@solidjs/signals 2.0.0-rc.14 → 2.0.0-rc.15

package/dist/dev.js

@@ -10,27 +10,27 @@ import {
   b as CONFIG_VERDICT,
   c as REACTIVE_PROBE_UNANSWERED,
   d as blocked,
-  e as enqueueSub,
+  e as REACTIVE_LANE_DIRTY,
+  f as enqueueSub,
   r as resolveTx,
-  f as CONFIG_AUTHORITATIVE,
+  g as CONFIG_AUTHORITATIVE,
   t as txOf,
-  g as tracking,
-  h as CONFIG_CHILDREN_FORBIDDEN,
+  h as tracking,
+  i as CONFIG_CHILDREN_FORBIDDEN,
   p as passLane,
   S as STATUS_PENDING,
   E as EFFECT_RENDER,
-  i as sameLane,
-  j as CONFIG_HELD,
-  k as flushTransaction,
-  l as STATUS_UNINITIALIZED,
-  m as NotReadyError,
-  o as REACTIVE_SCREEN_READ,
-  u as REACTIVE_FRAME_READ,
-  v as REACTIVE_LANE_READ,
-  w as ext,
-  x as REACTIVE_RECOMPUTING_DEPS,
-  y as queuePendingNode,
-  z as REACTIVE_LANE_DIRTY,
+  j as sameLane,
+  k as CONFIG_HELD,
+  l as flushTransaction,
+  m as STATUS_UNINITIALIZED,
+  o as NotReadyError,
+  u as REACTIVE_SCREEN_READ,
+  v as REACTIVE_FRAME_READ,
+  w as REACTIVE_LANE_READ,
+  x as ext,
+  y as REACTIVE_RECOMPUTING_DEPS,
+  z as queuePendingNode,
   A as list,
   B as clock,
   D as insertSubs,
@@ -43,119 +43,123 @@ import {
   M as ownFlights,
   O as setPassLane,
   P as REACTIVE_JOINED,
-  Q as stagedRead,
-  T as attrHooks,
-  U as holdNode,
-  V as joinFuture,
-  W as CONFIG_SLOT_NODE,
-  X as commitPendingNode,
-  Y as REACTIVE_IN_HEAP,
-  Z as REACTIVE_DIRTY,
-  _ as REACTIVE_CHECK,
-  $ as CONFIG_INPUTS_PUBLISHED,
-  a0 as setVerdict,
-  a1 as context,
-  a2 as REACTIVE_PROBED,
-  a3 as globalQueue,
-  a4 as staleReader,
-  a5 as REACTIVE_STAGED_READ,
-  a6 as verdict,
-  a7 as link,
-  a8 as pullComputed,
-  a9 as strictRead,
-  aa as warnStrictReadUntracked,
-  ab as markLateLinker,
-  ac as spectating,
-  ad as STATUS_ERROR,
-  ae as unflushedValue,
-  af as stagedReaders,
-  ag as enterAction,
-  ah as setEffectCallback,
-  ai as exitAction,
-  aj as isThenable,
-  ak as actionDepth,
-  al as flush,
-  am as setQuestion,
-  an as emitDiagnostic,
-  ao as enterCallback,
-  ap as exitCallback,
-  aq as getOwner,
-  ar as inEffectCallback,
-  as as signal,
-  at as setSignal,
-  au as cleanup,
-  av as read,
-  aw as NoOwnerError,
-  ax as ContextNotFoundError,
-  ay as createEffectNode,
-  az as recompute,
-  aA as EFFECT_USER,
-  aB as reportDiagnostic,
-  aC as computed,
-  aD as staleValues,
-  aE as CONFIG_AUTO_DISPOSE,
-  aF as EFFECT_TRACKED,
-  aG as unwrapStatusError,
-  aH as haltReactivity,
-  aI as setStrictRead,
-  aJ as StatusError,
-  aK as trimStaleDeps,
-  aL as setTrackedQueueCallback,
-  aM as setEffectStatusNotify,
-  aN as _hitUnhandledAsync,
-  aO as resetUnhandledAsync,
-  aP as ROOT_ERROR_HOOK,
-  aQ as registerGraph,
-  aR as runWithOwner,
-  aS as setMemo,
-  aT as $REFRESH,
-  aU as markRefresh,
-  aV as createRoot,
-  aW as getObserver,
-  aX as dispose,
-  aY as TimeoutError,
-  aZ as untrack,
-  a_ as dirtyQueue,
-  a$ as CONFIG_REDERIVE,
-  b0 as passTx,
-  b1 as CONFIG_FRESH_READ,
-  b2 as createOwner,
-  b3 as REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE,
-  b4 as ownedScopeWriteMessage,
-  b5 as DEV$1,
-  b6 as isEqual,
-  b7 as CONFIG_MANUAL_WRITE,
-  b8 as notePromotedWrite,
-  b9 as slotSignal,
-  ba as stagedScreen,
-  bb as CONFIG_PROMOTED,
-  bc as setSlotUnobserved,
-  bd as joinPassTx,
-  be as asyncTailFlights,
-  bf as untrackDepth,
-  bg as checkPostAwaitRead,
-  bh as insertIntoHeap,
-  bi as isDisposed,
-  bj as handleAsync,
-  bk as addPendingSource,
-  bl as propagateStatus,
-  bm as forEachDependent,
-  bn as settlePendingSource,
-  bo as notifyEpoch,
-  bp as SUPPORTS_PROXY,
-  bq as REACTIVE_ZOMBIE,
-  br as OBSERVE$1
+  Q as REACTIVE_STAGED_READ,
+  T as stagedRead,
+  U as CONFIG_SLOT_NODE,
+  V as attrHooks,
+  W as holdNode,
+  X as joinFuture,
+  Y as commitPendingNode,
+  Z as REACTIVE_IN_HEAP,
+  _ as REACTIVE_DIRTY,
+  $ as REACTIVE_CHECK,
+  a0 as CONFIG_INPUTS_PUBLISHED,
+  a1 as setVerdict,
+  a2 as context,
+  a3 as REACTIVE_PROBED,
+  a4 as bornInto,
+  a5 as globalQueue,
+  a6 as staleReader,
+  a7 as verdict,
+  a8 as link,
+  a9 as pullComputed,
+  aa as strictRead,
+  ab as warnStrictReadUntracked,
+  ac as joinPass,
+  ad as markLateLinker,
+  ae as spectating,
+  af as STATUS_ERROR,
+  ag as unflushedValue,
+  ah as stagedReaders,
+  ai as enterAction,
+  aj as setEffectCallback,
+  ak as exitAction,
+  al as isThenable,
+  am as actionDepth,
+  an as flush,
+  ao as setQuestion,
+  ap as emitDiagnostic,
+  aq as enterCallback,
+  ar as exitCallback,
+  as as getOwner,
+  at as inEffectCallback,
+  au as signal,
+  av as setSignal,
+  aw as cleanup,
+  ax as read,
+  ay as NoOwnerError,
+  az as ContextNotFoundError,
+  aA as createEffectNode,
+  aB as recompute,
+  aC as EFFECT_USER,
+  aD as reportDiagnostic,
+  aE as computed,
+  aF as staleValues,
+  aG as CONFIG_AUTO_DISPOSE,
+  aH as EFFECT_TRACKED,
+  aI as unwrapStatusError,
+  aJ as haltReactivity,
+  aK as setStrictRead,
+  aL as StatusError,
+  aM as trimStaleDeps,
+  aN as setTrackedQueueCallback,
+  aO as setEffectStatusNotify,
+  aP as _hitUnhandledAsync,
+  aQ as resetUnhandledAsync,
+  aR as ROOT_ERROR_HOOK,
+  aS as registerGraph,
+  aT as runWithOwner,
+  aU as setMemo,
+  aV as $REFRESH,
+  aW as markRefresh,
+  aX as createRoot,
+  aY as getObserver,
+  aZ as dispose,
+  a_ as TimeoutError,
+  a$ as untrack,
+  b0 as dirtyQueue,
+  b1 as CONFIG_REDERIVE,
+  b2 as passTx,
+  b3 as CONFIG_FRESH_READ,
+  b4 as createOwner,
+  b5 as REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE,
+  b6 as ownedScopeWriteMessage,
+  b7 as DEV$1,
+  b8 as isEqual,
+  b9 as CONFIG_MANUAL_WRITE,
+  ba as snapshotCaptureActive,
+  bb as captureWriteSnapshot,
+  bc as notePromotedWrite,
+  bd as slotSignal,
+  be as stagedScreen,
+  bf as CONFIG_PROMOTED,
+  bg as setSlotUnobserved,
+  bh as joinPassTx,
+  bi as asyncTailFlights,
+  bj as untrackDepth,
+  bk as checkPostAwaitRead,
+  bl as insertIntoHeap,
+  bm as isDisposed,
+  bn as handleAsync,
+  bo as addPendingSource,
+  bp as propagateStatus,
+  bq as forEachDependent,
+  br as settlePendingSource,
+  bs as notifyEpoch,
+  bt as SUPPORTS_PROXY,
+  bu as REACTIVE_ZOMBIE,
+  bv as OBSERVE$1
 } from "./dev-shared.js";
 export {
-  bs as clearSnapshots,
-  bt as enforceLoadingBoundary,
-  bu as getNextChildId,
-  bv as markSnapshotScope,
-  bw as peekNextChildId,
-  bx as releaseSnapshotScope,
-  by as resetErrorHalt,
-  bz as setConsoleFooter,
-  bA as setSnapshotCapture
+  bw as clearSnapshots,
+  bx as enforceLoadingBoundary,
+  by as getNextChildId,
+  bz as markSnapshotScope,
+  bA as peekNextChildId,
+  bB as releaseSnapshotScope,
+  bC as resetErrorHalt,
+  bD as setConsoleFooter,
+  bE as setSnapshotCapture
 } from "./dev-shared.js";
 
 // Lanes (plan sec. 28 replay, 2026-10-02; maintainer rulings 2026-10-01/02). A lane
@@ -190,6 +194,8 @@ export {
 // carries none of this.
 /** Live lanes (parented). Scanned at every seam while non-empty. */
 const lanes = [];
+/** A pass left a shown slot the equality gate can no longer see (#3892). */
+const LEFT_SHOWN = 1 << 20;
 function newLane(parent) {
   const l = newTransaction(true, parent);
   lanes.push(l);
@@ -326,8 +332,10 @@ function enterLane(l, c) {
     // The pass read a held write before its first lane read (it joined the
     // frame's future as mainline would): lane work sees the screen — the
     // seam re-derives it on the committed world next round (`stagedReaders`,
-    // the park's repair), as it does a lane pass that read a staging.
-    if (c._flags & REACTIVE_JOINED) stagedRead(c);
+    // the park's repair), as it does a lane pass that read a staging. Not a
+    // pass whose held reads were all of nodes born held (no staged read,
+    // `stagedRead`): it has no committed world to re-derive on (#3969).
+    if (c._flags & REACTIVE_JOINED && c._flags & REACTIVE_STAGED_READ) stagedRead(c);
     return;
   }
   if (sameLane(p, l)) return setPassLane(l);
@@ -402,17 +410,22 @@ function verdictLane(t) {
  * propagation (async.ts `propagateStatus`), the node gone pending. */
 function laneStage(el, l, create, errored) {
   if (!(create || errored || el._flags & REACTIVE_LANE_READ || el._config & CONFIG_GUESS)) {
-    if (el._x !== null) {
-      if (el._x._transaction?._lane) el._x._transaction = null;
-      el._x._lane = NOT_PENDING;
-    }
-    el._config &= -2305;
+    const x = el._x;
+    if (x !== null) {
+      const tx = x._transaction;
+      // Cleared before equality, so a return to the committed value notifies
+      // nobody. The seam wakes it unless the frame is still held (#3892).
+      if (tx?._shown && !blocked(resolveTx(tx._parent))) el._flags |= LEFT_SHOWN;
+      if (tx?._lane) x._transaction = null;
+      x._lane = NOT_PENDING;
+    }
+    el._config &= -1050881;
     return false;
   }
   if (!el._type) {
     if (!(el._config & CONFIG_OVERRIDE)) {
       el._pendingValue = NOT_PENDING;
-      el._config = (el._config & ~CONFIG_HELD) | CONFIG_OVERRIDE;
+      el._config = (el._config & -1048833) | CONFIG_OVERRIDE;
       ext(el);
     }
     // A written guess whose own pass is the lane's work — its source is a
@@ -464,6 +477,11 @@ function supersede(n, value, changed) {
   // lane opened (two actions guessing one slot entangle, A34 (1)) — the
   // truth is held by the transaction that lands, not the merged-away one.
   const parent = resolveTx(l._parent ?? l);
+  // A store row answered by a new object the store would reconcile into
+  // the guessed one unchanged is an echo, not a correction (#3898): the
+  // server's object never matches the guess by reference.
+  if (changed && n._config & CONFIG_SLOT_NODE && GlobalQueue._echoes?.(n._x._lane, value))
+    changed = false;
   if (changed) {
     // Observe: a displayed guess is being replaced by a differing truth — a
     // landing's (superseded), or the value it covered (reverted: the body
@@ -476,17 +494,46 @@ function supersede(n, value, changed) {
     if (l._shown) n._value = n._x._lane;
     n._config &= -10241;
     n._x._lane = NOT_PENDING;
-    n._pendingValue = value;
     holdNode(n, parent);
-    joinFuture(parent);
     if (n._subs !== null) insertSubs(n);
   } else {
-    n._pendingValue = value;
     n._config |= CONFIG_HELD;
-    joinFuture(parent);
-    for (let s = n._subs; s !== null; s = s._nextSub)
+    // A confirmation is silent (A17); only truth readers are told.
+    GlobalQueue._confirmed?.(l);
+  }
+  n._pendingValue = value;
+  joinFuture(parent);
+}
+/** Truth readers (`until`, `refresh`; CONFIG_AUTHORITATIVE) — pay-for-use:
+ * the first one installs these on GlobalQueue (signals.ts `watch`).
+ *
+ * A truth reader's read of a lane node: the lane's value when it is the
+ * truth (#3943), else the truth staged beneath a guess, else the committed
+ * value. */
+function truthRead(el) {
+  return truth(el)
+    ? laneValueOf(el)
+    : el._config & CONFIG_GUESS && el._pendingValue !== NOT_PENDING
+      ? el._pendingValue
+      : el._value;
+}
+/** A guess confirmed: its lane's truth readers re-read — of the lane's
+ * derivations too, which may be the truth now (#3943). */
+function truthConfirmed(l) {
+  for (let i = 0; i < l._nodes.length; i++)
+    for (let s = l._nodes[i]._subs; s !== null; s = s._nextSub)
       if (s._sub._config & CONFIG_AUTHORITATIVE) enqueueSub(s._sub);
-  }
+}
+/** A lane node's value is the truth when every guess beneath it is
+ * confirmed — its source staged a value equal to the guess — and nothing
+ * beneath it is held in the parent: same inputs, same value. */
+function truth(n) {
+  if (n._config & CONFIG_GUESS)
+    return n._pendingValue !== NOT_PENDING && n._equals && n._equals(n._x._lane, n._pendingValue);
+  if (n._pendingValue !== NOT_PENDING) return;
+  if (n._config & CONFIG_OVERRIDE)
+    for (let d = n._deps; d; d = d._nextDep) if (!truth(d._dep)) return;
+  return 1;
 }
 /** A lane's end, two ways. `into === null`: the parent landed — the lane's
  * values are the truth now: a guess lands the truth staged beneath it or
@@ -586,7 +633,7 @@ function dissolveLane(l, into, except) {
       } else {
         if (x._pendingFirstChild !== null || x._pendingDisposal !== null)
           GlobalQueue._dispose(n, false, true);
-        n._config &= -385;
+        n._config &= -1048961;
       }
     }
   }
@@ -621,8 +668,7 @@ function dissolveLane(l, into, except) {
  * member throws like any. */
 function laneRead(c, el) {
   const guess = el._config & CONFIG_GUESS;
-  if (c !== null && c._config & CONFIG_AUTHORITATIVE)
-    return guess && el._pendingValue !== NOT_PENDING ? el._pendingValue : el._value;
+  if (c !== null && c._config & CONFIG_AUTHORITATIVE) return GlobalQueue._truth(el);
   if (c === null) return laneValueOf(el);
   const l = txOf(el);
   const status = el._statusFlags;
@@ -734,6 +780,10 @@ function laneSeam(l, leaked) {
   reruns(l);
   for (let i = 0; i < l._nodes.length; i++) {
     const n = l._nodes[i];
+    if (n._flags & LEFT_SHOWN) {
+      n._flags ^= LEFT_SHOWN;
+      insertSubs(n);
+    }
     const x = n._x;
     if (x._transaction !== l) continue;
     if (!(n._config & CONFIG_GUESS) && !n._type && n._pendingValue !== NOT_PENDING) {
@@ -886,6 +936,13 @@ GlobalQueue._laneSeams = leaks => {
             : !blocked(l._parent)))
       )
         continue;
+      // A leaked effect re-derives seated in its lane from its first read: it
+      // carries no lane value (`laneStage`), so without this its pass starts
+      // as mainline, joins the parked frame on its first held read and reads
+      // the staging, then re-enters the lane at its guess read and leaks
+      // again — every round (#4014). A computed is already seated by its
+      // override, and a written guess's own pass stays the frame's.
+      if (l != null && l._lane && r._type) r._flags |= REACTIVE_LANE_DIRTY;
       enqueueSub(r);
       if (l != null && l._lane && leaked.indexOf(l) === -1) leaked.push(l);
     }
@@ -957,9 +1014,12 @@ function route(c, t) {
  * every flush (fuzzer F12). True when the reader is served the committed
  * value — not over a flight committed beneath inputs already on screen (A15
  * reveal corollary, #3305): that value would tear against them, and the
- * reveal observes the flight. */
+ * reveal observes the flight. Nor for a reader born into the flight's
+ * transaction (`bornInto`, #4010): it has no screen — it waits on the flight
+ * with the rest of its frame. */
 function observeFlight(c, el) {
-  if (el._config & CONFIG_INPUTS_PUBLISHED) return false;
+  if (el._config & CONFIG_INPUTS_PUBLISHED || (el._config & CONFIG_HELD && bornInto(c, txOf(el))))
+    return false;
   if (globalQueue._running) {
     joinFuture(null);
     if (!(el._config & CONFIG_HELD)) queuePendingNode(el);
@@ -983,9 +1043,10 @@ let probeFound = false;
  * reader re-derives there. `latest` shows the proposal that lands — a
  * rewrite or a landing reaches its reader through the link it holds — so a
  * re-run would only repeat the frame. */
-function verdictRead(c, t, rerun = probing) {
+function verdictRead(c, t, plain) {
   route(c, t);
-  if (rerun) staleReader(c, t);
+  if (plain) staleReader(c, t);
+  else if (probing && t._reruns[t._reruns.length - 1] !== c) t._reruns.push(c);
 }
 /** A verdict read of a node staged or in flight but not held yet: whether it
  * will be is the seam's.
@@ -1068,11 +1129,14 @@ function pendingVerdict(c, el) {
   }
 }
 /** The pass entering a verdict window is a verdict reader (CONFIG_VERDICT):
- * a dependency going pending re-derives it, the verdict having changed. */
+ * a dependency going pending re-derives it, the verdict having changed. Not
+ * an untracked window: that is a snapshot, like any untracked read (#3946 —
+ * a router's link claim probing inside the computation that creates the
+ * anchor). A throw still reaches the pass through `untrack`. */
 function markVerdictReader(window) {
   let c = context;
   if (c?._root) c = c._parentComputed;
-  if (c !== null) {
+  if (c !== null && tracking) {
     c._config |= CONFIG_VERDICT;
     c._flags |= REACTIVE_PROBED;
     // Observe tier: which windows this pass entered (1 `isPending`, 2
@@ -1154,7 +1218,8 @@ function heldLatest(el, c) {
  * - an errored derivation throws for every reader (#2897). */
 function verdictValue(el, c) {
   const owner = el;
-  const tracked = c !== null && tracking && !(c._config & CONFIG_CHILDREN_FORBIDDEN);
+  const owned = c !== null && !(c._config & CONFIG_CHILDREN_FORBIDDEN);
+  const tracked = owned && tracking;
   if (c !== null && tracking) {
     link(el, c);
     if (owner._fn !== undefined) {
@@ -1233,9 +1298,14 @@ function verdictValue(el, c) {
       }
       return el._value;
     }
-    // Born into the future: its staging is its only value.
-    if (el._pendingValue !== NOT_PENDING && !(owner._statusFlags & STATUS_PENDING))
+    // Born into the future: its staging is its only value. It has no
+    // committed value, so no verdict: `isPending` reads it as its read does —
+    // the owner joins the hold (held with it, or caught by a boundary that
+    // has not shown content) and answers for the commit, where it is final.
+    if (el._pendingValue !== NOT_PENDING && !(owner._statusFlags & STATUS_PENDING)) {
+      if (probing && owned) joinPass(c, el);
       return el._pendingValue;
+    }
   } else if (el._pendingValue !== NOT_PENDING) {
     if (owner._statusFlags & STATUS_PENDING && !uninitialized)
       pendingVerdict(tracked ? c : null, owner);
@@ -2309,6 +2379,10 @@ function createReaction(effectFn, options) {
  *   joined it (L2, born held — A29) and delivers at that commit: the
  *   committed view, never a foreign hold's unrevealed frame. */
 function watch(fn, onValue, onError, config = 0, inPass, own = flushTransaction) {
+  if (config & CONFIG_AUTHORITATIVE) {
+    GlobalQueue._truth = truthRead;
+    GlobalQueue._confirmed = truthConfirmed;
+  }
   // `config` is on the node for its first pass too (the pass runs inside
   // `computed()`): `until`'s predicate is authoritative from its first read,
   // or an already-displayed guess would satisfy it in a later slice. (REDERIVE
@@ -2446,17 +2520,24 @@ function refresh(target) {
   const own = flushTransaction;
   const promise = new Promise((res, rej) => {
     queueMicrotask(() => {
-      // No createRoot: the microtask has no ambient owner, so the watcher is
-      // naturally detached, and settle disposes the node directly (dev keeps
-      // a root husk purely to stay quiet about the missing owner). The
-      // capture runs inside the watcher's own pass, where the ambient owner
-      // IS the watcher — exactly what dispose() takes.
+      // The root is load-bearing: an ownerless computed is auto-disposing,
+      // and the settle walk releases an unobserved one instead of re-running
+      // it, so the waiter would never see the refetch land (#3888). Settle
+      // disposes the waiter directly; the capture runs inside the watcher's
+      // own pass, where the ambient owner IS the watcher — exactly what
+      // dispose() takes.
       let waiter = null;
       const make = () =>
         watch(
           () => {
             if (waiter === null) waiter = getOwner();
-            return read(node);
+            // Authoritative: the truth beneath a guess (`until`'s view). A
+            // guessed node's own re-ask is not answered by it (#3895): park
+            // on that flight, or reject with its error.
+            const v = read(node);
+            if (node._config & CONFIG_GUESS && node._statusFlags & (STATUS_PENDING | STATUS_ERROR))
+              throw node._x?._error;
+            return v;
           },
           value => {
             res(typeof target === "function" ? value : target);
@@ -2466,7 +2547,7 @@ function refresh(target) {
             rej(err);
             dispose(waiter);
           },
-          CONFIG_FRESH_READ,
+          CONFIG_FRESH_READ | CONFIG_AUTHORITATIVE,
           undefined,
           own
         );
@@ -3343,6 +3424,15 @@ function compare(key, a, b) {
   return key ? key(a) === key(b) : true;
 }
 
+let optHooks = null;
+function installOptHooks(hooks) {
+  optHooks = hooks;
+}
+let affectsHooks = null;
+function installAffectsHooks(hooks) {
+  affectsHooks = hooks;
+}
+
 /**
  * Store — plain stores on L2 (plan sec. 31, S1).
  *
@@ -3373,14 +3463,6 @@ function compare(key, a, b) {
  * setter (`wk`); overlay drafts for large plain records; no new named
  * fields on array targets; zero allocation for adopted-but-unread objects.
  */
-let optHooks = null;
-function installOptHooks(hooks) {
-  optHooks = hooks;
-}
-let affectsHooks = null;
-function installAffectsHooks(hooks) {
-  affectsHooks = hooks;
-}
 /** Key of the deep-witness slot node (never a user key). */
 const $DEEP = Symbol("STORE_DEEP");
 // ---------------------------------------------------------------------------
@@ -3570,7 +3652,7 @@ function releaseSlot(node) {
 function noteNode(target, node, key) {
   if (target.fam !== null) target.fam.live.add(target);
   markDescendants(target);
-  if (affectsHooks !== null) affectsHooks.born(target, node, key);
+  if (affectsHooks !== null) affectsHooks._born(target, node, key);
 }
 // Shared slot-node release handler: registered once; the core sweep
 // dispatches CONFIG_SLOT_NODE nodes here (graph.ts) instead of holding a
@@ -3746,6 +3828,7 @@ function notifyContainer(k, pb) {
   if (k._config & CONFIG_OVERRIDE) setSignal(k, pb);
   else {
     if (k._config & CONFIG_HELD) joinFuture(txOf(k));
+    if (snapshotCaptureActive) captureWriteSnapshot(k, k._value);
     insertSubs(k);
     schedule();
   }
@@ -4118,6 +4201,10 @@ GlobalQueue._storeCommit = () => {
   drainFolds();
   optHooks?.sweep();
 };
+/** The store half of `affects()` (store/affects.ts) makes its marks' nodes
+ * and walks records through these: it never imports the engine. */
+GlobalQueue._storeNode = getNode;
+GlobalQueue._storeWrappable = isWrappable;
 /** A projection's creation run commits directly (a memo's first value is
  * its `_value`, not a staging): the draft still writes a clone of the seed,
  * nothing is staged on the nodes, and the setter's exit folds the touched
@@ -4144,7 +4231,10 @@ function foldTarget(t, old) {
           // the adopted object (shared ownership — never cloned).
           t.pb = null;
           t.wk = null;
-        } else if (t.ovl && (t.v !== old || !overlayRebuilds(t, pb))) {
+        } else if (
+          t.ovl &&
+          (t.v !== old || (!overlayRebuilds(t, pb) && k?._x?._snapshotValue !== old))
+        ) {
           // Overlay flatten (#3044): the backing keeps its identity, so the
           // `t.v === old` gate below skips path copying (the parent slot
           // already points here) and the adopted-notify (setter
@@ -4355,16 +4445,19 @@ function notifyWrites(t) {
       ) {
         // Accessor keys: the node is linked for shape-change notification,
         // its value is never served (the getter runs with the proxy
-        // receiver on read) — FORCE wakes the readers.
+        // receiver on read) — FORCE wakes the readers. A data descriptor
+        // falls through so the cleared-acc hot read serves it (#3949);
+        // an own getter's descriptor has no `value`, so the compare below
+        // would otherwise keep the getter's result (or FORCE) for `undefined`.
         node.acc = isOwnAccessor(pb, key);
         const od = Object.getOwnPropertyDescriptor(old, key);
         const nd = Object.getOwnPropertyDescriptor(pb, key);
-        if ((od && (od.get || od.set)) || (nd && (nd.get || nd.set))) {
+        if (!nd || nd.get || nd.set) {
           if (od?.get !== nd?.get || od?.set !== nd?.set || od?.value !== nd?.value)
             setSignal(node, () => FORCE);
           continue;
         }
-        if (!isEqual(od?.value, nd?.value)) setSignal(node, () => nd?.value);
+        if (od?.get || od?.set || !isEqual(od?.value, nd.value)) setSignal(node, () => nd.value);
         continue;
       }
       const nv = t.del !== null && t.del.has(key) ? undefined : pb[key];
@@ -4462,14 +4555,15 @@ function notifyKeyDiff(node, key, old, neu, probe = true) {
     node.acc = isOwnAccessor(neu, key);
     const od = Object.getOwnPropertyDescriptor(old, key);
     const nd = Object.getOwnPropertyDescriptor(neu, key);
-    if ((od && (od.get || od.set)) || (nd && (nd.get || nd.set))) {
+    // Data descriptors fall through, as in notifyWrites (#3949).
+    if (!nd || nd.get || nd.set) {
       if (od?.get !== nd?.get || od?.set !== nd?.set || od?.value !== nd?.value)
         setSignal(node, () => FORCE);
       return;
     }
     const ov = od?.value;
     const nv = nd?.value;
-    if (!isEqual(ov, nv) && !targetsEqual(ov, nv))
+    if (od?.get || od?.set || (!isEqual(ov, nv) && !targetsEqual(ov, nv)))
       setSignal(node, typeof nv === "function" ? () => nv : nv);
   } else {
     const ov = old[key];
@@ -4710,7 +4804,67 @@ function readSource(target, key, shape = false) {
 /** Did the HELD staging (the container node's, not a mainline layer above
  * it) change `key`? */
 function heldKeyChanged(target, key, shape = true) {
-  return changedBetween(target, target.k._value, target.k._pendingValue, key, shape);
+  return (
+    changedBetween(target, target.k._value, target.k._pendingValue, key, shape) &&
+    !adoptChild(target, key)
+  );
+}
+/** The values of a held frame, built once per frame: neither the committed
+ * frame nor the held staging changes while the hold stands (a draft writes a
+ * clone), so the set stays true for every first read of the hold. */
+const frameRaws = new WeakMap();
+function rawsOf(frame) {
+  let raws = frameRaws.get(frame);
+  if (raws === undefined) frameRaws.set(frame, (raws = new Set(Object.values(frame))));
+  return raws;
+}
+/** The same row at a slot, as the adoption pairs rows (reconcile.ts): two
+ * objects whose keys agree — positionally for an unkeyed family. */
+function sameRow$1(pv, nv, keyFn) {
+  return (
+    pv !== null &&
+    typeof pv === "object" &&
+    nv !== null &&
+    typeof nv === "object" &&
+    (keyFn === null || sameKey(keyFn(pv), keyFn(nv)))
+  );
+}
+/** A key of a held adoption whose old and new values are the same row that
+ * nothing had proxied when the adoption ran, so `descend` never paired
+ * them: paired now, as it would have been (#3712) — one target, the old
+ * raw its committed frame, the new raw its staging, held by the same
+ * transaction. Both raws resolve to it, so the slot reads as unchanged and
+ * the row's own leaves decide: `id` the same in both frames holds no one,
+ * `version` holds. A record's keys pair by name; an array's by the family's
+ * key — without a family the pairing is not known here and the hold stands. */
+function adoptChild(target, key) {
+  const k = target.k;
+  const old = asBacking(k._value);
+  const ov = old[key];
+  const nv = k._pendingValue[key];
+  const keyFn = Array.isArray(old) ? target.fam?.key : null;
+  if (
+    target.s ||
+    keyFn === undefined ||
+    !sameRow$1(ov, nv, keyFn) ||
+    !isWrappable(ov) ||
+    !isWrappable(nv) ||
+    Array.isArray(ov) !== Array.isArray(nv) ||
+    lookupTarget(ov, target.fam) !== undefined ||
+    lookupTarget(nv, target.fam) !== undefined ||
+    // A raw in both frames (the same objects swapped or reordered) is its
+    // own row: pairing it with another would alias the two after the commit.
+    rawsOf(old).has(nv) ||
+    rawsOf(k._pendingValue).has(ov)
+  )
+    return false;
+  // A raw-marked value wraps to itself, a proxy to its own target: neither
+  // is a fresh target around `ov`.
+  const ct = wrap(ov, target, key)[$TARGET];
+  if (ct === undefined || ct.v !== ov) return false;
+  adoptPB(ct, nv, false);
+  holdNode(getContainerNode(ct), txOf(k));
+  return true;
 }
 /** A family target's unheld staging, read with no pass (a handler). */
 function familyAhead(target) {
@@ -4839,11 +4993,13 @@ function pullFamily(target) {
     // One that already observes the flight (linked by the pass that saw it
     // go up — the frame's hold, `blocked`) keeps observing it: a re-run for
     // another reason (a guess it read, the seam) that dropped the link would
-    // release the hold with the flight still up.
+    // release the hold with the flight still up. An errored derive has no
+    // landing to learn of: the error is what the frame shows.
     const c = context;
     if (
       c !== null &&
       c._type === EFFECT_RENDER &&
+      !(fw._statusFlags & STATUS_ERROR) &&
       fw._config & CONFIG_HELD &&
       flushTransaction !== txOf(fw) &&
       !linkedTo(c, fw)
@@ -4955,7 +5111,7 @@ const traps = {
     // (The witness before the pull: a mark on an uninitialized derived
     // store is witnessed, then the pull throws — loading, declared pending.)
     if (verdict !== null && affectsHooks !== null && getObserver() === null)
-      affectsHooks.witness(target, key);
+      affectsHooks._witness(target, key);
     if (target.fam !== null) pullFamily(target);
     // Hot inline case: existing PLAIN node (non-accessor) read outside any
     // draft — the dbmon/uibench effect re-read shape. Core's `read()` serves
@@ -5102,7 +5258,7 @@ const traps = {
     // (The witness before the pull: a mark on an uninitialized derived
     // store is witnessed, then the pull throws — loading, declared pending.)
     if (verdict !== null && affectsHooks !== null && getObserver() === null)
-      affectsHooks.witness(target, key);
+      affectsHooks._witness(target, key);
     if (target.fam !== null) pullFamily(target);
     const src = readSource(target, key);
     // A tracked reader's presence node answers (born from the two frames;
@@ -5127,7 +5283,7 @@ const traps = {
   },
   ownKeys(target) {
     if (verdict !== null && affectsHooks !== null && getObserver() === null)
-      affectsHooks.witness(target, undefined);
+      affectsHooks._witness(target, undefined);
     if (target.fam !== null) pullFamily(target);
     return visibleKeys(target, enumerationSource(target));
   },
@@ -5135,7 +5291,7 @@ const traps = {
     if (key === $OWNER || key === $RECORD) return undefined;
     const obs = getObserver();
     if (verdict !== null && affectsHooks !== null && obs === null)
-      affectsHooks.witness(target, key);
+      affectsHooks._witness(target, key);
     if (target.fam !== null) pullFamily(target);
     // An enumerator (spread, Object.entries) already holds the container
     // node and reads its frame; a descriptor read on its own tracks
@@ -5662,127 +5818,6 @@ const storePath = /* @__PURE__ */ Object.assign(
   { DELETE }
 );
 
-/**
- * Store — the store half of `affects()` (plan sec. 29, plan sec. 37; A24 (4), #2882,
- * #2893, #2904).
- *
- * A mark on a store is a mark on nodes (affects.ts: a count on the node, a
- * dependency walk at probe time): `affects(record, key)` marks the slot's
- * leaf; `affects(record)` marks a carrier (the record's `$AFFECTS` leaf)
- * and every live node in the record's subtree — the edges existing readers
- * subscribed through. Coverage is by RAW IDENTITY, not read path (#2882: a
- * captured row proxy, a derived store sharing the source's raw, never read
- * through the declaration's proxy): the identities reachable at the
- * declaration are the mark's `scope`, so a node born inside the window on
- * a covered record inherits the mark (released with the carrier's last),
- * and an untracked probe through a record with no nodes is witnessed into
- * the verdict. A mark declared on a draft (inside a setter) or over an
- * optimistic family walks the view the writer sees.
- *
- * Installed by `store/index.ts`: a program with stores carries it; one
- * without pays nothing (affects.ts asks `GlobalQueue._storeMarks`).
- */
-/** The keyless mark's carrier key: a leaf of the record no read serves. */
-const $AFFECTS = Symbol("STORE_AFFECTS");
-const scopes = new Map();
-/** The nodes an `affects(store[, key])` declaration marks (affects.ts
- * registers each). */
-function storeMarks(t, key) {
-  if (key === undefined) {
-    const carrier = getNode(t, $AFFECTS);
-    let entry = scopes.get(carrier);
-    if (entry === undefined) scopes.set(carrier, (entry = { scope: new Set(), inherited: [] }));
-    const found = [carrier];
-    walk(t.px, entry, found, t.fam, new Set());
-    return found;
-  }
-  const node = t.n?.[key] ?? getNode(t, key);
-  let entry = scopes.get(node);
-  if (entry === undefined) scopes.set(node, (entry = { scope: new Set(), inherited: [], key }));
-  entry.scope.add(t.v);
-  if (t.pb !== null) entry.scope.add(t.pb);
-  return [node];
-}
-/** The identities reachable from `value` into the scope (the draft's and
- * the committed backing both, when a draft is open; an optimistic family's
- * view), every live node under each record into `found`. Untracked by
- * construction: raws, never traps. */
-function walk(value, entry, found, fam, visited) {
-  if (!isWrappable(value)) return;
-  const t = value[$TARGET] ?? lookupTarget(value, fam);
-  let raw = t !== undefined ? (t.pb ?? t.v) : value;
-  if (visited.has(raw)) return;
-  visited.add(raw);
-  entry.scope.add(raw);
-  if (t !== undefined) {
-    if (t.pb !== null) entry.scope.add(t.v);
-    // The writer's view: the tick's own unflushed guesses are in motion too.
-    if (t.fam?.opt === true) raw = optHooks.view(t, raw, true);
-    const nodes = t.n;
-    if (nodes !== null)
-      for (const k of Reflect.ownKeys(nodes))
-        // Another mark's carrier is its own channel: counting it here would
-        // extend that scope's lifetime to this declaration's.
-        if (k !== $AFFECTS) found.push(nodes[k]);
-    const has = t.h;
-    if (has !== null) for (const k of Reflect.ownKeys(has)) found.push(has[k]);
-    if (t.k !== null) found.push(t.k);
-    if (t.dk !== null) found.push(t.dk);
-    fam = t.fam ?? fam;
-  }
-  for (const k of Reflect.ownKeys(raw)) {
-    if (k === $OWNER) continue;
-    const d = Object.getOwnPropertyDescriptor(raw, k);
-    if (d === undefined || d.get !== undefined) continue;
-    walk(d.value, entry, found, fam, visited);
-  }
-}
-/** A live scope covering `t`'s identity (keyed: for `key`). Chained
- * backings (§7b): a view's backing is another store's proxy — marks cover
- * the BASE raw, so every identity along the chain is checked. */
-function covering(t, key, skip) {
-  for (const [carrier, entry] of scopes) {
-    if (carrier === skip || (entry.key !== undefined && entry.key !== key)) continue;
-    for (let r = t.v; ; ) {
-      if (entry.scope.has(r)) return carrier;
-      const inner = r?.[$TARGET];
-      if (inner === undefined) break;
-      const backing = inner.pb ?? inner.v;
-      if (backing === r) break;
-      r = backing;
-    }
-  }
-  return null;
-}
-installAffectsHooks({
-  // A node born on a record a live mark covers inherits it (released with
-  // the carrier's last registration).
-  born(t, node, key) {
-    if (key === $AFFECTS) return;
-    const carrier = covering(t, key, node);
-    if (carrier === null) return;
-    GlobalQueue._mark(node);
-    scopes.get(carrier).inherited.push(node);
-  },
-  // An untracked probe (`isPending(() => s.x)` with no observer) reading a
-  // record a live mark covers: no node carries the mark for it — the
-  // verdict is told directly.
-  witness(t, key) {
-    const own = t.n?.[$AFFECTS];
-    if ((own !== undefined && own._x !== null && own._x._marks !== 0) || covering(t, key) !== null)
-      GlobalQueue._witnessMark();
-  }
-});
-GlobalQueue._storeMarks = storeMarks;
-/** The carrier's last mark released (affects.ts): its scope dies, and the
- * nodes that inherited the mark release theirs. */
-GlobalQueue._releaseMarkScope = carrier => {
-  const entry = scopes.get(carrier);
-  if (entry === undefined) return;
-  scopes.delete(carrier);
-  GlobalQueue._releaseMarks(entry.inherited);
-};
-
 /**
  * Store — reconcile: the immutable-diff adoption channel (INTERNALS §3).
  *
@@ -5874,17 +5909,7 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
       for (const end = Math.min(plen, nlen); i < end; i++) {
         const nv = nextRows[i];
         const pvRaw = prevRows[i];
-        if (
-          pvRaw !== nv &&
-          !(
-            pvRaw !== null &&
-            typeof pvRaw === "object" &&
-            nv !== null &&
-            typeof nv === "object" &&
-            sameKey(keyFn(pvRaw), keyFn(nv))
-          )
-        )
-          break; // misaligned: fall to the keyed remainder below
+        if (pvRaw !== nv && !sameRow$1(pvRaw, nv, keyFn)) break; // misaligned: fall to the keyed remainder below
         if (
           (pvRaw !== nv || (nv !== null && typeof nv === "object" && isOwned(nv))) &&
           nv !== null &&
@@ -6296,7 +6321,9 @@ function runProjectionComputed(wrappedStore, fn, key, wrapCommit, aroundDraftWri
     // A flight went up (NotReady out of the pass — the derive's own, with
     // the derive as its source): the leaves' readers learn it from here —
     // they do not subscribe to the derive.
-    if (e instanceof NotReadyError && !first) wakeFamily(fam, e);
+    // A synchronous error the same way (#3956: a rerun that finds the
+    // entry failed throws): every live reader re-derives and meets it.
+    if (!first) e instanceof NotReadyError ? wakeFamily(fam, e) : errorFamily(fam);
     throw e;
   }
   // A pass that returned with a flight up (an iterator's sync first yield):
@@ -6313,11 +6340,20 @@ function runProjectionComputed(wrappedStore, fn, key, wrapCommit, aroundDraftWri
   return owner;
 }
 function createProjectionInternal(fn, seed, options) {
+  const keyOption = options?.key === undefined ? "id" : options.key;
   const fam = {
     map: new WeakMap(),
     node: null,
     live: new Set(),
-    shallow: !!options?.shallow
+    shallow: !!options?.shallow,
+    // The row key, for a child paired after the adoption (store.ts
+    // `adoptChild`, #3712) as the adoption pairs them.
+    key:
+      typeof keyOption === "function"
+        ? keyOption
+        : keyOption === null
+          ? null
+          : row => (isWrappable(row) ? row[keyOption] : undefined)
   };
   const store = wrap(seed, null, null, fam);
   if (fam.shallow) {
@@ -6332,7 +6368,7 @@ function createProjectionInternal(fn, seed, options) {
   }
   const node = computed(() => {
     if (!fam.node) fam.node = getOwner();
-    runProjectionComputed(store, fn, options?.key === undefined ? "id" : options.key);
+    runProjectionComputed(store, fn, keyOption);
   }, nodeOptions);
   node._config &= ~CONFIG_AUTO_DISPOSE;
   fam.node = node;
@@ -6494,8 +6530,38 @@ function rowSame(a, b, keyFn) {
   if (keyFn === null || !isWrappable(a) || !isWrappable(b)) return false;
   const ka = keyFn(unwrapValue(a));
   const kb = keyFn(unwrapValue(b));
+  // Keyless rows are identified by position — reconcile's fallback when the
+  // key is missing. The caller already paired these by index, so two keyless
+  // rows are the same row and the landing confirms the arrangement instead of
+  // dissolving it. Dissolving held an external echo under the action, and a
+  // mainline `until` then timed out on a source that already contained it
+  // (#3898). Keyed rows still match only on the key.
+  if (ka === undefined && kb === undefined) return true;
   return ka !== undefined && sameKey(ka, kb);
 }
+/** Whether reconcile would write anything into `a` from `b`: wrappable
+ * pairs descend, leaves compare as its writes do. A key mismatch is a
+ * replacement, which a content difference already says. Plain data — the
+ * server's echo of a guessed row is a new object with the same contents. */
+function echoes(a, b) {
+  if (a === b) return true;
+  if (!isWrappable(a) || !isWrappable(b)) return false;
+  a = unwrapValue(a);
+  b = unwrapValue(b);
+  const ak = Object.keys(a);
+  if (Array.isArray(a) !== Array.isArray(b) || ak.length !== Object.keys(b).length) return false;
+  for (const k of ak) if (!hasOwn.call(b, k) || !echoes(a[k], b[k])) return false;
+  return true;
+}
+// A cycle (a row that references itself) is not plain data: no match, so
+// the landing stays a correction.
+GlobalQueue._echoes = (a, b) => {
+  try {
+    return echoes(a, b);
+  } catch {
+    return false;
+  }
+};
 function arrangementEqual(a, b, keyFn) {
   if (Array.isArray(a) !== Array.isArray(b)) return false;
   if (Array.isArray(a)) {
@@ -7934,6 +8000,137 @@ function deep(value) {
   return deep$1(value);
 }
 
+/**
+ * Store — the store half of `affects()` (plan sec. 29, plan sec. 37; A24 (4), #2882,
+ * #2893, #2904).
+ *
+ * A mark on a store is a mark on nodes (affects.ts: a count on the node, a
+ * dependency walk at probe time): `affects(record, key)` marks the slot's
+ * leaf; `affects(record)` marks a carrier (the record's `$AFFECTS` leaf)
+ * and every live node in the record's subtree — the edges existing readers
+ * subscribed through. Coverage is by RAW IDENTITY, not read path (#2882: a
+ * captured row proxy, a derived store sharing the source's raw, never read
+ * through the declaration's proxy): the identities reachable at the
+ * declaration are the mark's `scope`, so a node born inside the window on
+ * a covered record inherits the mark (released with the carrier's last),
+ * and an untracked probe through a record with no nodes is witnessed into
+ * the verdict. A mark declared on a draft (inside a setter) or over an
+ * optimistic family walks the view the writer sees.
+ *
+ * Imported by `affects()`, which installs it on its first store target
+ * (#3891, after #3912): a program with stores that never declares a mark
+ * carries none of it. It never imports store.ts — the engine's top level —
+ * so a program declaring marks without stores carries this module alone:
+ * the store's nodes and its wrappability test come through `GlobalQueue`
+ * (`_storeNode`, `_storeWrappable`), and node birth and the untracked traps
+ * reach back through `affectsHooks` (hooks.ts).
+ */
+/** The keyless mark's carrier key: a leaf of the record no read serves. */
+const $AFFECTS = Symbol("STORE_AFFECTS");
+const scopes = new Map();
+function scopeOf(carrier, key) {
+  let entry = scopes.get(carrier);
+  if (entry === undefined)
+    scopes.set(carrier, (entry = { _scope: new Set(), _inherited: [], _key: key }));
+  return entry;
+}
+/** The nodes an `affects(store[, key])` declaration marks (affects.ts
+ * registers each). */
+function storeMarks(t, key) {
+  const node = GlobalQueue._storeNode(t, key === undefined ? $AFFECTS : key);
+  const entry = scopeOf(node, key);
+  if (key === undefined) {
+    const found = [node];
+    walk(t.px, entry, found, t.fam, new Set());
+    return found;
+  }
+  entry._scope.add(t.v);
+  if (t.pb !== null) entry._scope.add(t.pb);
+  return [node];
+}
+/** The identities reachable from `value` into the scope (the draft's and
+ * the committed backing both, when a draft is open; an optimistic family's
+ * view), every live node under each record into `found`. Untracked by
+ * construction: raws, never traps. */
+function walk(value, entry, found, fam, visited) {
+  if (!GlobalQueue._storeWrappable(value)) return;
+  const t = value[$TARGET] ?? lookupTarget(value, fam);
+  let raw = t !== undefined ? (t.pb ?? t.v) : value;
+  if (visited.has(raw)) return;
+  visited.add(raw);
+  entry._scope.add(raw);
+  if (t !== undefined) {
+    if (t.pb !== null) entry._scope.add(t.v);
+    // The writer's view: the tick's own unflushed guesses are in motion too.
+    if (t.fam?.opt === true) raw = optHooks.view(t, raw, true);
+    const nodes = t.n;
+    if (nodes !== null)
+      for (const k of Reflect.ownKeys(nodes))
+        // Another mark's carrier is its own channel: counting it here would
+        // extend that scope's lifetime to this declaration's.
+        if (k !== $AFFECTS) found.push(nodes[k]);
+    const has = t.h;
+    if (has !== null) for (const k of Reflect.ownKeys(has)) found.push(has[k]);
+    if (t.k !== null) found.push(t.k);
+    if (t.dk !== null) found.push(t.dk);
+    fam = t.fam ?? fam;
+  }
+  for (const k of Reflect.ownKeys(raw))
+    if (k !== $OWNER) {
+      const d = Object.getOwnPropertyDescriptor(raw, k);
+      if (d.get === undefined) walk(d.value, entry, found, fam, visited);
+    }
+}
+/** A live scope covering `t`'s identity (keyed: for `key`). Chained
+ * backings (§7b): a view's backing is another store's proxy — marks cover
+ * the BASE raw, so every identity along the chain is checked. */
+function covering(t, key, skip) {
+  for (const [carrier, entry] of scopes) {
+    if (carrier === skip || (entry._key !== undefined && entry._key !== key)) continue;
+    for (let r = t.v; ; ) {
+      if (entry._scope.has(r)) return carrier;
+      const inner = r?.[$TARGET];
+      if (inner === undefined) break;
+      const backing = inner.pb ?? inner.v;
+      if (backing === r) break;
+      r = backing;
+    }
+  }
+  return null;
+}
+/** The store's side: node birth and the untracked traps call it (store.ts,
+ * through `affectsHooks`) — with no live mark too: an empty scope map is
+ * no work. */
+const hooks = {
+  // A node born on a record a live mark covers inherits it (released with
+  // the carrier's last registration).
+  _born(t, node, key) {
+    if (scopes.size === 0 || key === $AFFECTS) return;
+    const carrier = covering(t, key, node);
+    if (!carrier) return;
+    GlobalQueue._mark(node);
+    scopes.get(carrier)._inherited.push(node);
+  },
+  // An untracked probe (`isPending(() => s.x)` with no observer) reading a
+  // record a live mark covers: no node carries the mark for it — the
+  // verdict is told directly.
+  _witness(t, key) {
+    if (t.n?.[$AFFECTS]?._x?._marks || covering(t, key)) GlobalQueue._witnessMark();
+  }
+};
+/** `affects()` calls it before a store-targeted declaration (idempotent). */
+function installStoreAffects() {
+  installAffectsHooks(hooks);
+}
+/** The carrier's last mark released (affects.ts): its scope dies, and the
+ * nodes that inherited the mark release theirs. */
+function releaseMarkScope(carrier) {
+  const entry = scopes.get(carrier);
+  if (entry === undefined) return;
+  scopes.delete(carrier);
+  GlobalQueue._releaseMarks(entry._inherited);
+}
+
 // `affects()` — the declaration verb of the pending model (A24 (4), ruled
 // 2026-07-13; the #2893 audit corollaries; rebuilt on L2 2026-10-02 as ruled:
 // transaction-inert).
@@ -8001,7 +8198,7 @@ function release$1(nodes) {
       repoll(n);
       // A store mark's carrier: its scope (and the marks the nodes born in
       // its window inherited) goes with it.
-      GlobalQueue._releaseMarkScope?.(n);
+      releaseMarkScope(n);
     }
   }
   nodes.length = 0;
@@ -8032,7 +8229,8 @@ function affects(target, key) {
   // record's carrier and every live node under it.
   const t = target?.[$TARGET];
   if (t !== undefined) {
-    const nodes = GlobalQueue._storeMarks(t, key);
+    installStoreAffects();
+    const nodes = storeMarks(t, key);
     for (let i = 0; i < nodes.length; i++) register(nodes[i]);
     schedule();
     return;
@@ -8354,8 +8552,11 @@ function prune(b, pass) {
         // Landed, held: the content is that transaction's — the output's
         // pass enters it and the reveal lands with the reader's run. The
         // seam, past its park decision, waits for the commit instead. (A
-        // lane's reader reveals with the lane, this round.)
-        if (!pass) continue;
+        // lane's reader reveals with the lane, this round.) A boundary that
+        // has not shown content catches it instead: the fallback stays until
+        // the reader is committed (#3540: what a fresh boundary catches holds
+        // nothing outside it).
+        if (!pass || !b._initialized) continue;
         joinFuture(txOf(r));
       }
       b._readers.delete(r);
@@ -8541,7 +8742,8 @@ function createBoundary(type, fn, show, onFn) {
     _gated: false,
     _collapsed: false,
     _error: type === STATUS_ERROR ? signal(undefined, ERROR_SIGNAL) : null,
-    _show: show
+    _show: show,
+    _fb: null
   };
   const controller = type === STATUS_PENDING ? owner._context[REVEAL] : null;
   if (getOwner())
@@ -8682,6 +8884,20 @@ function createBoundary(type, fn, show, onFn) {
       if (b._fallback && b._type & STATUS_PENDING && attrHooks !== null)
         attrHooks.boundaryFallback(b, b._tree, false);
       b._fallback = false;
+      // The fallback dies when the content that replaces it is on screen —
+      // with this flush's commits when the pass is the frame's, at the
+      // landing when the frame parks (the run is held with it, as the old
+      // children of a held pass are) — not now: a held swap keeps the
+      // fallback on screen, live, until it commits. A pass back to the
+      // fallback before then finds it still built and keeps it.
+      const fb = b._fb;
+      if (fb !== null)
+        globalQueue.enqueue(EFFECT_RENDER, () => {
+          if (!b._fallback && b._fb === fb) {
+            dispose(fb);
+            b._fb = null;
+          }
+        });
       release(b);
       // Shown: the slot leaves its reveal order (a later re-arm gates nobody
       // else; the frontier moves on).
@@ -8724,7 +8940,22 @@ function fallback(b) {
     if (!globalQueue._running) schedule();
   }
   b._fallback = true;
-  return b._show(b);
+  // Built in its own scope, like `Show`'s function child, once per show
+  // (D-39: the fallback is the display until a new answer replaces the
+  // error): a re-derive of the output while it shows — a second reader
+  // caught, the same error propagated again through a sibling's re-run, a
+  // retry pending after `reset()`, a later error — keeps the built
+  // fallback, its DOM and focus with it (#3991). A later error reaches it
+  // through the error accessor; only a fallback reading the accessor at its
+  // top level is rebuilt by it. Created beside the output — in its owner,
+  // outside the boundary, as the output is: its errors and runs are the
+  // enclosing boundary's — with the output's id, so what it builds gets the
+  // ids a build under the output would; disposed once content is on screen.
+  if (b._fb === null) {
+    const out = getOwner();
+    b._fb = runWithOwner(out._parent, () => computed(() => b._show(b), { id: out.id }));
+  }
+  return read(b._fb);
 }
 const ERROR_SIGNAL = { ownedWrite: true, _noSnapshot: true };
 /**