * the array exotic class for `Array.isArray(proxy)`, and arrays store named
+ * fields off-object where this cliff does not apply. */
+function TargetShape() {
+    this.v = undefined;
+    this.ch = undefined;
+    this.pb = undefined;
+    this.n = undefined;
+    this.h = undefined;
+    this.k = undefined;
+    this.dk = undefined;
+    this.u = undefined;
+    this.pk = undefined;
+    this.px = undefined;
+    this.d = undefined;
+    this.a = undefined;
+    this.sc = undefined;
+    this.nc = undefined;
+    this.adopted = undefined;
+    this.fam = undefined;
+    this.s = undefined;
+    this.ovl = undefined;
+    this.del = undefined;
+    this.wk = undefined;
+}
+
+TargetShape.prototype = Object.prototype;
+
+function createTarget(e, t, n, r = t?.fam ?? null) {
+    // The proxy target carries the array exotic class when the value is an
+    // array, so Array.isArray(proxy) is true; the fields live on it directly.
+    // Direct field assignment in one fixed order (no Object.assign literal
+    // copy): every target shares a hidden-class transition chain — createTarget
+    // was the #2 store cost in the uibench creation profile.
+    const i = Array.isArray(e) ? [] : new TargetShape;
+    i.v = e;
+    // Chained-backing flag (backing IS another store's proxy, §7b) — cached so
+    // the hot read path never does a per-read symbol lookup on the backing.
+        i.ch = e[$TARGET] !== undefined;
+    i.pb = null;
+    i.n = null;
+    i.h = null;
+    i.k = null;
+    i.dk = null;
+    i.u = t;
+    i.pk = n;
+    i.px = null;
+    i.d = false;
+    i.a = false;
+    i.sc = false;
+    i.nc = 0;
+    i.adopted = false;
+    i.fam = r;
+    i.s = false;
+    i.ovl = false;
+    i.del = null;
+    i.wk = null;
+    i.px = new Proxy(i, traps);
+    // Legacy interop: shared machinery (affects walks, wrap dedupe) reads the
+    // proxy off looked-up targets as a field.
+        i[$PROXY] = i.px;
+    (r?.map ?? storeNextLookup).set(e, i);
+    return i;
+}
+
+function wrapNext(e, t = null, n = null, r = t?.fam ?? null) {
+    // markRaw'd values never wrap through ANY store (R42; sticky raw-marking
+    // is one half of the never-both-wrapped-and-raw invariant, RUL-12).
+    if (rawValuesUsed && isRawValue(e)) return e;
+    const i = (r?.map ?? storeNextLookup).get(e);
+    if (i !== undefined) return i.px;
+    const o = e[$TARGET];
+    if (o !== undefined && o.px === e) {
+        // Foreign-family proxies re-wrap into THIS family (writes stay isolated);
+        // same-family and plain-store proxies pass through.
+        if (r === null || o.fam === r) return e;
+        return createTarget(e, t, n, r).px;
+    }
+    return createTarget(e, t, n, r).px;
+}
+
+/** Unwrap our own proxies to their current backing; leave everything else. */ function unwrapValue(e) {
+    if (e == null || typeof e !== "object") return e;
+    const t = e[$TARGET];
+    if (t !== undefined && t.px === e && t.v !== undefined) {
+        // A draft escaping into other storage must be a REAL container that
+        // becomes this target's committed backing at fold (the shared-raw
+        // contract) — a prototype overlay is neither.
+        if (t.ovl) materializePB(t);
+        return t.pb ?? t.v;
+    }
+    return e;
+}
+
+// ---------------------------------------------------------------------------
+// nodes: pure subscription points (values used only for equality gating)
+function getNode(e, t, n) {
+    const r = e.n ??= Object.create(null);
+    let i = r[t];
+    if (i === undefined) {
+        const o = i = signal(n, {
+            // Logical-slot equality: values resolving to the same child target
+            // are the same slot (privatization/adoption swap raw identity without
+            // changing the logical value — only changed leaves notify, R9).
+            equals: (t, n) => isEqual(t, n) || sameLogicalSlot(e, t, n),
+            unobserved() {
+                // A live affects() mark keeps the node addressable (sweep parity).
+                if (o.o?.t) return;
+                if (e.n && e.n[t] === o) {
+                    delete e.n[t];
+                    e.nc--;
+                }
+            }
+        }, 
+        // Projection nodes carry the projection computed as their firewall:
+        // reads through them link the derive's status/lifecycle (§7b).
+        e.fam?.node ?? undefined);
+        // Store nodes are ownedWrite: the setter carries the owned-scope write
+        // guard; node-level setSignals are internal notification machinery.
+                o.T |= CONFIG_OWNED_WRITE;
+        // Accessor-ness resolved ONCE per node (no per-object descriptor scan):
+        // accessor keys serve through Reflect.get with the proxy receiver.
+                o.acc = isOwnAccessor(e.pb ?? e.v, t);
+        // Wrap cache: the proxy last served for this key and the raw it wrapped.
+        // Raw-as-truth stores raw in nodes, so every object read needs a wrapper;
+        // one pointer compare (pxv === value) replaces the per-read WeakMap
+        // lookup in wrapNext — the dominant read-path cost vs legacy, whose
+        // nodes stored pre-wrapped values. A replaced child fails the compare
+        // and re-wraps; at most one stale proxy is pinned until the next read.
+                o.px = undefined;
+        o.pxv = undefined;
+        // Optimistic families: arm the override slot — setSignal routes armed
+        // nodes through the core engine (lanes, ownership, reverts all native).
+                if (e.fam?.opt) {
+            ext(o).De = NOT_PENDING;
+            o.T |= CONFIG_OPTIMISTIC;
+        }
+        // A node born inside a live mark's identity scope inherits the mark
+        // (the declaration walk could only cover nodes existing then).
+                if (t !== $AFFECTS && affectsScopesLive()) inheritAffectsMarks(o, e.v, t);
+        r[t] = i;
+        e.nc++;
+        markDescendants(e);
+    }
+    return i;
+}
+
+function sameLogicalSlot(e, t, n) {
+    if (t === null || typeof t !== "object" || n === null || typeof n !== "object") return false;
+    const r = e.fam?.map ?? storeNextLookup;
+    const i = r.get(t);
+    return i !== undefined && i === r.get(n);
+}
+
+function getHasNode(e, t, n) {
+    const r = e.h ??= Object.create(null);
+    let i = r[t];
+    if (i === undefined) {
+        const o = i = signal(n, {
+            equals: isEqual,
+            unobserved() {
+                if (o.o?.t) return;
+                if (e.h && e.h[t] === o) delete e.h[t];
+            }
+        }, e.fam?.node ?? undefined);
+        o.T |= CONFIG_OWNED_WRITE;
+        if (e.fam?.opt) {
+            ext(o).De = NOT_PENDING;
+            o.T |= CONFIG_OPTIMISTIC;
+        }
+        if (affectsScopesLive()) inheritAffectsMarks(o, e.v, t);
+        r[t] = i;
+        markDescendants(e);
+    }
+    return i;
+}
+
+function getKeySetNode(e) {
+    let t = e.k;
+    if (t === null) {
+        const n = t = signal(0, {
+            equals: false,
+            unobserved() {
+                if (e.k === n) e.k = null;
+            }
+        }, e.fam?.node ?? undefined);
+        n.T |= CONFIG_OWNED_WRITE;
+        if (e.fam?.opt) {
+            ext(n).De = NOT_PENDING;
+            n.T |= CONFIG_OPTIMISTIC;
+        }
+        e.k = t;
+        markDescendants(e);
+    }
+    return t;
+}
+
+function getDeepNode(e) {
+    let t = e.dk;
+    if (t === null) {
+        const n = t = signal(0, {
+            equals: false,
+            unobserved() {
+                if (e.dk === n) e.dk = null;
+            }
+        }, e.fam?.node ?? undefined);
+        n.T |= CONFIG_OWNED_WRITE;
+        if (e.fam?.opt) {
+            ext(n).De = NOT_PENDING;
+            n.T |= CONFIG_OPTIMISTIC;
+        }
+        if (affectsScopesLive()) inheritAffectsMarks(n, e.v, $TRACK);
+        e.dk = t;
+        markDescendants(e);
+    }
+    return t;
+}
+
+/** Deep-witness bump: any value/shape change on a record with a live deep()
+ * subscriber notifies it. One null check when unused. */ function bumpDeep(e) {
+    if (e.dk !== null) setSignal(e.dk, 1);
+}
+
+function markDescendants(e) {
+    let t = e;
+    while (t && !t.d) {
+        t.d = true;
+        t = t.u;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// pending backing + fold (the single mutation point)
+/** target → committed backing at batch start (the fold diff's old side). */ const foldOlds = new Map;
+
+let hookInstalled = false;
+
+function cloneRaw(e, t) {
+    // Descriptor-preserving shallow clone (R29: installed getters stay live;
+    // ruled 2026-08-17: frozen sources clone unfrozen — theirs stays frozen).
+    // Data descriptors normalize to writable+configurable (the clone is OURS to
+    // mutate — R51's "source-non-configurable is writable through the store");
+    // enumerability and accessors are preserved. The scan doubles as the
+    // accessor-flag detector (free — we're enumerating descriptors anyway).
+    const n = Object.getOwnPropertyDescriptors(e);
+    for (const r of Reflect.ownKeys(n)) {
+        const i = n[r];
+        if (r === "length" && Array.isArray(e)) continue;
+        i.configurable = true;
+        if (!i.get && !i.set) i.writable = true; else if (t) t.a = true;
+    }
+    return Array.isArray(e) ? Object.defineProperties([], n) : Object.create(Object.getPrototypeOf(e), n);
+}
+
+/** One-time own-accessor scan (Annex-B probes, no descriptor allocation);
+ * returns true when the container is plain data (overlay-safe). */ function scanAccessorsOnce(e) {
+    const t = e.v;
+    for (const n of Reflect.ownKeys(t)) {
+        // Own keys shadow prototype accessors, so the lookups are exact here.
+        if (lookupGetter.call(t, n) !== undefined || lookupSetter.call(t, n) !== undefined) {
+            e.a = true;
+            break;
+        }
+    }
+    e.sc = true;
+    return !e.a;
+}
+
+/** Downgrade a prototype-overlay pending backing to the clone path: builds
+ * the real container (committed + overlay writes − deletes) that fold will
+ * SWAP in as the committed backing, exactly as if the draft had started on
+ * the clone path. Consumers that need a complete container (reconcile's
+ * diff walks, drafts escaping into other storage) call this. */ function materializePB(e) {
+    if (!e.ovl) return;
+    const t = e.pb;
+    const n = cloneRaw(e.v, e);
+    for (const e of Reflect.ownKeys(t)) {
+        const r = Object.getOwnPropertyDescriptor(t, e);
+        if (r.get || r.set || !r.enumerable || !r.writable || !r.configurable) Object.defineProperty(n, e, r); else n[e] = r.value;
+    }
+    if (e.del !== null) {
+        for (const t of e.del) delete n[t];
+        e.del = null;
+    }
+    const r = e.fam?.map ?? storeNextLookup;
+    r.delete(t);
+    ownedRaw.add(n);
+    r.set(n, e);
+    e.pb = n;
+    e.ovl = false;
+}
+
+function ensurePB(e) {
+    let t = e.pb;
+    if (t === null) {
+        // Prototype-chain overlay (#3044): plain-data non-array containers
+        // outside projection/optimistic families open drafts in O(1) — own keys
+        // are the writes, reads fall through to committed. Everything else
+        // (arrays: splice/length semantics; families: seeding/revert machinery;
+        // accessor containers: live getters) keeps the descriptor clone.
+        if (e.fam === null && !Array.isArray(e.v) && (e.sc ? !e.a : scanAccessorsOnce(e))) {
+            t = e.pb = Object.create(e.v);
+            e.ovl = true;
+        } else t = e.pb = cloneRaw(e.v, e);
+        // Optimistic families: seed USER drafts from the OPTIMISTIC VIEW
+        // (committed + active node overrides), so follow-up writes compose on
+        // optimism instead of clobbering from base (#2951's compose half).
+        // AUTHORITATIVE drafts (projection recompute / write-override landings)
+        // seed from committed truth — seeding overrides there would fold a lane
+        // value into the committed home ("authority wins at reveal" would break).
+                if (e.fam?.opt && !projectionWriteActive && !getWriteOverride()) {
+            const n = e.n;
+            if (n !== null) {
+                for (const e of Reflect.ownKeys(n)) {
+                    const r = n[e];
+                    if (hasActiveOverride(r)) t[e] = unwrapOverride(r.o?.De);
+                }
+            }
+            const r = e.h;
+            if (r !== null) {
+                for (const e of Reflect.ownKeys(r)) {
+                    const n = r[e];
+                    if (hasActiveOverride(n) && !unwrapOverride(n.o?.De)) delete t[e];
+                }
+            }
+        }
+        ownedRaw.add(t);
+        (e.fam?.map ?? storeNextLookup).set(t, e);
+        queueFold(e);
+    }
+    return t;
+}
+
+/**
+ * Adoption (2026-08-16c): the incoming object becomes the committed backing
+ * IMMEDIATELY — reconcile is eagerly visible to every reader (shipped
+ * contract; only its notifications batch), unlike setter writes which stay
+ * pending until flush. Ownership resets (incoming is unowned/user data). Any
+ * staged draft clone folds into the diff and is discarded — next is the
+ * authoritative base (R21/R32).
+ */ function adoptPB(e, t, n = false) {
+    // Eager mode (plain-store adoption): the caller notifies inline after its
+    // descent — no foldOlds queue/drain round trip (the reconcile diff IS the
+    // fold diff; ~half of dbmon tick time was this duplication).
+    if (!n) {
+        queueFold(e);
+ // records the pre-batch old before we swap
+                e.adopted = true;
+    }
+    e.pb = null;
+    // Overlay and accessor-scan state describe the OUTGOING backing — a
+    // swapped container must not inherit them: a stale `ovl` beside a nulled
+    // pb crashes materializePB (unwrapValue consults ovl before the
+    // null-coalesce), a stale `del` would read the adoptee's keys as deleted
+    // in the next draft, and a stale plain-data verdict (`sc`/`a`) could
+    // admit an accessor-bearing adoptee to the overlay path. Reset; the next
+    // draft rescans once (#3044 audit follow-up).
+        e.ovl = false;
+    e.del = null;
+    e.wk = null;
+ // adoption supersedes any staged trap writes
+        e.sc = false;
+    e.a = false;
+    e.v = t;
+    e.ch = t[$TARGET] !== undefined;
+    (e.fam?.map ?? storeNextLookup).set(t, e);
+}
+
+function queueFold(e) {
+    if (foldOlds.has(e)) return;
+    if (foldOlds.size === 0) {
+        if (!hookInstalled) {
+            hookInstalled = true;
+            setStoreCommitHook(drainFolds);
+        }
+        schedule();
+ // once per batch — drain clears the map
+        }
+    foldOlds.set(e, e.v);
+}
+
+/** Committed-time privatization for parent-chain slot updates (path copying). */ function privatizeCommitted(e) {
+    if (ownedRaw.has(e.v)) return;
+    const t = cloneRaw(e.v, e);
+    ownedRaw.add(t);
+    storeNextLookup.set(t, e);
+    e.v = t;
+    e.ch = false;
+    if (e.u) {
+        privatizeCommitted(e.u);
+        devAssertNeverUserMutation(e.u.v);
+        e.u.v[e.pk] = e.v;
+    }
+}
+
+function drainFolds() {
+    if (foldOlds.size === 0) return;
+    const e = [ ...foldOlds ];
+    foldOlds.clear();
+    for (const [t, n] of e) {
+        if (t.pb !== null) {
+            // Setter path: nodes were setSignal'd at setter exit (write-time
+            // notification — transitions/holds ride core machinery). Commit the
+            // backing only for keys whose nodes have committed; a still-pending
+            // node (transition-held) re-queues the target for the settling flush.
+            let e = false;
+            const r = t.pb;
+            const i = t.n;
+            if (i !== null) {
+                // Only written keys can hold (their nodes took the setSignal); the
+                // wk bound keeps this O(written) — see notifyWrites. Same fallback
+                // rules as the notify (WK_ALL / accessors / non-plain prototypes).
+                const n = t.wk;
+                const o = n === null || n === WK_ALL || t.a === true || !plainProto(t.ovl ? t.v : r) ? Reflect.ownKeys(i) : n;
+                for (const t of o) {
+                    const n = i[t];
+                    if (n !== undefined && n.Pe !== NOT_PENDING) {
+                        e = true;
+                        break;
+                    }
+                }
+            }
+            if (e) {
+                foldOlds.set(t, n);
+ // re-queue: commit happens when the hold settles
+                                continue;
+            }
+            if (t.ovl) {
+                // Overlay flatten (#3044): apply this batch's writes onto an OWNED
+                // committed backing in place — O(written), not O(container). The
+                // backing keeps its identity, so the `t.v === old` gate below skips
+                // path copying (the parent slot already points here) and the
+                // adopted-notify (setter notifications happened at write time).
+                // Unowned backings privatize first (clone once, parents re-slotted)
+                // — the never-mutate-user-data contract holds.
+                privatizeCommitted(t);
+                const e = t.v;
+                for (const t of Reflect.ownKeys(r)) {
+                    const n = Object.getOwnPropertyDescriptor(r, t);
+                    if (n.get || n.set || !n.enumerable || !n.writable || !n.configurable) Object.defineProperty(e, t, n); else e[t] = n.value;
+                }
+                if (t.del !== null) {
+                    for (const n of t.del) delete e[n];
+                    t.del = null;
+                }
+                (t.fam?.map ?? storeNextLookup).delete(r);
+                t.pb = null;
+                t.ovl = false;
+                t.wk = null;
+ // written-keys window closes with the fold commit
+                        } else {
+                t.v = r;
+                t.ch = false;
+ // pb is always a plain clone
+                                t.pb = null;
+                t.wk = null;
+ // written-keys window closes with the fold commit
+                        }
+        }
+        if (t.v === n) continue;
+ // adopted then re-adopted back, or no-op
+        // Path copying (CAS: see the eager-fold twin above).
+                if (t.u && t.u.v[t.pk] === n) {
+            privatizeCommitted(t.u);
+            devAssertNeverUserMutation(t.u.v);
+            t.u.v[t.pk] = t.v;
+        }
+        if (t.adopted) {
+            t.adopted = false;
+            notifyFold(t, n, t.v);
+        }
+    }
+}
+
+/**
+ * Setter-exit notification (write channel): diff the draft's pending backing
+ * against committed and setSignal every changed OBSERVED key — write-time
+ * notification with commit deferred to node commit, so transition holds,
+ * isPending, affects, and lane machinery ride the core natively (§3's
+ * "pending home = the node when a node exists"). Unobserved keys stay in the
+ * pending backing and fold directly at commit.
+ */
+/** Sentinel for `t.wk`: the written-keys bound is unusable this batch (an
+ * array length write implicitly deleted indices) — consumers full-scan. */ const WK_ALL = new Set;
+
+/** Plain-prototype check for the written-keys bound: prototype getters on
+ * class instances can derive from ANY field, so only plain-data containers
+ * may bound the notify to written keys. Overlay pbs chain to the COMMITTED
+ * object (#3044), so overlay plainness is judged on the committed proto. */ const plainProto = e => {
+    const t = Object.getPrototypeOf(e);
+    return t === Object.prototype || t === Array.prototype || t === null;
+};
+
+function notifyWrites(e) {
+    let t = e.pb;
+    if (t === null) return;
+    // Optimistic channel: user writes on an optimistic family become node-level
+    // engine writes (armed nodes route setSignal through optimisticWrite) — the
+    // committed backing is NEVER touched; the draft clone is discarded. Reverts,
+    // per-transaction ownership, and flash-at-flush are all core-native.
+    // Projection recompute writes (projectionWriteActive) and projection draft
+    // writes (write-override, incl. post-await async landings) are
+    // authoritative and take the plain channel below (they commit silently
+    // under overrides per the engine's no-revert-stash contract).
+        if (e.fam?.opt) {
+        if (!projectionWriteActive && !getWriteOverride()) {
+            optHooks.notifyOptimisticWrites(e, t);
+            return;
+        }
+        // Authoritative path on an optimistic family: armed nodes must commit
+        // silently (engine bypass) — without this, a landing's setSignals would
+        // create lanes and block their own transition's settle.
+                if (!projectionWriteActive) {
+            setProjectionWriteActive(true);
+            try {
+                notifyWrites(e);
+            } finally {
+                setProjectionWriteActive(false);
+            }
+            return;
+        }
+    }
+    const n = e.v;
+    const r = e.n;
+    // Written-keys bound: trap writes record their keys, so the notify visits
+    // O(written) nodes instead of every subscription on the record (a selection
+    // map with thousands of per-key subscribers pays two visits per select,
+    // not a full scan). Falls back to the full node scan when the bound can't
+    // hold: no trap granularity (wk null), an array length write (WK_ALL —
+    // implicit index deletes), accessors on the record (t.a — a getter node's
+    // value can change when ANY key is written), or a non-plain prototype.
+        const i = e.wk;
+    const o = i === WK_ALL || e.a === true || !plainProto(e.ovl ? e.v : t) ? null : i;
+    if (r !== null) {
+        const i = o ?? Reflect.ownKeys(r);
+        for (const o of i) {
+            const i = r[o];
+            if (i === undefined) continue;
+            // Per-key accessor handling: the node's cached flag plus ONE getter
+            // probe on the incoming side (getters arriving via merge/adoption).
+            // Setter-only props read as data (value undefined) so lookupSetter is
+            // not consulted on this hot path; prototype getters never own nodes.
+                        if (i.acc === true || hasOwn.call(t, o) && lookupGetter.call(t, o) !== undefined) {
+                i.acc = isOwnAccessor(t, o);
+                const e = Object.getOwnPropertyDescriptor(n, o);
+                const r = Object.getOwnPropertyDescriptor(t, o);
+                if (e && (e.get || e.set) || r && (r.get || r.set)) {
+                    if (e?.get !== r?.get || e?.set !== r?.set || e?.value !== r?.value) setSignal(i, () => FORCE);
+                    continue;
+                }
+                if (!isEqual(e?.value, r?.value)) setSignal(i, () => r?.value);
+                continue;
+            }
+            // No old-side pre-compare: t.v lags across multi-batch windows (a
+            // projection recompute can run before the prior fold commits) — the
+            // node's OWN current value is the true old side, and setSignal's
+            // internal equality already checks exactly that.
+                        const f = e.del !== null && e.del.has(o) ? undefined : t[o];
+            setSignal(i, () => f);
+        }
+    }
+    const f = e.h;
+    if (f !== null) {
+        for (const n of Reflect.ownKeys(f)) setSignal(f[n], n in t && !(e.del !== null && e.del.has(n)));
+    }
+    // Deep-witness (dk): setter writes must notify a deep() subscriber even on
+    // keys with no node. O(pb keys) equality only when a witness exists.
+        if (e.dk !== null) {
+        if (e.del !== null && e.del.size !== 0) bumpDeep(e); else for (const r of Reflect.ownKeys(t)) {
+            const i = t[r];
+            const o = n[r];
+            if (i !== null && typeof i === "object" ? !targetsEqual(o, i) : !isEqual(o, i)) {
+                bumpDeep(e);
+                break;
+            }
+        }
+    }
+    if (e.k !== null) {
+        let r;
+        if (e.ovl) {
+            // Overlay membership: only NEW own keys or deletes can change it.
+            r = e.del !== null && e.del.size !== 0;
+            if (!r) {
+                for (const e of Reflect.ownKeys(t)) {
+                    if (!hasOwn.call(n, e)) {
+                        r = true;
+                        break;
+                    }
+                }
+            }
+        } else {
+            r = Array.isArray(t) && Array.isArray(n) ? arrayStructureChanged(n, t) : membershipChanged(n, t);
+        }
+        if (r) setSignal(e.k, e => e + 1);
+    }
+    // Projection backing folds split by channel (two pinned contracts):
+    // - sync-derive drafts (recompute body): NEVER eager — a downstream async
+    //   hold can form LATER in the same flush and the leaf must stay at stale
+    //   committed for context-free readers (spec-async "pends only the written
+    //   leaf"). drainFolds commits when held-ness is knowable.
+    // - post-await async LANDINGS (write-override per-op, microtask context —
+    //   no enclosing flush can capture them): the data-level commit is
+    //   IMMEDIATE — landed truth shows to untracked readers even while a
+    //   downstream consumer's own async still holds the effect-level reveal
+    //   (spec-async "verdicts never inherit consumers' in-flight state").
+        if (e.fam !== null && e.pb !== null && getWriteOverride()) {
+        const n = e.v;
+        e.pb = null;
+        e.wk = null;
+ // written-keys window closes with the eager fold
+                e.v = t;
+        e.ch = false;
+        if (e.u && e.u.v[e.pk] === n) {
+            privatizeCommitted(e.u);
+            devAssertNeverUserMutation(e.u.v);
+            e.u.v[e.pk] = t;
+        }
+    }
+}
+
+const FORCE = Symbol();
+
+/** Same logical slot: both values resolve to one (re-pointed) child target —
+ * adoption preserved identity, so the slot did not change (R9). */ function targetsEqual(e, t) {
+    if (e === null || typeof e !== "object") return false;
+    const n = storeNextLookup.get(e);
+    return n !== undefined && n === storeNextLookup.get(t);
+}
+
+function arrayStructureChanged(e, t) {
+    if (e.length !== t.length) return true;
+    for (let n = 0; n < t.length; n++) {
+        const r = e[n];
+        const i = t[n];
+        if (!isEqual(r, i) && !targetsEqual(r, i)) return true;
+    }
+    return false;
+}
+
+function membershipChanged(e, t) {
+    const n = Reflect.ownKeys(t);
+    if (Reflect.ownKeys(e).length !== n.length) return true;
+    for (const t of n) if (!(t in e)) return true;
+    return false;
+}
+
+/**
+ * The fold diff walks SUBSCRIPTION KEYS ONLY (legacy parity: `for key in
+ * nodes`): nodes exist exactly where something tracked, so unobserved data
+ * costs nothing here regardless of object size. Accessor safety rides the
+ * sticky `t.a` flag — a node's key was necessarily read, so the get trap has
+ * already seen whether it is an accessor.
+ */
+/** One node's fold notification (shared by notifyFold's walk and the fused
+ * adoption walk): accessor-aware compare + equality/identity-gated setSignal. */ function notifyKeyDiff(e, t, n, r, 
+// The incoming-side getter probe covers SETTER-channel arrivals (return-
+// form merges, defineProperty) — those flow through notifyWrites/
+// notifyFold, which probe. The RECONCILE channel (fused walk) passes
+// false: reconcile adopts immutable data by contract (R2a) and the pinned
+// getter-preservation tests are all setter-channel; skipping ~2 Annex-B
+// calls per key per tick is a measured dbmon win.
+i = true) {
+    if (e.acc === true || i && hasOwn.call(r, t) && lookupGetter.call(r, t) !== undefined) {
+        e.acc = isOwnAccessor(r, t);
+        const i = Object.getOwnPropertyDescriptor(n, t);
+        const o = Object.getOwnPropertyDescriptor(r, t);
+        if (i && (i.get || i.set) || o && (o.get || o.set)) {
+            // Accessor involved: never invoke; force-notify on shape change so
+            // subscribers re-read (and re-track) through the trap.
+            if (i?.get !== o?.get || i?.set !== o?.set || i?.value !== o?.value) setSignal(e, () => FORCE);
+            return;
+        }
+        const f = i?.value;
+        const u = o?.value;
+        if (!isEqual(f, u) && !targetsEqual(f, u)) setSignal(e, typeof u === "function" ? () => u : u);
+    } else {
+        const i = n[t];
+        const o = r[t];
+        // Direct value write when not a function (setSignal treats functions as
+        // updaters) — saves a closure allocation per changed key on the fold
+        // hot path.
+                if (!isEqual(i, o) && !targetsEqual(i, o)) setSignal(e, typeof o === "function" ? () => o : o);
+    }
+}
+
+/** Accessor-flag probe for the fused walk's early-continue (accessor keys
+ * can never identity-skip: their VALUE is the descriptor's product). */ function hasAccessorFlag(e) {
+    return e.acc === true;
+}
+
+/** Fused-walk per-key notification with values already in hand: the caller
+ * fetched both sides and handled the identity skip; this applies the
+ * accessor branch (cached flag only — reconcile channel) or the plain
+ * equality/identity-gated write. */ function notifyKeyValue(e, t, n, r, i, o) {
+    if (e.acc === true) {
+        notifyKeyDiff(e, t, i, o, false);
+        return;
+    }
+    // The pre-compare is NOT redundant with the node's equals: setSignal parks
+    // a pending value and registers with the batch before equality applies at
+    // commit (RUL-1), so identity-preserved slots (adopted child containers —
+    // every row's fresh `queries` array) must be gated out HERE or each one
+    // pays the full write machinery every tick (measured: +0.5ms/tick dbmon).
+        if (!isEqual(n, r) && !targetsEqual(n, r)) setSignal(e, typeof r === "function" ? () => r : r);
+}
+
+/** Presence + membership halves of a fold notification (shared tail). */ function notifyFoldTail(e, t, n) {
+    const r = e.h;
+    if (r !== null) {
+        for (const e of Reflect.ownKeys(r)) setSignal(r[e], e in n);
+    }
+    if (e.k !== null) {
+        const r = Array.isArray(n) && Array.isArray(t) ? arrayStructureChanged(t, n) : membershipChanged(t, n);
+        if (r) setSignal(e.k, e => e + 1);
+    }
+}
+
+function notifyFold(e, t, n) {
+    if (e.dk !== null && t !== n) bumpDeep(e);
+    // Optimistic targets: adoption notifications are authoritative landings —
+    // bypass the engine (commit into _value; active overrides keep shadowing
+    // until their transaction settles, per the no-revert-stash contract).
+        if (e.fam?.opt && !projectionWriteActive) {
+        setProjectionWriteActive(true);
+        try {
+            notifyFold(e, t, n);
+        } finally {
+            setProjectionWriteActive(false);
+        }
+        return;
+    }
+    const r = e.n;
+    if (r !== null) {
+        for (const e of Reflect.ownKeys(r)) {
+            notifyKeyDiff(r[e], e, t, n);
+        }
+    }
+    const i = e.h;
+    if (i !== null) {
+        for (const e of Reflect.ownKeys(i)) setSignal(i[e], e in n);
+    }
+    if (e.k !== null) {
+        // Key-set/$TRACK: objects notify on membership; arrays on any index or
+        // length change (mapArray and iteration re-read values — R15).
+        const r = Array.isArray(n) && Array.isArray(t) ? arrayStructureChanged(t, n) : membershipChanged(t, n);
+        if (r) setSignal(e.k, e => e + 1);
+    }
+}
+
+// ---------------------------------------------------------------------------
+// traps
+/** >0 while inside a setter: writes allowed, reads are read-your-writes. */ let writing = 0;
+
+/** Write scope keys (a family object or a plain store's root target): draft
+ * semantics — write permission, read-your-writes, tracking suppression —
+ * apply ONLY to targets under a scope being written. Reads of OTHER stores
+ * inside a setter track normally (they are dependencies: a projection derive
+ * reading another store must link it). */ let writeScopes = null;
+
+function scopeKey(e) {
+    if (e.fam !== null) return e.fam;
+    let t = e;
+    while (t.u !== null) t = t.u;
+    return t;
+}
+
+function inDraft(e) {
+    return writeScopes !== null && writeScopes.has(scopeKey(e));
+}
+
+/** Shallow serve rule (#2932): raw-marked data serves VERBATIM, but a
+ * store-proxy slot value gets a boundary wrapper in THIS store's own family —
+ * write isolation through derived chains (downstream writes must never land
+ * upstream). markRawOne skips proxies for exactly this reason. */ function serveShallow(e, t, n) {
+    if (n !== null && typeof n === "object" && n[$TARGET] !== undefined) return draftServe(e, wrapNext(n, e, t));
+    return n;
+}
+
+/** Draft reads extend write permission to reachable stores (legacy Writing
+ * semantics: wrapping a child through a draft get admits it — cross-store
+ * writes like `s.inner.a = 10` work when `inner` is another store's proxy). */ function draftServe(e, t) {
+    if (writeScopes !== null && inDraft(e)) {
+        const e = t?.[$TARGET];
+        if (e !== undefined && e.v !== undefined) writeScopes.add(scopeKey(e));
+    }
+    return t;
+}
+
+/** Targets written during the current (outermost) setter — notified at exit. */ const pendingNotify = new Set;
+
+const UNSAFE_KEYS = new Set([ "__proto__", "prototype", "constructor" ]);
+
+/** Mirror of core read()'s context rule: the OWNER context (not the tracking
+ * observer) decides pending visibility, with Roots resolving to their parent
+ * computed (#2687 — untracked reads inside mapArray Roots see in-flight
+ * values mid-flush). CHILDREN_FORBIDDEN execution scopes (createTrackedEffect
+ * / onSettled callbacks) get COMMITTED visibility (#3006), same as core. */ function inOwnerContext() {
+    const e = getOwner();
+    if (e === null) return false;
+    const t = e.Ct ? e.Ot : e;
+    return t != null && !(t.T & CONFIG_CHILDREN_FORBIDDEN);
+}
+
+/** A pending fold is transition-held when any written node's parked value is
+ * stamped by a live transition (a plain batch parking — the lazy-recompute
+ * read case — has no transition stamp and serves fresh). */ function foldHeld(e) {
+    const t = e.n;
+    if (t === null) return false;
+    for (const e of Reflect.ownKeys(t)) {
+        const n = t[e];
+        if (n.Pe !== NOT_PENDING && n._e != null && n._e.an !== true) return true;
+    }
+    return false;
+}
+
+function readSource(e) {
+    // Signal-parity visibility (core read(): owner-context reads serve
+    // _pendingValue, context-free reads serve committed — effects recompute
+    // BEFORE commitPendingNodes in the flush, so the pending view must be
+    // servable). Drafts (setter window OR projection write-override) and
+    // owner-context reads see the pending backing; context-free reads see
+    // committed. Node reads apply the same rule, so both homes agree.
+    if (e.pb !== null && (inDraft(e) || getWriteOverride() || inOwnerContext() || 
+    // A projection's pending backing is authoritative-elect: serve it to
+    // context-free readers too UNLESS a transition is holding the node
+    // commits (downstream async hold — stale committed is the contract).
+    e.fam !== null && !foldHeld(e))) return e.pb;
+    return e.v;
+}
+
+const hasOwn = Object.prototype.hasOwnProperty;
+
+// Allocation-free own-accessor probe (replaces eager descriptor scans — the
+// single biggest creation cost in the uibench profile): Annex-B lookups
+// return the fn or undefined with no descriptor object. Own data properties
+// shadow prototype accessors, so hasOwn + lookup is an exact own-check.
+const lookupGetter = Object.prototype.__lookupGetter__;
+
+const lookupSetter = Object.prototype.__lookupSetter__;
+
+function isOwnAccessor(e, t) {
+    return hasOwn.call(e, t) && (lookupGetter.call(e, t) !== undefined || lookupSetter.call(e, t) !== undefined);
+}
+
+/** Authoritative-write wrapper exported for the optimistic module: sets the
+ * scheduler's projectionWriteActive through THIS module's binding (proven to
+ * share the instance core reads — cross-module live-binding writes from other
+ * store modules were observed not to propagate under the test transform). */ function runAuthoritative(e) {
+    const t = projectionWriteActive;
+    setProjectionWriteActive(true);
+    try {
+        return e();
+    } finally {
+        setProjectionWriteActive(t);
+    }
+}
+
+/** Active optimistic override on an armed node (armed slot idles at
+ * NOT_PENDING; undefined = unarmed plain node). */ function hasActiveOverride(e) {
+    return e.o?.De !== undefined && e.o?.De !== NOT_PENDING;
+}
+
+/** Context-aware node view for reads outside tracking: active override >
+ * held pending (owner context) > the BACKING value. Committed truth lives in
+ * the backing (single-home rule, O6) — node `_value` is never served here,
+ * so a lazy recompute's landing is immediately visible to the untracked
+ * reader that forced it (backing commits eagerly; node values fold at flush).
+ * FORCE sentinels never surface (they only bump subscribers of accessor
+ * keys, which are served by the trap, not the node). */ function nodeValue(e, t) {
+    const n = hasActiveOverride(e) ? unwrapOverride(e.o?.De) : e.Pe !== NOT_PENDING && inOwnerContext() ? e.Pe : t;
+    return n === FORCE ? t : n;
+}
+
+/** Serve an own data key: node-first when a node exists (pending visibility,
+ * holds, lanes ride the node); backing otherwise. Chained backings (§7b: the
+ * backing IS another store's proxy) serve the read-through value — the outer
+ * node is linked only for adoption-swap notification, its value never
+ * shadows the live chain. */ function serveDataKey(e, t, n, r, i) {
+    const o = e.ch && r === e.v;
+    let f = n;
+    // §6: on optimistic arrays LENGTH IS A VIEW, not a node value — one home
+    // (backing ± presence overrides) for both length and indices makes torn
+    // iteration impossible (a length node's value rides different visibility
+    // rails than index overrides mid-settle). The node still carries
+    // subscriptions; its value is never served here.
+        if (t === "length" && e.fam?.opt === true && !o && Array.isArray(r)) {
+        if (!inDraft(e)) {
+            const r = e.n?.length;
+            if (r !== undefined) {
+                if (getObserver() !== null) read(r);
+            } else if (getObserver() !== null) {
+                read(getNode(e, t, n));
+            }
+        }
+        return optHooks.optimisticView(e, r).length;
+    }
+    if (inDraft(e)) {
+        // Optimistic drafts before their first write have no pending backing yet;
+        // reads must still see the live optimistic view (compose, not clobber —
+        // #2951). Once ensurePB runs, the seeded clone carries the view.
+        if (e.fam?.opt && e.pb === null) {
+            const n = e.n?.[t];
+            if (n !== undefined && hasActiveOverride(n)) f = unwrapOverride(n.o?.De);
+        }
+    } else {
+        if (i !== undefined) {
+            // §7b: a lane value on the outer node SHADOWS read-through — an active
+            // override pierces the chained gate; otherwise chained backings always
+            // serve the live inner value.
+            if (getObserver() !== null) {
+                // read()'s plain-signal fast path hoisted over the call (legacy trap
+                // parity): READ_SLOW = a global read window or non-plain node.
+                let e = readNodeFast(i);
+                if (e === READ_SLOW) e = read(i);
+                if (!o || hasActiveOverride(i)) f = e === FORCE ? n : e;
+            } else if (!o || hasActiveOverride(i)) {
+                f = nodeValue(i, n);
+            }
+        } else if (getObserver() !== null) {
+            read(getNode(e, t, n));
+        }
+    }
+    // Shallow stores serve data raw; store-proxy slots get boundary wrappers.
+        if (e.s) return serveShallow(e, t, f);
+    if (i !== undefined) {
+        // Wrap cache (see getNode): only wrappables are ever cached, so a hit
+        // skips isWrappable too — pointer-compare replaces both checks.
+        if (i.pxv === f && f !== undefined) return draftServe(e, i.px);
+        if (!isWrappable(f)) return f;
+        const n = wrapNext(f, e, t);
+        i.px = n;
+        i.pxv = f;
+        return draftServe(e, n);
+    }
+    if (!isWrappable(f)) return f;
+    return draftServe(e, wrapNext(f, e, t));
+}
+
+/** §6c store-wide status gate for reads that DON'T flow through a node:
+ * untracked/raw fallthrough must still throw while the derive is
+ * uninitialized (seed invisibility, proj R23) or errored (memo parity).
+ * TRACKED reads never call this — store nodes carry `_firewall`, so core
+ * read() links the node and throws the firewall's error itself (the node
+ * link is what wakes async-memo readers when the landing writes values;
+ * the firewall link rides the same read). */ function firewallGate(e) {
+    // Own-draft ops are exempt: an async derive's continuation (generator body
+    // after an `await`/`yield`) runs OUTSIDE the sync write scope (inDraft is
+    // already false), but its draft-proxy traps mark every op with the write
+    // override. Those reads are the derive working its own draft (state.push
+    // reading .length) — gating them throws NotReadyError back into the derive
+    // itself, which the post-await read diagnostic (#2987) then escalates to a
+    // reactivity halt. The gate exists for EXTERNAL readers (seed invisibility,
+    // proj R23); the derive is the author.
+    if (projectionWriteActive || getWriteOverride()) return;
+    const t = e.fam?.node;
+    if (t != null && t.S & (STATUS_UNINITIALIZED | STATUS_ERROR)) read(t);
+}
+
+const traps = {
+    get(e, t, n) {
+        // One typeof gates every brand-symbol compare off the hot string path
+        // (four symbol comparisons per property read otherwise).
+        if (typeof t !== "string") {
+            if (t === $TARGET) return e;
+            if (t === $PROXY) return n;
+            // refresh()/isPending resolve the projection computed through $REFRESH.
+                        if (t === $REFRESH) return e.fam?.node ?? undefined;
+            if (t === $TRACK) {
+                if (pendingCheckActive) witnessAffectsMark(e, t);
+                if (e.fam !== null && getObserver() === null && !inDraft(e)) firewallGate(e);
+                if (!inDraft(e) && getObserver() !== null) {
+                    read(getKeySetNode(e));
+                    // Structural chaining (§7b, #2864 / core R21): a chained backing's
+                    // $TRACK reads through to the INNER store's key-set — structural
+                    // notifications land on the source's own node, never on this
+                    // wrapper view's.
+                                        const t = readSource(e);
+                    if (t[$TARGET] !== undefined) t[$TRACK];
+                }
+                return undefined;
+            }
+            // user symbols fall through to the generic path
+                }
+        if (pendingCheckActive) witnessAffectsMark(e, t);
+        if (e.fam !== null && getObserver() === null && !inDraft(e)) firewallGate(e);
+        const r = readSource(e);
+        // Overlay delete (#3044): a prototype overlay cannot shadow a delete, so
+        // deleted keys are tracked aside and read as absent in the pending view.
+                if (e.del !== null && r === e.pb && e.del.has(t)) {
+            if (!inDraft(e) && getObserver() !== null) read(getNode(e, t, undefined));
+            return undefined;
+        }
+        // Hot inline case: existing PLAIN node (non-accessor), unchained backing,
+        // tracked read of a present data key — the dbmon/uibench effect re-read
+        // shape. Skips serveDataKey's frame, the FORCE compare (only accessor
+        // keys ever hold the sentinel), and isWrappable for primitives.
+                if (e.ch === false && writeScopes === null) {
+            const n = e.n?.[t];
+            if (n !== undefined && n.acc !== true && getObserver() !== null) {
+                let r = readNodeFast(n);
+                if (r === READ_SLOW) r = read(n);
+                if (r === null || typeof r !== "object") return r;
+                if (e.s) return serveShallow(e, t, r);
+                if (n.pxv === r) return n.px;
+                if (isWrappable(r)) {
+                    const i = wrapNext(r, e, t);
+                    n.px = i;
+                    n.pxv = r;
+                    return i;
+                }
+                return r;
+            }
+        }
+        // Accessor keys serve through Reflect.get with the PROXY receiver
+        // (R20/R29: internal reads track; the node is linked for shape-change
+        // notification but its value is never served). Accessor-ness comes from
+        // the node's cached flag; the first TRACKED read (which creates the
+        // node) probes once — untracked node-less reads take the plain path,
+        // where a raw-receiver getter still returns correct committed values.
+        // Tracking suppression is PER-TARGET (inDraft), never global: `writing`
+        // counts every open setter anywhere, and a projection derive runs its
+        // whole body inside one — a global gate silently swallowed EXTERNAL
+        // absent-key/accessor subscriptions for every store read during any
+        // derive, leaving nested projections permanently dependency-less when
+        // their sources hadn't materialized yet (#3037).
+                const i = e.n?.[t];
+        {
+            const o = i !== undefined ? i.acc === true : !inDraft(e) && getObserver() !== null && isOwnAccessor(r, t);
+            if (o) {
+                if (!inDraft(e) && getObserver() !== null) read(i ?? getNode(e, t, undefined));
+                const o = Reflect.get(r, t, n);
+                if (e.s) return serveShallow(e, t, o);
+                return isWrappable(o) ? draftServe(e, wrapNext(o, e, t)) : o;
+            }
+        }
+        // Plain-data fast path: no descriptor allocation per read.
+        // Inherited pollution keys are never served (core R30) — checked before
+        // the proto-function branch can leak `constructor`. Interned-string
+        // compares beat a Set hash on this per-read path. Overlay pending
+        // backings chain to the committed backing, so "own in the view" means
+        // own on either layer (ownInView) — a genuine prototype method is one
+        // that is own on NEITHER.
+                const o = e.ovl && r === e.pb;
+        if ((t === "constructor" || t === "__proto__" || t === "prototype") && !hasOwn.call(r, t) && !(o && hasOwn.call(e.v, t))) return undefined;
+        let f = r[t];
+        if (f === undefined ? !hasOwn.call(r, t) && !(o && hasOwn.call(e.v, t)) : false) {
+            // Inherited: prototype getters/methods run with the proxy receiver.
+            f = Reflect.get(r, t, n);
+            if (typeof f === "function") return f;
+ // proto methods untracked
+            // Reading a currently-absent own key subscribes to it (R12) — for any
+            // target OUTSIDE its own draft scope, even mid-setter (#3037, above).
+                        if (f === undefined && !inDraft(e)) {
+                if (getObserver() !== null) read(getNode(e, t, undefined));
+                const n = e.n?.[t];
+                if (n) {
+                    const r = nodeValue(n, undefined);
+                    if (e.s) return serveShallow(e, t, r);
+                    return isWrappable(r) ? draftServe(e, wrapNext(r, e, t)) : r;
+                }
+            } else if (f === undefined && inDraft(e) && e.fam?.opt && e.pb === null) {
+                const n = e.n?.[t];
+                if (n !== undefined && hasActiveOverride(n)) f = unwrapOverride(n.o?.De);
+            }
+            if (e.s) return serveShallow(e, t, f);
+            return isWrappable(f) ? draftServe(e, wrapNext(f, e, t)) : f;
+        }
+        if (typeof f === "function" && !hasOwn.call(r, t) && !(o && hasOwn.call(e.v, t))) return f;
+ // proto method
+                return serveDataKey(e, t, f, r, i);
+    },
+    has(e, t) {
+        if (t === $TARGET || t === $PROXY || t === $TRACK) return true;
+        if (pendingCheckActive) witnessAffectsMark(e, t);
+        if (e.fam !== null && getObserver() === null && !inDraft(e)) firewallGate(e);
+        const n = readSource(e);
+        let r = t in n;
+        // Overlay deletes read as absent in the pending view (#3044).
+                if (r && e.del !== null && n === e.pb && e.del.has(t)) r = false;
+        if (!inDraft(e)) {
+            if (getObserver() !== null) {
+                const n = getHasNode(e, t, r);
+                const i = read(n);
+                if (hasActiveOverride(n)) r = !!i;
+            } else {
+                const n = e.h?.[t];
+                if (n !== undefined && hasActiveOverride(n)) r = !!unwrapOverride(n.o?.De);
+            }
+        } else if (e.fam?.opt && e.pb === null) {
+            const n = e.h?.[t];
+            if (n !== undefined && hasActiveOverride(n)) r = !!unwrapOverride(n.o?.De);
+        }
+        return r;
+    },
+    ownKeys(e) {
+        if (pendingCheckActive) witnessAffectsMark(e);
+        if (e.fam !== null && getObserver() === null && !inDraft(e)) firewallGate(e);
+        if (!inDraft(e) && getObserver() !== null) read(getKeySetNode(e));
+        const t = readSource(e);
+        let n;
+        if (e.ovl && t === e.pb) {
+            // Overlay merge (#3044): committed keys in their order, then this
+            // batch's NEW keys, minus deletes.
+            n = Reflect.ownKeys(e.v);
+            const r = e.del;
+            if (r !== null && r.size !== 0) n = n.filter(e => !r.has(e));
+            for (const r of Reflect.ownKeys(t)) {
+                if (!hasOwn.call(e.v, r)) n.push(r);
+            }
+        } else n = Reflect.ownKeys(t);
+        // Optimistic membership overlay: presence-node overrides add/remove keys
+        // (per-transaction lifecycle rides the nodes — §6, FINDING-2's fix).
+        // Draft reads before the first write overlay too (pb, once created, is
+        // seeded with the view).
+                if (e.fam?.opt && e.h !== null && (!inDraft(e) || e.pb === null)) {
+            let t = null;
+            for (const r of Reflect.ownKeys(e.h)) {
+                const i = e.h[r];
+                if (!hasActiveOverride(i)) continue;
+                t ??= new Set(n);
+                if (unwrapOverride(i.o?.De)) t.add(r); else t.delete(r);
+            }
+            if (t !== null) return [ ...t ];
+        }
+        return n;
+    },
+    getOwnPropertyDescriptor(e, t) {
+        const n = readSource(e);
+        let r = Object.getOwnPropertyDescriptor(n, t);
+        // Overlay (#3044): unwritten keys live on the committed backing;
+        // deleted keys are absent from the pending view.
+                if (e.ovl && n === e.pb) {
+            if (e.del !== null && e.del.has(t)) return undefined;
+            if (r === undefined) r = Object.getOwnPropertyDescriptor(e.v, t);
+        }
+        if (e.fam?.opt && !inDraft(e)) {
+            const n = e.h?.[t];
+            if (n !== undefined && hasActiveOverride(n)) {
+                if (!unwrapOverride(n.o?.De)) return undefined;
+ // opt delete
+                                if (r === undefined) {
+                    const n = e.n?.[t];
+                    return {
+                        value: n !== undefined ? nodeValue(n, undefined) : undefined,
+                        writable: true,
+                        enumerable: true,
+                        configurable: true
+                    };
+                }
+            }
+        }
+        if (r === undefined) return undefined;
+        // Array targets carry a real non-configurable `length` the proxy
+        // invariant forces us to report faithfully; everything else reports
+        // configurable via target indirection (core R51).
+                if (!(t === "length" && Array.isArray(e))) r.configurable = true;
+        return r;
+    },
+    set(e, t, n) {
+        // Writes require the target's draft scope OR the projection write
+        // override (post-await async draft writes arrive outside any window);
+        // everything else is silently ignored (R23).
+        const r = inDraft(e);
+        const i = !r && getWriteOverride();
+        if (!r && !i) return true;
+        if (t === "__proto__") return true;
+ // pollution guard (core R30)
+        // Unwrap BEFORE ensurePB: unwrapValue materializes a self-referencing
+        // draft's overlay (replacing target.pb), so a pb local captured earlier
+        // would be the abandoned overlay and the write would vanish.
+        // Shallow slots store what was written VERBATIM — another store's proxy
+        // passes through by reference (#2932; markRawOne skips proxies), while
+        // deep stores unwrap to raw backings.
+                const o = e.s ? n : unwrapValue(n);
+        const f = ensurePB(e);
+        pendingNotify.add(e);
+        // Array length writes implicitly delete indices — the written-keys bound
+        // can't see them, so poison to the full scan for this batch. Index
+        // writes implicitly GROW length, so arrays always record it alongside.
+                if (Array.isArray(f)) {
+            if (t === "length") e.wk = WK_ALL; else if (e.wk !== WK_ALL) {
+                const n = e.wk ??= new Set;
+                n.add(t);
+                n.add("length");
+            }
+        } else if (e.wk !== WK_ALL) (e.wk ??= new Set).add(t);
+        // Own data keys literally named "prototype"/"constructor" land as data —
+        // defineProperty sidesteps a proto-chain setter named the same.
+                if (UNSAFE_KEYS.has(t)) {
+            Object.defineProperty(f, t, {
+                value: o,
+                writable: true,
+                enumerable: true,
+                configurable: true
+            });
+            if (e.del !== null) e.del.delete(t);
+            return true;
+        }
+        // Overlay first-write DEFINES the own key: assignment through the proto
+        // chain would reject on a non-writable committed property (the clone
+        // path normalized descriptors for exactly this — R51 parity).
+                if (e.ovl && !hasOwn.call(f, t)) {
+            Object.defineProperty(f, t, {
+                value: o,
+                writable: true,
+                enumerable: true,
+                configurable: true
+            });
+        } else f[t] = o;
+        if (e.del !== null) e.del.delete(t);
+        // Shallow ingest: written records are sticky raw-marked (one entity is
+        // never both deep-wrapped and raw — R41/#2932, shared invariant).
+                if (e.s && o !== null && typeof o === "object") markRawOne(o);
+        // Override-mode (post-await draft) writes have no setter exit — notify
+        // per-op (setSignal equality-gates repeats).
+                if (i) notifyWrites(e);
+        return true;
+    },
+    defineProperty(e, t, n) {
+        const r = inDraft(e);
+        const i = !r && getWriteOverride();
+        if (!r && !i) return true;
+        if (t === "__proto__") return true;
+        if (n.get || n.set) e.a = true;
+        // Unwrap before ensurePB (see the set trap: self-reference materializes).
+                if ("value" in n) n = {
+            ...n,
+            value: unwrapValue(n.value)
+        };
+        const o = ensurePB(e);
+        pendingNotify.add(e);
+        if (e.wk !== WK_ALL) (e.wk ??= new Set).add(t);
+        Object.defineProperty(o, t, n);
+        if (e.del !== null) e.del.delete(t);
+        if (i) notifyWrites(e);
+        return true;
+    },
+    deleteProperty(e, t) {
+        const n = inDraft(e);
+        const r = !n && getWriteOverride();
+        if (!n && !r) return true;
+        const i = ensurePB(e);
+        pendingNotify.add(e);
+        if (e.wk !== WK_ALL) (e.wk ??= new Set).add(t);
+        delete i[t];
+        // A prototype overlay cannot shadow a delete of a committed key —
+        // record it aside (#3044); reads/has/ownKeys/commit consult the set.
+                if (e.ovl && hasOwn.call(e.v, t)) (e.del ??= new Set).add(t);
+        if (r) notifyWrites(e);
+        return true;
+    }
+};
+
+/** Low-level setter primitive: opens write mode on a next proxy, runs `fn`,
+ * emits write-time notifications at outermost exit, applies returned
+ * replacements as adoptions. `guard=false` skips the owned-scope dev guard —
+ * projection recomputes legitimately write from inside their computed. */ function storeSetterNext(e, t, n = true) {
+    const r = e[$TARGET];
+    const i = writeScopes;
+    writeScopes = new Set;
+    writeScopes.add(scopeKey(r));
+    writing++;
+    let o;
+    try {
+        // No untrack: the writing flag already disables store-node linking
+        // (draft reads never self-track, proj R2), while EXTERNAL reads (signals
+        // inside a projection derive) must keep tracking — they are the derive's
+        // dependencies.
+        o = t(e);
+    } finally {
+        writing--;
+        writeScopes = i;
+        // Outermost setter exit: emit write-time notifications (setSignal per
+        // changed observed key) so transition holds and lanes engage now.
+                if (writing === 0 && pendingNotify.size) {
+            const e = [ ...pendingNotify ];
+            pendingNotify.clear();
+            for (const t of e) notifyWrites(t);
+        }
+    }
+    if (o !== undefined && o !== e && isWrappable(o)) {
+        // Returned replacement: on an optimistic family (outside authoritative
+        // writes) the replacement is itself an optimistic edit — diff it against
+        // the visible view as engine writes (reverts at settle). Otherwise it is
+        // an adoption of the incoming object (unowned).
+        if (r.fam?.opt && !projectionWriteActive && !getWriteOverride()) {
+            optHooks.notifyOptimisticWrites(r, unwrapValue(o));
+        } else {
+            adoptPB(r, unwrapValue(o));
+        }
+    }
+}
+
+// Affects integration: the legacy affects machinery reads next targets
+// structurally (aliased field names); only node CREATION dispatches here.
+setNextAffectsNodeResolver((e, t) => t === $AFFECTS ? getNode(e, $AFFECTS, undefined) : getNode(e, t, (e.pb ?? e.v)[t]));
+
+function createStoreNext(e, t = false) {
+    const n = wrapNext(e);
+    if (t) {
+        n[$TARGET].s = true;
+        markRawIngest(e);
+    }
+    const setter = e => storeSetterNext(n, e);
+    return [ n, setter ];
+}
+
+/** Tracking deep snapshot (`deep()` for next targets): subscribes to the
+ * key-set and every property node at every reachable level, then returns the
+ * plain view. Shared references and cycles handled via the visited set. */ function deepNext(e) {
+    const t = e?.[$TARGET];
+    if (t === undefined || t.px !== e) return e;
+    const n = new Set;
+    // One membership node + one deep-witness node PER RECORD (legacy $TRACK
+    // parity): the walk stays O(records) in subscriptions instead of O(paths)
+    // in per-key nodes, and it walks TARGETS directly — no per-child proxy
+    // round-trip (wrapNext → proxy → $TARGET trap) on the re-walk every
+    // effect run performs.
+        const walkT = e => {
+        const t = readSource(e);
+        if (n.has(t)) return;
+        n.add(t);
+        read(getKeySetNode(e));
+        read(getDeepNode(e));
+        const r = e.fam?.map ?? storeNextLookup;
+        for (const n of Reflect.ownKeys(t)) {
+            const i = Object.getOwnPropertyDescriptor(t, n);
+            if (i === undefined) continue;
+            if (i.get || i.set) {
+                e.a = true;
+                continue;
+ // accessors track through their own reads when invoked
+                        }
+            const o = i.value;
+            if (o === null || typeof o !== "object") continue;
+            // Stored proxies (chained slots) resolve through their own target;
+            // raw children through the family map, created on first visit.
+                        let f = o[$TARGET] ?? r.get(o);
+            if (f === undefined) {
+                if (!isWrappable(o)) continue;
+                wrapNext(o, e, n);
+                f = r.get(o);
+                if (f === undefined) continue;
+ // raw-marked: leaf by contract
+                        }
+            walkT(f);
+        }
+    };
+    walkT(t);
+    return snapshotNext(e);
+}
+
+/**
+ * Snapshot with per-object registration resolution (RUL-12 DAG ruling): every
+ * reachable wrappable resolves through its target's CURRENT backing, so
+ * privatized subtrees are seen through any parent path. Identity-preserving:
+ * a subtree with no substitutions below returns its own object (zero copy for
+ * settled, never-diverged graphs).
+ */ function snapshotNext(e) {
+    const t = e?.[$TARGET];
+    return snapshotWalk(e, new Map, t?.fam ?? null);
+}
+
+function snapshotWalk(e, t, n) {
+    if (e === null || typeof e !== "object") return e;
+    // Resolve through the registration: proxies AND raws map to their target's
+    // current backing (stale raw pointers through other parents resolve here).
+    // Loops for chained backings (§7b: a projection's backing can be another
+    // store's proxy — snapshot unwraps to the base raw).
+        let r = e;
+    // Chained backings can pass through several targets; optimistic overrides
+    // on OUTER targets shadow the chain (§7b), so collect every opt target
+    // encountered and compose their views over the resolved base, innermost
+    // outward.
+        let i = null;
+    for (;;) {
+        let e = r?.[$TARGET]?.v !== undefined ? r[$TARGET] : undefined;
+        if (e === undefined && n !== null) e = n.map.get(r);
+        if (e === undefined) e = storeNextLookup.get(r);
+        if (e === undefined) break;
+        if (e.fam !== null) n = e.fam;
+        if (e.fam?.opt === true) (i ??= []).push(e);
+        // Snapshot runs mid-flush (tracked memos execute before commit), so a
+        // pending prototype overlay must present as a REAL merged container.
+                if (e.ovl) materializePB(e);
+        const t = e.pb ?? e.v;
+        if (t === r) break;
+        r = t;
+    }
+    if (!isWrappable(r)) return r;
+    // Optimistic families: compose the visible view; a composed view is a fresh
+    // object and snapshots via the owned/copy path (pinned `not.toBe` identity).
+        if (i !== null) {
+        let e = r;
+        for (let t = i.length - 1; t >= 0; t--) e = optHooks.optimisticView(i[t], e);
+        if (e !== r) {
+            const i = t.get(r);
+            if (i !== undefined) return i;
+            const o = Array.isArray(e);
+            const f = o ? [] : Object.create(Object.getPrototypeOf(e));
+            t.set(r, f);
+            for (const r of Reflect.ownKeys(e)) {
+                if (o && r === "length") continue;
+                const i = e[r];
+                f[r] = i !== null && typeof i === "object" ? snapshotWalk(i, t, n) : i;
+            }
+            if (o) f.length = e.length;
+            return f;
+        }
+    }
+    const o = t.get(r);
+    if (o !== undefined) return o;
+    // OWNED (written) subtrees snapshot as copies (§7b: identity is only for
+    // subtrees "unmodified relative to source"): non-enumerable symbols are
+    // excluded (recon-snap R29), and the copy registers BEFORE descent so
+    // cycles keep identity (FINDING-3).
+        if (ownedRaw.has(r)) {
+        const e = Array.isArray(r);
+        const i = e ? [] : Object.create(Object.getPrototypeOf(r));
+        t.set(r, i);
+        for (const o of Reflect.ownKeys(r)) {
+            if (e && o === "length") continue;
+            const f = Object.getOwnPropertyDescriptor(r, o);
+            if (typeof o === "symbol" && !f.enumerable) continue;
+            if (f.get || f.set) {
+                Object.defineProperty(i, o, f);
+                continue;
+            }
+            const u = f.value;
+            const l = u !== null && typeof u === "object" ? snapshotWalk(u, t, n) : u;
+            if (f.enumerable && f.writable && f.configurable) i[o] = l; else Object.defineProperty(i, o, {
+                ...f,
+                value: l
+            });
+        }
+        if (e && i.length !== r.length) i.length = r.length;
+        return i;
+    }
+    // UNOWNED (shared/user) subtrees keep identity unless a descendant
+    // substituted; copy-on-substitution preserves the documented CoW contract.
+        t.set(r, r);
+    let f = null;
+    for (const e of Reflect.ownKeys(r)) {
+        const i = Object.getOwnPropertyDescriptor(r, e);
+        if (!i || i.get || i.set) continue;
+        const o = i.value;
+        if (o === null || typeof o !== "object") continue;
+        const u = snapshotWalk(o, t, n);
+        if (u !== o) {
+            if (f === null) {
+                f = Array.isArray(r) ? [ ...r ] : Object.create(Object.getPrototypeOf(r), Object.getOwnPropertyDescriptors(r));
+                t.set(r, f);
+            }
+            f[e] = u;
+        }
+    }
+    return f ?? r;
+}
+
+export { adoptPB, bumpDeep, createStoreNext, deepNext, getHasNode, getKeySetNode, getNode, hasAccessorFlag, hasActiveOverride, materializePB, notifyFold, notifyFoldTail, notifyKeyDiff, notifyKeyValue, runAuthoritative, snapshotNext, storeSetterNext, targetsEqual, unwrapValue, wrapNext };