@solidjs/signals 2.0.0-rc.3 → 2.0.0-rc.4

package/dist/dev.js

@@ -708,11 +708,17 @@ const hooks = {};
 const diagnosticListeners = new Set();
 const diagnosticCaptures = new Set();
 let diagnosticSequence = 0;
+let consoleFooter;
+const footeredCodes = new Set();
 const diagnostics = {
   subscribe(listener) {
     diagnosticListeners.add(listener);
     return () => diagnosticListeners.delete(listener);
   },
+  setConsoleFooter(footer) {
+    consoleFooter = footer;
+    footeredCodes.clear();
+  },
   capture() {
     const events = [];
     diagnosticCaptures.add(events);
@@ -752,6 +758,13 @@ function emitDiagnostic(event) {
   };
   for (const listener of diagnosticListeners) listener(entry);
   for (const capture of diagnosticCaptures) capture.push(entry);
+  if (consoleFooter && !footeredCodes.has(entry.code)) {
+    footeredCodes.add(entry.code);
+    const footer = consoleFooter(entry);
+    // Call sites console.warn/error their message after emitDiagnostic
+    // returns; a microtask lands the footer right below that report.
+    if (footer) queueMicrotask(() => console.warn(footer));
+  }
   return entry;
 }
 /**
@@ -1097,7 +1110,7 @@ function cancelZombieRecompute(el) {
 }
 let clock = 0;
 let activeTransition = null;
-let scheduled = false;
+let scheduled$1 = false;
 let halted = false;
 let haltNotified = false;
 let syncDepth = 0;
@@ -1207,6 +1220,27 @@ function mergeTransitionState(target, outgoing) {
     outgoing._affectsNodes.length = 0;
   }
   for (const store of outgoing._optimisticStores) target._optimisticStores.add(store);
+  // Patch-channel stash (store/next/patch.ts): entries held for the outgoing
+  // transition must ride the merge like every other per-transition
+  // collection — releaseBatch only reads the COMMITTING transition's stash,
+  // so a stranded sidecar would silently drop its patches. Move (don't
+  // copy), same aliasing rule as the collections above. The field is an
+  // expando so this module stays free of patch imports (pay-for-use).
+  const heldPatches = outgoing._heldPatches;
+  if (heldPatches !== undefined) {
+    outgoing._heldPatches = undefined;
+    let dest = target._heldPatches;
+    if (dest !== undefined) dest.push(...heldPatches);
+    else dest = target._heldPatches = heldPatches;
+    // Retarget the entries' coalescing stamps to the surviving stash
+    // (opaque backref contract with store/next/patch.ts): without this a
+    // post-merge emission misses the stamp and pushes a SECOND entry —
+    // the record's patch applies twice at commit (re-audit 5, P1-2).
+    for (let i = 0; i < heldPatches.length; i++) {
+      const pc = heldPatches[i].pc;
+      if (pc !== undefined && pc.qe === heldPatches[i]) pc.qa = dest;
+    }
+  }
   for (const [source, reporters] of outgoing._asyncReporters) {
     let targetReporters = target._asyncReporters.get(source);
     if (!targetReporters) target._asyncReporters.set(source, (targetReporters = new Set()));
@@ -1219,8 +1253,8 @@ function schedule() {
     notifyHalted();
     return;
   }
-  if (scheduled) return;
-  scheduled = true;
+  if (scheduled$1) return;
+  scheduled$1 = true;
   if (!syncDepth && !globalQueue._running && !projectionWriteActive) queueMicrotask(flush);
 }
 /**
@@ -1403,6 +1437,10 @@ class GlobalQueue extends Queue {
   static _transitionBlocked = null;
   static _cleanupLanes = null;
   static _runLaneEffects = null;
+  /** Patch-channel optimistic drain (next/patch.ts): optimistic emissions
+   * apply at lane-effect timing — visible in flight, unlike the regular
+   * effect queues an action stashes. Injected; null when unused. */
+  static _drainPatchOptimistic = null;
   static _gatedRead = null;
   static _laneSuspends = null;
   static _laneReadsCommitted = null;
@@ -1415,6 +1453,10 @@ class GlobalQueue extends Queue {
     this._running = true;
     try {
       if (true) devCheckFlushStart();
+      // Before runHeap for the same reason as the fast drain above; late
+      // subscribers (an effect reading a swept memo this flush) revive it,
+      // which is the pay-for-use contract.
+      sweepDormant();
       runHeap(dirtyQueue, GlobalQueue._update);
       if (activeTransition) {
         const isComplete = transitionComplete(activeTransition);
@@ -1449,7 +1491,7 @@ class GlobalQueue extends Queue {
           // A kept ambient batch may hold pending nodes (#2916): stay
           // scheduled so the outer drain loop commits them via the plain
           // flush path instead of leaving them until the next natural flush.
-          scheduled = dirtyQueue._max >= dirtyQueue._min || this._batch._pendingNodes.length > 0;
+          scheduled$1 = dirtyQueue._max >= dirtyQueue._min || this._batch._pendingNodes.length > 0;
           reassignPendingTransition(stashedTransition._pendingNodes);
           activeTransition = null;
           finalizePureQueue(null, true);
@@ -1489,7 +1531,7 @@ class GlobalQueue extends Queue {
       }
       clock++;
       // Check if finalization added items to the heap (from optimistic reversion)
-      scheduled = dirtyQueue._max >= dirtyQueue._min;
+      scheduled$1 = dirtyQueue._max >= dirtyQueue._min;
       // Run lane effects first (for ready lanes), then regular effects
       activeLanes.size && GlobalQueue._runLaneEffects(EFFECT_RENDER);
       this.run(EFFECT_RENDER);
@@ -1506,7 +1548,7 @@ class GlobalQueue extends Queue {
       }
       if (
         true &&
-        !scheduled &&
+        !scheduled$1 &&
         !activeTransition &&
         transitions.size === 0 &&
         activeLanes.size === 0
@@ -1692,6 +1734,16 @@ let storeCommitHook = null;
 function setStoreCommitHook(fn) {
   storeCommitHook = fn;
 }
+/** Patch-channel release hook (next/patch.ts): transition-stamped patch
+ * emissions are released when THEIR batch commits. Transitions never
+ * abort: failed actions still commit (only optimistic overrides revert),
+ * and merged-away transitions hand their stash to the survivor
+ * (mergeTransitionState) — every stash drains exactly once. Injected like
+ * storeCommitHook to stay tree-shakeable. */
+let patchCommitHook = null;
+function setPatchCommitHook(fn) {
+  patchCommitHook = fn;
+}
 function commitPendingNodes() {
   const pendingNodes = currentBatch._pendingNodes;
   for (let i = 0; i < pendingNodes.length; i++) {
@@ -1699,6 +1751,7 @@ function commitPendingNodes() {
   }
   pendingNodes.length = 0;
   storeCommitHook?.();
+  patchCommitHook?.(currentBatch);
 }
 function finalizePureQueue(completingTransition = null, incomplete = false) {
   // For incomplete transitions, skip pending resolution and optimistic reversion
@@ -1825,7 +1878,7 @@ function flush(fn) {
   let count = 0;
   // `flush()` is an explicit drain point, so it must also process an active
   // transition even if no microtask was scheduled for it yet.
-  while (scheduled || activeTransition) {
+  while (scheduled$1 || activeTransition) {
     if (++count === 1e5) throw new Error("Potential Infinite Loop Detected.");
     globalQueue.flush();
   }
@@ -2363,7 +2416,7 @@ function unlinkSubs(link) {
       // transition holding it) is an observer — tearing down would orphan
       // the work and re-execute it on the next read. The settle path runs
       // this same last-one-out check when that observer releases (the
-      // untracked-read dispose in core.ts guards on pending identically).
+      // untracked-read dormancy sweep guards on pending identically).
       const c = dep;
       c._fn &&
         c._config & CONFIG_AUTO_DISPOSE &&
@@ -2403,6 +2456,46 @@ function unobserved(el) {
   clearDeps(el);
   disposeChildren(el, true);
 }
+/**
+ * Deferred dormancy for never-observed auto-dispose computeds (#3078).
+ *
+ * An untracked top-level read of a subscriber-less observation-lifecycle memo
+ * used to call unobserved() inline at the end of read(). That kept the leak
+ * closed (the compute links the memo into its deps' sub lists — without a
+ * teardown point a never-observed memo is retained by its sources forever;
+ * upstream alien-signals has exactly this retention), but it made reads
+ * destructive: each read disposed the node, the next read revived it with a
+ * full recompute in whatever ambient transition/lane context happened to be
+ * current, so consecutive reads could return different answers with no write
+ * in between.
+ *
+ * Instead, reads queue the node here and the scheduler sweeps at the top of
+ * the next flush (before runHeap, so a same-tick dirtying is reclaimed
+ * instead of recomputed). Reads become idempotent within a tick (the node
+ * stays alive and serves its cache, uniform with observed memos) while
+ * reclamation still happens within one microtask — the enqueue site arms
+ * schedule(), so a flush is guaranteed even when no other work is queued.
+ */
+const dormantNodes = new Set();
+function sweepDormant() {
+  if (dormantNodes.size === 0) return;
+  for (const el of dormantNodes) {
+    // Re-validate at sweep time: the node may have gained a subscriber (its
+    // lifecycle is the unlinkSubs cascade now), gone pending (in-flight async
+    // is an observer; the settle path re-runs last-one-out), lost its
+    // AUTO_DISPOSE bit (owner teardown strips it, #3024), or already been
+    // torn down.
+    if (
+      !el._subs &&
+      el._config & CONFIG_AUTO_DISPOSE &&
+      !(el._statusFlags & STATUS_PENDING) &&
+      !(el._flags & (REACTIVE_DISPOSED | REACTIVE_ZOMBIE))
+    ) {
+      unobserved(el);
+    }
+  }
+  dormantNodes.clear();
+}
 // https://github.com/stackblitz/alien-signals/blob/v2.0.3/src/system.ts#L52
 function link(dep, sub, pendingObserver = false) {
   // Repeat touches within one pass AND-combine `_pendingObserver`: a probe
@@ -3084,7 +3177,8 @@ function clearStatus(el, clearUninitialized = false) {
     GlobalQueue._updateChildCompanions !== null
   )
     GlobalQueue._updateChildCompanions(el);
-  if (el._x?._notifyStatus) el._x._notifyStatus.call(el);
+  const notify = statusNotifierOf(el);
+  if (notify) notify.call(el);
 }
 function notifyStatus(el, status, error, blockStatus, lane) {
   // Wrap regular errors to track source node
@@ -3126,14 +3220,15 @@ function notifyStatus(el, status, error, blockStatus, lane) {
   }
   const downstreamBlockStatus = blockStatus || startsBlocking;
   const downstreamLane = blockStatus || isOptimisticBoundary ? undefined : lane;
-  if (el._x?._notifyStatus) {
+  const elNotify = statusNotifierOf(el);
+  if (elNotify) {
     if (blockStatus && status === STATUS_PENDING) {
       return;
     }
     if (downstreamBlockStatus) {
-      el._x._notifyStatus.call(el, status, error);
+      elNotify.call(el, status, error);
     } else {
-      el._x._notifyStatus.call(el);
+      elNotify.call(el);
     }
     return;
   }
@@ -3668,7 +3763,7 @@ function ext(el) {
  * mode (recompute is called explicitly by `effect()`), so we hardcode the lazy bits and skip
  * the auto-dispose CONFIG bit (effect() previously cleared it post-construction).
  */
-function createEffectNode(fn, effectFn, errorFn, type, notifyStatus, options) {
+function createEffectNode(fn, effectFn, errorFn, type, options) {
   const transparent = options?.transparent ?? false;
   const self = {
     id: inheritId(options, transparent, context),
@@ -3712,12 +3807,36 @@ function createEffectNode(fn, effectFn, errorFn, type, notifyStatus, options) {
     _x: null
   };
   self._name = options?.name ?? "effect";
-  // Boundary effects carry a status channel; most effects never touch _x.
-  if (notifyStatus !== undefined) ext(self)._notifyStatus = notifyStatus;
+  // Effects dispatch status through the SHARED notifier (statusNotifierOf,
+  // keyed off _type) — storing it per node forced a full NodeExtension
+  // allocation on EVERY effect at creation (an alloc + 19 field stores,
+  // +23% effect creation, caught by the creation benches). Only genuinely
+  // per-node channels (boundaries) live on _x.
   if (options?.unobserved) ext(self)._unobserved = options.unobserved;
   setupComputedNode(self, lazyOptions);
   return self;
 }
+/**
+ * The shared status notifier for effect nodes, installed once by effect.ts
+ * at module evaluation (`this`-dispatched — one function serves every
+ * effect, so nodes never store it). Boundary computeds keep their own
+ * per-node channel on `_x._notifyStatus`, which takes precedence.
+ */
+let effectStatusNotify = null;
+function setEffectStatusNotify(fn) {
+  effectStatusNotify = fn;
+}
+/** Resolve a node's status notifier: an own `_x` channel (boundaries) wins;
+ * effect nodes (`_type` — EFFECT_PURE is 0, and only effect literals carry
+ * the field) fall back to the shared notifier. Presence doubles as the
+ * "display consumer" membership test in the status walks, exactly as the
+ * per-node field did when every effect carried one. */
+function statusNotifierOf(el) {
+  const x = el._x;
+  const own = x !== null && x !== undefined ? x._notifyStatus : undefined;
+  if (own !== undefined) return own;
+  return el._type ? (effectStatusNotify ?? undefined) : undefined;
+}
 const lazyOptions = { lazy: true };
 function setupComputedNode(self, options) {
   self._prevHeap = self;
@@ -4094,7 +4213,14 @@ function read(el) {
     !(owner._statusFlags & STATUS_PENDING) &&
     !el._subs
   ) {
-    unobserved(el);
+    // Deferred, not inline (#3078): an inline unobserved() here made untracked
+    // reads destructive — dispose on this read, full revival recompute on the
+    // next — so consecutive reads could answer differently with no write in
+    // between (the revival samples the ambient transition/lane context).
+    // The sweep at flush finalization re-validates and reclaims; schedule()
+    // guarantees that flush happens even if nothing else is queued.
+    dormantNodes.add(el);
+    schedule();
   }
   return value;
 }
@@ -4617,6 +4743,9 @@ function runLaneEffects(type) {
       runQueue(effects, type);
     }
   }
+  // Optimistic patch applications ride the same visibility slot as lane
+  // effects (in-flight DOM updates); no-op unless patches registered.
+  if (type === EFFECT_RENDER) GlobalQueue._drainPatchOptimistic?.();
 }
 function cleanupCompletedLanes(completingTransition) {
   for (const lane of activeLanes) {
@@ -5161,8 +5290,22 @@ function pendingCheckRead(el, c, owner, firewall) {
  */
 function heldAwaitingAsync(el) {
   const et = el._transition;
-  const t = et ? currentTransition(et) : null;
+  const t = et ? currentTransition(et) : activeTransition;
   if (!t || t._done) return false;
+  // A plain staged write (a signal/store leaf — no _fn) held while an action
+  // is still running is an INPUT to a computation still in flight (#3078):
+  // the pairing rule must not suppress the verdict, or a memo recomputing
+  // mid-action reads the staged value, gets told "not pending", and
+  // disagrees with a direct isPending() probe for the whole action window.
+  // A computed's staged value is the opposite case — a LANDED answer
+  // awaiting reveal — where the pairing rule stands even inside an open
+  // action (#2831: a reader that saw the new value must not also see
+  // pending); still-computing answers are covered by the reporter scan.
+  if (t._actions.length && !el._fn) return true;
+  // A node not yet stamped with a transition only qualifies through the
+  // action check above; the reporter scan below is for transition-held
+  // writes whose source async is still computing.
+  if (!et) return false;
   for (const [source, reporters] of t._asyncReporters) {
     if (
       reporters.size &&
@@ -5279,7 +5422,6 @@ function effect(compute, effect, error, options) {
     effect,
     error,
     isUser ? EFFECT_USER : EFFECT_RENDER,
-    notifyEffectStatus,
     options
   );
   recompute(node, true);
@@ -5452,17 +5594,9 @@ function trackedEffect(fn, options) {
   node._config = (node._config & ~CONFIG_AUTO_DISPOSE) | CONFIG_CHILDREN_FORBIDDEN;
   node._modified = true;
   node._type = EFFECT_TRACKED;
-  ext(node)._notifyStatus = (status, error) => {
-    const actualStatus = status !== undefined ? status : node._statusFlags;
-    if (actualStatus & STATUS_ERROR) {
-      node._queue.notify(node, STATUS_PENDING, 0);
-      const err = error !== undefined ? error : node._x?._error;
-      if (!node._queue.notify(node, STATUS_ERROR, STATUS_ERROR)) {
-        haltReactivity(unwrapStatusError(err));
-        throw err;
-      }
-    }
-  };
+  // Status dispatch rides the SHARED notifier (statusNotifierOf keys off
+  // _type): its error arm is behavior-identical to the closure that used to
+  // live here, without the per-node NodeExtension allocation.
   node._run = run;
   node._queue.enqueue(EFFECT_USER, run);
   if (!node._parent) {
@@ -5480,6 +5614,10 @@ function trackedEffect(fn, options) {
     console.warn(message);
   }
 }
+// Install the shared effect status notifier (statusNotifierOf serves it to
+// every effect node) — module-scope: any bundle that creates effects
+// evaluates this module.
+setEffectStatusNotify(notifyEffectStatus);
 
 const ACTION_CALLED_IN_OWNED_SCOPE_MESSAGE =
   "[ACTION_CALLED_IN_OWNED_SCOPE] Calling an action inside an owned scope (component, computation) is not allowed. " +
@@ -6100,6 +6238,15 @@ let optHooks = null;
 function setOptHooks(h) {
   optHooks = h;
 }
+/** Sticky descendants flag walk (§6d): reconcile's keyed pruning descends
+ * only where subscriptions exist at/below. Nodes AND patches count. */
+function markDescendants(target) {
+  let t = target;
+  while (t && !t.d) {
+    t.d = true;
+    t = t.u;
+  }
+}
 
 /**
  * Brand symbols used internally by the store proxy / projection plumbing.
@@ -6448,8 +6595,9 @@ function notifyMarkBoundaries(node) {
     visited.add(sub);
     // Display consumers (render effects, boundary computeds) act on the
     // notification; descent stops there, exactly like the status rails.
-    if (sub._x?._notifyStatus) {
-      sub._x._notifyStatus.call(sub, STATUS_PENDING, error);
+    const notify = statusNotifierOf(sub);
+    if (notify) {
+      notify.call(sub, STATUS_PENDING, error);
       return;
     }
     forEachDependent(sub, visit);
@@ -6557,6 +6705,15 @@ function affects(target, key) {
   }
 }
 
+let patchHooks = null;
+let rowHooks = null;
+function installPatchHooks(hooks) {
+  patchHooks = hooks;
+}
+function installRowHooks(hooks) {
+  rowHooks = hooks;
+}
+
 /**
  * Store rewrite — increment 2: plain deep stores with pending-backing writes.
  * Contract: INTERNALS-STORE-STATE.md.
@@ -6585,8 +6742,13 @@ function affects(target, key) {
  * headroom for future fields. The prototype is reset to `Object.prototype`
  * so proxy-forwarded semantics (getPrototypeOf, constructor) are exactly a
  * plain object's. Array targets keep the bare-`[]` path — they must carry
- * the array exotic class for `Array.isArray(proxy)`, and arrays store named
- * fields off-object where this cliff does not apply. */
+ * the array exotic class for `Array.isArray(proxy)`.
+ *
+ * ARRAY SHAPE RULE: arrays normalize their named properties to dictionary
+ * mode as the count grows (V8 13.x: counts ≡ 0 mod 3 from 18 up), so the
+ * target's named field count is capped at 20 — write-side patch-channel
+ * state lives inside the single `pc` extension (see target.ts), never as
+ * new named fields here. */
 function TargetShape() {
   this.v = undefined;
   this.ch = undefined;
@@ -6607,9 +6769,15 @@ function TargetShape() {
   this.s = undefined;
   this.ovl = undefined;
   this.del = undefined;
-  this.wk = undefined;
+  this.pc = undefined;
+  this.hv = undefined;
+  this.ht = undefined;
 }
 TargetShape.prototype = Object.prototype;
+/** Lazily allocate the patch-channel extension (one literal shape). */
+function pcOf(t) {
+  return t.pc ?? (t.pc = { sp: null, p: null, ro: null, wk: null, qa: null, qe: null });
+}
 function createTarget(value, parent, parentKey, fam = parent?.fam ?? null) {
   // The proxy target carries the array exotic class when the value is an
   // array, so Array.isArray(proxy) is true; the fields live on it directly.
@@ -6626,6 +6794,7 @@ function createTarget(value, parent, parentKey, fam = parent?.fam ?? null) {
   t.h = null;
   t.k = null;
   t.dk = null;
+  t.pc = null;
   t.u = parent;
   t.pk = parentKey;
   t.px = null;
@@ -6638,7 +6807,8 @@ function createTarget(value, parent, parentKey, fam = parent?.fam ?? null) {
   t.s = false;
   t.ovl = false;
   t.del = null;
-  t.wk = null;
+  t.hv = null;
+  t.ht = null;
   t.px = new Proxy(t, traps);
   // Legacy interop: shared machinery (affects walks, wrap dedupe) reads the
   // proxy off looked-up targets as a field.
@@ -6819,13 +6989,6 @@ function getDeepNode(target) {
 function bumpDeep(t) {
   if (t.dk !== null) setSignal(t.dk, 1);
 }
-function markDescendants(target) {
-  let t = target;
-  while (t && !t.d) {
-    t.d = true;
-    t = t.u;
-  }
-}
 // ---------------------------------------------------------------------------
 // pending backing + fold (the single mutation point)
 /** target → committed backing at batch start (the fold diff's old side). */
@@ -6850,6 +7013,12 @@ function cloneRaw(source, t) {
     ? Object.defineProperties([], descs)
     : Object.create(Object.getPrototypeOf(source), descs);
 }
+/** Scanned plainness for patch admission (patchableRaw): runs the one-time
+ * accessor scan if it hasn't happened yet — the sticky `a` flag alone is not
+ * trustworthy before a scan (it starts false and is discovered lazily). */
+function targetIsPlain(target) {
+  return target.sc ? !target.a : scanAccessorsOnce(target);
+}
 /** One-time own-accessor scan (Annex-B probes, no descriptor allocation);
  * returns true when the container is plain data (overlay-safe). */
 function scanAccessorsOnce(target) {
@@ -6891,6 +7060,7 @@ function materializePB(target) {
   target.ovl = false;
 }
 function ensurePB(target) {
+  if (activeTransition !== null) foldBatches.set(target, activeTransition);
   let pb = target.pb;
   if (pb === null) {
     // Prototype-chain overlay (#3044): plain-data non-array containers
@@ -6934,6 +7104,25 @@ function ensurePB(target) {
   }
   return pb;
 }
+/** Sentinel holder for `t.ht`: a latest()-pull staged this adoption outside
+ * any transition — the hold lasts until the fold commit (drainFolds). */
+const PLAIN_HOLD = Symbol("plainHold");
+/** True while a latest() read is pulling the projection computed up to date
+ * (see the get trap): adoptions landing during the pull are speculative
+ * against the un-flushed batch and stage a held view. (Not injectable — the
+ * derived createStore overload retains projection machinery in every store
+ * bundle, see treeshake.test.ts.) */
+let latestPullActive = false;
+/** Resolve the held committed view (#3074): answers the masked old backing
+ * while the hold is live, and lazily clears a hold whose transition has
+ * committed (transitions merge — resolve through currentTransition, same as
+ * foldHeld's node stamps). */
+function heldMaskView(t) {
+  const ht = t.ht;
+  if (ht === null) return null;
+  if (ht !== PLAIN_HOLD && currentTransition(ht)?._done === true) return (t.ht = t.hv = null);
+  return t.hv;
+}
 /**
  * Adoption (2026-08-16c): the incoming object becomes the committed backing
  * IMMEDIATELY — reconcile is eagerly visible to every reader (shipped
@@ -6949,6 +7138,20 @@ function adoptPB(target, incoming, eager = false) {
   if (!eager) {
     queueFold(target); // records the pre-batch old before we swap
     target.adopted = true;
+    // #3074/#3075: a projection recompute deriving from uncommitted inputs
+    // swaps the backing SPECULATIVELY — committed-visibility readers must
+    // keep the pre-hold view until the hold resolves (a source held by a
+    // live transition, or a latest()-pull ahead of the flush). Post-await
+    // landings (write-override) stay immediately visible — landed truth —
+    // and clear any hold; optimistic families ride the lane machinery.
+    if (target.fam?.opt !== true) {
+      if (getWriteOverride()) {
+        target.ht = target.hv = null;
+      } else if (activeTransition !== null || latestPullActive) {
+        if (heldMaskView(target) === null) target.hv = target.v;
+        target.ht = activeTransition ?? PLAIN_HOLD;
+      }
+    }
   }
   target.pb = null;
   // Overlay and accessor-scan state describe the OUTGOING backing — a
@@ -6960,24 +7163,43 @@ function adoptPB(target, incoming, eager = false) {
   // draft rescans once (#3044 audit follow-up).
   target.ovl = false;
   target.del = null;
-  target.wk = null; // adoption supersedes any staged trap writes
   target.sc = false;
   target.a = false;
+  if (target.pc !== null) target.pc.wk = null; // adoption supersedes staged trap writes
   target.v = incoming;
   target.ch = incoming[$TARGET] !== undefined;
   (target.fam?.map ?? storeNextLookup).set(incoming, target);
 }
+/** Sentinel for `t.wk`: the written-keys bound is unusable this batch (an
+ * array length write implicitly deleted indices) — consumers full-scan. */
+const WK_ALL = new Set();
+const plainProto = o => {
+  const p = Object.getPrototypeOf(o);
+  return p === Object.prototype || p === Array.prototype || p === null;
+};
 function queueFold(target) {
   if (foldOlds.has(target)) return;
-  if (foldOlds.size === 0) {
-    if (!hookInstalled) {
-      hookInstalled = true;
-      setStoreCommitHook(drainFolds);
-    }
-    schedule(); // once per batch — drain clears the map
-  }
+  if (!hookInstalled) {
+    hookInstalled = true;
+    setStoreCommitHook(drainFolds);
+  }
+  // Always arm — "map non-empty ⇒ drain scheduled" is NOT an invariant: a
+  // held re-queue, or an incomplete-transition flush (which skips
+  // commitPendingNodes entirely), leaves entries behind after `scheduled`
+  // was consumed. A size-gated arm then strands every LATER fold — queued
+  // silently, never drained, committed base frozen at stale state while its
+  // nodes commit (#3089). schedule() early-returns when already armed.
+  schedule();
   foldOlds.set(target, target.v);
 }
+/** Fold write-attribution (#3089): a draft written while a transition is
+ * active belongs to that transition — its fold must not commit before the
+ * transition settles. Observed keys already defer through the held check in
+ * drainFolds (their nodes carry _pendingValue); this write-time stamp is the
+ * equivalent hold for UNOBSERVED keys, which have no node to consult.
+ * Refreshed on every write; resolved through currentTransition at drain
+ * (transitions merge — same rule as heldMaskView). */
+const foldBatches = new WeakMap();
 /** Committed-time privatization for parent-chain slot updates (path copying). */
 function privatizeCommitted(target) {
   if (ownedRaw.has(target.v)) return;
@@ -6997,7 +7219,27 @@ function drainFolds() {
   const entries = [...foldOlds];
   foldOlds.clear();
   for (const [t, old] of entries) {
+    // A latest()-pull staging holds only until the fold commit: this flush
+    // is committing the batch the pull ran ahead of. Transition holds stay —
+    // they clear when their transition is done (heldMaskView).
+    if (t.ht === PLAIN_HOLD) t.ht = t.hv = null;
+    // Eager (write-override) family folds swap pb -> v at notifyWrites'
+    // tail: by the time this drain runs they carry no pb, and their
+    // structural ops must emit at the fold-commit site below (the clone
+    // branch never sees them). Re-audit blocker 4.
+    const foldedEager = t.pb === null;
     if (t.pb !== null) {
+      // #3089: a fold written under a still-running transition defers to
+      // that transition's settle (the write-time stamp covers unobserved
+      // keys; observed keys also hit the pending-node held check below).
+      const fb = foldBatches.get(t);
+      if (fb !== undefined) {
+        if (currentTransition(fb)._done === false) {
+          foldOlds.set(t, old);
+          continue;
+        }
+        foldBatches.delete(t);
+      }
       // Setter path: nodes were setSignal'd at setter exit (write-time
       // notification — transitions/holds ride core machinery). Commit the
       // backing only for keys whose nodes have committed; a still-pending
@@ -7009,9 +7251,14 @@ function drainFolds() {
         // Only written keys can hold (their nodes took the setSignal); the
         // wk bound keeps this O(written) — see notifyWrites. Same fallback
         // rules as the notify (WK_ALL / accessors / non-plain prototypes).
-        const wkh = t.wk;
+        const wkh = t.pc !== null ? t.pc.wk : null;
         const keys =
-          wkh === null || wkh === WK_ALL || t.a === true || !plainProto(t.ovl ? t.v : pb)
+          wkh === null ||
+          wkh === WK_ALL ||
+          t.a === true ||
+          // Overlay pbs chain to the COMMITTED object (#3044) — plainness is
+          // the committed container's prototype, not the overlay's.
+          !plainProto(t.ovl ? t.v : pb)
             ? Reflect.ownKeys(nodes)
             : wkh;
         for (const key of keys) {
@@ -7049,15 +7296,70 @@ function drainFolds() {
         (t.fam?.map ?? storeNextLookup).delete(pb);
         t.pb = null;
         t.ovl = false;
-        t.wk = null; // written-keys window closes with the fold commit
+        if (t.pc !== null) t.pc.wk = null; // written-keys window closes with the fold commit
       } else {
+        // Setter-channel structural ops: a fold that changes an array's shape
+        // (push/splice/permutation through the setter — the reconcile walk
+        // never queues here) is a structural visibility transition for any
+        // registered list driver. Identity-keyed; aligned folds emit nothing.
+        // Family targets defer to their own adoption emission (fam reconcile).
+        // Arrays always fold on this clone branch (overlay is non-array only).
+        // Family setter drafts (writable projection push/splice through the
+        // masked setter) fold on this branch too and the fold IS their
+        // visibility moment — emit unless the structure already rode another
+        // channel: adoption folds (reconcile walk emitted ops) and
+        // optimistic families (lane-timed override channel). Re-audit
+        // blocker 4.
+        if (
+          t.pc !== null &&
+          t.pc.ro !== null &&
+          !t.adopted &&
+          t.fam?.opt !== true &&
+          Array.isArray(pb) &&
+          Array.isArray(t.v)
+        )
+          rowHooks.emitSetterRowOps(t, t.v, pb);
         t.v = pb;
         t.ch = false; // pb is always a plain clone
         t.pb = null;
-        t.wk = null; // written-keys window closes with the fold commit
+        if (t.pc !== null) t.pc.wk = null; // written-keys window closes with the fold commit
+      }
+    }
+    if (t.v === old) {
+      // A no-op adoption (A -> B -> A before flush) still consumed its walk:
+      // clear the flag or every later setter row-op gate (!t.adopted) stays
+      // failed and a driven family list freezes (re-audit 5, P1-1).
+      t.adopted = false;
+      continue;
+    }
+    // Patch channel (fold-commit site): family targets emit HERE — the fold
+    // IS their visibility moment (held folds re-queued above emit when they
+    // actually commit) — and so do PLAIN fold-adopted targets (setter-
+    // returned root replacements, chained-store swaps: adoptions WITHOUT a
+    // reconcile walk, so no walk-site emission ever happened — re-audit 2,
+    // P1-2). Plain eager targets emitted at their walk/setter sites already.
+    if (t.pc !== null && (t.fam !== null || t.adopted)) {
+      // Structural ops for folds whose structure rode no other channel:
+      // eager-folded family SETTER drafts (write-override swaps pb -> v at
+      // notifyWrites' tail — the clone branch never sees them; adoption
+      // folds re-emitting would double the walk's ops) and PLAIN fold
+      // adoptions (no walk at all). Optimistic families ride the override
+      // channel (lane-timed ops + revert RESYNC) — never re-emit here.
+      if (
+        t.pc.ro !== null &&
+        t.fam?.opt !== true &&
+        (t.fam !== null ? foldedEager && !t.adopted : t.adopted) &&
+        Array.isArray(t.v) &&
+        Array.isArray(old)
+      )
+        rowHooks.emitSetterRowOps(t, old, t.v);
+      if (t.pc.p !== null) {
+        // Accessor demotion at the fold-commit seam is DEV-ONLY (see the
+        // reconcile seam note: prod never pays per-adoption scans).
+        if (!targetIsPlain(t)) patchHooks.demoteToEffects(t);
+        else patchHooks.emitPatchLocal(t, t.v, old);
       }
     }
-    if (t.v === old) continue; // adopted then re-adopted back, or no-op
     // Path copying (CAS: see the eager-fold twin above).
     if (t.u && t.u.v[t.pk] === old) {
       privatizeCommitted(t.u);
@@ -7078,17 +7380,6 @@ function drainFolds() {
  * "pending home = the node when a node exists"). Unobserved keys stay in the
  * pending backing and fold directly at commit.
  */
-/** Sentinel for `t.wk`: the written-keys bound is unusable this batch (an
- * array length write implicitly deleted indices) — consumers full-scan. */
-const WK_ALL = new Set();
-/** Plain-prototype check for the written-keys bound: prototype getters on
- * class instances can derive from ANY field, so only plain-data containers
- * may bound the notify to written keys. Overlay pbs chain to the COMMITTED
- * object (#3044), so overlay plainness is judged on the committed proto. */
-const plainProto = o => {
-  const p = Object.getPrototypeOf(o);
-  return p === Object.prototype || p === Array.prototype || p === null;
-};
 function notifyWrites(t) {
   let pb = t.pb;
   if (pb === null) return;
@@ -7143,8 +7434,15 @@ function notifyWrites(t) {
   // not a full scan). Falls back to the full node scan when the bound can't
   // hold: no trap granularity (wk null), an array length write (WK_ALL —
   // implicit index deletes), accessors on the record (t.a — a getter node's
-  // value can change when ANY key is written), or a non-plain prototype.
-  const wk0 = t.wk;
+  // value can change when ANY key is written), or a non-plain prototype
+  // (class instances: prototype getters derive from arbitrary fields).
+  const wk0 = t.pc !== null ? t.pc.wk : null;
+  // Overlay pbs chain to the COMMITTED object (#3044): a prototype-overlay
+  // draft is plain data on its own layer, but its getPrototypeOf is the
+  // committed container — judge plainness by the COMMITTED prototype or the
+  // bound never engages for overlay writes (every plain-object setter batch
+  // would full-scan: the exact selection-map workload wk exists for; jf
+  // `select` regressed 2x on this).
   const writtenKeys = wk0 === WK_ALL || t.a === true || !plainProto(t.ovl ? t.v : pb) ? null : wk0;
   if (nodes !== null) {
     const keys = writtenKeys ?? Reflect.ownKeys(nodes);
@@ -7177,15 +7475,18 @@ function notifyWrites(t) {
   }
   const has = t.h;
   if (has !== null) {
-    for (const key of Reflect.ownKeys(has))
-      setSignal(has[key], key in pb && !(t.del !== null && t.del.has(key)));
+    const keys = writtenKeys ?? Reflect.ownKeys(has);
+    for (const key of keys) {
+      const node = has[key];
+      if (node !== undefined) setSignal(node, key in pb && !(t.del !== null && t.del.has(key)));
+    }
   }
   // Deep-witness (dk): setter writes must notify a deep() subscriber even on
-  // keys with no node. O(pb keys) equality only when a witness exists.
+  // keys with no node. O(written/pb keys) equality only when a witness exists.
   if (t.dk !== null) {
     if (t.del !== null && t.del.size !== 0) bumpDeep(t);
     else
-      for (const key of Reflect.ownKeys(pb)) {
+      for (const key of writtenKeys ?? Reflect.ownKeys(pb)) {
         const nv = pb[key];
         const ov = old[key];
         if (nv !== null && typeof nv === "object" ? !targetsEqual(ov, nv) : !isEqual(ov, nv)) {
@@ -7215,6 +7516,13 @@ function notifyWrites(t) {
     }
     if (changed) setSignal(t.k, v => v + 1);
   }
+  // Patch channel (setter site): a committed write transitions this record —
+  // queue its patches and bubble to ancestors (targeted nested writes must
+  // reach the row patch, §4b). One number compare when no patches exist.
+  // Family targets skip this site: their visibility moment is the FOLD
+  // commit (drainFolds emits), not the recompute/draft write.
+  if (t.fam === null && patchHooks !== null && patchHooks.hasPatches())
+    patchHooks.emitPatch(t, pb, old);
   // Projection backing folds split by channel (two pinned contracts):
   // - sync-derive drafts (recompute body): NEVER eager — a downstream async
   //   hold can form LATER in the same flush and the leaf must stay at stale
@@ -7226,9 +7534,11 @@ function notifyWrites(t) {
   //   downstream consumer's own async still holds the effect-level reveal
   //   (spec-async "verdicts never inherit consumers' in-flight state").
   if (t.fam !== null && t.pb !== null && getWriteOverride()) {
+    // Landed truth (post-await write-override): immediately visible to every
+    // reader — any staged held view is superseded.
+    if (t.ht !== null) t.ht = t.hv = null;
     const oldBacking = t.v;
     t.pb = null;
-    t.wk = null; // written-keys window closes with the eager fold
     t.v = pb;
     t.ch = false;
     if (t.u && t.u.v[t.pk] === oldBacking) {
@@ -7433,6 +7743,17 @@ function inOwnerContext() {
   const eff = c._root ? c._parentComputed : c;
   return eff != null && !(eff._config & CONFIG_CHILDREN_FORBIDDEN);
 }
+/** CHILDREN_FORBIDDEN execution scope (createTrackedEffect / onSettled
+ * callbacks). Distinct from context-free: these scopes get committed
+ * visibility even against a projection's authoritative-elect pending
+ * backing (#3082) — parity with signals, where core read() serves
+ * committed to them regardless of staged writes. */
+function inForbiddenScope() {
+  const c = getOwner();
+  if (c === null) return false;
+  const eff = c._root ? c._parentComputed : c;
+  return eff != null && !!(eff._config & CONFIG_CHILDREN_FORBIDDEN);
+}
 /** A pending fold is transition-held when any written node's parked value is
  * stamped by a live transition (a plain batch parking — the lazy-recompute
  * read case — has no transition stamp and serves fresh). */
@@ -7451,6 +7772,20 @@ function foldHeld(target) {
   return false;
 }
 function readSource(target) {
+  // Held view first (#3074): an adoption staged under a live hold serves the
+  // pre-hold committed backing to committed-visibility readers. Speculative
+  // readers — drafts, write-override, owner-context computeds recomputing
+  // inside the transaction, and latest() reads — see the adopted backing.
+  if (
+    target.ht !== null &&
+    !latestReadActive &&
+    !inDraft(target) &&
+    !getWriteOverride() &&
+    !inOwnerContext()
+  ) {
+    const hv = heldMaskView(target);
+    if (hv !== null) return hv;
+  }
   // Signal-parity visibility (core read(): owner-context reads serve
   // _pendingValue, context-free reads serve committed — effects recompute
   // BEFORE commitPendingNodes in the flush, so the pending view must be
@@ -7464,8 +7799,10 @@ function readSource(target) {
       inOwnerContext() ||
       // A projection's pending backing is authoritative-elect: serve it to
       // context-free readers too UNLESS a transition is holding the node
-      // commits (downstream async hold — stale committed is the contract).
-      (target.fam !== null && !foldHeld(target)))
+      // commits (downstream async hold — stale committed is the contract)
+      // or the reader is a CHILDREN_FORBIDDEN scope, which never observes
+      // its own unsettled write (#3082, signal parity per #3006).
+      (target.fam !== null && !foldHeld(target) && !inForbiddenScope()))
   )
     return target.pb;
   return target.v;
@@ -7509,9 +7846,11 @@ function hasActiveOverride(node) {
  * FORCE sentinels never surface (they only bump subscribers of accessor
  * keys, which are served by the trap, not the node). */
 function nodeValue(node, backing) {
+  // latest() sees the in-flight parked value like an owner-context reader
+  // does (#3075) — signal/memo parity for store-node-backed keys.
   const v = hasActiveOverride(node)
     ? unwrapOverride(node._x?._overrideValue)
-    : node._pendingValue !== NOT_PENDING && inOwnerContext()
+    : node._pendingValue !== NOT_PENDING && (latestReadActive || inOwnerContext())
       ? node._pendingValue
       : backing;
   return v === FORCE ? backing : v;
@@ -7602,6 +7941,27 @@ function firewallGate(target) {
   const fw = target.fam?.node;
   if (fw != null && fw._statusFlags & (STATUS_UNINITIALIZED | STATUS_ERROR)) read(fw);
 }
+/** latest() pull (#3075): bring the projection computed up to date so the
+ * read serves the IN-FLIGHT derivation — signal/memo parity, where core
+ * read() routes latest() through a companion that recomputes speculatively.
+ * The latest flag is suspended for the recompute (the derive's own reads
+ * are normal reads), and latestPullActive marks any adoption it commits as
+ * staged (see adoptPB) — the speculative swap must not leak to
+ * committed-visibility readers before the flush. */
+function pullProjectionForLatest(target) {
+  const fw = target.fam.node;
+  if (fw == null) return;
+  const prevLatest = latestReadActive;
+  setLatestReadActive(false);
+  const prevPull = latestPullActive;
+  latestPullActive = true;
+  try {
+    prepareComputed(fw, true);
+  } finally {
+    latestPullActive = prevPull;
+    setLatestReadActive(prevLatest);
+  }
+}
 const traps = {
   get(target, key, receiver) {
     // One typeof gates every brand-symbol compare off the hot string path
@@ -7629,6 +7989,11 @@ const traps = {
     }
     if (pendingCheckActive) witnessAffectsMark(target, key);
     if (target.fam !== null && getObserver() === null && !inDraft(target)) firewallGate(target);
+    // latest() pull (#3075): store traps never reach core read() without an
+    // observer, so bring the projection computed up to date here — signal/
+    // memo parity for latest() reads through a projection.
+    if (target.fam !== null && latestReadActive && !inDraft(target) && !getWriteOverride())
+      pullProjectionForLatest(target);
     const src = readSource(target);
     // Overlay delete (#3044): a prototype overlay cannot shadow a delete, so
     // deleted keys are tracked aside and read as absent in the pending view.
@@ -7852,14 +8217,15 @@ const traps = {
     // Array length writes implicitly delete indices — the written-keys bound
     // can't see them, so poison to the full scan for this batch. Index
     // writes implicitly GROW length, so arrays always record it alongside.
+    const pcs = pcOf(target);
     if (Array.isArray(pb)) {
-      if (key === "length") target.wk = WK_ALL;
-      else if (target.wk !== WK_ALL) {
-        const wk = (target.wk ??= new Set());
+      if (key === "length") pcs.wk = WK_ALL;
+      else if (pcs.wk !== WK_ALL) {
+        const wk = (pcs.wk ??= new Set());
         wk.add(key);
         wk.add("length");
       }
-    } else if (target.wk !== WK_ALL) (target.wk ??= new Set()).add(key);
+    } else if (pcs.wk !== WK_ALL) (pcs.wk ??= new Set()).add(key);
     // Own data keys literally named "prototype"/"constructor" land as data —
     // defineProperty sidesteps a proto-chain setter named the same.
     if (UNSAFE_KEYS.has(key)) {
@@ -7897,12 +8263,20 @@ const traps = {
     const override = !draft && getWriteOverride();
     if (!draft && !override) return true;
     if (key === "__proto__") return true;
-    if (desc.get || desc.set) target.a = true;
+    if (desc.get || desc.set) {
+      target.a = true;
+      // Accessor demotion (re-audit blocker 3): a record that acquires an
+      // accessor after patch registration stops being patchable — pull its
+      // patches and re-drive them as tracked effect fallbacks. Hooks are
+      // installed whenever pc.p exists (registration installs them).
+      if (target.pc !== null && target.pc.p !== null) patchHooks.demoteToEffects(target);
+    }
     // Unwrap before ensurePB (see the set trap: self-reference materializes).
     if ("value" in desc) desc = { ...desc, value: unwrapValue(desc.value) };
     const pb = ensurePB(target);
     pendingNotify.add(target);
-    if (target.wk !== WK_ALL) (target.wk ??= new Set()).add(key);
+    const pcd = pcOf(target);
+    if (pcd.wk !== WK_ALL) (pcd.wk ??= new Set()).add(key);
     Object.defineProperty(pb, key, desc);
     if (target.del !== null) target.del.delete(key);
     if (override) notifyWrites(target);
@@ -7914,7 +8288,8 @@ const traps = {
     if (!draft && !override) return true;
     const pb = ensurePB(target);
     pendingNotify.add(target);
-    if (target.wk !== WK_ALL) (target.wk ??= new Set()).add(key);
+    const pcx = pcOf(target);
+    if (pcx.wk !== WK_ALL) (pcx.wk ??= new Set()).add(key);
     delete pb[key];
     // A prototype overlay cannot shadow a delete of a committed key —
     // record it aside (#3044); reads/has/ownKeys/commit consult the set.
@@ -7987,8 +8362,39 @@ function createStoreNext(init, shallow = false) {
   const setter = fn => storeSetterNext(proxy, fn);
   return [proxy, setter];
 }
+/** True when `proxy` is a SHALLOW store (children served verbatim, slots
+ * replaced by reference — #2932). The list driver uses this to choose the
+ * slot-patch channel (collected row bodies) over per-record registration. */
+function storeIsShallow(proxy) {
+  const t = proxy?.[$TARGET];
+  return t !== undefined && t.s === true;
+}
+/** True when `proxy` belongs to a projection/optimistic FAMILY. The list
+ * driver must DECLINE family arrays (external audit finding): family
+ * structural changes never emit row/slot ops (the setter channel is
+ * fam-gated; optimistic writes ride node overrides), and the proxy identity
+ * is stable so the each-watch cannot catch the change either — an engaged
+ * list would freeze on optimistic/projection structural updates. Record-
+ * level family patches are unaffected (they have their own emission). */
+function storeHasFamily(proxy) {
+  const t = proxy?.[$TARGET];
+  return t !== undefined && t.fam !== null;
+}
+/** True when `proxy` belongs to an OPTIMISTIC family specifically. The list
+ * driver declines these (audit finding, narrowed): optimistic user writes
+ * ride node-level overrides — they never enter the reconcile walk, so no
+ * row/slot ops are emitted and an engaged list would freeze on optimistic
+ * structural changes. PROJECTION (non-optimistic) families are drivable:
+ * their recomputes go through the reconcile walk, whose emissions are
+ * transition-stamped in the apply queue like any other (equivalence-matrix
+ * gated). Re-admitting optimistic families requires a lane-timed structural
+ * emission mirroring emitPatchOptimistic, plus revert resync. */
+function storeHasOptimisticFamily(proxy) {
+  const t = proxy?.[$TARGET];
+  return t !== undefined && t.fam?.opt === true;
+}
 /** Tracking deep snapshot (`deep()` for next targets): subscribes to the
- * key-set and every property node at every reachable level, then returns the
+ * key-set and deep-witness node at every reachable level, then returns the
  * plain view. Shared references and cycles handled via the visited set. */
 function deepNext(value) {
   const t0 = value?.[$TARGET];
@@ -8188,7 +8594,7 @@ function reconcileNextState(value, state, key, replace = false) {
     // positional so old-entity subtrees never merge into the new entity's).
     const prev = t.pb ?? t.v;
     const eq = keyFn(prev);
-    if (eq !== undefined && keyFn(incoming) !== eq) {
+    if (eq !== undefined && !sameKey(keyFn(incoming), eq)) {
       if (!replace) throw new Error("Cannot reconcile states with different identity");
       // Entity change: wholesale swap. The root proxy is stable for life
       // (proj R5) but NOTHING below survives — children are never matched
@@ -8229,6 +8635,33 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
   const shallow = t.s === true;
   const old = t.v;
   adoptPB(t, incoming, eager);
+  // Patch channel (adoption site): this record transitioned — queue its
+  // patches with the pre-adopt prev. No bubbling walk: the adoption walk
+  // visits parents before children, so ancestors emitted already. EAGER
+  // only — family targets' visibility moment is their fold commit
+  // (drainFolds emits there; emitting here too would double-fire).
+  if (patchHooks !== null && eager && t.pc !== null && t.pc.p !== null) {
+    // Accessor demotion at the ADOPTION seam is DEV-ONLY (prod principle:
+    // explicitly-odd input must not cost correct-input prod — the
+    // per-adoption scan was ~12% of dbmon's tick since adoptPB resets the
+    // verdict every adoption). Dev demotes AND warns; prod emits directly,
+    // so a getter adoptee's OUTSIDE deps (signals) won't re-apply in prod —
+    // caught loudly during development instead. Registration-time admission
+    // (patchableRaw) keeps its full one-time scan in both modes.
+    if (!targetIsPlain(t)) {
+      console.warn(
+        "A reconcile adopted an object with own getters into a record that " +
+          "carries compiled patches. Patches read raw values and will not " +
+          "track the getters' reactive dependencies — this record's patches " +
+          "are demoted to effects in development, but production will NOT " +
+          "demote. Avoid getters on patched records, or key them out of " +
+          "patch-eligible templates."
+      );
+      patchHooks.demoteToEffects(t);
+    } else {
+      patchHooks.emitPatchLocal(t, incoming, old);
+    }
+  }
   // Shallow adoption: records are slot values — sticky raw-mark the incoming
   // set (R41) and never descend; slot notification is the positional diff.
   if (shallow) markRawIngest(incoming);
@@ -8268,7 +8701,7 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
             typeof pvRaw === "object" &&
             nv !== null &&
             typeof nv === "object" &&
-            keyFn(pvRaw) === keyFn(nv)
+            sameKey(keyFn(pvRaw), keyFn(nv))
           )
         )
           break; // misaligned: fall to the keyed remainder below
@@ -8296,6 +8729,7 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
         }
       }
       if (t.dk !== null && !dkBumpedA && i < nextRows.length) bumpDeep(t);
+      const structStart = i; // misalignment point (== nlen on aligned ticks)
       let prevByKey = null;
       for (; i < nextRows.length; i++) {
         const nv = nextRows[i];
@@ -8305,16 +8739,39 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
           let pv;
           if (nk !== undefined) {
             if (prevByKey === null) {
+              // Occurrence-aware (re-audit 2, P1-5): duplicate keys queue
+              // their prev INDICES (rows can themselves be arrays, so index
+              // queues are the unambiguous encoding — same as buildRowOps)
+              // and each is consumed ONCE. First-wins would adopt two next
+              // rows into the SAME prev target while row ops retain two
+              // separate DOM rows (the second one stale).
               prevByKey = new Map();
-              for (let j = 0; j < prevRows.length; j++) {
+              // From structStart, not 0 (re-audit 3, P1-2): prefix-aligned
+              // rows already adopted their incoming counterparts — re-offering
+              // them here let a duplicate key adopt a prefix row AGAIN while
+              // row ops (which correctly window from structStart) retained
+              // the later occurrence's DOM row against a never-adopted target.
+              for (let j = structStart; j < prevRows.length; j++) {
                 const p = unwrapValue(prevRows[j]);
                 if (p !== null && typeof p === "object") {
                   const pk = keyFn(p);
-                  if (pk !== undefined && !prevByKey.has(pk)) prevByKey.set(pk, p);
+                  if (pk === undefined) continue;
+                  const existing = prevByKey.get(pk);
+                  if (existing === undefined) prevByKey.set(pk, j);
+                  else if (Array.isArray(existing)) existing.push(j);
+                  else prevByKey.set(pk, [existing, j]);
                 }
               }
             }
-            pv = prevByKey.get(nk);
+            const m = prevByKey.get(nk);
+            if (m === undefined) pv = undefined;
+            else if (Array.isArray(m)) {
+              pv = unwrapValue(prevRows[m.shift()]);
+              if (m.length === 1) prevByKey.set(nk, m[0]);
+            } else {
+              pv = unwrapValue(prevRows[m]);
+              prevByKey.delete(nk);
+            }
           } else {
             pv = unwrapValue(prevRows[i]); // keyless item: positional fallback
           }
@@ -8328,12 +8785,62 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
           }
         }
       }
+      // Row ops (PR-B): emit structural ops ONLY when structure changed —
+      // aligned value ticks pay nothing. Built after the walk so retained
+      // rows' value patches queue first (adds bind at op-apply).
+      if (
+        rowHooks !== null &&
+        t.pc !== null &&
+        t.pc.ro !== null &&
+        (structStart < nlen || plen !== nlen)
+      )
+        buildAndEmitRowOps(t, prevRows, nextRows, structStart, keyFn);
     } else {
       const dlen = Math.min(prevRows.length, nextRows.length);
       const nlen = nextRows.length;
       let dkBumpedP = false;
+      const sp = rowHooks !== null && t.pc !== null ? t.pc.sp : null;
+      // Row ops for shallow/positional lists: track the key-aligned prefix
+      // (keyed) so aligned value ticks emit nothing; keyless lists emit only
+      // on length change (append/truncate). Slot-patch consumers need the
+      // alignment tracking too (aligned = value tick, misaligned = ops).
+      const ro = rowHooks !== null && t.pc !== null ? t.pc.ro : null;
+      let keyAligned = keyFn !== null && (ro !== null || sp !== null);
+      let keyPrefix = 0;
       for (let i = 0; i < nlen; i++) {
         const nvP = nextRows[i];
+        if (keyAligned && i < dlen) {
+          const pvK = prevRows[i];
+          if (
+            pvK !== null &&
+            typeof pvK === "object" &&
+            nvP !== null &&
+            typeof nvP === "object" &&
+            // SameValueZero (self-sweep): strict === here broke slot
+            // alignment on NaN keys while buildRowOps retained the row —
+            // retained DOM with suppressed value ticks (the round-1 NaN
+            // staleness, in the shallow branch).
+            sameKey(keyFn(pvK), keyFn(nvP))
+          )
+            keyPrefix++;
+          else keyAligned = false;
+        }
+        // Slot-patch dispatch (shallow): a KEY-ALIGNED slot whose value was
+        // replaced by reference is a value tick — emit through the queue.
+        // Misaligned/appended slots are STRUCTURE (row ops rebuild or move
+        // them; new rows initial-apply at bind), so they emit nothing here.
+        // Keyless positional lists treat same-index replacement as the value
+        // tick for indices below the common length.
+        // `i < dlen` is load-bearing for BOTH modes: an appended position
+        // past a fully-aligned prefix (vacuously aligned when prev is empty)
+        // has no previous slot — emitting a slot tick for it races the row
+        // ops that CREATE the row (the slot queue applies first, indexing a
+        // row that does not exist yet). Equivalence-matrix finding:
+        // clear-then-refill and pure appends crashed the driver.
+        if (sp !== null && i < dlen && (keyFn === null || keyAligned)) {
+          const pvS = prevRows[i];
+          if (pvS !== nvP) rowHooks.emitSlotPatch(t, i, nvP, pvS);
+        }
         if (!shallow && i < dlen && nvP !== null && typeof nvP === "object")
           descend(unwrapValue(prevRows[i]), nvP, keyFn, fam, proj);
         if (
@@ -8354,6 +8861,15 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
           }
         }
       }
+      if (ro !== null) {
+        const plen = prevRows.length;
+        if (keyFn !== null) {
+          if (keyPrefix < nlen || plen !== nlen)
+            buildAndEmitRowOps(t, prevRows, nextRows, keyPrefix, keyFn);
+        } else if (plen !== nlen) {
+          buildAndEmitRowOps(t, prevRows, nextRows, dlen, null);
+        }
+      }
     }
     if (eager) {
       if (nodes !== null && nodesHit < t.nc) {
@@ -8374,6 +8890,22 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
     // slots must not notify, R9). This replaces the notifyFold re-walk that
     // doubled dbmon's diff cost. for-in covers own enumerable string keys
     // with no key-array allocation; symbols get a pass only when present.
+    // PROTOTYPE compiled-patch fast path: a pure-patch record (no nodes,
+    // no presence/key-set/deep subscribers, no family) adopts and hands the
+    // (next, prev) pair to its compiled patch — no per-key walk at all.
+    if (
+      t.pc !== null &&
+      t.pc.p !== null &&
+      eager &&
+      t.n === null &&
+      t.h === null &&
+      t.k === null &&
+      t.dk === null &&
+      fam === null
+    ) {
+      // Adoption already ran at applyAdopt entry; emission was queued there.
+      return;
+    }
     const nodes = eager ? t.n : null;
     let nodesHit = 0;
     let dkBumped = false;
@@ -8439,6 +8971,93 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
   }
 }
 const hasOwnP = Object.prototype.hasOwnProperty;
+/** Setter-channel row ops (the fold site calls this for array targets with
+ * ops consumers): structural mutation through the setter — push/splice/index
+ * assignment/permutation — is a visibility transition for the list container
+ * just like a reconcile walk, and drivers consuming registerRowOps must see
+ * it. Setter mutations move the SAME row objects around, so RAW IDENTITY is
+ * the key. Aligned arrays (value-only folds) emit nothing. */
+const identityKey = r => unwrapValue(r);
+/** Key equality for EVERY key comparison in this module (re-audit 2, P1-5):
+ * SameValueZero, matching the Map-based matchers (buildRowOps, the adoption
+ * window) — NaN keys are equal to themselves, so aligned NaN rows stay
+ * aligned in the prefix walk instead of forever misaligning. Adoption and
+ * row ops MUST agree on key equality or retained DOM rows go stale. */
+function sameKey(a, b) {
+  return a === b || (a !== a && b !== b);
+}
+function emitSetterRowOps(t, prevRows, nextRows) {
+  const ops = buildIdentityRowOps(prevRows, nextRows);
+  if (ops !== null) rowHooks.emitRowOps(t, nextRows, ops);
+}
+/** Identity-keyed structural diff, returned rather than emitted: shared by
+ * the setter channel (regular queue) and the OPTIMISTIC write channel (lane
+ * queue) — same retention semantics, different dispatch timing. Returns
+ * null when the lists are identity-aligned (no structure changed). */
+function buildIdentityRowOps(prevRows, nextRows) {
+  let p = 0;
+  const min = prevRows.length < nextRows.length ? prevRows.length : nextRows.length;
+  while (p < min && unwrapValue(prevRows[p]) === unwrapValue(nextRows[p])) p++;
+  if (p === prevRows.length && p === nextRows.length) return null;
+  return buildRowOps(prevRows, nextRows, p, identityKey);
+}
+/** Shared row-ops builder (keyed deep branch + shallow/positional branch):
+ * key-matches the misaligned window into { prefix, sources, removed }.
+ * `keyFn === null` degrades to positional ops (append/truncate only). */
+function buildAndEmitRowOps(t, prevRows, nextRows, structStart, keyFn) {
+  rowHooks.emitRowOps(t, nextRows, buildRowOps(prevRows, nextRows, structStart, keyFn));
+}
+function buildRowOps(prevRows, nextRows, structStart, keyFn) {
+  const plen = prevRows.length;
+  const nlen = nextRows.length;
+  const sources = new Array(nlen - structStart);
+  // Occurrence-aware matching (re-audit): duplicate keys queue their old
+  // indices and each is consumed ONCE — first-wins reuse would hand the same
+  // source (and its one DOM row) to multiple next positions. The no-dup fast
+  // shape stays a bare number; collisions upgrade to a queue.
+  let oldIndexByKey = null;
+  if (keyFn !== null && structStart < plen) {
+    oldIndexByKey = new Map();
+    for (let j = structStart; j < plen; j++) {
+      const p = unwrapValue(prevRows[j]);
+      if (p !== null && typeof p === "object") {
+        const pk = keyFn(p);
+        if (pk === undefined) continue;
+        const existing = oldIndexByKey.get(pk);
+        if (existing === undefined) oldIndexByKey.set(pk, j);
+        else if (Array.isArray(existing)) existing.push(j);
+        else oldIndexByKey.set(pk, [existing, j]);
+      }
+    }
+  }
+  const consumed = oldIndexByKey !== null ? new Set() : null;
+  for (let k = structStart; k < nlen; k++) {
+    const nv = nextRows[k];
+    let oldIdx = -1;
+    if (nv !== null && typeof nv === "object" && oldIndexByKey !== null) {
+      const nk = keyFn(nv);
+      if (nk !== undefined) {
+        const m = oldIndexByKey.get(nk);
+        if (m !== undefined) {
+          if (Array.isArray(m)) {
+            oldIdx = m.shift();
+            if (m.length === 1) oldIndexByKey.set(nk, m[0]);
+          } else {
+            oldIdx = m;
+            oldIndexByKey.delete(nk);
+          }
+          consumed.add(oldIdx);
+        }
+      }
+    }
+    sources[k - structStart] = oldIdx;
+  }
+  const removed = [];
+  for (let j = structStart; j < plen; j++) {
+    if (consumed === null || !consumed.has(j)) removed.push(unwrapValue(prevRows[j]));
+  }
+  return { prefix: structStart, sources, removed };
+}
 function descend(pv, nv, keyFn, fam, proj = false) {
   if (pv === null || typeof pv !== "object" || nv === null || typeof nv !== "object") return;
   // Lookup FIRST: a hit implies pv was wrappable and never raw-marked (only
@@ -8462,7 +9081,10 @@ function descend(pv, nv, keyFn, fam, proj = false) {
     const nk = keyFn(nv);
     // Key mismatch detaches: the slot takes the new entity; the old proxy
     // keeps its (old) backing and a fresh proxy wraps the new value on read.
-    if (pk !== undefined && nk !== undefined && pk !== nk) return;
+    // SameValueZero (re-audit 2, P1-5): NaN keys are self-equal — strict
+    // inequality detached every NaN-keyed slot on every tick while the
+    // Map-based row-ops matcher retained its DOM row (stale forever).
+    if (pk !== undefined && nk !== undefined && !sameKey(pk, nk)) return;
   }
   // Reachability pruning (§6d) is MODE-dependent, both pinned:
   // - keyed matching descends only where subscriptions exist at/below (`d`) —
@@ -8701,6 +9323,558 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
   return owner;
 }
 
+/**
+ * PR-A: the patch channel (DESIGN-PATCH-CHANNEL.md).
+ *
+ * Compiled patch functions — per-record compare-and-write consumers —
+ * dispatched by the store's visibility transitions instead of render
+ * effects. This module owns registration, the per-flush apply queue
+ * (effect-phase timing, §2b), the owned-prev rule (§2c), and dispatch
+ * bubbling (§4b). Emission calls live at the four visibility-transition
+ * sites (adoption walk, setter notify, fold commit, override lifecycle)
+ * and are gated on registration, so unpatched stores pay a null check.
+ *
+ * Bubbling contract: a targeted nested write reaches ancestor patches as a
+ * FORCED re-apply — the third `force` argument makes every compiled compare
+ * pass, so the ancestor rewrites its bound fields from its current backing
+ * (idempotent, and prev-free: an ancestor's pre-state is not reconstructible
+ * after in-place folds). Compiled bodies therefore have the signature
+ * `(next, prev, force?)`.
+ *
+ * Tree-shaking: core never imports this module; stores without patches
+ * never schedule the queue.
+ */
+let queue = null;
+let scheduled = false;
+function drainApplyQueue() {
+  // Settle-time fallback for optimistic emissions (a reverting flush may
+  // have no active lanes left to run the lane-slot drain).
+  drainOptimistic();
+  const q = queue;
+  queue = null;
+  scheduled = false;
+  if (q === null) return;
+  // Per-entry isolation: one throwing patch must not abort its siblings
+  // (effect parity — each effect isolates its failure). A throwing patch
+  // routes through its REGISTERING OWNER's queue chain exactly like a
+  // render-effect error (§2b): an Errored boundary above the row collects
+  // it (source = the owner, error read via owner._x?._error). Unhandled errors
+  // rethrow after the drain so they still surface.
+  let firstError = UNSET;
+  for (let i = 0; i < q.length; i++) {
+    clearStamp(q[i]);
+    const { list, prev, force, t } = q[i];
+    const next = t !== null ? (t.pb ?? t.v) : q[i].next;
+    firstError = applyEntries(list, next, prev, force, firstError);
+  }
+  if (firstError !== UNSET) {
+    // Unhandled patch errors HALT like unhandled effect errors (re-audit 2,
+    // P1-4): app state is undefined past an unboundaried throw.
+    haltReactivity(firstError);
+    throw firstError;
+  }
+}
+const UNSET = Symbol();
+/** ONE callback/error primitive for every drain (normal, transition-held,
+ * optimistic): per-entry isolation — a throwing patch must not abort its
+ * siblings (effect parity) — and failures route through the REGISTERING
+ * OWNER's queue chain exactly like a render-effect error (§2b): an Errored
+ * boundary above the row collects it. Unhandled errors are aggregated by the
+ * caller (first one rethrows after its drain completes). */
+function applyEntries(list, next, prev, force, firstError) {
+  // SNAPSHOT multi-consumer lists (re-audit 5, P1-3): a callback can dispose
+  // a sibling's owner, whose unbind SPLICES this same array mid-iteration —
+  // index-walking the live array skips the shifted consumer. The dominant
+  // single-consumer case pays nothing; unbound entries are marked so a
+  // snapshot never applies a consumer severed by an earlier callback.
+  const snap = list.length > 1 ? list.slice() : list;
+  for (let j = 0; j < snap.length; j++) {
+    const entry = snap[j];
+    if (entry.u === true) continue;
+    // Disposed owners drop their patches (the row unmounted mid-flush).
+    if (entry.owner !== null && isDisposed(entry.owner)) continue;
+    try {
+      entry.fn(next, prev, force);
+    } catch (err) {
+      let handled = false;
+      const owner = entry.owner;
+      if (owner !== null) {
+        // Route through the nearest COMPUTED ancestor (re-audit 2, P1-4):
+        // <Errored>.reset() recomputes its sources, and a plain owner (the
+        // list driver's listOwner) is not recomputable — the component/memo
+        // scope above it is, and recomputing it rebuilds the rows, exactly
+        // what reset means for a throwing render effect.
+        let source = owner;
+        while (source !== null && source._fn === undefined) source = source._parent;
+        source ??= owner;
+        const statusErr = new StatusError(source, err);
+        ext(source)._error = statusErr;
+        source._statusFlags = (source._statusFlags ?? 0) | STATUS_ERROR;
+        handled = owner._queue.notify(source, STATUS_ERROR, STATUS_ERROR, statusErr);
+      }
+      if (!handled && firstError === UNSET) firstError = err;
+    }
+  }
+  return firstError;
+}
+// Transition-stamped emissions (§2b, "the walk is not the visibility moment
+// inside a transition"): entries stash DIRECTLY on their transition
+// (`_heldPatches`) and release into the live queue when THAT batch commits
+// (patchCommitHook). Reverted transitions never commit — their stash drops
+// with the transition object, no revert bookkeeping. The field (rather than
+// a WeakMap) keeps the every-flush commit-hook check to one property read;
+// the ambient batch never stashes.
+let commitHookInstalled = false;
+function releaseBatch(batch) {
+  const held = batch._heldPatches;
+  if (held === undefined) return;
+  batch._heldPatches = undefined;
+  for (let i = 0; i < held.length; i++) pushLive(held[i]);
+}
+function pushLive(item) {
+  if (queue === null) queue = [];
+  queue.push(item);
+  if (!scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+function push(item) {
+  const tx = activeTransition;
+  if (tx !== null) {
+    let held = tx._heldPatches;
+    if (held === undefined) tx._heldPatches = held = [];
+    held.push(item);
+    return;
+  }
+  pushLive(item);
+}
+/** Self-entry push with SAME-BATCH COALESCING (re-audit 2/3): a record's
+ * later non-forced emission into the same container UPDATES the queued
+ * entry in place — `next` takes the newest capture (adoption swaps the
+ * backing object per emission; dropping the later one applied STALE state),
+ * `prev` keeps the batch's earliest (effect semantics: one application per
+ * batch spanning the whole window). The entry's consumer list is the live
+ * pc.p array, so mid-batch registrants ride the single application. Forced
+ * entries and row/slot ops never coalesce; the drain clears the stamps so a
+ * quiet record retains nothing from its last batch. */
+function pushSelf(pc, item) {
+  const tx = activeTransition;
+  let arr;
+  if (tx !== null) {
+    let held = tx._heldPatches;
+    if (held === undefined) tx._heldPatches = held = [];
+    arr = held;
+  } else {
+    if (queue === null) queue = [];
+    arr = queue;
+  }
+  if (pc.qa === arr && pc.qe !== null) {
+    const qe = pc.qe;
+    qe.next = item.next;
+    qe.list = item.list; // pc.p can be re-created if emptied mid-batch
+    return;
+  }
+  pc.qa = arr;
+  pc.qe = item;
+  item.pc = pc;
+  arr.push(item);
+  if (arr === queue && !scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+/** Drain-side stamp clear (re-audit 3, P2-6): without it a quiet long-lived
+ * record's channel retains its last batch's container array, entry, and both
+ * captured backings for the record's lifetime. */
+function clearStamp(item) {
+  const pc = item.pc;
+  if (pc !== undefined && pc.qe === item) {
+    pc.qa = null;
+    pc.qe = null;
+  }
+}
+/** Shallow clone for the owned-prev rule (§2c): owned backings fold values
+ * INTO the same raw at commit, so a queued prev must be snapshotted. */
+function clonePrev(prev) {
+  return Array.isArray(prev) ? prev.slice() : { ...prev };
+}
+/**
+ * Emit a record's visibility transition. Callers gate on `hasPatches()` and
+ * `t.d` cheaply; this function re-checks and walks ancestors (§4b).
+ */
+function emitPatch(t, next, prev) {
+  const p = t.pc !== null ? t.pc.p : null;
+  if (p !== null)
+    pushSelf(t.pc, {
+      list: p,
+      next,
+      prev: ownedRaw.has(prev) ? clonePrev(prev) : prev,
+      force: false,
+      t: null
+    });
+  // Bubbling: ancestors force-re-apply from their LIVE backing, resolved at
+  // drain (privatization may clone it between now and then).
+  let u = t.u;
+  while (u !== null) {
+    const up = u.pc !== null ? u.pc.p : null;
+    if (up !== null) push({ list: up, next: null, prev: null, force: true, t: u });
+    u = u.u;
+  }
+}
+/** Emission for sites that already stand at the record with both sides in
+ * hand and have already handled ancestors (the adoption walk descends —
+ * parents were visited first), so no bubbling walk. */
+function emitPatchLocal(t, next, prev) {
+  const p = t.pc !== null ? t.pc.p : null;
+  if (p !== null)
+    pushSelf(t.pc, {
+      list: p,
+      next,
+      prev: ownedRaw.has(prev) ? clonePrev(prev) : prev,
+      force: false,
+      t: null
+    });
+}
+/** Optimistic-channel emission: overrides are visible THIS flush while the
+ * transaction is in flight — that is what optimism means. These ride a
+ * dedicated queue drained at LANE-EFFECT timing (the regular effect queues
+ * are stashed by an in-flight action), with the regular drain as the
+ * settle-time fallback. `next === null` = forced re-apply from the live
+ * target (the revert shape: committed truth back onto the DOM). */
+let optQueue = null;
+function drainOptimistic() {
+  const q = optQueue;
+  optQueue = null;
+  if (q === null) return;
+  // Same isolation/routing primitive as the normal drain (re-audit blocker
+  // 5): one throwing optimistic patch must not abort its siblings, and it
+  // must reach the registering owner's Errored boundary.
+  let firstError = UNSET;
+  for (let i = 0; i < q.length; i++) {
+    clearStamp(q[i]);
+    const { list, prev, force, t } = q[i];
+    const next = t !== null ? (t.pb ?? t.v) : q[i].next;
+    firstError = applyEntries(list, next, prev, force, firstError);
+  }
+  if (firstError !== UNSET) {
+    haltReactivity(firstError);
+    throw firstError;
+  }
+}
+function emitPatchOptimistic(t, next, prev) {
+  const p = t.pc !== null ? t.pc.p : null;
+  if (p === null) return;
+  if (optQueue === null) optQueue = [];
+  if (next === null) optQueue.push({ list: p, next: null, prev: null, force: true, t });
+  else {
+    // Same-batch coalescing, optimistic container (re-audit 3): later
+    // non-forced emission updates the queued entry's next in place.
+    const pc = t.pc;
+    if (pc.qa === optQueue && pc.qe !== null) {
+      const qe = pc.qe;
+      qe.next = next;
+      qe.list = p;
+    } else {
+      const item = { list: p, next, prev, force: false, t: null };
+      pc.qa = optQueue;
+      pc.qe = item;
+      item.pc = pc;
+      optQueue.push(item);
+    }
+  }
+  // Backup scheduling: the lane-slot drain covers in-flight application; a
+  // stashed regular drain guarantees settle-time application when no lane
+  // survives to the final flush (pure reverts).
+  if (!scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+/** Row-ops emission at OPTIMISTIC (lane) timing: user drafts on an
+ * optimistic family must show structure IN FLIGHT — bypassing the
+ * transition stash exactly like emitPatchOptimistic. Two forms:
+ * - `ops` given (write site): `nextRows` is the draft's intended visible
+ *   list, ops the identity diff against the pre-write optimistic view.
+ * - `ops === null` (revert site): RESYNC — the consumer rebuilds retention
+ *   by row identity against the live post-revert view, resolved from the
+ *   target at drain time (overrides are gone by then, so `pb ?? v` IS the
+ *   committed truth). */
+function emitRowOpsOptimistic(t, nextRows, ops) {
+  const list = t.pc !== null ? t.pc.ro : null;
+  if (list === null) return;
+  if (optQueue === null) optQueue = [];
+  optQueue.push({
+    list: list.map(e => ({
+      owner: e.owner,
+      fn: (n, _p) => e.fn(n, ops)
+    })),
+    next: nextRows,
+    prev: null,
+    force: false,
+    t: nextRows === null ? t : null
+  });
+  if (!scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+/**
+ * Register a compiled patch on a store record. Multi-consumer (two lists
+ * can render one record); owner-scoped for disposal. Returns unbind.
+ */
+// Global registration count: the cheap gate emission sites check before any
+// per-record work (unpatched apps pay one number compare per transition).
+let patchCount = 0;
+function hasPatches() {
+  return patchCount > 0;
+}
+function registerPatch(record, fn) {
+  let t = record?.[$TARGET];
+  if (t === undefined) throw new Error("registerPatch: not a store record");
+  // Chained backings (§7b): register on the ULTIMATE owner — that is where
+  // value transitions fold and dispatch; the wrapper's identity is stable
+  // and would never fire (see ultimateTarget).
+  t = ultimateTarget(t) ?? t;
+  if (!commitHookInstalled) {
+    commitHookInstalled = true;
+    armPatchHooks();
+    setPatchCommitHook(releaseBatch);
+    GlobalQueue._drainPatchOptimistic = drainOptimistic;
+  }
+  const entry = { fn, owner: getOwner() };
+  const pc = pcOf(t);
+  const list = (pc.p ??= []);
+  list.push(entry);
+  patchCount++;
+  // Bindings are subscriptions for reachability (§6d pruning must descend
+  // into bound records).
+  markDescendants(t);
+  let unbound = false;
+  return () => {
+    if (unbound) return;
+    unbound = true;
+    entry.u = true; // dispatch snapshots skip severed consumers
+    // Decrement ONLY on actual removal: a demotion (demoteToEffects) may
+    // have already pulled this entry and repaired the count — the splice
+    // miss is how this closure learns that.
+    const idx = list.indexOf(entry);
+    if (idx >= 0) {
+      list.splice(idx, 1);
+      patchCount--;
+    }
+    if (list.length === 0 && pc.p === list) pc.p = null;
+  };
+}
+/** Resolve a target through CHAINED backings (§7b) to the ultimate owner.
+ * A projection family wrapper's backing IS another store's proxy: value
+ * transitions fold on the ULTIMATE target (the wrapper's identity never
+ * changes), so patch registration and raw resolution must land there or
+ * registered patches never fire (equivalence-matrix finding: projection
+ * value ticks froze driver rows while classic effects tracked through). */
+function ultimateTarget(t) {
+  while (t.ch) {
+    const u = (t.pb ?? t.v)?.[$TARGET];
+    if (u === undefined) return undefined;
+    t = u;
+  }
+  return t;
+}
+/** Dual-driver bind probe (compiler runtime contract): when `record` is a
+ * patchable store record, returns its CURRENT raw backing (the driver's
+ * initial force-apply reads it directly — no proxy traffic, no tracking);
+ * returns undefined otherwise (driver falls back to the effect path).
+ * Not patchable: non-records, non-proxies, accessor-bearing records
+ * (patches read raw — getters need tracked evaluation), broken chains. */
+function patchableRaw(record) {
+  let t = record?.[$TARGET];
+  if (t === undefined || t.px !== record || t.a === true) return undefined;
+  t = ultimateTarget(t);
+  // SCAN before trusting (re-audit blocker 3): `a` starts false and is only
+  // discovered lazily (first draft, deep walks) — admission must run the
+  // one-time own-accessor scan itself, or a getter-bearing record takes the
+  // patch path and its getter's OUTSIDE dependencies (signals, other
+  // records) never re-apply. Sticky `sc` makes this one probe pass per
+  // record lifetime.
+  if (t === undefined || !targetIsPlain(t)) return undefined;
+  return t.pb ?? t.v;
+}
+/** Accessor demotion (design §5): a record that acquires an accessor after
+ * registration stops being patchable — reads must go through tracked
+ * evaluation. Clears patches and repairs the global count; callers re-drive
+ * the pulled bodies (demoteToEffects). */
+function demotePatches(t) {
+  if (t.pc === null) return null;
+  const p = t.pc.p;
+  t.pc.p = null;
+  if (p === null) return null;
+  patchCount -= p.length;
+  // Drain IN PLACE: unbind closures captured this array — a late unbind must
+  // miss its indexOf and not double-decrement the repaired count.
+  return p.splice(0, p.length);
+}
+/** The demotion re-drive (re-audit blocker 3): each pulled body becomes the
+ * SAME dual-driver effect fallback the web runtime would have chosen had the
+ * record carried the accessor at bind — a tracked compute pass (next === prev
+ * short-circuits every compare into a pure read THROUGH THE PROXY, so getter
+ * dependencies track) plus an untracked force-apply at effect timing.
+ *
+ * Creation is DEFERRED to the effect phase: the trap that discovers the
+ * accessor runs mid-draft, and an effect's initial pass must not read
+ * through the proxy inside the write window. The record's own transition
+ * for that draft is covered by the new effect's initial force-apply.
+ *
+ * Known edge (documented): a demoted LIST-ROW body re-drives under its
+ * registering owner (the list owner), so per-row severing on removal is
+ * lost for demoted rows — the effect lives until the LIST disposes. Rows
+ * only demote when user code defines an accessor on a row record at
+ * runtime. */
+function demoteToEffects(t) {
+  const entries = demotePatches(t);
+  if (entries === null || entries.length === 0) return;
+  const proxy = t.px;
+  globalQueue.enqueue(EFFECT_RENDER, () => {
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      if (entry.owner !== null && isDisposed(entry.owner)) continue;
+      const fn = entry.fn;
+      runWithOwner(entry.owner, () =>
+        createRenderEffect(
+          () => {
+            fn(proxy, proxy, false);
+          },
+          () => {
+            // Block body: a compiled patch body's return value must not be
+            // mistaken for an effect cleanup.
+            untrack(() => fn(proxy, undefined, true));
+          }
+        )
+      );
+    }
+  });
+}
+/** Register a structural-ops consumer on a keyed store array (the list
+ * container's channel — what `For` consumes through the seam). */
+function registerRowOps(array, fn) {
+  let t = array?.[$TARGET];
+  if (t === undefined) throw new Error("registerRowOps: not a store array");
+  // Chained backings resolve to the ULTIMATE owner, same as registerPatch
+  // (§7b) — the walk/fold emits there (re-audit blocker 4).
+  t = ultimateTarget(t) ?? t;
+  armRowHooks();
+  if (!commitHookInstalled) {
+    commitHookInstalled = true;
+    armPatchHooks();
+    setPatchCommitHook(releaseBatch);
+    GlobalQueue._drainPatchOptimistic = drainOptimistic;
+  }
+  const entry = { fn, owner: getOwner() };
+  const pc = pcOf(t);
+  const list = (pc.ro ??= []);
+  list.push(entry);
+  patchCount++;
+  markDescendants(t);
+  let unbound = false;
+  return () => {
+    if (unbound) return;
+    unbound = true;
+    patchCount--;
+    const idx = list.indexOf(entry);
+    if (idx >= 0) list.splice(idx, 1);
+    if (list.length === 0 && pc.ro === list) pc.ro = null;
+  };
+}
+/** Slot patches (shallow arrays) ride the same apply queue: the walk emits
+ * per aligned value-replaced slot; application happens at effect phase under
+ * the registration owner's lifetime. */
+function emitSlotPatch(t, index, next, prev) {
+  const sp = t.pc !== null ? t.pc.sp : null;
+  if (sp === null) return;
+  push({
+    list: sp.map(e => ({ owner: e.owner, fn: () => e.fn(index, next, prev) })),
+    next,
+    prev,
+    force: false,
+    t: null
+  });
+}
+/** Slot patch for shallow arrays: the reconcile walk emits (index, next,
+ * prev) for KEY-ALIGNED value-replaced slots (structure rides row ops), and
+ * the emission queues through the patch apply queue — effect-phase timing,
+ * transition stamping, disposed-owner drop — like every other channel. */
+function registerSlotPatchNext(arr, fn) {
+  let t = arr?.[$TARGET];
+  if (t === undefined) throw new Error("registerSlotPatchNext: not a store array");
+  // Chained backings resolve to the ULTIMATE owner, same as registerPatch
+  // (§7b) — the walk emits slot ticks there (re-audit blocker 4).
+  t = ultimateTarget(t) ?? t;
+  armRowHooks();
+  if (!commitHookInstalled) {
+    commitHookInstalled = true;
+    armPatchHooks();
+    setPatchCommitHook(releaseBatch);
+    GlobalQueue._drainPatchOptimistic = drainOptimistic;
+  }
+  // Multi-consumer (external audit): one shallow array can drive several
+  // lists — registrations are a list, unbinds splice their own entry.
+  const pc = pcOf(t);
+  const entry = { fn, owner: getOwner() };
+  (pc.sp ??= []).push(entry);
+  markDescendants(t);
+  let unbound = false;
+  return () => {
+    if (unbound || pc.sp === null) return;
+    unbound = true;
+    const idx = pc.sp.indexOf(entry);
+    if (idx >= 0) pc.sp.splice(idx, 1);
+    if (pc.sp.length === 0) pc.sp = null;
+  };
+}
+/** Row-ops ride the SAME apply queue/timing as record patches: transition-
+ * stamped, applied at effect phase, in emission order (structure before the
+ * new rows' own patches can exist; retained rows' value patches commute). */
+function emitRowOps(t, next, ops) {
+  const list = t.pc !== null ? t.pc.ro : null;
+  if (list === null) return;
+  push({
+    list: list.map(e => ({
+      owner: e.owner,
+      fn: (n, _p) => e.fn(n, ops)
+    })),
+    next,
+    prev: null,
+    force: false,
+    t: null
+  });
+}
+// Pay-for-use seams: the write paths (store/reconcile/optimistic) emit
+// through installed hooks instead of importing this module. Installation is
+// LAZY (first registration) rather than a module-scope call — the dist is a
+// flat bundle, and a top-level side effect would retain the whole channel in
+// every consumer. TWO TIERS so a value-only registration (registerPatch —
+// present in ~every bundle under patch-mode default) does not retain the
+// list machinery (row-ops emitters + reconcile's diff builders): row hooks
+// arm only from the list driver's registrations. Sound because every
+// emission site is guarded by the matching pc channel, which only the
+// corresponding registration creates. See patch-hooks.ts.
+function armPatchHooks() {
+  installPatchHooks({
+    emitPatch,
+    emitPatchLocal,
+    emitPatchOptimistic,
+    hasPatches,
+    demoteToEffects
+  });
+}
+function armRowHooks() {
+  installRowHooks({
+    emitRowOps,
+    emitSlotPatch,
+    emitSetterRowOps,
+    emitRowOpsOptimistic
+  });
+}
+
 /**
  * Store rewrite — optimistic stores (§3/§7, RUL-3): no store-side layer, no
  * backup snapshots. Nodes in an optimistic family are ARMED core signals
@@ -8730,6 +9904,23 @@ function installNextBlockedHalf() {
   // so the hook only empties the batch set.
   if (!GlobalQueue._clearOptimisticStores) {
     GlobalQueue._clearOptimisticStores = stores => {
+      // Patch channel (revert site): engine-native reverts flip node values
+      // back to committed; patched records need a forced DOM re-apply from
+      // the post-revert view. Emission only — next keeps no layer to clear.
+      for (const px of stores) {
+        const t = px?.[$TARGET];
+        const overlaid = t?.fam?.overlaid;
+        if (overlaid !== undefined) {
+          for (const ot of overlaid) {
+            if (ot.pc !== null && ot.pc.p !== null) patchHooks.emitPatchOptimistic(ot, null, null);
+            // Row-ops resync (family increment 2): reverts flip node values
+            // back engine-natively; a driven list must rebuild retention by
+            // row identity against the post-revert view (resolved from the
+            // target at drain — overrides are gone by then).
+            if (ot.pc !== null && ot.pc.ro !== null) rowHooks.emitRowOpsOptimistic(ot, null, null);
+          }
+        }
+      }
       stores.clear();
     };
   }
@@ -8836,6 +10027,22 @@ function notifyOptimisticWrites(t, pb) {
   const fw = t.fam?.node;
   if (fw?._transition) globalQueue.initTransition(fw._transition);
   const old = t.v;
+  // Patch channel (override-application site): the draft IS the intended
+  // visible state; prev is the view before these overrides apply. Bypasses
+  // the transition stash — optimism is visible in flight.
+  if (t.pc !== null && t.pc.p !== null)
+    patchHooks.emitPatchOptimistic(t, pb, optimisticView(t, old));
+  // Row-ops channel (family increment 2): optimistic STRUCTURE on an array
+  // rides node overrides — it never enters the reconcile walk — so a driven
+  // list must get its structural ops here, lane-timed. Identity diff of the
+  // pre-write optimistic view against the draft; aligned writes emit nothing.
+  if (t.pc !== null && t.pc.ro !== null && Array.isArray(pb)) {
+    const prevView = optimisticView(t, old);
+    if (Array.isArray(prevView)) {
+      const ops = buildIdentityRowOps(prevView, pb);
+      if (ops !== null) rowHooks.emitRowOpsOptimistic(t, pb, ops);
+    }
+  }
   const visible = (key, fallback) => {
     const node = t.n?.[key];
     return node !== undefined && hasActiveOverride(node)
@@ -8963,6 +10170,10 @@ function consumeOverridesNext(fam) {
         insertSubs(t.k, true);
         schedule();
       }
+      // Patch channel (override-consumption site): visible truth flipped to
+      // committed for the consumed keys — force a re-apply from the live
+      // view so the DOM leaves the override state.
+      if (t.pc !== null && t.pc.p !== null) patchHooks.emitPatchOptimistic(t, null, null);
     }
     overlaid.clear();
   });
@@ -9011,7 +10222,9 @@ function applyTentative(t, incoming, keyFn) {
     if (keyFn) {
       const pk = keyFn(pv);
       const nk = keyFn(nv);
-      if (pk !== undefined && nk !== undefined && pk !== nk) return null;
+      // SameValueZero (re-audit 3, P1-3): parity with the plain reconcile
+      // channel — NaN keys are self-equal.
+      if (pk !== undefined && nk !== undefined && !sameKey(pk, nk)) return null;
     }
     return map.get(unwrapValue(pv)) ?? null;
   };
@@ -9026,16 +10239,31 @@ function applyTentative(t, incoming, keyFn) {
         const nk = keyFn(nv);
         if (nk !== undefined) {
           if (viewByKey === null) {
+            // Occurrence-aware index queues (re-audit 3, P1-3): parity with
+            // the plain adoption window — duplicate keys match per
+            // occurrence, each view row consumed once.
             viewByKey = new Map();
             for (let j = 0; j < viewRows.length; j++) {
               const p = unwrapValue(viewRows[j]);
               if (isWrappable(p)) {
                 const pk = keyFn(p);
-                if (pk !== undefined && !viewByKey.has(pk)) viewByKey.set(pk, p);
+                if (pk === undefined) continue;
+                const existing = viewByKey.get(pk);
+                if (existing === undefined) viewByKey.set(pk, j);
+                else if (Array.isArray(existing)) existing.push(j);
+                else viewByKey.set(pk, [existing, j]);
               }
             }
           }
-          pv = viewByKey.get(nk);
+          const m = viewByKey.get(nk);
+          if (m === undefined) pv = undefined;
+          else if (Array.isArray(m)) {
+            pv = unwrapValue(viewRows[m.shift()]);
+            if (m.length === 1) viewByKey.set(nk, m[0]);
+          } else {
+            pv = unwrapValue(viewRows[m]);
+            viewByKey.delete(nk);
+          }
         } else pv = unwrapValue(viewRows[i]);
       } else pv = unwrapValue(viewRows[i]);
       const ct = match(pv, nv);
@@ -10139,7 +11367,12 @@ function createLoadingBoundary(fn, fallback, options) {
 function createErrorBoundary(fn, fallback) {
   return createCollectionBoundary(STATUS_ERROR, fn, queue => {
     return fallback(accessor(queue._error), () => {
-      for (const source of queue._sources) recompute(source);
+      for (const source of queue._sources) {
+        // Non-computed sources (patch-channel registrations under plain
+        // owners) are not recomputable — their reset is the record's next
+        // transition re-applying the patch (re-audit 2, P1-4).
+        if (source._fn !== undefined) recompute(source);
+      }
       schedule();
     });
   });
@@ -10340,9 +11573,13 @@ export {
   omit,
   onCleanup,
   onSettled,
+  patchableRaw,
   peekNextChildId,
   reconcile,
   refresh,
+  registerPatch,
+  registerRowOps,
+  registerSlotPatchNext as registerSlotPatch,
   releaseSnapshotScope,
   repeat,
   resetErrorHalt,
@@ -10351,6 +11588,9 @@ export {
   setContext,
   setSnapshotCapture,
   snapshot,
+  storeHasFamily,
+  storeHasOptimisticFamily,
+  storeIsShallow,
   storePath,
   untrack
 };