@solidjs/signals 2.0.0-rc.3 → 2.0.0-rc.5

package/dist/dev.js

@@ -42,6 +42,18 @@ class StatusError extends Error {
 function unwrapStatusError(error) {
   return error instanceof StatusError ? error.cause : error;
 }
+/**
+ * Rejection value of `until(fn, { timeout })` when the predicate does not turn
+ * truthy within the window. Inside an `action()`, the rejection is thrown back
+ * in at the `yield` point — catchable there, or the action fails and its
+ * optimistic state reverts.
+ */
+class TimeoutError extends Error {
+  constructor(message = "Timed out waiting for condition") {
+    super(message);
+    this.name = "TimeoutError";
+  }
+}
 class NoOwnerError extends Error {
   constructor() {
     super("Context can only be accessed under a reactive root.");
@@ -117,6 +129,60 @@ const CONFIG_CHILD_COMPANIONS = 1 << 11;
  * moved into the cold extension (§12), and an unconditional `_x` deref per
  * marked node measurably taxed the propagation hot path (diamond -22%). */
 const CONFIG_FW_CHILDREN = 1 << 12;
+/** Authoritative-view reader (`until()`): while this node computes, reads
+ * dodge active optimistic OVERRIDES only — the predicate must observe
+ * arriving truth, never the caller's own tentative writes (which would
+ * trivially satisfy it). Everything else reads normally, INCLUDING
+ * transition-staged `_pendingValue`: staged data is authoritative (optimism
+ * lives only in override slots), and a hold that refused staged reads would
+ * deadlock on data the open transaction itself is holding (a refresh the
+ * action issued lands staged and cannot commit until the hold releases).
+ * read() checks the bit on the reading computation (`context`) directly — no
+ * ambient flag — so a shared computed the predicate pulls recomputes as
+ * itself (no bit) under the normal view, and its cache never forks. */
+const CONFIG_AUTHORITATIVE_READ = 1 << 13;
+/** Sticky mark: an authoritative-view reader read this node PAST an active
+ * override. The ack shape — an authoritative arrival EQUAL to the override —
+ * rides paths that are deliberately silent under A17 (every ordinary reader
+ * sees the override, so an equal landing changes nothing for them). A marked
+ * node notifies those readers on such paths anyway, so the landed truth is
+ * seen without re-firing ordinary subscribers. Never cleared — only nodes an
+ * until() predicate observed mid-override pay. */
+const CONFIG_AUTHORITATIVE_OBSERVED = 1 << 14;
+/** Promise-delivery effect (resolve()/until()): commits its computed value
+ * directly even when recomputing under its own held transition. These
+ * effects deliver applies on a microtask (#2930) instead of the stashed
+ * effect queues, so the value must ride the same immediate schedule — a
+ * staged value with an immediate apply delivers stale state (resolve) or
+ * deadlocks the hold (until). Safe because the node is a private leaf: no
+ * subscriber reads an effect's value, only its own apply does. */
+const CONFIG_DIRECT_COMMIT = 1 << 15;
+/** Fresh-pull reader (awaitable `refresh()`'s waiter effect): a read of a
+ * dirty source recomputes it inline even when the height gate defers to the
+ * flush. Closes the same-flush ordering race where a waiter created
+ * alongside a refresh() mark read the PRE-re-ask value as settled and
+ * delivered stale; with the pull, the waiter either parks on the re-ask's
+ * pending window (async — woken by the settle walk, which runs on every
+ * landing including equal-value ones) or serves its sync answer. resolve()
+ * deliberately keeps that race — its contract is "first settled value"
+ * (#2930), not "next quiescent state". */
+const CONFIG_FRESH_READ = 1 << 16;
+/** HELD truth (#3164): this node's staged `_pendingValue` is confirming
+ * truth riding a transaction that retains optimism, revealed only at that
+ * transaction's settle. Two arming sites, one meaning: the store fold
+ * (a landing staged into the retaining transaction) and until()'s
+ * flip-entanglement (a foreign carrier's staged write, stolen when it
+ * flipped the awaited predicate truthy). Until the reveal, ordinary
+ * readers — lane and speculative recomputes included — keep committed:
+ * the staging notified subscribers as a plain write, so without the mask
+ * a mid-hold recompute composes live optimism with the confirming truth,
+ * a frame no timeline contains (GabbeV's union tear). Authoritative
+ * readers (until()'s predicate) and latest() tunnel through — the
+ * exemption that keeps holds deadlock-free. Override-covered nodes never
+ * arm: the override is their display and its revert their notification
+ * (A17). Cleared at commit (the commit IS the reveal); subscribers masked
+ * during the hold are woken by finalizePureQueue's post-revert pass. */
+const CONFIG_HELD_TRUTH = 1 << 17;
 const STATUS_PENDING = 1 << 0;
 const STATUS_ERROR = 1 << 1;
 const STATUS_UNINITIALIZED = 1 << 2;
@@ -600,6 +666,18 @@ const engineHooks = {
     const totalMs = now() - frame.start;
     if (frames.length > 0) frames[frames.length - 1].childMs += totalMs;
     const selfMs = Math.max(0, totalMs - frame.childMs);
+    // Effect-output honesty: effects run with `_equals: false`, so core
+    // reports EVERY effect recompute as changed — which made effect waste
+    // invisible to costs() (and compiled JSX bindings are effects: the
+    // fan-out waste a naive selected-row produces is all effects). The
+    // engine re-derives the fact from its own snapshot: an identical
+    // committed compute output is an unchanged run. `undefined` outputs are
+    // exempt — a side-effect-only compute's work IS its effect phase, and
+    // identity of `undefined` proves nothing.
+    if (changed && frame.causes !== null && el._type) {
+      const committed = el._pendingValue !== NOT_PENDING ? el._pendingValue : el._value;
+      if (committed !== undefined && committed === frame.prevValue) changed = false;
+    }
     // Unstable-output check: memos only, non-create, plain runs with a
     // committed change. The fresh value sits in `_pendingValue` for held
     // plain-flush memo commits and in `_value` for direct ones. Overlay runs
@@ -708,11 +786,17 @@ const hooks = {};
 const diagnosticListeners = new Set();
 const diagnosticCaptures = new Set();
 let diagnosticSequence = 0;
+let consoleFooter;
+const footeredCodes = new Set();
 const diagnostics = {
   subscribe(listener) {
     diagnosticListeners.add(listener);
     return () => diagnosticListeners.delete(listener);
   },
+  setConsoleFooter(footer) {
+    consoleFooter = footer;
+    footeredCodes.clear();
+  },
   capture() {
     const events = [];
     diagnosticCaptures.add(events);
@@ -752,6 +836,13 @@ function emitDiagnostic(event) {
   };
   for (const listener of diagnosticListeners) listener(entry);
   for (const capture of diagnosticCaptures) capture.push(entry);
+  if (consoleFooter && !footeredCodes.has(entry.code)) {
+    footeredCodes.add(entry.code);
+    const footer = consoleFooter(entry);
+    // Call sites console.warn/error their message after emitDiagnostic
+    // returns; a microtask lands the footer right below that report.
+    if (footer) queueMicrotask(() => console.warn(footer));
+  }
   return entry;
 }
 /**
@@ -1097,7 +1188,7 @@ function cancelZombieRecompute(el) {
 }
 let clock = 0;
 let activeTransition = null;
-let scheduled = false;
+let scheduled$1 = false;
 let halted = false;
 let haltNotified = false;
 let syncDepth = 0;
@@ -1207,6 +1298,27 @@ function mergeTransitionState(target, outgoing) {
     outgoing._affectsNodes.length = 0;
   }
   for (const store of outgoing._optimisticStores) target._optimisticStores.add(store);
+  // Patch-channel stash (store/next/patch.ts): entries held for the outgoing
+  // transition must ride the merge like every other per-transition
+  // collection — releaseBatch only reads the COMMITTING transition's stash,
+  // so a stranded sidecar would silently drop its patches. Move (don't
+  // copy), same aliasing rule as the collections above. The field is an
+  // expando so this module stays free of patch imports (pay-for-use).
+  const heldPatches = outgoing._heldPatches;
+  if (heldPatches !== undefined) {
+    outgoing._heldPatches = undefined;
+    let dest = target._heldPatches;
+    if (dest !== undefined) dest.push(...heldPatches);
+    else dest = target._heldPatches = heldPatches;
+    // Retarget the entries' coalescing stamps to the surviving stash
+    // (opaque backref contract with store/next/patch.ts): without this a
+    // post-merge emission misses the stamp and pushes a SECOND entry —
+    // the record's patch applies twice at commit (re-audit 5, P1-2).
+    for (let i = 0; i < heldPatches.length; i++) {
+      const pc = heldPatches[i].pc;
+      if (pc !== undefined && pc.qe === heldPatches[i]) pc.qa = dest;
+    }
+  }
   for (const [source, reporters] of outgoing._asyncReporters) {
     let targetReporters = target._asyncReporters.get(source);
     if (!targetReporters) target._asyncReporters.set(source, (targetReporters = new Set()));
@@ -1214,13 +1326,114 @@ function mergeTransitionState(target, outgoing) {
   }
   for (const sub of outgoing._gatedSubs) target._gatedSubs.add(sub);
 }
+/**
+ * Flip-entanglement (#3164 follow-up): `until()` is a declaration of
+ * relatedness — the predicate names the condition that confirms the awaiting
+ * transaction. When the predicate settles truthy, every live foreign
+ * transition whose staged write it read IS the confirming event by the
+ * user's own definition, so it merges into the awaiting transaction and
+ * reveals at the joint settle — the cross-primitive twin of the family fold
+ * (a landing on an optimism-carrying family joins the retaining
+ * transaction). Non-flipping updates never pass through here: falsy
+ * evaluations don't entangle, so unrelated traffic on the watched sources
+ * reveals freely on its own schedule.
+ *
+ * Runs inside the predicate's compute (pure phase) — the confirming
+ * transition's stamps are still live and its commit decision hasn't run, so
+ * the merge lands before any reveal. Only the tree-shaken graphs that call
+ * `until()` retain this.
+ */
+function entangleConfirmingTransitions(obs, target) {
+  target = currentTransition(target);
+  if (target._done === true) return;
+  // The confirming evidence is a dep whose value is STAGED (pending,
+  // uncommitted) at flip evaluation — committed deps are public already and
+  // carry nothing to entangle. A staged dep lives in one of two carriers: a
+  // stamped transition, or the queue's current batch (ambient registrations
+  // don't stamp; "ambient work IS a transaction" — the batch is the
+  // carrier). The entangle STEALS the carrier's staged cargo — its pending
+  // nodes move (re-stamped) into the awaiting transaction and reveal at its
+  // settle — but never the carrier itself: its async reporters, actions,
+  // and stashes are its own future (a live stream's flight must not chain
+  // the awaiting transaction to landings that haven't happened; a merged
+  // reporter deadlocked exactly that way).
+  let stole = false;
+  for (let l = obs._deps; l !== null; l = l._nextDep) {
+    const dep = l._dep;
+    if (dep._pendingValue !== NOT_PENDING) {
+      const stamp = dep._transition;
+      const t = stamp != null ? currentTransition(stamp) : null;
+      // Skip the awaiting transaction's own cargo (t === target: a
+      // fold-staged landing or a write the action itself issued — hold and
+      // reveal already correct) and dead carriers. Ambient-batch staging
+      // (t === null) must leave the batch NOW — it commits at this flush's
+      // end, which would reveal the confirmation under the live optimism
+      // it just confirmed.
+      const carrier =
+        t === null
+          ? currentBatch._pendingNodes
+          : t !== target && t._done !== true
+            ? t._pendingNodes
+            : null;
+      if (carrier !== null) stole = stealEntangledCargo(carrier, target) || stole;
+    }
+    if (l === obs._depsTail) break;
+  }
+  // The steal never activates the awaiting transaction: the predicate can
+  // flip inside another transaction's finalize heap, and adopting the queue
+  // batch there hands the stolen cargo to that finalize's commit sweep — a
+  // premature reveal at a foreign settle. Subscribers that computed against
+  // the pre-steal world were re-dirtied by the steal itself, so this
+  // flush's applies paint the masked (mid-hold) view; the cargo commits at
+  // the awaiting transaction's own settle.
+}
+/** Move a confirming carrier's staged nodes into the awaiting transaction:
+ * re-stamp and arm the held-truth mask (override-covered nodes skip it —
+ * the override already hides their staged value per A17, and is usually
+ * the very optimism this confirmation settles); the mask's commit
+ * registers the settle-side post-revert wake. The carrier's array is
+ * emptied so its own commit point commits none of the stolen cargo.
+ *
+ * EFFECT subs of stolen nodes re-run: any that recomputed against the
+ * staging BEFORE the steal (the carrier's landing notified them as a plain
+ * write) hold a private torn result — override composed with confirming
+ * truth — that the next paint gate (stash-point lane run, a foreign
+ * flush's completion drain) would show. Re-running them under the mask
+ * re-derives the mid-hold view in this same heap pass. PURE computeds are
+ * deliberately NOT re-run: a torn staged value of theirs is itself stolen
+ * cargo — masked at read, so ordinary readers already serve their
+ * committed value — while re-running them would re-derive the OLD world
+ * and re-stage it over the held truth. The reveal re-notifies
+ * (commitPendingNodes), which is when they re-derive for real. */
+function stealEntangledCargo(carrier, target) {
+  if (carrier === target._pendingNodes || carrier.length === 0) return false;
+  for (let i = 0; i < carrier.length; i++) {
+    const node = carrier[i];
+    node._transition = target;
+    target._pendingNodes.push(node);
+    // Override-covered nodes stay silent AND unmasked: the override is the
+    // display (A17 — its staging never notified, its revert will), so their
+    // subs saw nothing and re-running one would break the silence with a
+    // duplicate fire of an unchanged view.
+    if (!hasActiveOverride$1(node)) {
+      node._config |= CONFIG_HELD_TRUTH;
+      for (let s = node._subs; s !== null; s = s._nextSub) {
+        const sub = s._sub;
+        if (sub._type && !(sub._config & CONFIG_AUTHORITATIVE_READ)) enqueueSub(sub);
+      }
+    }
+  }
+  carrier.length = 0;
+  transitions.add(target);
+  return true;
+}
 function schedule() {
   if (halted) {
     notifyHalted();
     return;
   }
-  if (scheduled) return;
-  scheduled = true;
+  if (scheduled$1) return;
+  scheduled$1 = true;
   if (!syncDepth && !globalQueue._running && !projectionWriteActive) queueMicrotask(flush);
 }
 /**
@@ -1403,11 +1616,19 @@ class GlobalQueue extends Queue {
   static _transitionBlocked = null;
   static _cleanupLanes = null;
   static _runLaneEffects = null;
+  /** Patch-channel optimistic drain (next/patch.ts): optimistic emissions
+   * apply at lane-effect timing — visible in flight, unlike the regular
+   * effect queues an action stashes. Injected; null when unused. */
+  static _drainPatchOptimistic = null;
   static _gatedRead = null;
   static _laneSuspends = null;
   static _laneReadsCommitted = null;
   static _recomputeLane = null;
   static _laneAsyncPending = null;
+  /** Authoritative-view reader wakeup (until()): installed at first until() call.
+   * Call sites are gated by CONFIG_AUTHORITATIVE_OBSERVED, which only until()'s
+   * carve-out read can set, so `!` invocations are safe once the gate holds. */
+  static _notifyAuthoritativeObservers = null;
   static _laneAsyncSettled = null;
   static _trackOptimisticStore = null;
   flush() {
@@ -1415,6 +1636,10 @@ class GlobalQueue extends Queue {
     this._running = true;
     try {
       if (true) devCheckFlushStart();
+      // Before runHeap for the same reason as the fast drain above; late
+      // subscribers (an effect reading a swept memo this flush) revive it,
+      // which is the pay-for-use contract.
+      sweepDormant();
       runHeap(dirtyQueue, GlobalQueue._update);
       if (activeTransition) {
         const isComplete = transitionComplete(activeTransition);
@@ -1449,7 +1674,7 @@ class GlobalQueue extends Queue {
           // A kept ambient batch may hold pending nodes (#2916): stay
           // scheduled so the outer drain loop commits them via the plain
           // flush path instead of leaving them until the next natural flush.
-          scheduled = dirtyQueue._max >= dirtyQueue._min || this._batch._pendingNodes.length > 0;
+          scheduled$1 = dirtyQueue._max >= dirtyQueue._min || this._batch._pendingNodes.length > 0;
           reassignPendingTransition(stashedTransition._pendingNodes);
           activeTransition = null;
           finalizePureQueue(null, true);
@@ -1489,7 +1714,7 @@ class GlobalQueue extends Queue {
       }
       clock++;
       // Check if finalization added items to the heap (from optimistic reversion)
-      scheduled = dirtyQueue._max >= dirtyQueue._min;
+      scheduled$1 = dirtyQueue._max >= dirtyQueue._min;
       // Run lane effects first (for ready lanes), then regular effects
       activeLanes.size && GlobalQueue._runLaneEffects(EFFECT_RENDER);
       this.run(EFFECT_RENDER);
@@ -1506,7 +1731,7 @@ class GlobalQueue extends Queue {
       }
       if (
         true &&
-        !scheduled &&
+        !scheduled$1 &&
         !activeTransition &&
         transitions.size === 0 &&
         activeLanes.size === 0
@@ -1547,8 +1772,17 @@ class GlobalQueue extends Queue {
     return false;
   }
   initTransition(transition) {
-    if (transition) transition = currentTransition(transition);
-    if (transition && transition === activeTransition) return;
+    if (transition) {
+      transition = currentTransition(transition);
+      // A finished transaction cannot be re-entered: its state is committed
+      // or reverted, so "rejoining" it (A26) is meaningless and re-activating
+      // it spins the drain loop (#3140). The refusal must be a bare return —
+      // redirecting the caller to a fresh batch would re-arm the loop with a
+      // new transaction identity each pass. Stamps are cleared at commit, so
+      // this is a belt for paths that hand over a chased-dead reference
+      // (merged chains, async settles racing completion).
+      if (transition._done === true || transition === activeTransition) return;
+    }
     if (!transition && activeTransition && activeTransition._time === clock) return;
     if (!activeTransition) {
       activeTransition = transition ?? createBatch();
@@ -1592,11 +1826,25 @@ class GlobalQueue extends Queue {
     for (const lane of activeLanes) {
       if (!lane._transition) lane._transition = activeTransition;
     }
+    // A transaction's ambient window is one flush. Entering must therefore
+    // guarantee a flush: a transaction opened with no writes (an action whose
+    // first statements only await) otherwise leaves activeTransition and the
+    // adopted batch armed across the async gap, and the next unrelated work
+    // to arrive — an optimistic store's authoritative landing, a plain async
+    // settle — is adopted into a transaction it has nothing to do with
+    // (#3141). The scheduled flush parks the incomplete transaction through
+    // the normal machinery and detaches the ambient slots first.
+    schedule();
   }
 }
 function queuePendingNode(node) {
+  lastStagedNodeName = node._name ?? null;
   currentBatch._pendingNodes.push(node);
 }
+// Dev-only attribution for the flush loop guard (#3140): when the guard
+// trips, naming what the loop kept chewing on lets the app author attribute
+// the runaway without patching dist.
+let lastStagedNodeName = null;
 // Sticky: flips true on the first refresh() ever (the only setter of
 // REACTIVE_REASK) so the hot notification loop skips the per-subscriber flag
 // clear entirely in apps that never refresh.
@@ -1692,13 +1940,48 @@ let storeCommitHook = null;
 function setStoreCommitHook(fn) {
   storeCommitHook = fn;
 }
+/** Patch-channel release hook (next/patch.ts): transition-stamped patch
+ * emissions are released when THEIR batch commits. Transitions never
+ * abort: failed actions still commit (only optimistic overrides revert),
+ * and merged-away transitions hand their stash to the survivor
+ * (mergeTransitionState) — every stash drains exactly once. Injected like
+ * storeCommitHook to stay tree-shakeable. */
+let patchCommitHook = null;
+function setPatchCommitHook(fn) {
+  patchCommitHook = fn;
+}
+/** Held truth committed this finalize, awaiting its post-revert wake (see
+ * finalizePureQueue): the commit IS the reveal, but subscribers must not
+ * re-derive until the settling transaction's optimistic overrides have
+ * reverted — a commit-time wake recomputes them in the window where
+ * confirming truth is committed and the override still displays, a torn
+ * frame no timeline contains. */
+const heldRevealed = [];
 function commitPendingNodes() {
   const pendingNodes = currentBatch._pendingNodes;
   for (let i = 0; i < pendingNodes.length; i++) {
-    commitPendingNode(pendingNodes[i]);
+    const node = pendingNodes[i];
+    commitPendingNode(node);
+    // The stamp dies with the commit (#3143) — symmetric with
+    // resolveOptimisticNodes clearing optimistic stamps. A stamp outliving
+    // its transaction let any later write (even a value-equal no-op, which
+    // re-opens before the equality bail) resurrect the finished transaction;
+    // a boundary flag rewritten every finalize pass then spun the drain loop
+    // forever (#3140). The held-truth mark dies the same death — the commit
+    // IS the reveal — but its wake defers to the post-revert pass: ordinary
+    // subscribers were masked to committed all hold (some re-derived against
+    // that old view and cached it), and commits are otherwise silent
+    // (staging already notified), so without a wake they'd hold the old
+    // world forever.
+    node._transition = null;
+    if (node._config & CONFIG_HELD_TRUTH) {
+      node._config &= ~CONFIG_HELD_TRUTH;
+      heldRevealed.push(node);
+    }
   }
   pendingNodes.length = 0;
   storeCommitHook?.();
+  patchCommitHook?.(currentBatch);
 }
 function finalizePureQueue(completingTransition = null, incomplete = false) {
   // For incomplete transitions, skip pending resolution and optimistic reversion
@@ -1746,6 +2029,22 @@ function finalizePureQueue(completingTransition = null, incomplete = false) {
     // completing transition scopes the clear to its own layer keys (#2899).
     if (batch._optimisticStores.size)
       GlobalQueue._clearOptimisticStores(batch._optimisticStores, completingTransition);
+    // Held-truth reveal wake (#3164), post-revert by construction: this
+    // finalize committed confirming truth whose subscribers were masked all
+    // hold — some re-derived against the committed view (the staging, or a
+    // confirming carrier's landing, notified them as a plain write) and
+    // cached it, and stash-restored applies may carry those torn values.
+    // Waking and recomputing HERE — after _resolveOptimistic and the store
+    // clears above — means every apply paints the settled view; a wake at
+    // commit time would recompute them in the window where truth is
+    // committed but the settling transaction's overrides still display.
+    if (heldRevealed.length !== 0) {
+      while (heldRevealed.length) insertSubs(heldRevealed.pop());
+      if (dirtyQueue._max >= dirtyQueue._min) {
+        runHeap(dirtyQueue, GlobalQueue._update);
+        commitPendingNodes();
+      }
+    }
     sweepTransientStoreNodes();
     // Lanes only enter activeLanes through the engine's getOrCreateLane.
     if (activeLanes.size) GlobalQueue._cleanupLanes(completingTransition);
@@ -1825,8 +2124,21 @@ function flush(fn) {
   let count = 0;
   // `flush()` is an explicit drain point, so it must also process an active
   // transition even if no microtask was scheduled for it yet.
-  while (scheduled || activeTransition) {
-    if (++count === 1e5) throw new Error("Potential Infinite Loop Detected.");
+  while (scheduled$1 || activeTransition) {
+    if (++count === 1e5) {
+      // Attribution beats a bare guard (#3140): say what kept the loop alive.
+      // A completed transition being re-activated reads `done=true` here —
+      // the corpse-revival signature — while application-driven runaways
+      // (#2843) usually show staged work naming the culprit node.
+      const t = activeTransition;
+      throw new Error(
+        `Potential Infinite Loop Detected. Kept alive by ${scheduled$1 ? "scheduled work" : "an active transition"}${
+          t
+            ? `; transition: done=${t._done === true}, pending=${t._pendingNodes.length}, optimistic=${t._optimisticNodes.length}, asyncReporters=${t._asyncReporters.size}`
+            : ""
+        }${lastStagedNodeName ? `; last staged node: ${lastStagedNodeName}` : ""}`
+      );
+    }
     globalQueue.flush();
   }
 }
@@ -1888,6 +2200,29 @@ function runInTransition(transition, fn) {
     activeTransition = prevTransition;
   }
 }
+/** Run `fn` with `transition` as BOTH the ambient transaction and the
+ * registration batch, restoring both after. runInTransition alone is not
+ * enough for code that WRITES on behalf of a transaction from inside someone
+ * else's window (optimistic replay re-arming a still-open action's edits
+ * during a landing commit, #3123): registrations route through the queue's
+ * batch pointer, and a bare activeTransition swap leaves them in the ambient
+ * batch — a plain batch "completes" at the next flush and reverts optimistic
+ * registrations that were supposed to live with the transaction.
+ * initTransition is the wrong tool here: it MERGES the currently ambient
+ * transaction into the target, entangling whatever the interrupted window
+ * belonged to. */
+function runAsTransitionBatch(transition, fn) {
+  const prevTransition = activeTransition;
+  const prevBatch = globalQueue._batch;
+  try {
+    activeTransition = currentTransition(transition);
+    currentBatch = globalQueue._batch = activeTransition;
+    return fn();
+  } finally {
+    activeTransition = prevTransition;
+    currentBatch = globalQueue._batch = prevBatch;
+  }
+}
 
 /** The queue a node belongs to, picked from its own zombie flag. */
 function queueFor(n) {
@@ -2363,7 +2698,7 @@ function unlinkSubs(link) {
       // transition holding it) is an observer — tearing down would orphan
       // the work and re-execute it on the next read. The settle path runs
       // this same last-one-out check when that observer releases (the
-      // untracked-read dispose in core.ts guards on pending identically).
+      // untracked-read dormancy sweep guards on pending identically).
       const c = dep;
       c._fn &&
         c._config & CONFIG_AUTO_DISPOSE &&
@@ -2403,6 +2738,46 @@ function unobserved(el) {
   clearDeps(el);
   disposeChildren(el, true);
 }
+/**
+ * Deferred dormancy for never-observed auto-dispose computeds (#3078).
+ *
+ * An untracked top-level read of a subscriber-less observation-lifecycle memo
+ * used to call unobserved() inline at the end of read(). That kept the leak
+ * closed (the compute links the memo into its deps' sub lists — without a
+ * teardown point a never-observed memo is retained by its sources forever;
+ * upstream alien-signals has exactly this retention), but it made reads
+ * destructive: each read disposed the node, the next read revived it with a
+ * full recompute in whatever ambient transition/lane context happened to be
+ * current, so consecutive reads could return different answers with no write
+ * in between.
+ *
+ * Instead, reads queue the node here and the scheduler sweeps at the top of
+ * the next flush (before runHeap, so a same-tick dirtying is reclaimed
+ * instead of recomputed). Reads become idempotent within a tick (the node
+ * stays alive and serves its cache, uniform with observed memos) while
+ * reclamation still happens within one microtask — the enqueue site arms
+ * schedule(), so a flush is guaranteed even when no other work is queued.
+ */
+const dormantNodes = new Set();
+function sweepDormant() {
+  if (dormantNodes.size === 0) return;
+  for (const el of dormantNodes) {
+    // Re-validate at sweep time: the node may have gained a subscriber (its
+    // lifecycle is the unlinkSubs cascade now), gone pending (in-flight async
+    // is an observer; the settle path re-runs last-one-out), lost its
+    // AUTO_DISPOSE bit (owner teardown strips it, #3024), or already been
+    // torn down.
+    if (
+      !el._subs &&
+      el._config & CONFIG_AUTO_DISPOSE &&
+      !(el._statusFlags & STATUS_PENDING) &&
+      !(el._flags & (REACTIVE_DISPOSED | REACTIVE_ZOMBIE))
+    ) {
+      unobserved(el);
+    }
+  }
+  dormantNodes.clear();
+}
 // https://github.com/stackblitz/alien-signals/blob/v2.0.3/src/system.ts#L52
 function link(dep, sub, pendingObserver = false) {
   // Repeat touches within one pass AND-combine `_pendingObserver`: a probe
@@ -2616,11 +2991,11 @@ function settlePendingSource(el) {
     const errored = node._statusFlags & STATUS_ERROR;
     if (remaining) {
       if (!errored) setPendingError(node, remaining);
-      updateCompanions !== null && updateCompanions(node);
+      updateCompanions?.(node);
     } else {
       node._statusFlags &= ~STATUS_PENDING;
       if (!errored) setPendingError(node);
-      updateCompanions !== null && updateCompanions(node);
+      updateCompanions?.(node);
       if (node._x?._blocked) {
         enqueueSub(node);
         scheduled = true;
@@ -2643,6 +3018,14 @@ function settlePendingSource(el) {
 function isThenable(value) {
   return value != null && typeof value === "object" && typeof value.then === "function";
 }
+/** Fire and clear a node's iterator-flight cancellation hook (#3122). */
+function releaseFlightTeardown(el) {
+  const teardown = el._x?._flightTeardown;
+  if (teardown != null) {
+    el._x._flightTeardown = null;
+    teardown();
+  }
+}
 function handleAsync(el, result, setter) {
   let iterator = false;
   let thenable = false;
@@ -2680,6 +3063,11 @@ function handleAsync(el, result, setter) {
     });
     throw new Error(message);
   }
+  // Flight replacement relies on recompute's supersede release for iterator
+  // teardown (#3122): every handleAsync call — including the projection
+  // self-registration — runs during a recompute of `el`, which has already
+  // fired _flightTeardown. A future non-recompute registration path must
+  // release it here before overwriting _inFlight.
   ext(el)._inFlight = result;
   let syncValue;
   // Settle-time transition re-entry. The loading rail is invisible to
@@ -2783,10 +3171,21 @@ function handleAsync(el, result, setter) {
       // only notified when the hold is visible to them: under an active
       // override every reader sees the override (A17), so waking subs would
       // re-show an unchanged view — the revert is the notification point.
-      GlobalQueue._syncCompanions !== null && GlobalQueue._syncCompanions(el, value);
+      GlobalQueue._syncCompanions?.(el, value);
       if (!hasActiveOverride$1(el)) {
         if (attrHooks !== null) attrHooks.asyncEnd(el, undefined, value, true);
         insertSubs(el);
+      } else if (el._config & CONFIG_AUTHORITATIVE_OBSERVED) {
+        // A17 silence is stated over ordinary readers; an authoritative-view
+        // reader (until()'s predicate) observed this node PAST its override
+        // and is waiting for exactly this staged truth. Without the wake the
+        // hold deadlocks: the landing waits on the transaction, the
+        // transaction on the action, the action on an until() that was never
+        // re-notified (#3164). Same selective wake as the equal-landing
+        // branch in recompute(). Optional call: the bit implies the
+        // optimistic engine WAS consulted, but the hook only installs with
+        // it — a bare-core build must not crash here.
+        GlobalQueue._notifyAuthoritativeObservers?.(el);
       }
       el._time = clock;
     } else if (lane) {
@@ -2801,7 +3200,7 @@ function handleAsync(el, result, setter) {
           // The latest() shadow write gives latest() effects independent lanes; the
           // _pendingSignal update is a no-op repeat of the clearStatus() call above
           // (computePendingState doesn't read _value).
-          GlobalQueue._syncCompanions !== null && GlobalQueue._syncCompanions(el, value);
+          GlobalQueue._syncCompanions?.(el, value);
           insertSubs(el, true);
         }
       } catch (e) {
@@ -2883,6 +3282,11 @@ function handleAsync(el, result, setter) {
       } catch {}
     };
     registerClose ? registerClose(close) : cleanup(close);
+    // Flight-identity cancellation (#3122): the registration above is the
+    // owner-death backstop, but its disposal list can be zombie-deferred
+    // until the SUPERSEDING flight settles. The teardown slot fires at the
+    // _inFlight release sites so supersede stops this stream immediately.
+    ext(el)._flightTeardown = close;
     // Release check before each next pull: an unobserved lazy node must tear
     // down (its close above runs via disposal, closing the iterator) instead
     // of pumping the stream forever with zero subscribers (#2935).
@@ -3084,7 +3488,8 @@ function clearStatus(el, clearUninitialized = false) {
     GlobalQueue._updateChildCompanions !== null
   )
     GlobalQueue._updateChildCompanions(el);
-  if (el._x?._notifyStatus) el._x._notifyStatus.call(el);
+  const notify = statusNotifierOf(el);
+  if (notify) notify.call(el);
 }
 function notifyStatus(el, status, error, blockStatus, lane) {
   // Wrap regular errors to track source node
@@ -3113,7 +3518,7 @@ function notifyStatus(el, status, error, blockStatus, lane) {
         status | (status !== STATUS_ERROR ? el._statusFlags & STATUS_UNINITIALIZED : 0);
       ext(el)._error = error;
     }
-    GlobalQueue._updatePendingSignal !== null && GlobalQueue._updatePendingSignal(el);
+    GlobalQueue._updatePendingSignal?.(el);
     if (
       el._x?._child &&
       el._config & CONFIG_CHILD_COMPANIONS &&
@@ -3126,14 +3531,15 @@ function notifyStatus(el, status, error, blockStatus, lane) {
   }
   const downstreamBlockStatus = blockStatus || startsBlocking;
   const downstreamLane = blockStatus || isOptimisticBoundary ? undefined : lane;
-  if (el._x?._notifyStatus) {
+  const elNotify = statusNotifierOf(el);
+  if (elNotify) {
     if (blockStatus && status === STATUS_PENDING) {
       return;
     }
     if (downstreamBlockStatus) {
-      el._x._notifyStatus.call(el, status, error);
+      elNotify.call(el, status, error);
     } else {
-      el._x._notifyStatus.call(el);
+      elNotify.call(el);
     }
     return;
   }
@@ -3257,7 +3663,15 @@ function recompute(el, create = false) {
     if (el._transition && (!isEffect || activeTransition) && activeTransition !== el._transition)
       globalQueue.initTransition(el._transition);
     deleteFromHeap(el, queueFor(el));
-    if (el._x !== null) el._x._inFlight = null;
+    if (el._x !== null) {
+      el._x._inFlight = null;
+      // Supersede is where an iterator flight dies (#3122): close it now.
+      // Its cleanup(close) registration may sit in a zombie-deferred
+      // disposal list that a held transition only drains when the
+      // SUPERSEDING flight settles — cancellation must not wait for the
+      // work that replaced it. Idempotent with the cleanup-channel close.
+      releaseFlightTeardown(el);
+    }
     // Tracked effects run after finalizePureQueue, so dispose immediately instead of deferring
     if (el._transition || isEffect === EFFECT_TRACKED) disposeChildren(el);
     else if (el._firstChild !== null || el._disposal !== null) {
@@ -3281,6 +3695,14 @@ function recompute(el, create = false) {
   // recovers to an unchanged value, dependents still holding this object must
   // be swept (settleErroredDependents, #2949).
   const outgoingError = el._statusFlags & STATUS_ERROR ? el._x?._error : undefined;
+  // Pending SOURCE-hood, captured before the compute clears status: a node
+  // whose own flight parked dependents self-registers in _pendingSources
+  // (notifyStatus, isSource). If this recompute supersedes that flight and
+  // settles synchronously, those dependents settle HERE — asyncWrite's
+  // settlePendingSource walk never runs for a landing that was preempted
+  // (#3181).
+  const wasPendingSource =
+    (el._statusFlags & STATUS_PENDING) !== 0 && el._x?._pendingSources?.has(el) === true;
   // Re-ask classification lives in the verdict module; capture the flag before
   // the recompute wipes _flags below.
   const hadReask = (el._flags & REACTIVE_REASK) !== 0;
@@ -3455,7 +3877,14 @@ function recompute(el, create = false) {
         // values directly — the pending round-trip (queuePendingNode +
         // commitPendingNodes) exists to sequence transition reveals, and
         // paying it per effect on the plain path is pure overhead.
-        (isEffect && (activeTransition !== el._transition || activeTransition === null)) ||
+        // DIRECT_COMMIT effects (resolve/until) commit directly even under
+        // their own held transition: their applies deliver on a microtask,
+        // not the stashed queues, so a staged value would hand the immediate
+        // apply stale state — see CONFIG_DIRECT_COMMIT.
+        (isEffect &&
+          (activeTransition !== el._transition ||
+            activeTransition === null ||
+            el._config & CONFIG_DIRECT_COMMIT)) ||
         isOptimisticDirty
         // NOTE (stage-3, 2026-08-21): a quiet-world MEMO direct-commit was
         // attempted here and REVERTED — memo staging is load-bearing beyond
@@ -3501,6 +3930,12 @@ function recompute(el, create = false) {
       if (el._pendingValue === NOT_PENDING) queuePendingNode(el);
       el._pendingValue = value;
       if (wasLoading) el._loading = true; // see the held branch above (#2990)
+      // A authoritative-view reader (until()) observed this node past its
+      // override — and "authoritative arrival equal to the override" is
+      // exactly the acknowledgment it waits for. Wake those readers only;
+      // A17 silence holds for every ordinary subscriber. (Hook installed by
+      // until(), the only setter of the gating bit.)
+      if (el._config & CONFIG_AUTHORITATIVE_OBSERVED) GlobalQueue._notifyAuthoritativeObservers(el);
     } else if (el._height != oldHeight) {
       for (let s = el._subs; s !== null; s = s._nextSub) {
         insertIntoHeapHeight(s._sub, queueFor(s._sub));
@@ -3513,6 +3948,17 @@ function recompute(el, create = false) {
     // (el._x?._error re-set), so this only runs on a genuinely clean recovery.
     if (outgoingError !== undefined && !valueChanged && !el._x?._error)
       settleErroredDependents(el, outgoingError);
+    // Pending twin of the sweep above (#3181): a flight superseded by this
+    // synchronous settle leaves every registered dependent still flagged
+    // STATUS_PENDING with a pending source that will never land — asyncWrite
+    // owns the walk only for flights that actually land. An unchanged value
+    // is the dangerous shape (a projection reconciling in place: a memo over
+    // it re-throws its cached NotReadyError forever, and every reader that
+    // suspended through that memo re-parks on the dead source), but the walk
+    // runs on the changed shape too, exactly as the landing path does —
+    // insertSubs notifies value SUBSCRIBERS, not pending REGISTRANTS, and
+    // the two sets only partially overlap.
+    if (wasPendingSource && !(el._statusFlags & STATUS_PENDING)) settlePendingSource(el);
   }
   // Attribution hook: fired before the lane restore so `currentOptimisticLane`
   // still reflects THIS run's posture. The facts distinguish an overlay
@@ -3561,7 +4007,9 @@ function updateIfNecessary(el) {
   // (_depsTail/_depGen) is live, and a nested recompute would corrupt it.
   // A mid-pass mark stays latched for recompute's own tail to reschedule
   // (#3037); readers meanwhile serve the values the pass has so far.
-  if (el._flags & REACTIVE_RECOMPUTING_DEPS) return;
+  // Never recompute a DISPOSED node either: recompute rewrites _flags and
+  // would resurrect it (#2983) — readers serve its last value.
+  if (el._flags & (REACTIVE_RECOMPUTING_DEPS | REACTIVE_DISPOSED)) return;
   if (el._flags & REACTIVE_CHECK) {
     for (let d = el._deps; d; d = d._nextDep) {
       const dep1 = d._dep;
@@ -3597,7 +4045,7 @@ function computed(fn, options) {
       (options?.sync ? CONFIG_SYNC : 0) |
       (options?._noSnapshot ? CONFIG_NO_SNAPSHOT : 0) |
       (snapshotCaptureActive && ownerInSnapshotScope(context) ? CONFIG_IN_SNAPSHOT_SCOPE : 0),
-    _equals: options?.equals != null ? options.equals : isEqual,
+    _equals: options?.equals ?? isEqual,
     _disposal: null,
     _queue: context?._queue ?? globalQueue,
     _context: context?._context ?? defaultContext,
@@ -3649,6 +4097,7 @@ function ext(el) {
     _parentSource: undefined,
     _affectsCount: 0,
     _inFlight: null,
+    _flightTeardown: null,
     _error: undefined,
     _blocked: undefined,
     _pendingSources: undefined,
@@ -3668,7 +4117,7 @@ function ext(el) {
  * mode (recompute is called explicitly by `effect()`), so we hardcode the lazy bits and skip
  * the auto-dispose CONFIG bit (effect() previously cleared it post-construction).
  */
-function createEffectNode(fn, effectFn, errorFn, type, notifyStatus, options) {
+function createEffectNode(fn, effectFn, errorFn, type, options) {
   const transparent = options?.transparent ?? false;
   const self = {
     id: inheritId(options, transparent, context),
@@ -3676,6 +4125,7 @@ function createEffectNode(fn, effectFn, errorFn, type, notifyStatus, options) {
       (transparent ? CONFIG_TRANSPARENT : 0) |
       (options?.ownedWrite ? CONFIG_OWNED_WRITE : 0) |
       (options?.sync ? CONFIG_SYNC : 0) |
+      (options?._extraConfig ?? 0) |
       (snapshotCaptureActive && ownerInSnapshotScope(context) ? CONFIG_IN_SNAPSHOT_SCOPE : 0),
     _equals: false,
     _disposal: null,
@@ -3712,12 +4162,35 @@ function createEffectNode(fn, effectFn, errorFn, type, notifyStatus, options) {
     _x: null
   };
   self._name = options?.name ?? "effect";
-  // Boundary effects carry a status channel; most effects never touch _x.
-  if (notifyStatus !== undefined) ext(self)._notifyStatus = notifyStatus;
+  // Effects dispatch status through the SHARED notifier (statusNotifierOf,
+  // keyed off _type) — storing it per node forced a full NodeExtension
+  // allocation on EVERY effect at creation (an alloc + 19 field stores,
+  // +23% effect creation, caught by the creation benches). Only genuinely
+  // per-node channels (boundaries) live on _x.
   if (options?.unobserved) ext(self)._unobserved = options.unobserved;
   setupComputedNode(self, lazyOptions);
   return self;
 }
+/**
+ * The shared status notifier for effect nodes, installed once by effect.ts
+ * at module evaluation (`this`-dispatched — one function serves every
+ * effect, so nodes never store it). Boundary computeds keep their own
+ * per-node channel on `_x._notifyStatus`, which takes precedence.
+ */
+let effectStatusNotify = null;
+function setEffectStatusNotify(fn) {
+  effectStatusNotify = fn;
+}
+/** Resolve a node's status notifier: an own `_x` channel (boundaries) wins;
+ * effect nodes (`_type` — EFFECT_PURE is 0, and only effect literals carry
+ * the field) fall back to the shared notifier. Presence doubles as the
+ * "display consumer" membership test in the status walks, exactly as the
+ * per-node field did when every effect carried one. */
+function statusNotifierOf(el) {
+  const own = el._x?._notifyStatus;
+  if (own !== undefined) return own;
+  return el._type ? (effectStatusNotify ?? undefined) : undefined;
+}
 const lazyOptions = { lazy: true };
 function setupComputedNode(self, options) {
   self._prevHeap = self;
@@ -3757,7 +4230,7 @@ function setupComputedNode(self, options) {
 }
 function signal(v, options, firewall = null) {
   const s = {
-    _equals: options?.equals != null ? options.equals : isEqual,
+    _equals: options?.equals ?? isEqual,
     _config:
       (options?.ownedWrite ? CONFIG_OWNED_WRITE : 0) |
       (options?._noSnapshot ? CONFIG_NO_SNAPSHOT : 0),
@@ -3894,6 +4367,35 @@ const READ_SLOW = Symbol("read-slow");
  * snapshot / transition / lane / dev-strictRead state all take the full
  * resolution. Anything slow returns READ_SLOW; the caller then calls read().
  */
+/**
+ * Wake only authoritative-view readers (until() predicates) subscribed to `el`.
+ * The A17-silent ack paths — an authoritative arrival equal to the active
+ * override — use this so the predicate re-evaluates without re-firing
+ * ordinary subscribers whose visible (override) value did not change.
+ * Pay-for-use: reached through GlobalQueue._notifyAuthoritativeObservers,
+ * installed at first until() call — apps that never use until() shake it.
+ */
+function notifyAuthoritativeObservers(el) {
+  for (let s = el._subs; s !== null; s = s._nextSub) {
+    const sub = s._sub;
+    if (!(sub._config & CONFIG_AUTHORITATIVE_READ)) continue;
+    // Missed-wake latch (#3037), same contract as insertSubs: the reader may
+    // itself have pulled this recompute (updateIfNecessary from its own
+    // read), and the heap refuses RECOMPUTING nodes — latch so recompute's
+    // tail reschedules it with the staged value visible.
+    if (sub._flags & REACTIVE_RECOMPUTING_DEPS && s._gen === sub._depGen && s !== sub._depsTail)
+      sub._flags |= REACTIVE_MISSED_WAKE;
+    enqueueSub(sub);
+  }
+  schedule();
+}
+/** Installs the until() machinery hook. Idempotent; called by until() before
+ * any authoritative-view read happens (same late-binding contract as the
+ * optimistic engine). */
+function installAuthoritativeRead() {
+  if (GlobalQueue._notifyAuthoritativeObservers === null)
+    GlobalQueue._notifyAuthoritativeObservers = notifyAuthoritativeObservers;
+}
 function readNodeFast(el) {
   if (
     latestReadActive ||
@@ -3973,6 +4475,13 @@ function read(el) {
         markHeap(elQueue);
         updateIfNecessary(owner);
       }
+      // Fresh-pull readers (awaitable refresh's waiter) recompute a dirty
+      // source inline even when the height gate defers to the flush: the
+      // waiter must park on the re-ask's window (or serve its sync answer),
+      // never read the PRE-re-ask value as settled. Self-guarded: a clean
+      // node no-ops and updateIfNecessary refuses disposed nodes (#2983) —
+      // a dead target serves its last value, which is already quiescent.
+      else if (c._config & CONFIG_FRESH_READ) updateIfNecessary(owner);
       const height = owner._height;
       // parent check is shallow, might need to be recursive
       if (height >= c._height && el._parent !== c) {
@@ -4051,8 +4560,18 @@ function read(el) {
       nodeName: owner?._name
     });
   if (el._x?._overrideValue !== undefined && el._x?._overrideValue !== NOT_PENDING) {
-    // A17: the override IS the value for every reader.
-    return unwrapOverride(el._x?._overrideValue);
+    // A17: the override IS the value for every reader — except an authoritative
+    // reader (until()'s predicate carries CONFIG_AUTHORITATIVE_READ): it must
+    // observe independently-arriving truth, and serving it the caller's own
+    // tentative write would trivially satisfy the predicate. The bit is checked
+    // on the reading computation itself, so a shared computed the predicate
+    // pulls recomputes as ITSELF (context = the memo, no bit) under the normal
+    // view. Fall through to normal value selection (staged `_pendingValue` is
+    // authoritative — optimism never lives there); the sticky mark makes the
+    // A17-silent "landing equals override" paths notify this node's subs so
+    // the reader re-runs when truth arrives.
+    if (!(c && c._config & CONFIG_AUTHORITATIVE_READ)) return unwrapOverride(el._x?._overrideValue);
+    el._config |= CONFIG_AUTHORITATIVE_OBSERVED;
   }
   // Entanglement gate: a reader recomputing under an optimistic lane that reads
   // a pending mid-transition write sees the committed value. Projection-store
@@ -4080,7 +4599,18 @@ function read(el) {
     (currentOptimisticLane !== null && GlobalQueue._laneReadsCommitted(el, owner, c)) ||
     el._pendingValue === NOT_PENDING ||
     c._config & CONFIG_CHILDREN_FORBIDDEN ||
-    (stale && el._transition && activeTransition !== el._transition)
+    (stale && el._transition && activeTransition !== el._transition) ||
+    // A17 for HELD truth (#3164, see CONFIG_HELD_TRUTH): staged confirming
+    // truth — fold-staged onto an armed family, or entangle-stolen by an
+    // awaited until() — is masked from ordinary readers until its
+    // transaction's reveal; the retaining transaction's own speculative
+    // recomputes included (partial override coverage would otherwise
+    // compose override + staged truth into a state no timeline contains).
+    // Authoritative readers (until()'s predicate) and latest() see the
+    // staged truth — the tunnel that keeps the hold deadlock-free.
+    (el._config & CONFIG_HELD_TRUTH &&
+      !latestReadActive &&
+      !(c._config & CONFIG_AUTHORITATIVE_READ))
       ? el._value
       : el._pendingValue;
   // Record that this isPending() probe observed the fresh pending value, so
@@ -4094,7 +4624,14 @@ function read(el) {
     !(owner._statusFlags & STATUS_PENDING) &&
     !el._subs
   ) {
-    unobserved(el);
+    // Deferred, not inline (#3078): an inline unobserved() here made untracked
+    // reads destructive — dispose on this read, full revival recompute on the
+    // next — so consecutive reads could answer differently with no write in
+    // between (the revival samples the ambient transition/lane context).
+    // The sweep at flush finalization re-validates and reclaims; schedule()
+    // guarantees that flush happens even if nothing else is queued.
+    dormantNodes.add(el);
+    schedule();
   }
   return value;
 }
@@ -4118,9 +4655,17 @@ function devGuardStoreSetterWrite() {
       ownerName: context._name,
       data: { operation: "setStore" }
     });
-    throw new Error(REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE);
+    // the owner name reaches the THROWN message too, not just the
+    // diagnostics channel apps don't subscribe to by default (#3157)
+    throw new Error(ownedScopeWriteMessage(context));
   }
 }
+function ownedScopeWriteMessage(owner) {
+  const name = owner._name;
+  return name
+    ? `${REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE} (in ${name})`
+    : REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE;
+}
 function setSignal(el, v) {
   if (
     !(el._config & CONFIG_OWNED_WRITE) &&
@@ -4138,7 +4683,7 @@ function setSignal(el, v) {
       nodeName: el._name,
       data: { operation: "setSignal" }
     });
-    throw new Error(REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE);
+    throw new Error(ownedScopeWriteMessage(context));
   }
   if (el._transition && activeTransition !== el._transition)
     globalQueue.initTransition(el._transition);
@@ -4264,41 +4809,13 @@ function staleValues(fn, set = true) {
   }
 }
 /**
- * Invalidates one reactive source, forcing it to re-execute even if its inputs
- * haven't changed.
- *
- * Pass either a Solid-created accessor or a projected store created from
- * `createStore(fn, ...)` / `createProjection(...)`. `refresh()` is a
- * write-like invalidation operation: it does not read the target's value, and
- * refreshing a plain signal accessor is a no-op.
- *
- * Use it to invalidate cached async values (e.g. force a re-fetch) without
- * tearing the consumer down.
- *
- * @example
- * ```ts
- * const user = createMemo(async () => fetch(`/users/${id()}`).then(r => r.json()));
- *
- * // Re-fetch on demand
- * <button onClick={() => refresh(user)}>Reload</button>
- * ```
+ * Core marking half of `refresh()` (the public wrapper lives in signals.ts —
+ * it validates the target, marks through here, then builds the quiescence
+ * promise on the resolve()/until() effect machinery). Flags the node's next
+ * recompute as a quiet re-ask and schedules it; no-ops for non-derived or
+ * disposed targets and for same-tick manual writes.
  */
-function refresh(target) {
-  const node = target?.[$REFRESH];
-  if (!node) {
-    {
-      const message =
-        "[INVALID_REFRESH_TARGET] refresh() expects a Solid source accessor or refreshable store. " +
-        "Pass the original source target, not a wrapper function or derived property read.";
-      emitDiagnostic({
-        code: "INVALID_REFRESH_TARGET",
-        kind: "write",
-        severity: "error",
-        message
-      });
-      throw new Error(message);
-    }
-  }
+function markRefresh(node) {
   if (
     context &&
     !((node._config ?? 0) & CONFIG_OWNED_WRITE) &&
@@ -4617,6 +5134,9 @@ function runLaneEffects(type) {
       runQueue(effects, type);
     }
   }
+  // Optimistic patch applications ride the same visibility slot as lane
+  // effects (in-flight DOM updates); no-op unless patches registered.
+  if (type === EFFECT_RENDER) GlobalQueue._drainPatchOptimistic?.();
 }
 function cleanupCompletedLanes(completingTransition) {
   for (const lane of activeLanes) {
@@ -5107,7 +5627,22 @@ function latestRead(el) {
       !(pendingComputed._flags & (REACTIVE_DISPOSED | REACTIVE_ZOMBIE))
     ) {
       markHeap(queue);
-      prepareComputed(pendingComputed, true);
+      // Suspend probe collection during the pull (mirrors pendingCheckRead's
+      // prepare): a probe through latest() answers for the SHADOW — the
+      // read() dispatch collects it deliberately, so the verdict reflects
+      // async still in flight for the latest view, not the parent's held
+      // write. A stale shadow recomputing HERE ran its `read(parent)` with
+      // the probe still live and collected the parent too, so the verdict
+      // depended on whether anything had pulled the shadow current earlier
+      // in the tick (#3104: reading latest(m) flipped a later
+      // latest(() => isPending(x)) from true to false).
+      const prevCheck = pendingCheckActive;
+      setPendingCheckActive(false);
+      try {
+        prepareComputed(pendingComputed, true);
+      } finally {
+        setPendingCheckActive(prevCheck);
+      }
     }
     value = read(pendingComputed);
   } catch (e) {
@@ -5137,12 +5672,42 @@ function latestRead(el) {
     return pendingComputed._pendingValue;
   return value;
 }
+/**
+ * A latest() shadow that is uninitialized only because it was CREATED during
+ * an active flight — its parent source already has a committed value, so
+ * latest() serves that as the visible value and a tracked reader has
+ * something to pair a verdict with (#3166). Same parent resolution as
+ * computePendingState. The pending signal companion also carries
+ * `_parentSource` but is a plain signal (no `_fn`) that never goes pending,
+ * so the `_fn` check is belt-and-braces for this call site.
+ */
+function latestShadowWithInitializedParent(owner) {
+  if (typeof owner._fn !== "function") return false;
+  const parentNode = owner._x?._parentSource;
+  if (parentNode === undefined) return false;
+  const parent = parentNode._firewall || parentNode;
+  return !(parent._statusFlags & STATUS_UNINITIALIZED);
+}
 /** The isPending()-probe read path, installed as GlobalQueue._pendingCheck. */
 function pendingCheckRead(el, c, owner, firewall) {
   setPendingCheckActive(false);
   if (typeof el._fn === "function") prepareComputed(el, true);
   const ownerStatus = owner._statusFlags;
-  if (c && ownerStatus & STATUS_PENDING && ownerStatus & STATUS_UNINITIALIZED) {
+  if (
+    c &&
+    ownerStatus & STATUS_PENDING &&
+    ownerStatus & STATUS_UNINITIALIZED &&
+    // The suspend-throw is for a genuinely-first-load source: the tracked
+    // reader has nothing to pair a verdict with, so it parks on the source.
+    // A latest() SHADOW created lazily mid-flight is born uninitialized even
+    // though its parent has a committed value latest() will serve — throwing
+    // here (swallowed by latestRead's fallback) dropped the shadow from the
+    // probe, so a tracked latest(isPending()) probe created during a
+    // new-question flight cached `false` for that whole flight (#3166).
+    // Defer to the PARENT's initialization state and fall through to normal
+    // collection; the plain pending throw downstream still links the reader.
+    !latestShadowWithInitializedParent(owner)
+  ) {
     if (tracking && el !== c) link(el, c);
     setPendingCheckActive(true);
     throw owner._x?._error;
@@ -5161,8 +5726,22 @@ function pendingCheckRead(el, c, owner, firewall) {
  */
 function heldAwaitingAsync(el) {
   const et = el._transition;
-  const t = et ? currentTransition(et) : null;
+  const t = et ? currentTransition(et) : activeTransition;
   if (!t || t._done) return false;
+  // A plain staged write (a signal/store leaf — no _fn) held while an action
+  // is still running is an INPUT to a computation still in flight (#3078):
+  // the pairing rule must not suppress the verdict, or a memo recomputing
+  // mid-action reads the staged value, gets told "not pending", and
+  // disagrees with a direct isPending() probe for the whole action window.
+  // A computed's staged value is the opposite case — a LANDED answer
+  // awaiting reveal — where the pairing rule stands even inside an open
+  // action (#2831: a reader that saw the new value must not also see
+  // pending); still-computing answers are covered by the reporter scan.
+  if (t._actions.length && !el._fn) return true;
+  // A node not yet stamped with a transition only qualifies through the
+  // action check above; the reporter scan below is for transition-held
+  // writes whose source async is still computing.
+  if (!et) return false;
   for (const [source, reporters] of t._asyncReporters) {
     if (
       reporters.size &&
@@ -5209,6 +5788,17 @@ function isPending(fn) {
   });
   const collectPending = () => {
     setPendingCheckActive(false);
+    // Companion reads are mode-neutral plumbing: under an outer latest()
+    // (isPending inside a latest window — #3104's memo shape) leaving latest
+    // mode active dispatched these reads through latestRead, which built a
+    // SHADOW OF THE PENDING SIGNAL itself. The next updatePendingSignal then
+    // wrote that companion-on-companion from inside a recompute
+    // (syncCompanions → setSignal on a shadow created without ownedWrite)
+    // and halted dev with the owned-scope write guard. The creation paths
+    // (getLatestValueComputed / getPendingSignal) already suspend both
+    // modes; this read site must too.
+    const prevLatest = latestReadActive;
+    setLatestReadActive(false);
     const prevStrictRead = strictRead;
     setStrictRead(false);
     try {
@@ -5220,6 +5810,7 @@ function isPending(fn) {
       });
     } finally {
       setStrictRead(prevStrictRead);
+      setLatestReadActive(prevLatest);
       setPendingCheckActive(true);
     }
     // A "not pending" verdict that exists only because this reader saw the
@@ -5279,7 +5870,6 @@ function effect(compute, effect, error, options) {
     effect,
     error,
     isUser ? EFFECT_USER : EFFECT_RENDER,
-    notifyEffectStatus,
     options
   );
   recompute(node, true);
@@ -5452,17 +6042,9 @@ function trackedEffect(fn, options) {
   node._config = (node._config & ~CONFIG_AUTO_DISPOSE) | CONFIG_CHILDREN_FORBIDDEN;
   node._modified = true;
   node._type = EFFECT_TRACKED;
-  ext(node)._notifyStatus = (status, error) => {
-    const actualStatus = status !== undefined ? status : node._statusFlags;
-    if (actualStatus & STATUS_ERROR) {
-      node._queue.notify(node, STATUS_PENDING, 0);
-      const err = error !== undefined ? error : node._x?._error;
-      if (!node._queue.notify(node, STATUS_ERROR, STATUS_ERROR)) {
-        haltReactivity(unwrapStatusError(err));
-        throw err;
-      }
-    }
-  };
+  // Status dispatch rides the SHARED notifier (statusNotifierOf keys off
+  // _type): its error arm is behavior-identical to the closure that used to
+  // live here, without the per-node NodeExtension allocation.
   node._run = run;
   node._queue.enqueue(EFFECT_USER, run);
   if (!node._parent) {
@@ -5480,6 +6062,10 @@ function trackedEffect(fn, options) {
     console.warn(message);
   }
 }
+// Install the shared effect status notifier (statusNotifierOf serves it to
+// every effect node) — module-scope: any bundle that creates effects
+// evaluates this module.
+setEffectStatusNotify(notifyEffectStatus);
 
 const ACTION_CALLED_IN_OWNED_SCOPE_MESSAGE =
   "[ACTION_CALLED_IN_OWNED_SCOPE] Calling an action inside an owned scope (component, computation) is not allowed. " +
@@ -5948,8 +6534,256 @@ function resolve(fn) {
           rej(err);
           dispose();
         },
-        { user: true }
+        // DIRECT_COMMIT: a source settling INTO the held transaction (e.g. a
+        // refresh this action issued) stages its landing; the effect's own
+        // recompute must not stage too, or the microtask apply reads the
+        // stale mainline value and resolves with old data.
+        { user: true, _extraConfig: CONFIG_DIRECT_COMMIT }
+      );
+    });
+  });
+}
+/**
+ * Invalidates one reactive source, forcing it to re-execute even if its inputs
+ * haven't changed, and returns a promise for the target's NEXT QUIESCENT
+ * STATE — the re-ask (and anything that supersedes it) has settled.
+ *
+ * Pass either a Solid-created accessor or a projected store created from
+ * `createStore(fn, ...)` / `createProjection(...)`. `refresh()` is a
+ * write-like invalidation operation: it does not read the target's value, and
+ * refreshing a plain signal accessor is a no-op that resolves immediately.
+ *
+ * The returned promise is safe to ignore (fire-and-forget refresh is
+ * unchanged, and a failed refetch will not surface an unhandled rejection).
+ * Awaiting it gives imperative flows the settle point without a reactive
+ * read:
+ * - Accessor targets resolve with the settled value; store targets resolve
+ *   with the store node passed (reads through it are fresh after the await).
+ * - A failed re-ask rejects with the error (inside an action's generator,
+ *   `yield refresh(x)` throws back at the yield point and the action reverts
+ *   like any other failure).
+ * - Semantics are quiescence, not flight identity: if another refresh (or
+ *   any invalidation) supersedes this one mid-flight, the promise waits for
+ *   — and delivers — whatever finally lands.
+ * - Inside an action, truth landing into the held transaction is STAGED;
+ *   the promise still settles then (matching `resolve()`/`until()`, #2930)
+ *   and delivers the staged value — the caller's own optimistic override is
+ *   never the delivered value.
+ * - The re-ask itself stays verdict-quiet exactly as before: `isPending`
+ *   does not flip for a bare refresh (pair with `affects()` for a visible
+ *   pending window).
+ *
+ * @example
+ * ```ts
+ * const user = createMemo(async () => fetch(`/users/${id()}`).then(r => r.json()));
+ *
+ * // Fire-and-forget re-fetch
+ * <button onClick={() => refresh(user)}>Reload</button>;
+ *
+ * // Imperative settle point
+ * const fresh = await refresh(user);
+ * ```
+ */
+function refresh(target) {
+  const node = target?.[$REFRESH];
+  if (!node) {
+    {
+      const message =
+        "[INVALID_REFRESH_TARGET] refresh() expects a Solid source accessor or refreshable store. " +
+        "Pass the original source target, not a wrapper function or derived property read.";
+      emitDiagnostic({
+        code: "INVALID_REFRESH_TARGET",
+        kind: "write",
+        severity: "error",
+        message
+      });
+      throw new Error(message);
+    }
+  }
+  // Mark now, watch on a microtask. The waiter is resolve()'s machinery with
+  // two extra reader bits, but it must NOT compute at call time (effects
+  // recompute eagerly on creation): same-tick refreshes coalesce into ONE
+  // re-ask only because every mark lands before anything pulls, and eager
+  // per-call pulls turned three refreshes into three fetches. Deferred, the
+  // waiter's first read sees the coalesced state: FRESH_READ pulls the node
+  // through recompute if it is still dirty (self-deduping — a clean node
+  // no-ops, so N waiters cost one pull; this also closes the race where a
+  // waiter reads the PRE-re-ask value as settled and delivers stale), after
+  // which the read either parks on the re-ask's pending window (async — the
+  // settle walk re-runs it on every landing, equal-value and
+  // staged-under-hold included, and a rejection arrives through the effect's
+  // error channel) or serves the sync answer. AUTHORITATIVE_READ keeps an
+  // action's own optimistic override out of the delivered value. resolve()'s
+  // own eager compute is untouched: created after a refresh it still settles
+  // stale-while-revalidate (#2930) — its contract is "first settled value",
+  // not "next quiescent state".
+  markRefresh(node);
+  const promise = new Promise((res, rej) => {
+    queueMicrotask(() => {
+      // No createRoot: the microtask has no ambient owner, so the effect is
+      // naturally detached, and settle disposes the node directly — the root
+      // added ~560B of otherwise-shakeable machinery for nothing but the
+      // dev-mode NO_OWNER_EFFECT warning, so dev keeps a root husk purely to
+      // stay quiet. The waiter swaps in its microtask queue during its own
+      // first compute (before the initial apply enqueue), replacing the
+      // root-owner plumbing.
+      // Typed as the effect node, not Owner: the capture runs inside the
+      // effect's own compute, where the ambient owner IS the effect —
+      // exactly what dispose() takes.
+      let waiter = null;
+      const make = () =>
+        effect(
+          () => {
+            if (waiter === null) {
+              waiter = getOwner();
+              const queue = new MicrotaskQueue();
+              queue._parent = waiter._queue;
+              waiter._queue = queue;
+            }
+            return read(node);
+          },
+          value => {
+            res(typeof target === "function" ? value : target);
+            dispose(waiter);
+          },
+          err => {
+            rej(err);
+            dispose(waiter);
+          },
+          {
+            user: true,
+            _extraConfig: CONFIG_DIRECT_COMMIT | CONFIG_AUTHORITATIVE_READ | CONFIG_FRESH_READ
+          }
+        );
+      createRoot(make);
+    });
+  });
+  // Fire-and-forget refresh must not turn a failed refetch into an unhandled
+  // rejection; awaiting callers attach their own handlers to `promise`.
+  promise.catch(() => {});
+  return promise;
+}
+/**
+ * Awaits a reactive predicate and resolves the first time it settles *truthy*,
+ * with that (narrowed) value. Falsy results and pending async reads both mean
+ * "not yet": the subscription stays live and re-evaluates as sources change.
+ * If the predicate settles with an error — a throw, or an async source that
+ * rejects — the promise rejects with it, as do timeout and abort.
+ *
+ * Where {@link resolve} answers "what is this value" (first settled value,
+ * whatever it is), `until` answers "when does the world confirm this
+ * condition". The difference matters inside an `action()`: `yield until(...)`
+ * holds the action's transaction — and any optimistic state riding it — open
+ * until the condition is independently true.
+ *
+ * To make that sound, `until`'s predicate reads the AUTHORITATIVE view — and
+ * this is the one read-semantics difference from `resolve`, which reads the
+ * normal (transaction's own) view where overrides are visible:
+ *
+ * - **Optimistic overrides are invisible** to the predicate. Your own
+ *   tentative write can never satisfy your own ack, even on the
+ *   single-primitive shape where the optimistic store IS the live-fed store.
+ *   (Derived computeds serve their normal cached values — express the
+ *   condition over sources of truth, not derived views of the overlay.)
+ * - **Everything else reads normally, including uncommitted transition-staged
+ *   data.** Real data is real wherever it currently lives. This is
+ *   load-bearing, not a loophole: truth that arrives *into* the open
+ *   transaction (a `refresh()` this action issued, an entangled landing)
+ *   stages and cannot commit until the hold releases — a predicate that
+ *   refused staged reads would deadlock on the very data it is waiting for.
+ *
+ * This is the acknowledgment mechanism for mutations confirmed on a live data
+ * channel (sockets, subscriptions, live queries) rather than by the mutation's
+ * own response: correlate by a client-generated id or version in the predicate,
+ * and let truth arrive however it arrives — push, refetch, or another tab.
+ *
+ * Failure composes with action semantics: a rejection is thrown back into the
+ * generator at the `yield` point — catchable there, or the action fails and
+ * its optimistic state reverts.
+ *
+ * Must be called *outside* a tracking scope.
+ *
+ * @example
+ * ```ts
+ * const send = action(async function* (text: string) {
+ *   const clientId = crypto.randomUUID();
+ *   setMessages(m => { m.push({ clientId, text, pending: true }); }); // optimistic
+ *   await socket.send({ clientId, text }); // fire-and-forget transport
+ *   // Hold until the live source echoes the write (authoritative view —
+ *   // the optimistic row above cannot satisfy this):
+ *   yield until(() => messages.some(m => m.clientId === clientId), { timeout: 10_000 });
+ * });
+ * ```
+ *
+ * @param fn a reactive predicate over authoritative state
+ * @param options optional `timeout` (ms) and abort `signal`
+ */
+function until(fn, options) {
+  if (getObserver()) {
+    throw new Error(
+      "Cannot call until inside a reactive scope; await it from an action or another imperative scope."
+    );
+  }
+  // Late-bind the wakeup hook for the A17-silent ack paths (pay-for-use:
+  // apps that never call until() never retain it).
+  installAuthoritativeRead();
+  // Flip-entanglement (#3164 follow-up): the transaction this until() holds
+  // open (the action's, when yielded from one). The predicate is the user's
+  // declaration of what confirms it — when a foreign transition's staged
+  // write flips it truthy, that transition merges here and reveals at the
+  // joint settle instead of painting the confirmation under live optimism.
+  const awaiting = activeTransition;
+  return new Promise((res, rej) => {
+    const signal = options?.signal;
+    if (signal?.aborted) return rej(signal.reason);
+    createRoot(dispose => {
+      // Same delivery contract as resolve() (#2930): effect applies ride a
+      // microtask so the promise can settle while the transaction the caller
+      // yielded it into is still open — that transaction being open is the
+      // entire point of the hold.
+      const owner = getOwner();
+      const queue = new MicrotaskQueue();
+      queue._parent = owner._queue;
+      owner._queue = queue;
+      let timer;
+      let onAbort;
+      const settle = fire => {
+        if (timer !== undefined) clearTimeout(timer);
+        if (onAbort !== undefined) signal.removeEventListener("abort", onAbort);
+        fire();
+        dispose();
+      };
+      effect(
+        awaiting === null
+          ? fn
+          : () => {
+              const value = fn();
+              // Runs inside the compute (pure phase): the confirming
+              // transition's stamps are live and its commit hasn't run, so
+              // the merge lands before any reveal. Falsy evaluations skip —
+              // non-flipping updates were never named as the confirmation.
+              if (value) entangleConfirmingTransitions(getObserver(), awaiting);
+              return value;
+            },
+        value => {
+          // Falsy is "not yet": keep the subscription live and wait for the
+          // next evaluation. Only a truthy settled value resolves.
+          if (value) settle(() => res(value));
+        },
+        err => settle(() => rej(err)),
+        // AUTHORITATIVE_READ: overrides invisible to the predicate.
+        // DIRECT_COMMIT: truth that stages into the held transaction (a
+        // refresh the action issued) must flow through to the microtask
+        // apply — a staged effect value would deadlock the hold on data
+        // the hold itself is keeping uncommitted.
+        { user: true, _extraConfig: CONFIG_AUTHORITATIVE_READ | CONFIG_DIRECT_COMMIT }
       );
+      if (options?.timeout !== undefined)
+        timer = setTimeout(() => settle(() => rej(new TimeoutError())), options.timeout);
+      if (signal !== undefined) {
+        onAbort = () => settle(() => rej(signal.reason));
+        signal.addEventListener("abort", onAbort, { once: true });
+      }
     });
   });
 }
@@ -6100,6 +6934,15 @@ let optHooks = null;
 function setOptHooks(h) {
   optHooks = h;
 }
+/** Sticky descendants flag walk (§6d): reconcile's keyed pruning descends
+ * only where subscriptions exist at/below. Nodes AND patches count. */
+function markDescendants(target) {
+  let t = target;
+  while (t && !t.d) {
+    t.d = true;
+    t = t.u;
+  }
+}
 
 /**
  * Brand symbols used internally by the store proxy / projection plumbing.
@@ -6448,8 +7291,9 @@ function notifyMarkBoundaries(node) {
     visited.add(sub);
     // Display consumers (render effects, boundary computeds) act on the
     // notification; descent stops there, exactly like the status rails.
-    if (sub._x?._notifyStatus) {
-      sub._x._notifyStatus.call(sub, STATUS_PENDING, error);
+    const notify = statusNotifierOf(sub);
+    if (notify) {
+      notify.call(sub, STATUS_PENDING, error);
       return;
     }
     forEachDependent(sub, visit);
@@ -6557,6 +7401,15 @@ function affects(target, key) {
   }
 }
 
+let patchHooks = null;
+let rowHooks = null;
+function installPatchHooks(hooks) {
+  patchHooks = hooks;
+}
+function installRowHooks(hooks) {
+  rowHooks = hooks;
+}
+
 /**
  * Store rewrite — increment 2: plain deep stores with pending-backing writes.
  * Contract: INTERNALS-STORE-STATE.md.
@@ -6585,8 +7438,13 @@ function affects(target, key) {
  * headroom for future fields. The prototype is reset to `Object.prototype`
  * so proxy-forwarded semantics (getPrototypeOf, constructor) are exactly a
  * plain object's. Array targets keep the bare-`[]` path — they must carry
- * the array exotic class for `Array.isArray(proxy)`, and arrays store named
- * fields off-object where this cliff does not apply. */
+ * the array exotic class for `Array.isArray(proxy)`.
+ *
+ * ARRAY SHAPE RULE: arrays normalize their named properties to dictionary
+ * mode as the count grows (V8 13.x: counts ≡ 0 mod 3 from 18 up), so the
+ * target's named field count is capped at 20 — write-side patch-channel
+ * state lives inside the single `pc` extension (see target.ts), never as
+ * new named fields here. */
 function TargetShape() {
   this.v = undefined;
   this.ch = undefined;
@@ -6607,9 +7465,15 @@ function TargetShape() {
   this.s = undefined;
   this.ovl = undefined;
   this.del = undefined;
-  this.wk = undefined;
+  this.pc = undefined;
+  this.hv = undefined;
+  this.ht = undefined;
 }
 TargetShape.prototype = Object.prototype;
+/** Lazily allocate the patch-channel extension (one literal shape). */
+function pcOf(t) {
+  return t.pc ?? (t.pc = { sp: null, p: null, ro: null, wk: null, qa: null, qe: null });
+}
 function createTarget(value, parent, parentKey, fam = parent?.fam ?? null) {
   // The proxy target carries the array exotic class when the value is an
   // array, so Array.isArray(proxy) is true; the fields live on it directly.
@@ -6626,6 +7490,7 @@ function createTarget(value, parent, parentKey, fam = parent?.fam ?? null) {
   t.h = null;
   t.k = null;
   t.dk = null;
+  t.pc = null;
   t.u = parent;
   t.pk = parentKey;
   t.px = null;
@@ -6638,7 +7503,8 @@ function createTarget(value, parent, parentKey, fam = parent?.fam ?? null) {
   t.s = false;
   t.ovl = false;
   t.del = null;
-  t.wk = null;
+  t.hv = null;
+  t.ht = null;
   t.px = new Proxy(t, traps);
   // Legacy interop: shared machinery (affects walks, wrap dedupe) reads the
   // proxy off looked-up targets as a field.
@@ -6819,13 +7685,6 @@ function getDeepNode(target) {
 function bumpDeep(t) {
   if (t.dk !== null) setSignal(t.dk, 1);
 }
-function markDescendants(target) {
-  let t = target;
-  while (t && !t.d) {
-    t.d = true;
-    t = t.u;
-  }
-}
 // ---------------------------------------------------------------------------
 // pending backing + fold (the single mutation point)
 /** target → committed backing at batch start (the fold diff's old side). */
@@ -6850,6 +7709,12 @@ function cloneRaw(source, t) {
     ? Object.defineProperties([], descs)
     : Object.create(Object.getPrototypeOf(source), descs);
 }
+/** Scanned plainness for patch admission (patchableRaw): runs the one-time
+ * accessor scan if it hasn't happened yet — the sticky `a` flag alone is not
+ * trustworthy before a scan (it starts false and is discovered lazily). */
+function targetIsPlain(target) {
+  return target.sc ? !target.a : scanAccessorsOnce(target);
+}
 /** One-time own-accessor scan (Annex-B probes, no descriptor allocation);
  * returns true when the container is plain data (overlay-safe). */
 function scanAccessorsOnce(target) {
@@ -6892,6 +7757,28 @@ function materializePB(target) {
 }
 function ensurePB(target) {
   let pb = target.pb;
+  // Truth-staged backing hand-off (#3164 fold): a TENTATIVE draft opening on
+  // a target whose pending backing is truth-staged (a landing folded into a
+  // retaining transaction — it carries a foldBatches stamp) must not share
+  // the container. Tentative writes would pollute staged truth, and the
+  // tentative discard (notifyOptimisticWrites nulls pb) would destroy the
+  // landing. Park the staged backing and open a fresh draft seeded from the
+  // optimistic view below; the tentative discard restores it. The
+  // tentativePBs guard scopes this to draft OPEN: the draft's own backing
+  // (foldBatches-stamped by its first write when an action's transition is
+  // ambient) must not be parked by its own later writes.
+  if (
+    pb !== null &&
+    !tentativePBs.has(pb) &&
+    target.fam?.opt === true &&
+    !projectionWriteActive &&
+    !getWriteOverride() &&
+    foldBatches.has(target)
+  ) {
+    stagedTruthPB.set(target, pb);
+    pb = target.pb = null;
+  }
+  if (activeTransition !== null) foldBatches.set(target, activeTransition);
   if (pb === null) {
     // Prototype-chain overlay (#3044): plain-data non-array containers
     // outside projection/optimistic families open drafts in O(1) — own keys
@@ -6913,6 +7800,7 @@ function ensurePB(target) {
     // seed from committed truth — seeding overrides there would fold a lane
     // value into the committed home ("authority wins at reveal" would break).
     if (target.fam?.opt && !projectionWriteActive && !getWriteOverride()) {
+      tentativePBs.add(pb);
       const nodes = target.n;
       if (nodes !== null) {
         for (const key of Reflect.ownKeys(nodes)) {
@@ -6934,6 +7822,25 @@ function ensurePB(target) {
   }
   return pb;
 }
+/** Sentinel holder for `t.ht`: a latest()-pull staged this adoption outside
+ * any transition — the hold lasts until the fold commit (drainFolds). */
+const PLAIN_HOLD = Symbol("plainHold");
+/** True while a latest() read is pulling the projection computed up to date
+ * (see the get trap): adoptions landing during the pull are speculative
+ * against the un-flushed batch and stage a held view. (Not injectable — the
+ * derived createStore overload retains projection machinery in every store
+ * bundle, see treeshake.test.ts.) */
+let latestPullActive = false;
+/** Resolve the held committed view (#3074): answers the masked old backing
+ * while the hold is live, and lazily clears a hold whose transition has
+ * committed (transitions merge — resolve through currentTransition, same as
+ * foldHeld's node stamps). */
+function heldMaskView(t) {
+  const ht = t.ht;
+  if (ht === null) return null;
+  if (ht !== PLAIN_HOLD && currentTransition(ht)?._done === true) return (t.ht = t.hv = null);
+  return t.hv;
+}
 /**
  * Adoption (2026-08-16c): the incoming object becomes the committed backing
  * IMMEDIATELY — reconcile is eagerly visible to every reader (shipped
@@ -6949,6 +7856,20 @@ function adoptPB(target, incoming, eager = false) {
   if (!eager) {
     queueFold(target); // records the pre-batch old before we swap
     target.adopted = true;
+    // #3074/#3075: a projection recompute deriving from uncommitted inputs
+    // swaps the backing SPECULATIVELY — committed-visibility readers must
+    // keep the pre-hold view until the hold resolves (a source held by a
+    // live transition, or a latest()-pull ahead of the flush). Post-await
+    // landings (write-override) stay immediately visible — landed truth —
+    // and clear any hold; optimistic families ride the lane machinery.
+    if (target.fam?.opt !== true) {
+      if (getWriteOverride()) {
+        target.ht = target.hv = null;
+      } else if (activeTransition !== null || latestPullActive) {
+        if (heldMaskView(target) === null) target.hv = target.v;
+        target.ht = activeTransition ?? PLAIN_HOLD;
+      }
+    }
   }
   target.pb = null;
   // Overlay and accessor-scan state describe the OUTGOING backing — a
@@ -6960,24 +7881,54 @@ function adoptPB(target, incoming, eager = false) {
   // draft rescans once (#3044 audit follow-up).
   target.ovl = false;
   target.del = null;
-  target.wk = null; // adoption supersedes any staged trap writes
   target.sc = false;
   target.a = false;
+  if (target.pc !== null) target.pc.wk = null; // adoption supersedes staged trap writes
   target.v = incoming;
   target.ch = incoming[$TARGET] !== undefined;
   (target.fam?.map ?? storeNextLookup).set(incoming, target);
 }
+/** Sentinel for `t.wk`: the written-keys bound is unusable this batch (an
+ * array length write implicitly deleted indices) — consumers full-scan. */
+const WK_ALL = new Set();
+const plainProto = o => {
+  const p = Object.getPrototypeOf(o);
+  return p === Object.prototype || p === Array.prototype || p === null;
+};
 function queueFold(target) {
   if (foldOlds.has(target)) return;
-  if (foldOlds.size === 0) {
-    if (!hookInstalled) {
-      hookInstalled = true;
-      setStoreCommitHook(drainFolds);
-    }
-    schedule(); // once per batch — drain clears the map
-  }
+  if (!hookInstalled) {
+    hookInstalled = true;
+    setStoreCommitHook(drainFolds);
+  }
+  // Always arm — "map non-empty ⇒ drain scheduled" is NOT an invariant: a
+  // held re-queue, or an incomplete-transition flush (which skips
+  // commitPendingNodes entirely), leaves entries behind after `scheduled`
+  // was consumed. A size-gated arm then strands every LATER fold — queued
+  // silently, never drained, committed base frozen at stale state while its
+  // nodes commit (#3089). schedule() early-returns when already armed.
+  schedule();
   foldOlds.set(target, target.v);
 }
+/** Fold write-attribution (#3089): a draft written while a transition is
+ * active belongs to that transition — its fold must not commit before the
+ * transition settles. Observed keys already defer through the held check in
+ * drainFolds (their nodes carry _pendingValue); this write-time stamp is the
+ * equivalent hold for UNOBSERVED keys, which have no node to consult.
+ * Refreshed on every write; resolved through currentTransition at drain
+ * (transitions merge — same rule as heldMaskView). */
+const foldBatches = new WeakMap();
+/** Parked truth-staged pending backings (#3164 fold): a tentative draft that
+ * opens while a folded landing's backing is live moves the staged container
+ * here (see ensurePB); the tentative discard in notifyOptimisticWrites
+ * restores it in place of the usual null. */
+const stagedTruthPB = new WeakMap();
+/** Backings opened by TENTATIVE drafts (optimistic user setters): ensurePB's
+ * truth-park must not fire against the draft's own container on its second
+ * and later writes (the first write stamps foldBatches whenever an action's
+ * transition is ambient). Entries die with their draft — tentative backings
+ * are consumed at setter exit. */
+const tentativePBs = new WeakSet();
 /** Committed-time privatization for parent-chain slot updates (path copying). */
 function privatizeCommitted(target) {
   if (ownedRaw.has(target.v)) return;
@@ -6997,7 +7948,27 @@ function drainFolds() {
   const entries = [...foldOlds];
   foldOlds.clear();
   for (const [t, old] of entries) {
+    // A latest()-pull staging holds only until the fold commit: this flush
+    // is committing the batch the pull ran ahead of. Transition holds stay —
+    // they clear when their transition is done (heldMaskView).
+    if (t.ht === PLAIN_HOLD) t.ht = t.hv = null;
+    // Eager (write-override) family folds swap pb -> v at notifyWrites'
+    // tail: by the time this drain runs they carry no pb, and their
+    // structural ops must emit at the fold-commit site below (the clone
+    // branch never sees them). Re-audit blocker 4.
+    const foldedEager = t.pb === null;
     if (t.pb !== null) {
+      // #3089: a fold written under a still-running transition defers to
+      // that transition's settle (the write-time stamp covers unobserved
+      // keys; observed keys also hit the pending-node held check below).
+      const fb = foldBatches.get(t);
+      if (fb !== undefined) {
+        if (currentTransition(fb)._done === false) {
+          foldOlds.set(t, old);
+          continue;
+        }
+        foldBatches.delete(t);
+      }
       // Setter path: nodes were setSignal'd at setter exit (write-time
       // notification — transitions/holds ride core machinery). Commit the
       // backing only for keys whose nodes have committed; a still-pending
@@ -7009,9 +7980,14 @@ function drainFolds() {
         // Only written keys can hold (their nodes took the setSignal); the
         // wk bound keeps this O(written) — see notifyWrites. Same fallback
         // rules as the notify (WK_ALL / accessors / non-plain prototypes).
-        const wkh = t.wk;
+        const wkh = t.pc !== null ? t.pc.wk : null;
         const keys =
-          wkh === null || wkh === WK_ALL || t.a === true || !plainProto(t.ovl ? t.v : pb)
+          wkh === null ||
+          wkh === WK_ALL ||
+          t.a === true ||
+          // Overlay pbs chain to the COMMITTED object (#3044) — plainness is
+          // the committed container's prototype, not the overlay's.
+          !plainProto(t.ovl ? t.v : pb)
             ? Reflect.ownKeys(nodes)
             : wkh;
         for (const key of keys) {
@@ -7049,15 +8025,70 @@ function drainFolds() {
         (t.fam?.map ?? storeNextLookup).delete(pb);
         t.pb = null;
         t.ovl = false;
-        t.wk = null; // written-keys window closes with the fold commit
+        if (t.pc !== null) t.pc.wk = null; // written-keys window closes with the fold commit
       } else {
+        // Setter-channel structural ops: a fold that changes an array's shape
+        // (push/splice/permutation through the setter — the reconcile walk
+        // never queues here) is a structural visibility transition for any
+        // registered list driver. Identity-keyed; aligned folds emit nothing.
+        // Family targets defer to their own adoption emission (fam reconcile).
+        // Arrays always fold on this clone branch (overlay is non-array only).
+        // Family setter drafts (writable projection push/splice through the
+        // masked setter) fold on this branch too and the fold IS their
+        // visibility moment — emit unless the structure already rode another
+        // channel: adoption folds (reconcile walk emitted ops) and
+        // optimistic families (lane-timed override channel). Re-audit
+        // blocker 4.
+        if (
+          t.pc !== null &&
+          t.pc.ro !== null &&
+          !t.adopted &&
+          t.fam?.opt !== true &&
+          Array.isArray(pb) &&
+          Array.isArray(t.v)
+        )
+          rowHooks.emitSetterRowOps(t, t.v, pb);
         t.v = pb;
         t.ch = false; // pb is always a plain clone
         t.pb = null;
-        t.wk = null; // written-keys window closes with the fold commit
+        if (t.pc !== null) t.pc.wk = null; // written-keys window closes with the fold commit
+      }
+    }
+    if (t.v === old) {
+      // A no-op adoption (A -> B -> A before flush) still consumed its walk:
+      // clear the flag or every later setter row-op gate (!t.adopted) stays
+      // failed and a driven family list freezes (re-audit 5, P1-1).
+      t.adopted = false;
+      continue;
+    }
+    // Patch channel (fold-commit site): family targets emit HERE — the fold
+    // IS their visibility moment (held folds re-queued above emit when they
+    // actually commit) — and so do PLAIN fold-adopted targets (setter-
+    // returned root replacements, chained-store swaps: adoptions WITHOUT a
+    // reconcile walk, so no walk-site emission ever happened — re-audit 2,
+    // P1-2). Plain eager targets emitted at their walk/setter sites already.
+    if (t.pc !== null && (t.fam !== null || t.adopted)) {
+      // Structural ops for folds whose structure rode no other channel:
+      // eager-folded family SETTER drafts (write-override swaps pb -> v at
+      // notifyWrites' tail — the clone branch never sees them; adoption
+      // folds re-emitting would double the walk's ops) and PLAIN fold
+      // adoptions (no walk at all). Optimistic families ride the override
+      // channel (lane-timed ops + revert RESYNC) — never re-emit here.
+      if (
+        t.pc.ro !== null &&
+        t.fam?.opt !== true &&
+        (t.fam !== null ? foldedEager && !t.adopted : t.adopted) &&
+        Array.isArray(t.v) &&
+        Array.isArray(old)
+      )
+        rowHooks.emitSetterRowOps(t, old, t.v);
+      if (t.pc.p !== null) {
+        // Accessor demotion at the fold-commit seam is DEV-ONLY (see the
+        // reconcile seam note: prod never pays per-adoption scans).
+        if (!targetIsPlain(t)) patchHooks.demoteToEffects(t);
+        else patchHooks.emitPatchLocal(t, t.v, old);
       }
     }
-    if (t.v === old) continue; // adopted then re-adopted back, or no-op
     // Path copying (CAS: see the eager-fold twin above).
     if (t.u && t.u.v[t.pk] === old) {
       privatizeCommitted(t.u);
@@ -7078,17 +8109,6 @@ function drainFolds() {
  * "pending home = the node when a node exists"). Unobserved keys stay in the
  * pending backing and fold directly at commit.
  */
-/** Sentinel for `t.wk`: the written-keys bound is unusable this batch (an
- * array length write implicitly deleted indices) — consumers full-scan. */
-const WK_ALL = new Set();
-/** Plain-prototype check for the written-keys bound: prototype getters on
- * class instances can derive from ANY field, so only plain-data containers
- * may bound the notify to written keys. Overlay pbs chain to the COMMITTED
- * object (#3044), so overlay plainness is judged on the committed proto. */
-const plainProto = o => {
-  const p = Object.getPrototypeOf(o);
-  return p === Object.prototype || p === Array.prototype || p === null;
-};
 function notifyWrites(t) {
   let pb = t.pb;
   if (pb === null) return;
@@ -7143,8 +8163,15 @@ function notifyWrites(t) {
   // not a full scan). Falls back to the full node scan when the bound can't
   // hold: no trap granularity (wk null), an array length write (WK_ALL —
   // implicit index deletes), accessors on the record (t.a — a getter node's
-  // value can change when ANY key is written), or a non-plain prototype.
-  const wk0 = t.wk;
+  // value can change when ANY key is written), or a non-plain prototype
+  // (class instances: prototype getters derive from arbitrary fields).
+  const wk0 = t.pc !== null ? t.pc.wk : null;
+  // Overlay pbs chain to the COMMITTED object (#3044): a prototype-overlay
+  // draft is plain data on its own layer, but its getPrototypeOf is the
+  // committed container — judge plainness by the COMMITTED prototype or the
+  // bound never engages for overlay writes (every plain-object setter batch
+  // would full-scan: the exact selection-map workload wk exists for; jf
+  // `select` regressed 2x on this).
   const writtenKeys = wk0 === WK_ALL || t.a === true || !plainProto(t.ovl ? t.v : pb) ? null : wk0;
   if (nodes !== null) {
     const keys = writtenKeys ?? Reflect.ownKeys(nodes);
@@ -7177,15 +8204,18 @@ function notifyWrites(t) {
   }
   const has = t.h;
   if (has !== null) {
-    for (const key of Reflect.ownKeys(has))
-      setSignal(has[key], key in pb && !(t.del !== null && t.del.has(key)));
+    const keys = writtenKeys ?? Reflect.ownKeys(has);
+    for (const key of keys) {
+      const node = has[key];
+      if (node !== undefined) setSignal(node, key in pb && !(t.del !== null && t.del.has(key)));
+    }
   }
   // Deep-witness (dk): setter writes must notify a deep() subscriber even on
-  // keys with no node. O(pb keys) equality only when a witness exists.
+  // keys with no node. O(written/pb keys) equality only when a witness exists.
   if (t.dk !== null) {
     if (t.del !== null && t.del.size !== 0) bumpDeep(t);
     else
-      for (const key of Reflect.ownKeys(pb)) {
+      for (const key of writtenKeys ?? Reflect.ownKeys(pb)) {
         const nv = pb[key];
         const ov = old[key];
         if (nv !== null && typeof nv === "object" ? !targetsEqual(ov, nv) : !isEqual(ov, nv)) {
@@ -7215,6 +8245,13 @@ function notifyWrites(t) {
     }
     if (changed) setSignal(t.k, v => v + 1);
   }
+  // Patch channel (setter site): a committed write transitions this record —
+  // queue its patches and bubble to ancestors (targeted nested writes must
+  // reach the row patch, §4b). One number compare when no patches exist.
+  // Family targets skip this site: their visibility moment is the FOLD
+  // commit (drainFolds emits), not the recompute/draft write.
+  if (t.fam === null && patchHooks !== null && patchHooks.hasPatches())
+    patchHooks.emitPatch(t, pb, old);
   // Projection backing folds split by channel (two pinned contracts):
   // - sync-derive drafts (recompute body): NEVER eager — a downstream async
   //   hold can form LATER in the same flush and the leaf must stay at stale
@@ -7225,10 +8262,18 @@ function notifyWrites(t) {
   //   IMMEDIATE — landed truth shows to untracked readers even while a
   //   downstream consumer's own async still holds the effect-level reveal
   //   (spec-async "verdicts never inherit consumers' in-flight state").
-  if (t.fam !== null && t.pb !== null && getWriteOverride()) {
+  //   EXCEPT under an active transaction (#3164 fold): a landing riding a
+  //   retaining transaction (the optimistic module's aroundWrite binds it)
+  //   stages instead — ensurePB stamped foldBatches, so the backing commits
+  //   with the transaction and the reveal is atomic at settle. The pinned
+  //   immediate-commit contract is stated over the no-transaction microtask
+  //   posture, which `activeTransition === null` is exactly.
+  if (t.fam !== null && t.pb !== null && getWriteOverride() && activeTransition === null) {
+    // Landed truth (post-await write-override): immediately visible to every
+    // reader — any staged held view is superseded.
+    if (t.ht !== null) t.ht = t.hv = null;
     const oldBacking = t.v;
     t.pb = null;
-    t.wk = null; // written-keys window closes with the eager fold
     t.v = pb;
     t.ch = false;
     if (t.u && t.u.v[t.pk] === oldBacking) {
@@ -7433,6 +8478,17 @@ function inOwnerContext() {
   const eff = c._root ? c._parentComputed : c;
   return eff != null && !(eff._config & CONFIG_CHILDREN_FORBIDDEN);
 }
+/** CHILDREN_FORBIDDEN execution scope (createTrackedEffect / onSettled
+ * callbacks). Distinct from context-free: these scopes get committed
+ * visibility even against a projection's authoritative-elect pending
+ * backing (#3082) — parity with signals, where core read() serves
+ * committed to them regardless of staged writes. */
+function inForbiddenScope() {
+  const c = getOwner();
+  if (c === null) return false;
+  const eff = c._root ? c._parentComputed : c;
+  return eff != null && !!(eff._config & CONFIG_CHILDREN_FORBIDDEN);
+}
 /** A pending fold is transition-held when any written node's parked value is
  * stamped by a live transition (a plain batch parking — the lazy-recompute
  * read case — has no transition stamp and serves fresh). */
@@ -7451,6 +8507,20 @@ function foldHeld(target) {
   return false;
 }
 function readSource(target) {
+  // Held view first (#3074): an adoption staged under a live hold serves the
+  // pre-hold committed backing to committed-visibility readers. Speculative
+  // readers — drafts, write-override, owner-context computeds recomputing
+  // inside the transaction, and latest() reads — see the adopted backing.
+  if (
+    target.ht !== null &&
+    !latestReadActive &&
+    !inDraft(target) &&
+    !getWriteOverride() &&
+    !inOwnerContext()
+  ) {
+    const hv = heldMaskView(target);
+    if (hv !== null) return hv;
+  }
   // Signal-parity visibility (core read(): owner-context reads serve
   // _pendingValue, context-free reads serve committed — effects recompute
   // BEFORE commitPendingNodes in the flush, so the pending view must be
@@ -7461,15 +8531,37 @@ function readSource(target) {
     target.pb !== null &&
     (inDraft(target) ||
       getWriteOverride() ||
-      inOwnerContext() ||
+      // Owner-context readers see the pending backing — EXCEPT held truth
+      // on an optimistic family (#3164 fold): a live pb on an opt family
+      // outside the draft/write-override windows is a staged landing
+      // (tentative drafts never outlive their setter), and only the
+      // authoritative postures and latest() see it (the backing-level twin
+      // of core read()'s A17-for-held-truth arm; ordinary readers keep
+      // committed until the transaction's reveal).
+      (inOwnerContext() && !heldTruthMasked(target)) ||
       // A projection's pending backing is authoritative-elect: serve it to
       // context-free readers too UNLESS a transition is holding the node
-      // commits (downstream async hold — stale committed is the contract).
-      (target.fam !== null && !foldHeld(target)))
+      // commits (downstream async hold — stale committed is the contract)
+      // or the reader is a CHILDREN_FORBIDDEN scope, which never observes
+      // its own unsettled write (#3082, signal parity per #3006).
+      (target.fam !== null && !heldTruthMasked(target) && !foldHeld(target) && !inForbiddenScope()))
   )
     return target.pb;
   return target.v;
 }
+/** #3164 fold: HELD truth on an optimistic family — a pending backing
+ * stamped by a live transition that retains optimism — is masked from
+ * ordinary readers (they keep committed until the transaction's reveal);
+ * the authoritative postures and latest() tunnel through. Un-stamped
+ * backings and optimism-free transitions keep ordinary mid-batch/
+ * speculation visibility. */
+function heldTruthMasked(target) {
+  if (target.fam?.opt !== true || latestReadActive || authoritativeServe()) return false;
+  const fb = foldBatches.get(target);
+  // opt families are only created by createOptimisticStore, whose module
+  // install populates optHooks — the assertion holds by construction.
+  return fb !== undefined && optHooks.retainsOptimism(fb);
+}
 const hasOwn = Object.prototype.hasOwnProperty;
 // Allocation-free own-accessor probe (replaces eager descriptor scans — the
 // single biggest creation cost in the uibench profile): Annex-B lookups
@@ -7501,6 +8593,26 @@ function runAuthoritative(fn) {
 function hasActiveOverride(node) {
   return node._x?._overrideValue !== undefined && node._x?._overrideValue !== NOT_PENDING;
 }
+/** The reading computation is until()'s authoritative-view predicate — same
+ * source of truth as core read()'s A17 carve-out (`context`, which persists
+ * under untrack). optimisticView()'s composition gate consults exactly this:
+ * write-side machinery (patch emission, tentative re-application) must keep
+ * composing even when it runs inside an authoritative-write bracket. */
+function authoritativeRead() {
+  const c = context;
+  return c !== null && (c._config & CONFIG_AUTHORITATIVE_READ) !== 0;
+}
+/** Serve-side authoritative gate: until()'s predicate PLUS truth authors —
+ * the projection derive's draft (wrapDraft trap brackets, runAuthoritative;
+ * the same posture pair ensurePB classifies drafts by). A source computing
+ * the next truth must never read its callers' tentative overlays: a derive
+ * continuation's `store.push` computing its index from an action's
+ * optimistic row landed truth in the wrong slot and corrupted committed
+ * state (#3108). Trap-level overlay serves gate on this so values, length,
+ * membership, and keys leave the authoritative view together. */
+function authoritativeServe() {
+  return projectionWriteActive || getWriteOverride() || authoritativeRead();
+}
 /** Context-aware node view for reads outside tracking: active override >
  * held pending (owner context) > the BACKING value. Committed truth lives in
  * the backing (single-home rule, O6) — node `_value` is never served here,
@@ -7509,11 +8621,26 @@ function hasActiveOverride(node) {
  * FORCE sentinels never surface (they only bump subscribers of accessor
  * keys, which are served by the trap, not the node). */
 function nodeValue(node, backing) {
-  const v = hasActiveOverride(node)
-    ? unwrapOverride(node._x?._overrideValue)
-    : node._pendingValue !== NOT_PENDING && inOwnerContext()
-      ? node._pendingValue
-      : backing;
+  // latest() sees the in-flight parked value like an owner-context reader
+  // does (#3075) — signal/memo parity for store-node-backed keys.
+  // Authoritative-view reads (until()'s predicate) skip the override arm
+  // only: staged pending values are authoritative, overrides are the
+  // caller's optimism.
+  const v =
+    !authoritativeServe() && hasActiveOverride(node)
+      ? unwrapOverride(node._x?._overrideValue)
+      : node._pendingValue !== NOT_PENDING &&
+          (latestReadActive ||
+            // Owner-context pending visibility — except HELD truth (#3164,
+            // see CONFIG_HELD_TRUTH: fold-staged or entangle-stolen
+            // confirming truth), which only authoritative/latest readers
+            // see (core read()'s A17-for-held-truth twin; ordinary readers
+            // keep committed until the transaction's reveal — latest() is
+            // exempted by the leading arm above).
+            ((inOwnerContext() || authoritativeServe()) &&
+              !(node._config & CONFIG_HELD_TRUTH && !authoritativeServe())))
+        ? node._pendingValue
+        : backing;
   return v === FORCE ? backing : v;
 }
 /** Serve an own data key: node-first when a node exists (pending visibility,
@@ -7538,13 +8665,18 @@ function serveDataKey(target, key, backingValue, src, node) {
         read(getNode(target, key, backingValue));
       }
     }
-    return optHooks.optimisticView(target, src).length;
+    // Truth authors read the backing's own length — an optimistic row from
+    // the caller's transaction must not shift where the author's next write
+    // lands (#3108).
+    return (authoritativeServe() ? src : optHooks.optimisticView(target, src)).length;
   }
   if (inDraft(target)) {
     // Optimistic drafts before their first write have no pending backing yet;
     // reads must still see the live optimistic view (compose, not clobber —
     // #2951). Once ensurePB runs, the seeded clone carries the view.
-    if (target.fam?.opt && target.pb === null) {
+    // AUTHORITATIVE drafts (projection derive) never overlay — ensurePB's
+    // seeding rule, applied to the read side (#3108).
+    if (target.fam?.opt && target.pb === null && !authoritativeServe()) {
       const node = target.n?.[key];
       if (node !== undefined && hasActiveOverride(node))
         v = unwrapOverride(node._x?._overrideValue);
@@ -7602,6 +8734,27 @@ function firewallGate(target) {
   const fw = target.fam?.node;
   if (fw != null && fw._statusFlags & (STATUS_UNINITIALIZED | STATUS_ERROR)) read(fw);
 }
+/** latest() pull (#3075): bring the projection computed up to date so the
+ * read serves the IN-FLIGHT derivation — signal/memo parity, where core
+ * read() routes latest() through a companion that recomputes speculatively.
+ * The latest flag is suspended for the recompute (the derive's own reads
+ * are normal reads), and latestPullActive marks any adoption it commits as
+ * staged (see adoptPB) — the speculative swap must not leak to
+ * committed-visibility readers before the flush. */
+function pullProjectionForLatest(target) {
+  const fw = target.fam.node;
+  if (fw == null) return;
+  const prevLatest = latestReadActive;
+  setLatestReadActive(false);
+  const prevPull = latestPullActive;
+  latestPullActive = true;
+  try {
+    prepareComputed(fw, true);
+  } finally {
+    latestPullActive = prevPull;
+    setLatestReadActive(prevLatest);
+  }
+}
 const traps = {
   get(target, key, receiver) {
     // One typeof gates every brand-symbol compare off the hot string path
@@ -7629,6 +8782,11 @@ const traps = {
     }
     if (pendingCheckActive) witnessAffectsMark(target, key);
     if (target.fam !== null && getObserver() === null && !inDraft(target)) firewallGate(target);
+    // latest() pull (#3075): store traps never reach core read() without an
+    // observer, so bring the projection computed up to date here — signal/
+    // memo parity for latest() reads through a projection.
+    if (target.fam !== null && latestReadActive && !inDraft(target) && !getWriteOverride())
+      pullProjectionForLatest(target);
     const src = readSource(target);
     // Overlay delete (#3044): a prototype overlay cannot shadow a delete, so
     // deleted keys are tracked aside and read as absent in the pending view.
@@ -7727,7 +8885,15 @@ const traps = {
           if (target.s) return serveShallow(target, key, nv);
           return isWrappable(nv) ? draftServe(target, wrapNext(nv, target, key)) : nv;
         }
-      } else if (v === undefined && inDraft(target) && target.fam?.opt && target.pb === null) {
+      } else if (
+        v === undefined &&
+        inDraft(target) &&
+        target.fam?.opt &&
+        target.pb === null &&
+        // AUTHORITATIVE drafts (landing folds) never seed from overrides —
+        // the caller's optimism is not truth (has-trap twin below).
+        !authoritativeServe()
+      ) {
         const node = target.n?.[key];
         if (node !== undefined && hasActiveOverride(node))
           v = unwrapOverride(node._x?._overrideValue);
@@ -7754,14 +8920,16 @@ const traps = {
     if (!inDraft(target)) {
       if (getObserver() !== null) {
         const node = getHasNode(target, key, present);
+        // Authoritative-view readers get the right answer for free: core read()
+        // skips the override arm for them, so nv is authoritative presence.
         const nv = read(node);
         if (hasActiveOverride(node)) present = !!nv;
-      } else {
+      } else if (!authoritativeServe()) {
         const node = target.h?.[key];
         if (node !== undefined && hasActiveOverride(node))
           present = !!unwrapOverride(node._x?._overrideValue);
       }
-    } else if (target.fam?.opt && target.pb === null) {
+    } else if (target.fam?.opt && target.pb === null && !authoritativeServe()) {
       const node = target.h?.[key];
       if (node !== undefined && hasActiveOverride(node))
         present = !!unwrapOverride(node._x?._overrideValue);
@@ -7787,8 +8955,14 @@ const traps = {
     // Optimistic membership overlay: presence-node overrides add/remove keys
     // (per-transaction lifecycle rides the nodes — §6, FINDING-2's fix).
     // Draft reads before the first write overlay too (pb, once created, is
-    // seeded with the view).
-    if (target.fam?.opt && target.h !== null && (!inDraft(target) || target.pb === null)) {
+    // seeded with the view). Authoritative-view reads (until()'s predicate,
+    // truth-author drafts) skip the overlay.
+    if (
+      !authoritativeServe() &&
+      target.fam?.opt &&
+      target.h !== null &&
+      (!inDraft(target) || target.pb === null)
+    ) {
       let set = null;
       for (const key of Reflect.ownKeys(target.h)) {
         const node = target.h[key];
@@ -7810,7 +8984,7 @@ const traps = {
       if (target.del !== null && target.del.has(key)) return undefined;
       if (desc === undefined) desc = Object.getOwnPropertyDescriptor(target.v, key);
     }
-    if (target.fam?.opt && !inDraft(target)) {
+    if (!authoritativeServe() && target.fam?.opt && !inDraft(target)) {
       const node = target.h?.[key];
       if (node !== undefined && hasActiveOverride(node)) {
         if (!unwrapOverride(node._x?._overrideValue)) return undefined; // opt delete
@@ -7852,14 +9026,15 @@ const traps = {
     // Array length writes implicitly delete indices — the written-keys bound
     // can't see them, so poison to the full scan for this batch. Index
     // writes implicitly GROW length, so arrays always record it alongside.
+    const pcs = pcOf(target);
     if (Array.isArray(pb)) {
-      if (key === "length") target.wk = WK_ALL;
-      else if (target.wk !== WK_ALL) {
-        const wk = (target.wk ??= new Set());
+      if (key === "length") pcs.wk = WK_ALL;
+      else if (pcs.wk !== WK_ALL) {
+        const wk = (pcs.wk ??= new Set());
         wk.add(key);
         wk.add("length");
       }
-    } else if (target.wk !== WK_ALL) (target.wk ??= new Set()).add(key);
+    } else if (pcs.wk !== WK_ALL) (pcs.wk ??= new Set()).add(key);
     // Own data keys literally named "prototype"/"constructor" land as data —
     // defineProperty sidesteps a proto-chain setter named the same.
     if (UNSAFE_KEYS.has(key)) {
@@ -7897,12 +9072,20 @@ const traps = {
     const override = !draft && getWriteOverride();
     if (!draft && !override) return true;
     if (key === "__proto__") return true;
-    if (desc.get || desc.set) target.a = true;
+    if (desc.get || desc.set) {
+      target.a = true;
+      // Accessor demotion (re-audit blocker 3): a record that acquires an
+      // accessor after patch registration stops being patchable — pull its
+      // patches and re-drive them as tracked effect fallbacks. Hooks are
+      // installed whenever pc.p exists (registration installs them).
+      if (target.pc !== null && target.pc.p !== null) patchHooks.demoteToEffects(target);
+    }
     // Unwrap before ensurePB (see the set trap: self-reference materializes).
     if ("value" in desc) desc = { ...desc, value: unwrapValue(desc.value) };
     const pb = ensurePB(target);
     pendingNotify.add(target);
-    if (target.wk !== WK_ALL) (target.wk ??= new Set()).add(key);
+    const pcd = pcOf(target);
+    if (pcd.wk !== WK_ALL) (pcd.wk ??= new Set()).add(key);
     Object.defineProperty(pb, key, desc);
     if (target.del !== null) target.del.delete(key);
     if (override) notifyWrites(target);
@@ -7914,7 +9097,8 @@ const traps = {
     if (!draft && !override) return true;
     const pb = ensurePB(target);
     pendingNotify.add(target);
-    if (target.wk !== WK_ALL) (target.wk ??= new Set()).add(key);
+    const pcx = pcOf(target);
+    if (pcx.wk !== WK_ALL) (pcx.wk ??= new Set()).add(key);
     delete pb[key];
     // A prototype overlay cannot shadow a delete of a committed key —
     // record it aside (#3044); reads/has/ownKeys/commit consult the set.
@@ -7987,8 +9171,39 @@ function createStoreNext(init, shallow = false) {
   const setter = fn => storeSetterNext(proxy, fn);
   return [proxy, setter];
 }
+/** True when `proxy` is a SHALLOW store (children served verbatim, slots
+ * replaced by reference — #2932). The list driver uses this to choose the
+ * slot-patch channel (collected row bodies) over per-record registration. */
+function storeIsShallow(proxy) {
+  const t = proxy?.[$TARGET];
+  return t !== undefined && t.s === true;
+}
+/** True when `proxy` belongs to a projection/optimistic FAMILY. The list
+ * driver must DECLINE family arrays (external audit finding): family
+ * structural changes never emit row/slot ops (the setter channel is
+ * fam-gated; optimistic writes ride node overrides), and the proxy identity
+ * is stable so the each-watch cannot catch the change either — an engaged
+ * list would freeze on optimistic/projection structural updates. Record-
+ * level family patches are unaffected (they have their own emission). */
+function storeHasFamily(proxy) {
+  const t = proxy?.[$TARGET];
+  return t !== undefined && t.fam !== null;
+}
+/** True when `proxy` belongs to an OPTIMISTIC family specifically. The list
+ * driver declines these (audit finding, narrowed): optimistic user writes
+ * ride node-level overrides — they never enter the reconcile walk, so no
+ * row/slot ops are emitted and an engaged list would freeze on optimistic
+ * structural changes. PROJECTION (non-optimistic) families are drivable:
+ * their recomputes go through the reconcile walk, whose emissions are
+ * transition-stamped in the apply queue like any other (equivalence-matrix
+ * gated). Re-admitting optimistic families requires a lane-timed structural
+ * emission mirroring emitPatchOptimistic, plus revert resync. */
+function storeHasOptimisticFamily(proxy) {
+  const t = proxy?.[$TARGET];
+  return t !== undefined && t.fam?.opt === true;
+}
 /** Tracking deep snapshot (`deep()` for next targets): subscribes to the
- * key-set and every property node at every reachable level, then returns the
+ * key-set and deep-witness node at every reachable level, then returns the
  * plain view. Shared references and cycles handled via the visited set. */
 function deepNext(value) {
   const t0 = value?.[$TARGET];
@@ -8188,7 +9403,7 @@ function reconcileNextState(value, state, key, replace = false) {
     // positional so old-entity subtrees never merge into the new entity's).
     const prev = t.pb ?? t.v;
     const eq = keyFn(prev);
-    if (eq !== undefined && keyFn(incoming) !== eq) {
+    if (eq !== undefined && !sameKey(keyFn(incoming), eq)) {
       if (!replace) throw new Error("Cannot reconcile states with different identity");
       // Entity change: wholesale swap. The root proxy is stable for life
       // (proj R5) but NOTHING below survives — children are never matched
@@ -8229,6 +9444,33 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
   const shallow = t.s === true;
   const old = t.v;
   adoptPB(t, incoming, eager);
+  // Patch channel (adoption site): this record transitioned — queue its
+  // patches with the pre-adopt prev. No bubbling walk: the adoption walk
+  // visits parents before children, so ancestors emitted already. EAGER
+  // only — family targets' visibility moment is their fold commit
+  // (drainFolds emits there; emitting here too would double-fire).
+  if (patchHooks !== null && eager && t.pc !== null && t.pc.p !== null) {
+    // Accessor demotion at the ADOPTION seam is DEV-ONLY (prod principle:
+    // explicitly-odd input must not cost correct-input prod — the
+    // per-adoption scan was ~12% of dbmon's tick since adoptPB resets the
+    // verdict every adoption). Dev demotes AND warns; prod emits directly,
+    // so a getter adoptee's OUTSIDE deps (signals) won't re-apply in prod —
+    // caught loudly during development instead. Registration-time admission
+    // (patchableRaw) keeps its full one-time scan in both modes.
+    if (!targetIsPlain(t)) {
+      console.warn(
+        "A reconcile adopted an object with own getters into a record that " +
+          "carries compiled patches. Patches read raw values and will not " +
+          "track the getters' reactive dependencies — this record's patches " +
+          "are demoted to effects in development, but production will NOT " +
+          "demote. Avoid getters on patched records, or key them out of " +
+          "patch-eligible templates."
+      );
+      patchHooks.demoteToEffects(t);
+    } else {
+      patchHooks.emitPatchLocal(t, incoming, old);
+    }
+  }
   // Shallow adoption: records are slot values — sticky raw-mark the incoming
   // set (R41) and never descend; slot notification is the positional diff.
   if (shallow) markRawIngest(incoming);
@@ -8268,7 +9510,7 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
             typeof pvRaw === "object" &&
             nv !== null &&
             typeof nv === "object" &&
-            keyFn(pvRaw) === keyFn(nv)
+            sameKey(keyFn(pvRaw), keyFn(nv))
           )
         )
           break; // misaligned: fall to the keyed remainder below
@@ -8296,6 +9538,7 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
         }
       }
       if (t.dk !== null && !dkBumpedA && i < nextRows.length) bumpDeep(t);
+      const structStart = i; // misalignment point (== nlen on aligned ticks)
       let prevByKey = null;
       for (; i < nextRows.length; i++) {
         const nv = nextRows[i];
@@ -8305,16 +9548,39 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
           let pv;
           if (nk !== undefined) {
             if (prevByKey === null) {
+              // Occurrence-aware (re-audit 2, P1-5): duplicate keys queue
+              // their prev INDICES (rows can themselves be arrays, so index
+              // queues are the unambiguous encoding — same as buildRowOps)
+              // and each is consumed ONCE. First-wins would adopt two next
+              // rows into the SAME prev target while row ops retain two
+              // separate DOM rows (the second one stale).
               prevByKey = new Map();
-              for (let j = 0; j < prevRows.length; j++) {
+              // From structStart, not 0 (re-audit 3, P1-2): prefix-aligned
+              // rows already adopted their incoming counterparts — re-offering
+              // them here let a duplicate key adopt a prefix row AGAIN while
+              // row ops (which correctly window from structStart) retained
+              // the later occurrence's DOM row against a never-adopted target.
+              for (let j = structStart; j < prevRows.length; j++) {
                 const p = unwrapValue(prevRows[j]);
                 if (p !== null && typeof p === "object") {
                   const pk = keyFn(p);
-                  if (pk !== undefined && !prevByKey.has(pk)) prevByKey.set(pk, p);
+                  if (pk === undefined) continue;
+                  const existing = prevByKey.get(pk);
+                  if (existing === undefined) prevByKey.set(pk, j);
+                  else if (Array.isArray(existing)) existing.push(j);
+                  else prevByKey.set(pk, [existing, j]);
                 }
               }
             }
-            pv = prevByKey.get(nk);
+            const m = prevByKey.get(nk);
+            if (m === undefined) pv = undefined;
+            else if (Array.isArray(m)) {
+              pv = unwrapValue(prevRows[m.shift()]);
+              if (m.length === 1) prevByKey.set(nk, m[0]);
+            } else {
+              pv = unwrapValue(prevRows[m]);
+              prevByKey.delete(nk);
+            }
           } else {
             pv = unwrapValue(prevRows[i]); // keyless item: positional fallback
           }
@@ -8328,12 +9594,62 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
           }
         }
       }
+      // Row ops (PR-B): emit structural ops ONLY when structure changed —
+      // aligned value ticks pay nothing. Built after the walk so retained
+      // rows' value patches queue first (adds bind at op-apply).
+      if (
+        rowHooks !== null &&
+        t.pc !== null &&
+        t.pc.ro !== null &&
+        (structStart < nlen || plen !== nlen)
+      )
+        buildAndEmitRowOps(t, prevRows, nextRows, structStart, keyFn);
     } else {
       const dlen = Math.min(prevRows.length, nextRows.length);
       const nlen = nextRows.length;
       let dkBumpedP = false;
+      const sp = rowHooks !== null && t.pc !== null ? t.pc.sp : null;
+      // Row ops for shallow/positional lists: track the key-aligned prefix
+      // (keyed) so aligned value ticks emit nothing; keyless lists emit only
+      // on length change (append/truncate). Slot-patch consumers need the
+      // alignment tracking too (aligned = value tick, misaligned = ops).
+      const ro = rowHooks !== null && t.pc !== null ? t.pc.ro : null;
+      let keyAligned = keyFn !== null && (ro !== null || sp !== null);
+      let keyPrefix = 0;
       for (let i = 0; i < nlen; i++) {
         const nvP = nextRows[i];
+        if (keyAligned && i < dlen) {
+          const pvK = prevRows[i];
+          if (
+            pvK !== null &&
+            typeof pvK === "object" &&
+            nvP !== null &&
+            typeof nvP === "object" &&
+            // SameValueZero (self-sweep): strict === here broke slot
+            // alignment on NaN keys while buildRowOps retained the row —
+            // retained DOM with suppressed value ticks (the round-1 NaN
+            // staleness, in the shallow branch).
+            sameKey(keyFn(pvK), keyFn(nvP))
+          )
+            keyPrefix++;
+          else keyAligned = false;
+        }
+        // Slot-patch dispatch (shallow): a KEY-ALIGNED slot whose value was
+        // replaced by reference is a value tick — emit through the queue.
+        // Misaligned/appended slots are STRUCTURE (row ops rebuild or move
+        // them; new rows initial-apply at bind), so they emit nothing here.
+        // Keyless positional lists treat same-index replacement as the value
+        // tick for indices below the common length.
+        // `i < dlen` is load-bearing for BOTH modes: an appended position
+        // past a fully-aligned prefix (vacuously aligned when prev is empty)
+        // has no previous slot — emitting a slot tick for it races the row
+        // ops that CREATE the row (the slot queue applies first, indexing a
+        // row that does not exist yet). Equivalence-matrix finding:
+        // clear-then-refill and pure appends crashed the driver.
+        if (sp !== null && i < dlen && (keyFn === null || keyAligned)) {
+          const pvS = prevRows[i];
+          if (pvS !== nvP) rowHooks.emitSlotPatch(t, i, nvP, pvS);
+        }
         if (!shallow && i < dlen && nvP !== null && typeof nvP === "object")
           descend(unwrapValue(prevRows[i]), nvP, keyFn, fam, proj);
         if (
@@ -8354,6 +9670,15 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
           }
         }
       }
+      if (ro !== null) {
+        const plen = prevRows.length;
+        if (keyFn !== null) {
+          if (keyPrefix < nlen || plen !== nlen)
+            buildAndEmitRowOps(t, prevRows, nextRows, keyPrefix, keyFn);
+        } else if (plen !== nlen) {
+          buildAndEmitRowOps(t, prevRows, nextRows, dlen, null);
+        }
+      }
     }
     if (eager) {
       if (nodes !== null && nodesHit < t.nc) {
@@ -8374,6 +9699,22 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
     // slots must not notify, R9). This replaces the notifyFold re-walk that
     // doubled dbmon's diff cost. for-in covers own enumerable string keys
     // with no key-array allocation; symbols get a pass only when present.
+    // PROTOTYPE compiled-patch fast path: a pure-patch record (no nodes,
+    // no presence/key-set/deep subscribers, no family) adopts and hands the
+    // (next, prev) pair to its compiled patch — no per-key walk at all.
+    if (
+      t.pc !== null &&
+      t.pc.p !== null &&
+      eager &&
+      t.n === null &&
+      t.h === null &&
+      t.k === null &&
+      t.dk === null &&
+      fam === null
+    ) {
+      // Adoption already ran at applyAdopt entry; emission was queued there.
+      return;
+    }
     const nodes = eager ? t.n : null;
     let nodesHit = 0;
     let dkBumped = false;
@@ -8439,6 +9780,93 @@ function applyAdopt(t, incoming, keyFn, proj = false) {
   }
 }
 const hasOwnP = Object.prototype.hasOwnProperty;
+/** Setter-channel row ops (the fold site calls this for array targets with
+ * ops consumers): structural mutation through the setter — push/splice/index
+ * assignment/permutation — is a visibility transition for the list container
+ * just like a reconcile walk, and drivers consuming registerRowOps must see
+ * it. Setter mutations move the SAME row objects around, so RAW IDENTITY is
+ * the key. Aligned arrays (value-only folds) emit nothing. */
+const identityKey = r => unwrapValue(r);
+/** Key equality for EVERY key comparison in this module (re-audit 2, P1-5):
+ * SameValueZero, matching the Map-based matchers (buildRowOps, the adoption
+ * window) — NaN keys are equal to themselves, so aligned NaN rows stay
+ * aligned in the prefix walk instead of forever misaligning. Adoption and
+ * row ops MUST agree on key equality or retained DOM rows go stale. */
+function sameKey(a, b) {
+  return a === b || (a !== a && b !== b);
+}
+function emitSetterRowOps(t, prevRows, nextRows) {
+  const ops = buildIdentityRowOps(prevRows, nextRows);
+  if (ops !== null) rowHooks.emitRowOps(t, nextRows, ops);
+}
+/** Identity-keyed structural diff, returned rather than emitted: shared by
+ * the setter channel (regular queue) and the OPTIMISTIC write channel (lane
+ * queue) — same retention semantics, different dispatch timing. Returns
+ * null when the lists are identity-aligned (no structure changed). */
+function buildIdentityRowOps(prevRows, nextRows) {
+  let p = 0;
+  const min = prevRows.length < nextRows.length ? prevRows.length : nextRows.length;
+  while (p < min && unwrapValue(prevRows[p]) === unwrapValue(nextRows[p])) p++;
+  if (p === prevRows.length && p === nextRows.length) return null;
+  return buildRowOps(prevRows, nextRows, p, identityKey);
+}
+/** Shared row-ops builder (keyed deep branch + shallow/positional branch):
+ * key-matches the misaligned window into { prefix, sources, removed }.
+ * `keyFn === null` degrades to positional ops (append/truncate only). */
+function buildAndEmitRowOps(t, prevRows, nextRows, structStart, keyFn) {
+  rowHooks.emitRowOps(t, nextRows, buildRowOps(prevRows, nextRows, structStart, keyFn));
+}
+function buildRowOps(prevRows, nextRows, structStart, keyFn) {
+  const plen = prevRows.length;
+  const nlen = nextRows.length;
+  const sources = new Array(nlen - structStart);
+  // Occurrence-aware matching (re-audit): duplicate keys queue their old
+  // indices and each is consumed ONCE — first-wins reuse would hand the same
+  // source (and its one DOM row) to multiple next positions. The no-dup fast
+  // shape stays a bare number; collisions upgrade to a queue.
+  let oldIndexByKey = null;
+  if (keyFn !== null && structStart < plen) {
+    oldIndexByKey = new Map();
+    for (let j = structStart; j < plen; j++) {
+      const p = unwrapValue(prevRows[j]);
+      if (p !== null && typeof p === "object") {
+        const pk = keyFn(p);
+        if (pk === undefined) continue;
+        const existing = oldIndexByKey.get(pk);
+        if (existing === undefined) oldIndexByKey.set(pk, j);
+        else if (Array.isArray(existing)) existing.push(j);
+        else oldIndexByKey.set(pk, [existing, j]);
+      }
+    }
+  }
+  const consumed = oldIndexByKey !== null ? new Set() : null;
+  for (let k = structStart; k < nlen; k++) {
+    const nv = nextRows[k];
+    let oldIdx = -1;
+    if (nv !== null && typeof nv === "object" && oldIndexByKey !== null) {
+      const nk = keyFn(nv);
+      if (nk !== undefined) {
+        const m = oldIndexByKey.get(nk);
+        if (m !== undefined) {
+          if (Array.isArray(m)) {
+            oldIdx = m.shift();
+            if (m.length === 1) oldIndexByKey.set(nk, m[0]);
+          } else {
+            oldIdx = m;
+            oldIndexByKey.delete(nk);
+          }
+          consumed.add(oldIdx);
+        }
+      }
+    }
+    sources[k - structStart] = oldIdx;
+  }
+  const removed = [];
+  for (let j = structStart; j < plen; j++) {
+    if (consumed === null || !consumed.has(j)) removed.push(unwrapValue(prevRows[j]));
+  }
+  return { prefix: structStart, sources, removed };
+}
 function descend(pv, nv, keyFn, fam, proj = false) {
   if (pv === null || typeof pv !== "object" || nv === null || typeof nv !== "object") return;
   // Lookup FIRST: a hit implies pv was wrappable and never raw-marked (only
@@ -8462,7 +9890,10 @@ function descend(pv, nv, keyFn, fam, proj = false) {
     const nk = keyFn(nv);
     // Key mismatch detaches: the slot takes the new entity; the old proxy
     // keeps its (old) backing and a fresh proxy wraps the new value on read.
-    if (pk !== undefined && nk !== undefined && pk !== nk) return;
+    // SameValueZero (re-audit 2, P1-5): NaN keys are self-equal — strict
+    // inequality detached every NaN-keyed slot on every tick while the
+    // Map-based row-ops matcher retained its DOM row (stale forever).
+    if (pk !== undefined && nk !== undefined && !sameKey(pk, nk)) return;
   }
   // Reachability pruning (§6d) is MODE-dependent, both pinned:
   // - keyed matching descends only where subscriptions exist at/below (`d`) —
@@ -8516,7 +9947,8 @@ function descend(pv, nv, keyFn, fam, proj = false) {
  * driven from inside an enclosing authoritative-write scope (next-store
  * optimistic derives), and a hard `false` would clobber it mid-derive.
  */
-function wrapDraft(inner, isActive, onDraftWrite) {
+function wrapDraft(inner, isActive, aroundWrite) {
+  const write = op => (aroundWrite ? aroundWrite(op) : op());
   const traps = {
     get(_, prop) {
       let value;
@@ -8531,7 +9963,7 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       }
       if (prop === $TARGET) return value;
       return typeof value === "object" && value !== null
-        ? wrapDraft(value, isActive, onDraftWrite)
+        ? wrapDraft(value, isActive, aroundWrite)
         : value;
     },
     has(_, prop) {
@@ -8553,8 +9985,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        inner[prop] = value;
-        onDraftWrite?.();
+        write(() => {
+          inner[prop] = value;
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -8567,8 +10000,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        delete inner[prop];
-        onDraftWrite?.();
+        write(() => {
+          delete inner[prop];
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -8609,8 +10043,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        Reflect.defineProperty(inner, prop, desc);
-        onDraftWrite?.();
+        write(() => {
+          Reflect.defineProperty(inner, prop, desc);
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -8662,7 +10097,7 @@ function createStoreDerivedNext(fn, seed, options) {
     }
   ];
 }
-function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWrite) {
+function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, aroundDraftWrite) {
   const owner = getOwner();
   let settled = false;
   let result;
@@ -8676,7 +10111,7 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
   const draft = wrapDraft(
     wrappedStore,
     () => !settled || owner._x?._inFlight === result,
-    onDraftWrite
+    aroundDraftWrite
   );
   storeSetterNext(
     draft,
@@ -8691,7 +10126,7 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
         if (v === s || v === undefined) return;
         const write = () =>
           storeSetterNext(wrappedStore, st => reconcileNextState(v, st, key, true), false);
-        wrapCommit ? wrapCommit(write) : write();
+        wrapCommit ? wrapCommit(write, v) : write();
       };
       const sync = handleAsync(owner, result, commit);
       if (!owner._loading) commit(sync);
@@ -8701,6 +10136,558 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
   return owner;
 }
 
+/**
+ * PR-A: the patch channel (DESIGN-PATCH-CHANNEL.md).
+ *
+ * Compiled patch functions — per-record compare-and-write consumers —
+ * dispatched by the store's visibility transitions instead of render
+ * effects. This module owns registration, the per-flush apply queue
+ * (effect-phase timing, §2b), the owned-prev rule (§2c), and dispatch
+ * bubbling (§4b). Emission calls live at the four visibility-transition
+ * sites (adoption walk, setter notify, fold commit, override lifecycle)
+ * and are gated on registration, so unpatched stores pay a null check.
+ *
+ * Bubbling contract: a targeted nested write reaches ancestor patches as a
+ * FORCED re-apply — the third `force` argument makes every compiled compare
+ * pass, so the ancestor rewrites its bound fields from its current backing
+ * (idempotent, and prev-free: an ancestor's pre-state is not reconstructible
+ * after in-place folds). Compiled bodies therefore have the signature
+ * `(next, prev, force?)`.
+ *
+ * Tree-shaking: core never imports this module; stores without patches
+ * never schedule the queue.
+ */
+let queue = null;
+let scheduled = false;
+function drainApplyQueue() {
+  // Settle-time fallback for optimistic emissions (a reverting flush may
+  // have no active lanes left to run the lane-slot drain).
+  drainOptimistic();
+  const q = queue;
+  queue = null;
+  scheduled = false;
+  if (q === null) return;
+  // Per-entry isolation: one throwing patch must not abort its siblings
+  // (effect parity — each effect isolates its failure). A throwing patch
+  // routes through its REGISTERING OWNER's queue chain exactly like a
+  // render-effect error (§2b): an Errored boundary above the row collects
+  // it (source = the owner, error read via owner._x?._error). Unhandled errors
+  // rethrow after the drain so they still surface.
+  let firstError = UNSET;
+  for (let i = 0; i < q.length; i++) {
+    clearStamp(q[i]);
+    const { list, prev, force, t } = q[i];
+    const next = t !== null ? (t.pb ?? t.v) : q[i].next;
+    firstError = applyEntries(list, next, prev, force, firstError);
+  }
+  if (firstError !== UNSET) {
+    // Unhandled patch errors HALT like unhandled effect errors (re-audit 2,
+    // P1-4): app state is undefined past an unboundaried throw.
+    haltReactivity(firstError);
+    throw firstError;
+  }
+}
+const UNSET = Symbol();
+/** ONE callback/error primitive for every drain (normal, transition-held,
+ * optimistic): per-entry isolation — a throwing patch must not abort its
+ * siblings (effect parity) — and failures route through the REGISTERING
+ * OWNER's queue chain exactly like a render-effect error (§2b): an Errored
+ * boundary above the row collects it. Unhandled errors are aggregated by the
+ * caller (first one rethrows after its drain completes). */
+function applyEntries(list, next, prev, force, firstError) {
+  // SNAPSHOT multi-consumer lists (re-audit 5, P1-3): a callback can dispose
+  // a sibling's owner, whose unbind SPLICES this same array mid-iteration —
+  // index-walking the live array skips the shifted consumer. The dominant
+  // single-consumer case pays nothing; unbound entries are marked so a
+  // snapshot never applies a consumer severed by an earlier callback.
+  const snap = list.length > 1 ? list.slice() : list;
+  for (let j = 0; j < snap.length; j++) {
+    const entry = snap[j];
+    if (entry.u === true) continue;
+    // Disposed owners drop their patches (the row unmounted mid-flush).
+    if (entry.owner !== null && isDisposed(entry.owner)) continue;
+    try {
+      entry.fn(next, prev, force);
+    } catch (err) {
+      let handled = false;
+      const owner = entry.owner;
+      if (owner !== null) {
+        // Route through the nearest COMPUTED ancestor (re-audit 2, P1-4):
+        // <Errored>.reset() recomputes its sources, and a plain owner (the
+        // list driver's listOwner) is not recomputable — the component/memo
+        // scope above it is, and recomputing it rebuilds the rows, exactly
+        // what reset means for a throwing render effect.
+        let source = owner;
+        while (source !== null && source._fn === undefined) source = source._parent;
+        source ??= owner;
+        const statusErr = new StatusError(source, err);
+        ext(source)._error = statusErr;
+        source._statusFlags = (source._statusFlags ?? 0) | STATUS_ERROR;
+        handled = owner._queue.notify(source, STATUS_ERROR, STATUS_ERROR, statusErr);
+      }
+      if (!handled && firstError === UNSET) firstError = err;
+    }
+  }
+  return firstError;
+}
+// Transition-stamped emissions (§2b, "the walk is not the visibility moment
+// inside a transition"): entries stash DIRECTLY on their transition
+// (`_heldPatches`) and release into the live queue when THAT batch commits
+// (patchCommitHook). Reverted transitions never commit — their stash drops
+// with the transition object, no revert bookkeeping. The field (rather than
+// a WeakMap) keeps the every-flush commit-hook check to one property read;
+// the ambient batch never stashes.
+let commitHookInstalled = false;
+function releaseBatch(batch) {
+  const held = batch._heldPatches;
+  if (held === undefined) return;
+  batch._heldPatches = undefined;
+  for (let i = 0; i < held.length; i++) pushLive(held[i]);
+}
+function pushLive(item) {
+  if (queue === null) queue = [];
+  queue.push(item);
+  if (!scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+function push(item) {
+  const tx = activeTransition;
+  if (tx !== null) {
+    let held = tx._heldPatches;
+    if (held === undefined) tx._heldPatches = held = [];
+    held.push(item);
+    return;
+  }
+  pushLive(item);
+}
+/** Self-entry push with SAME-BATCH COALESCING (re-audit 2/3): a record's
+ * later non-forced emission into the same container UPDATES the queued
+ * entry in place — `next` takes the newest capture (adoption swaps the
+ * backing object per emission; dropping the later one applied STALE state),
+ * `prev` keeps the batch's earliest (effect semantics: one application per
+ * batch spanning the whole window). The entry's consumer list is the live
+ * pc.p array, so mid-batch registrants ride the single application. Forced
+ * entries and row/slot ops never coalesce; the drain clears the stamps so a
+ * quiet record retains nothing from its last batch. */
+function pushSelf(pc, item) {
+  const tx = activeTransition;
+  let arr;
+  if (tx !== null) {
+    let held = tx._heldPatches;
+    if (held === undefined) tx._heldPatches = held = [];
+    arr = held;
+  } else {
+    if (queue === null) queue = [];
+    arr = queue;
+  }
+  if (pc.qa === arr && pc.qe !== null) {
+    const qe = pc.qe;
+    qe.next = item.next;
+    qe.list = item.list; // pc.p can be re-created if emptied mid-batch
+    return;
+  }
+  pc.qa = arr;
+  pc.qe = item;
+  item.pc = pc;
+  arr.push(item);
+  if (arr === queue && !scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+/** Drain-side stamp clear (re-audit 3, P2-6): without it a quiet long-lived
+ * record's channel retains its last batch's container array, entry, and both
+ * captured backings for the record's lifetime. */
+function clearStamp(item) {
+  const pc = item.pc;
+  if (pc !== undefined && pc.qe === item) {
+    pc.qa = null;
+    pc.qe = null;
+  }
+}
+/** Shallow clone for the owned-prev rule (§2c): owned backings fold values
+ * INTO the same raw at commit, so a queued prev must be snapshotted. */
+function clonePrev(prev) {
+  return Array.isArray(prev) ? prev.slice() : { ...prev };
+}
+/**
+ * Emit a record's visibility transition. Callers gate on `hasPatches()` and
+ * `t.d` cheaply; this function re-checks and walks ancestors (§4b).
+ */
+function emitPatch(t, next, prev) {
+  const p = t.pc !== null ? t.pc.p : null;
+  if (p !== null)
+    pushSelf(t.pc, {
+      list: p,
+      next,
+      prev: ownedRaw.has(prev) ? clonePrev(prev) : prev,
+      force: false,
+      t: null
+    });
+  // Bubbling: ancestors force-re-apply from their LIVE backing, resolved at
+  // drain (privatization may clone it between now and then).
+  let u = t.u;
+  while (u !== null) {
+    const up = u.pc !== null ? u.pc.p : null;
+    if (up !== null) push({ list: up, next: null, prev: null, force: true, t: u });
+    u = u.u;
+  }
+}
+/** Emission for sites that already stand at the record with both sides in
+ * hand and have already handled ancestors (the adoption walk descends —
+ * parents were visited first), so no bubbling walk. */
+function emitPatchLocal(t, next, prev) {
+  const p = t.pc !== null ? t.pc.p : null;
+  if (p !== null)
+    pushSelf(t.pc, {
+      list: p,
+      next,
+      prev: ownedRaw.has(prev) ? clonePrev(prev) : prev,
+      force: false,
+      t: null
+    });
+}
+/** Optimistic-channel emission: overrides are visible THIS flush while the
+ * transaction is in flight — that is what optimism means. These ride a
+ * dedicated queue drained at LANE-EFFECT timing (the regular effect queues
+ * are stashed by an in-flight action), with the regular drain as the
+ * settle-time fallback. `next === null` = forced re-apply from the live
+ * target (the revert shape: committed truth back onto the DOM). */
+let optQueue = null;
+function drainOptimistic() {
+  const q = optQueue;
+  optQueue = null;
+  if (q === null) return;
+  // Same isolation/routing primitive as the normal drain (re-audit blocker
+  // 5): one throwing optimistic patch must not abort its siblings, and it
+  // must reach the registering owner's Errored boundary.
+  let firstError = UNSET;
+  for (let i = 0; i < q.length; i++) {
+    clearStamp(q[i]);
+    const { list, prev, force, t } = q[i];
+    const next = t !== null ? (t.pb ?? t.v) : q[i].next;
+    firstError = applyEntries(list, next, prev, force, firstError);
+  }
+  if (firstError !== UNSET) {
+    haltReactivity(firstError);
+    throw firstError;
+  }
+}
+function emitPatchOptimistic(t, next, prev) {
+  const p = t.pc !== null ? t.pc.p : null;
+  if (p === null) return;
+  if (optQueue === null) optQueue = [];
+  if (next === null) optQueue.push({ list: p, next: null, prev: null, force: true, t });
+  else {
+    // Same-batch coalescing, optimistic container (re-audit 3): later
+    // non-forced emission updates the queued entry's next in place.
+    const pc = t.pc;
+    if (pc.qa === optQueue && pc.qe !== null) {
+      const qe = pc.qe;
+      qe.next = next;
+      qe.list = p;
+    } else {
+      const item = { list: p, next, prev, force: false, t: null };
+      pc.qa = optQueue;
+      pc.qe = item;
+      item.pc = pc;
+      optQueue.push(item);
+    }
+  }
+  // Backup scheduling: the lane-slot drain covers in-flight application; a
+  // stashed regular drain guarantees settle-time application when no lane
+  // survives to the final flush (pure reverts).
+  if (!scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+/** Row-ops emission at OPTIMISTIC (lane) timing: user drafts on an
+ * optimistic family must show structure IN FLIGHT — bypassing the
+ * transition stash exactly like emitPatchOptimistic. Two forms:
+ * - `ops` given (write site): `nextRows` is the draft's intended visible
+ *   list, ops the identity diff against the pre-write optimistic view.
+ * - `ops === null` (revert site): RESYNC — the consumer rebuilds retention
+ *   by row identity against the live post-revert view, resolved from the
+ *   target at drain time (overrides are gone by then, so `pb ?? v` IS the
+ *   committed truth). */
+function emitRowOpsOptimistic(t, nextRows, ops) {
+  const list = t.pc !== null ? t.pc.ro : null;
+  if (list === null) return;
+  if (optQueue === null) optQueue = [];
+  optQueue.push({
+    list: list.map(e => ({
+      owner: e.owner,
+      fn: (n, _p) => e.fn(n, ops)
+    })),
+    next: nextRows,
+    prev: null,
+    force: false,
+    t: nextRows === null ? t : null
+  });
+  if (!scheduled) {
+    scheduled = true;
+    globalQueue.enqueue(EFFECT_RENDER, drainApplyQueue);
+  }
+}
+/**
+ * Register a compiled patch on a store record. Multi-consumer (two lists
+ * can render one record); owner-scoped for disposal. Returns unbind.
+ */
+// Global registration count: the cheap gate emission sites check before any
+// per-record work (unpatched apps pay one number compare per transition).
+let patchCount = 0;
+function hasPatches() {
+  return patchCount > 0;
+}
+function registerPatch(record, fn) {
+  let t = record?.[$TARGET];
+  if (t === undefined) throw new Error("registerPatch: not a store record");
+  // Chained backings (§7b): register on the ULTIMATE owner — that is where
+  // value transitions fold and dispatch; the wrapper's identity is stable
+  // and would never fire (see ultimateTarget).
+  t = ultimateTarget(t) ?? t;
+  if (!commitHookInstalled) {
+    commitHookInstalled = true;
+    armPatchHooks();
+    setPatchCommitHook(releaseBatch);
+    GlobalQueue._drainPatchOptimistic = drainOptimistic;
+  }
+  const entry = { fn, owner: getOwner() };
+  const pc = pcOf(t);
+  const list = (pc.p ??= []);
+  list.push(entry);
+  patchCount++;
+  // Bindings are subscriptions for reachability (§6d pruning must descend
+  // into bound records).
+  markDescendants(t);
+  let unbound = false;
+  return () => {
+    if (unbound) return;
+    unbound = true;
+    entry.u = true; // dispatch snapshots skip severed consumers
+    // Decrement ONLY on actual removal: a demotion (demoteToEffects) may
+    // have already pulled this entry and repaired the count — the splice
+    // miss is how this closure learns that.
+    const idx = list.indexOf(entry);
+    if (idx >= 0) {
+      list.splice(idx, 1);
+      patchCount--;
+    }
+    if (list.length === 0 && pc.p === list) pc.p = null;
+  };
+}
+/** Resolve a target through CHAINED backings (§7b) to the ultimate owner.
+ * A projection family wrapper's backing IS another store's proxy: value
+ * transitions fold on the ULTIMATE target (the wrapper's identity never
+ * changes), so patch registration and raw resolution must land there or
+ * registered patches never fire (equivalence-matrix finding: projection
+ * value ticks froze driver rows while classic effects tracked through). */
+function ultimateTarget(t) {
+  while (t.ch) {
+    const u = (t.pb ?? t.v)?.[$TARGET];
+    if (u === undefined) return undefined;
+    t = u;
+  }
+  return t;
+}
+/** Dual-driver bind probe (compiler runtime contract): when `record` is a
+ * patchable store record, returns its CURRENT raw backing (the driver's
+ * initial force-apply reads it directly — no proxy traffic, no tracking);
+ * returns undefined otherwise (driver falls back to the effect path).
+ * Not patchable: non-records, non-proxies, accessor-bearing records
+ * (patches read raw — getters need tracked evaluation), broken chains. */
+function patchableRaw(record) {
+  let t = record?.[$TARGET];
+  if (t === undefined || t.px !== record || t.a === true) return undefined;
+  t = ultimateTarget(t);
+  // SCAN before trusting (re-audit blocker 3): `a` starts false and is only
+  // discovered lazily (first draft, deep walks) — admission must run the
+  // one-time own-accessor scan itself, or a getter-bearing record takes the
+  // patch path and its getter's OUTSIDE dependencies (signals, other
+  // records) never re-apply. Sticky `sc` makes this one probe pass per
+  // record lifetime.
+  if (t === undefined || !targetIsPlain(t)) return undefined;
+  return t.pb ?? t.v;
+}
+/** Accessor demotion (design §5): a record that acquires an accessor after
+ * registration stops being patchable — reads must go through tracked
+ * evaluation. Clears patches and repairs the global count; callers re-drive
+ * the pulled bodies (demoteToEffects). */
+function demotePatches(t) {
+  if (t.pc === null) return null;
+  const p = t.pc.p;
+  t.pc.p = null;
+  if (p === null) return null;
+  patchCount -= p.length;
+  // Drain IN PLACE: unbind closures captured this array — a late unbind must
+  // miss its indexOf and not double-decrement the repaired count.
+  return p.splice(0, p.length);
+}
+/** The demotion re-drive (re-audit blocker 3): each pulled body becomes the
+ * SAME dual-driver effect fallback the web runtime would have chosen had the
+ * record carried the accessor at bind — a tracked compute pass (next === prev
+ * short-circuits every compare into a pure read THROUGH THE PROXY, so getter
+ * dependencies track) plus an untracked force-apply at effect timing.
+ *
+ * Creation is DEFERRED to the effect phase: the trap that discovers the
+ * accessor runs mid-draft, and an effect's initial pass must not read
+ * through the proxy inside the write window. The record's own transition
+ * for that draft is covered by the new effect's initial force-apply.
+ *
+ * Known edge (documented): a demoted LIST-ROW body re-drives under its
+ * registering owner (the list owner), so per-row severing on removal is
+ * lost for demoted rows — the effect lives until the LIST disposes. Rows
+ * only demote when user code defines an accessor on a row record at
+ * runtime. */
+function demoteToEffects(t) {
+  const entries = demotePatches(t);
+  if (entries === null || entries.length === 0) return;
+  const proxy = t.px;
+  globalQueue.enqueue(EFFECT_RENDER, () => {
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      if (entry.owner !== null && isDisposed(entry.owner)) continue;
+      const fn = entry.fn;
+      runWithOwner(entry.owner, () =>
+        createRenderEffect(
+          () => {
+            fn(proxy, proxy, false);
+          },
+          () => {
+            // Block body: a compiled patch body's return value must not be
+            // mistaken for an effect cleanup.
+            untrack(() => fn(proxy, undefined, true));
+          }
+        )
+      );
+    }
+  });
+}
+/** Register a structural-ops consumer on a keyed store array (the list
+ * container's channel — what `For` consumes through the seam). */
+function registerRowOps(array, fn) {
+  let t = array?.[$TARGET];
+  if (t === undefined) throw new Error("registerRowOps: not a store array");
+  // Chained backings resolve to the ULTIMATE owner, same as registerPatch
+  // (§7b) — the walk/fold emits there (re-audit blocker 4).
+  t = ultimateTarget(t) ?? t;
+  armRowHooks();
+  if (!commitHookInstalled) {
+    commitHookInstalled = true;
+    armPatchHooks();
+    setPatchCommitHook(releaseBatch);
+    GlobalQueue._drainPatchOptimistic = drainOptimistic;
+  }
+  const entry = { fn, owner: getOwner() };
+  const pc = pcOf(t);
+  const list = (pc.ro ??= []);
+  list.push(entry);
+  patchCount++;
+  markDescendants(t);
+  let unbound = false;
+  return () => {
+    if (unbound) return;
+    unbound = true;
+    patchCount--;
+    const idx = list.indexOf(entry);
+    if (idx >= 0) list.splice(idx, 1);
+    if (list.length === 0 && pc.ro === list) pc.ro = null;
+  };
+}
+/** Slot patches (shallow arrays) ride the same apply queue: the walk emits
+ * per aligned value-replaced slot; application happens at effect phase under
+ * the registration owner's lifetime. */
+function emitSlotPatch(t, index, next, prev) {
+  const sp = t.pc !== null ? t.pc.sp : null;
+  if (sp === null) return;
+  push({
+    list: sp.map(e => ({ owner: e.owner, fn: () => e.fn(index, next, prev) })),
+    next,
+    prev,
+    force: false,
+    t: null
+  });
+}
+/** Slot patch for shallow arrays: the reconcile walk emits (index, next,
+ * prev) for KEY-ALIGNED value-replaced slots (structure rides row ops), and
+ * the emission queues through the patch apply queue — effect-phase timing,
+ * transition stamping, disposed-owner drop — like every other channel. */
+function registerSlotPatchNext(arr, fn) {
+  let t = arr?.[$TARGET];
+  if (t === undefined) throw new Error("registerSlotPatchNext: not a store array");
+  // Chained backings resolve to the ULTIMATE owner, same as registerPatch
+  // (§7b) — the walk emits slot ticks there (re-audit blocker 4).
+  t = ultimateTarget(t) ?? t;
+  armRowHooks();
+  if (!commitHookInstalled) {
+    commitHookInstalled = true;
+    armPatchHooks();
+    setPatchCommitHook(releaseBatch);
+    GlobalQueue._drainPatchOptimistic = drainOptimistic;
+  }
+  // Multi-consumer (external audit): one shallow array can drive several
+  // lists — registrations are a list, unbinds splice their own entry.
+  const pc = pcOf(t);
+  const entry = { fn, owner: getOwner() };
+  (pc.sp ??= []).push(entry);
+  markDescendants(t);
+  let unbound = false;
+  return () => {
+    if (unbound || pc.sp === null) return;
+    unbound = true;
+    const idx = pc.sp.indexOf(entry);
+    if (idx >= 0) pc.sp.splice(idx, 1);
+    if (pc.sp.length === 0) pc.sp = null;
+  };
+}
+/** Row-ops ride the SAME apply queue/timing as record patches: transition-
+ * stamped, applied at effect phase, in emission order (structure before the
+ * new rows' own patches can exist; retained rows' value patches commute). */
+function emitRowOps(t, next, ops) {
+  const list = t.pc !== null ? t.pc.ro : null;
+  if (list === null) return;
+  push({
+    list: list.map(e => ({
+      owner: e.owner,
+      fn: (n, _p) => e.fn(n, ops)
+    })),
+    next,
+    prev: null,
+    force: false,
+    t: null
+  });
+}
+// Pay-for-use seams: the write paths (store/reconcile/optimistic) emit
+// through installed hooks instead of importing this module. Installation is
+// LAZY (first registration) rather than a module-scope call — the dist is a
+// flat bundle, and a top-level side effect would retain the whole channel in
+// every consumer. TWO TIERS so a value-only registration (registerPatch —
+// present in ~every bundle under patch-mode default) does not retain the
+// list machinery (row-ops emitters + reconcile's diff builders): row hooks
+// arm only from the list driver's registrations. Sound because every
+// emission site is guarded by the matching pc channel, which only the
+// corresponding registration creates. See patch-hooks.ts.
+function armPatchHooks() {
+  installPatchHooks({
+    emitPatch,
+    emitPatchLocal,
+    emitPatchOptimistic,
+    hasPatches,
+    demoteToEffects
+  });
+}
+function armRowHooks() {
+  installRowHooks({
+    emitRowOps,
+    emitSlotPatch,
+    emitSetterRowOps,
+    emitRowOpsOptimistic
+  });
+}
+
 /**
  * Store rewrite — optimistic stores (§3/§7, RUL-3): no store-side layer, no
  * backup snapshots. Nodes in an optimistic family are ARMED core signals
@@ -8710,12 +10697,31 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
  * armed presence nodes (the §6 overlay), so structural optimism reverts with
  * the same per-transaction granularity (FINDING-2's fix by construction).
  *
- * Derived form = an optimistic projection: the derive's recompute and its
- * async commits run under projectionWriteActive (authoritative landings
- * commit silently beneath any active overrides). The transitionBlocked
- * store-half (#2951) is installed here for next-shaped targets, chaining the
+ * Derived form = an optimistic projection. Landings follow the fold rule
+ * (#3164, RUL-2 as re-ruled): while a transaction retains optimistic edits
+ * on the family, truth that lands STAGES into that transaction — a keyed
+ * identity-preserving walk written through the ordinary staged setter
+ * channel — and reveals atomically at settle, exactly like a signal landing
+ * under an active override (asyncWrite's held branch). Optimistic edits are
+ * never consumed by landings; they live exactly as long as their transaction
+ * and die by engine-native revert. With no retainer, landings commit
+ * immediately under projectionWriteActive (authoritative, silently beneath
+ * any bare-write overrides — those ride the flight's own transition, #2951).
+ * Authoritative readers (until()'s predicate) tunnel into staged truth via
+ * the node read path's pending-value arm. The transitionBlocked store-half
+ * (#2951) is installed here for next-shaped targets, chaining the
  * legacy/engine checks.
  */
+/** #3164 fold: a stamped truth is HELD (masked from ordinary readers until
+ * the reveal) only while its transition is live AND retaining optimism —
+ * overrides are what make partial-coverage composition a tear. A plain
+ * async transition carries no overrides, so downstream computes must see
+ * staged values to converge (normal speculation). Resolves merges first:
+ * merge unions optimistic nodes/stores into the target. */
+function transitionHoldsOptimism(transition) {
+  const t = currentTransition(transition);
+  return t._done !== true && (t._optimisticNodes.length !== 0 || t._optimisticStores.size !== 0);
+}
 let blockedInstalled = false;
 function installNextBlockedHalf() {
   if (blockedInstalled) return;
@@ -8723,13 +10729,42 @@ function installNextBlockedHalf() {
   // Late-bind the optimistic machinery into the plain store/reconcile paths
   // (all call sites are fam?.opt-gated, so this always runs first) and the
   // affects witness's view resolver.
-  setOptHooks({ notifyOptimisticWrites, optimisticView, applyTentative });
+  setOptHooks({
+    notifyOptimisticWrites,
+    optimisticView,
+    applyTentative,
+    retainsOptimism: transitionHoldsOptimism
+  });
   setNextOptimisticViewResolver((t, raw) => optimisticView(t, raw));
   // Scheduler flush tails call _clearOptimisticStores whenever tracked
   // stores exist; next has no layer to clear — reverts are engine-native —
   // so the hook only empties the batch set.
   if (!GlobalQueue._clearOptimisticStores) {
     GlobalQueue._clearOptimisticStores = stores => {
+      // Patch channel (revert site): engine-native reverts flip node values
+      // back to committed; patched records need a forced DOM re-apply from
+      // the post-revert view. Emission only — next keeps no layer to clear.
+      for (const px of stores) {
+        const t = px?.[$TARGET];
+        const overlaid = t?.fam?.overlaid;
+        if (overlaid !== undefined) {
+          for (const ot of overlaid) {
+            if (ot.pc !== null && ot.pc.p !== null) patchHooks.emitPatchOptimistic(ot, null, null);
+            // Row-ops resync (family increment 2): reverts flip node values
+            // back engine-natively; a driven list must rebuild retention by
+            // row identity against the post-revert view (resolved from the
+            // target at drain — overrides are gone by then).
+            if (ot.pc !== null && ot.pc.ro !== null) rowHooks.emitRowOpsOptimistic(ot, null, null);
+            // Keyset resync (classic channel twin): the keyset node's own
+            // revert can compare EQUAL (a landing's bump matched the
+            // tentative bump) while the arrangement underneath changed —
+            // mapArray/ownKeys subscribers must re-read the post-revert
+            // view. Authoritative bump: never re-arm the node we are
+            // clearing.
+            if (ot.k !== null) runAuthoritative(() => setSignal(ot.k, v => v + 1));
+          }
+        }
+      }
       stores.clear();
     };
   }
@@ -8787,20 +10822,41 @@ function createOptimisticStoreNext(first, second, options) {
   };
   const store = wrapNext(initialValue, null, null, fam);
   fam.px = store;
+  // Same key resolution the projection channels use ("id" default) — replay's
+  // satisfaction rule reads it off the family.
+  const keyOption = options?.key === undefined ? "id" : options.key;
+  fam.key =
+    typeof keyOption === "function"
+      ? keyOption
+      : keyOption === null
+        ? null
+        : row => (isWrappable(row) ? row[keyOption] : undefined);
   if (fam.shallow) {
     store[$TARGET].s = true;
     markRawIngest(initialValue);
   }
   if (derived) {
     const fn = first;
-    // Async commits land outside the computed's sync body — re-apply the
-    // authoritative-write posture there too. Landings consume the family's
-    // tentative overrides (RUL-2: visible landed truth replaces optimism) —
-    // both the reconcile-channel commit and per-op post-await draft writes.
-    const consume = () => consumeOverridesNext(fam);
-    const wrapCommit = write => {
-      runAuthoritative(write);
-      consume();
+    // Landing router (#3164 fold ruling): while a transaction retains
+    // optimistic edits on this family, truth landings stage INTO it and
+    // reveal atomically at settle; with no retainer they commit immediately
+    // under the authoritative posture (async commits land outside the
+    // computed's sync body, so the posture is re-applied here).
+    const wrapCommit = (write, value) => {
+      const txn = retainingTransition(fam);
+      if (txn === null) runAuthoritative(write);
+      else stageLanding(fam, txn, value);
+    };
+    // Draft writes (the derive mutating its draft, sync body and post-await
+    // continuations alike) are the same truth channel per-operation: bind
+    // each op to the retaining transaction so its node writes stage and its
+    // backing fold defers (ensurePB stamps foldBatches with the swapped-in
+    // batch; the write-override eager-commit branch in notifyWrites yields
+    // to any active transaction).
+    const aroundDraftWrite = op => {
+      const txn = retainingTransition(fam);
+      if (txn === null) op();
+      else runFolded(txn, op);
     };
     let nodeOptions;
     if (options?.seedLoadingValue) nodeOptions = { loadingValue: undefined };
@@ -8812,14 +10868,201 @@ function createOptimisticStoreNext(first, second, options) {
           fn,
           options?.key === undefined ? "id" : options.key,
           wrapCommit,
-          consume
+          aroundDraftWrite
         )
       );
     }, nodeOptions);
     node._config &= ~CONFIG_AUTO_DISPOSE;
     fam.node = node;
   }
-  return [store, fn => storeSetterNext(store, fn)];
+  return [
+    store,
+    fn => {
+      // Retention ledger (#3164): record the owning transaction so landings
+      // know to fold. Captured at entry — the action machinery has the
+      // transaction ambient while user code runs; a bare write with no
+      // transaction retains nothing (it rides the flight's own transition
+      // per #2951 and dies with it).
+      const txn = activeTransition;
+      storeSetterNext(store, fn);
+      if (txn !== null) (fam.rt ??= new Set()).add(txn);
+    }
+  ];
+}
+/** Resolve a retained transition through its merge chain (`_done` holds the
+ * merge target while merged, `true` once settled). Null = dead. */
+function liveTransition(txn) {
+  while (typeof txn._done === "object") txn = txn._done;
+  return txn._done === true ? null : txn;
+}
+/** The transaction truth landings fold into: the first live member of the
+ * family's retention ledger (dead members prune here). Multiple live
+ * retainers entangle through their shared family writes and settle
+ * together, so folding into the first reaches all of them. */
+function retainingTransition(fam) {
+  const rt = fam.rt;
+  if (rt === undefined || rt.size === 0) return null;
+  let live = null;
+  for (const txn of rt) {
+    const resolved = liveTransition(txn);
+    if (resolved === null) rt.delete(txn);
+    else live ??= resolved;
+  }
+  return live;
+}
+/** Fold a landing into the retaining transaction (#3164): the landed value
+ * is written through the ORDINARY staged setter channel — node writes park
+ * as `_pendingValue` registered with the transaction's batch (speculation
+ * and until()'s authoritative tunnel see them; live view stays coherent),
+ * and the backing fold defers via the foldBatches stamp — under the
+ * authoritative posture, so armed nodes take the engine bypass and no
+ * override is created. The engine's own commit machinery reveals everything
+ * atomically when the transaction settles (transitions never abort: failed
+ * actions still commit — only optimistic overrides revert). */
+function stageLanding(fam, txn, incoming) {
+  runFolded(txn, () =>
+    runAuthoritative(() =>
+      storeSetterNext(
+        fam.px,
+        draft => {
+          stagedApply(draft, unwrapValue(incoming), fam.key ?? null);
+        },
+        false
+      )
+    )
+  );
+}
+/** Run a fold write inside the retaining transaction's batch, then
+ * transition-stamp its staged nodes NOW (parity with the parked-transition
+ * flush path's reassignPendingTransition): the stamp is what routes stale
+ * (render) readers to the committed value — core read's cross-transaction
+ * guard — and what makes foldHeld defer the backing for context-free
+ * readers. A microtask staging never crosses that flush path, so without
+ * the stamp a render effect's speculative recompute would compose staged
+ * truth with live overrides — the #3164 tear, one window later. Armed
+ * nodes additionally raise CONFIG_HELD_TRUTH: their staged value is
+ * confirming truth masked from ordinary readers until the reveal (plain
+ * staged nodes stay visible — normal speculation; override-covered nodes
+ * stay unarmed — the override is their display and its revert their
+ * notification, A17). */
+function runFolded(txn, op) {
+  runAsTransitionBatch(txn, op);
+  const pending = txn._pendingNodes;
+  for (let i = 0; i < pending.length; i++) {
+    const node = pending[i];
+    node._transition = txn;
+    if (node._config & CONFIG_OPTIMISTIC && !hasActiveOverride(node))
+      node._config |= CONFIG_HELD_TRUTH;
+  }
+}
+/** Keyed identity-preserving deep merge through live draft proxies — the
+ * staged twin of the adoption walk. Reads see the pending backing (staged
+ * view), so consecutive landings during one hold compose; key-matched rows
+ * keep their raw (and so their proxy) in the slot with only changed leaves
+ * written; unmatched rows land wholesale. Runs inside stageLanding's
+ * authoritative bracket: drafts seed from committed truth, never overlays. */
+function stagedApply(cur, incoming, keyFn) {
+  const curArr = Array.isArray(cur);
+  if (curArr && Array.isArray(incoming)) {
+    const len = incoming.length;
+    if (keyFn !== null) {
+      // Occurrence-aware key queues (parity with the adoption window):
+      // duplicate keys match per occurrence, each current row consumed once.
+      let byKey = null;
+      const curLen = cur.length;
+      for (let j = 0; j < curLen; j++) {
+        const raw = unwrapValue(cur[j]);
+        if (!isWrappable(raw)) continue;
+        const k = keyFn(raw);
+        if (k === undefined) continue;
+        const q = (byKey ??= new Map()).get(k);
+        if (q === undefined) byKey.set(k, [raw]);
+        else q.push(raw);
+      }
+      // Echo adoption: an optimistic structural add whose key the landing
+      // confirms must keep its raw (and so its proxy — list drivers keep the
+      // DOM row). Tentative rows never reach committed truth (they live in
+      // node overrides), so key-match the draft target's active override
+      // rows as a secondary pool. Committed rows queued first own their
+      // keys; overlay rows only extend coverage. Adopted raws enter staged
+      // truth; at settle the override reverts and the reveal re-seats the
+      // same raw.
+      const overlayNodes = cur[$TARGET]?.n;
+      if (overlayNodes != null) {
+        for (const ok of Reflect.ownKeys(overlayNodes)) {
+          const node = overlayNodes[ok];
+          if (!hasActiveOverride(node)) continue;
+          const raw = unwrapValue(unwrapOverride(node._x._overrideValue));
+          if (!isWrappable(raw)) continue;
+          const k = keyFn(raw);
+          if (k === undefined) continue;
+          const q = (byKey ??= new Map()).get(k);
+          if (q === undefined) byKey.set(k, [raw]);
+          else q.push(raw);
+        }
+      }
+      for (let i = 0; i < len; i++) {
+        const nv = incoming[i];
+        let matched;
+        if (isWrappable(nv) && byKey !== null) {
+          const nk = keyFn(nv);
+          if (nk !== undefined) {
+            for (const [k, q] of byKey) {
+              if (!sameKey(k, nk)) continue;
+              matched = q.shift();
+              if (q.length === 0) byKey.delete(k);
+              break;
+            }
+          }
+        }
+        if (matched !== undefined) {
+          if (unwrapValue(cur[i]) !== matched) cur[i] = matched;
+          stagedApply(cur[i], nv, keyFn);
+        } else {
+          const pv = unwrapValue(cur[i]);
+          if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) cur[i] = nv;
+        }
+      }
+    } else {
+      for (let i = 0; i < len; i++) {
+        const nv = incoming[i];
+        const pv = unwrapValue(cur[i]);
+        if (pv === nv) continue;
+        if (isWrappable(nv) && isWrappable(pv) && Array.isArray(nv) === Array.isArray(pv))
+          stagedApply(cur[i], nv, keyFn);
+        else if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) cur[i] = nv;
+      }
+    }
+    if (cur.length !== len) cur.length = len;
+    return;
+  }
+  // Object merge; also the degenerate root-kind-change shape (arrays accept
+  // keyed writes/deletes, so a wholesale restatement still lands staged).
+  for (const k of Reflect.ownKeys(incoming)) {
+    if (curArr && k === "length") continue;
+    const nv = incoming[k];
+    const pv = unwrapValue(cur[k]);
+    if (pv === nv) continue;
+    if (isWrappable(nv) && isWrappable(pv) && Array.isArray(nv) === Array.isArray(pv)) {
+      // Different-keyed entities never merge (tentative-channel parity):
+      // the incoming object replaces the slot wholesale.
+      if (keyFn !== null) {
+        const pk = keyFn(pv);
+        const nk = keyFn(nv);
+        if (pk !== undefined && nk !== undefined && !sameKey(pk, nk)) {
+          cur[k] = nv;
+          continue;
+        }
+      }
+      stagedApply(cur[k], nv, keyFn);
+    } else if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) {
+      cur[k] = nv;
+    }
+  }
+  for (const k of Reflect.ownKeys(cur)) {
+    if ((curArr && k === "length") || k in incoming) continue;
+    delete cur[k];
+  }
 }
 // ---- optimistic-only store machinery (moved from next/store.ts /
 // next/reconcile.ts so plain-store bundles tree-shake it) ----
@@ -8836,6 +11079,22 @@ function notifyOptimisticWrites(t, pb) {
   const fw = t.fam?.node;
   if (fw?._transition) globalQueue.initTransition(fw._transition);
   const old = t.v;
+  // Patch channel (override-application site): the draft IS the intended
+  // visible state; prev is the view before these overrides apply. Bypasses
+  // the transition stash — optimism is visible in flight.
+  if (t.pc !== null && t.pc.p !== null)
+    patchHooks.emitPatchOptimistic(t, pb, optimisticView(t, old));
+  // Row-ops channel (family increment 2): optimistic STRUCTURE on an array
+  // rides node overrides — it never enters the reconcile walk — so a driven
+  // list must get its structural ops here, lane-timed. Identity diff of the
+  // pre-write optimistic view against the draft; aligned writes emit nothing.
+  if (t.pc !== null && t.pc.ro !== null && Array.isArray(pb)) {
+    const prevView = optimisticView(t, old);
+    if (Array.isArray(prevView)) {
+      const ops = buildIdentityRowOps(prevView, pb);
+      if (ops !== null) rowHooks.emitRowOpsOptimistic(t, pb, ops);
+    }
+  }
   const visible = (key, fallback) => {
     const node = t.n?.[key];
     return node !== undefined && hasActiveOverride(node)
@@ -8886,92 +11145,22 @@ function notifyOptimisticWrites(t, pb) {
   // (structural ones already ride the key-set bump above).
   bumpDeep(t);
   // Discard the draft — committed raw is untouched (revert target by
-  // construction). Register the root store for the scheduler's settle hooks
-  // and the target for landing consumption (RUL-2).
-  t.pb = null;
+  // construction) — restoring any truth-staged backing this draft displaced
+  // (#3164 fold: ensurePB parked it so tentative writes could not pollute
+  // staged truth). Register the root store for the scheduler's settle hooks.
+  t.pb = stagedTruthPB.get(t) ?? null;
+  if (t.pb !== null) stagedTruthPB.delete(t);
   (t.fam.overlaid ??= new Set()).add(t);
   GlobalQueue._trackOptimisticStore?.(t.fam.px ?? t.px);
 }
-/**
- * Landing consumption (RUL-2): fresh authoritative data supersedes every
- * tentative override in the family. Mirrors legacy clearProjectionOverride —
- * drop the override, clear lane/ownership, notify subscribers whose visible
- * value changes (reversion effects go to regular queues via the projection
- * write posture the caller holds).
- */
-function consumeOverridesNext(fam) {
-  const overlaid = fam.overlaid;
-  if (overlaid === undefined || overlaid.size === 0) return;
-  runAuthoritative(() => {
-    for (const t of overlaid) {
-      const drop = (node, committed) => {
-        if (!hasActiveOverride(node)) return;
-        const prev = unwrapOverride(node._x?._overrideValue);
-        // Full legacy reset (clearOptimisticOverride parity): the landing is
-        // authoritative NOW — fold committed into the node directly instead
-        // of riding a transaction's commit (whose queues may be stashed with
-        // the transaction parked; the wake would strand until it settles).
-        ext(node)._overrideValue = NOT_PENDING;
-        node._config |= CONFIG_OPTIMISTIC;
-        const nx = node._x;
-        if (nx) {
-          nx._overrideOwner = null;
-          nx._optimisticLane = undefined;
-        }
-        node._pendingValue = NOT_PENDING;
-        node._value = committed;
-        if (!node._equals || !node._equals(prev, committed)) {
-          insertSubs(node, true);
-          schedule();
-        }
-      };
-      // Landing consumes STRUCTURAL optimism only (legacy layer parity):
-      // membership edits, array length, and the value overrides written WITH
-      // them (a key carrying an active presence override is an add/delete —
-      // classified BEFORE the adoption may have made the key exist in landed
-      // data). A pure value override on a key the landing carries stays with
-      // its owning transaction (rapid-toggle contract: a live action's edit
-      // of an existing entity rides on top of landed truth).
-      const isArr = Array.isArray(t.v);
-      const has = t.h;
-      let structuralKeys = null;
-      if (has !== null) {
-        for (const key of Reflect.ownKeys(has)) {
-          if (hasActiveOverride(has[key])) (structuralKeys ??= new Set()).add(key);
-        }
-      }
-      const nodes = t.n;
-      if (nodes !== null) {
-        for (const key of Reflect.ownKeys(nodes)) {
-          const structural =
-            structuralKeys?.has(key) || !(key in t.v) || (isArr && key === "length");
-          if (!structural) continue;
-          drop(nodes[key], isArr && key === "length" ? t.v.length : t.v[key]);
-        }
-      }
-      if (has !== null) {
-        for (const key of Reflect.ownKeys(has)) drop(has[key], key in t.v);
-      }
-      if (t.k !== null && hasActiveOverride(t.k)) {
-        ext(t.k)._overrideValue = NOT_PENDING;
-        t.k._config |= CONFIG_OPTIMISTIC;
-        const kx = t.k._x;
-        if (kx) {
-          kx._overrideOwner = null;
-          kx._optimisticLane = undefined;
-        }
-        insertSubs(t.k, true);
-        schedule();
-      }
-    }
-    overlaid.clear();
-  });
-}
 /** Optimistic-view composition for snapshot/deep (O1: snapshot is the CURRENT
  * view, lane values included; a fresh copy per call during pending windows —
- * RUL-12). Returns `src` untouched when no override is active on `t`. */
+ * RUL-12). Returns `src` untouched when no override is active on `t`.
+ * Authoritative-view reads (until()'s predicate) skip composition entirely:
+ * the predicate observes authoritative truth, never the caller's tentative
+ * overlay. (Write-side emission callers never run under such a compute.) */
 function optimisticView(t, src) {
-  if (t.fam?.opt !== true) return src;
+  if (t.fam?.opt !== true || authoritativeRead()) return src;
   let out = null;
   const ensure = () => (out ??= Array.isArray(src) ? [...src] : { ...src });
   const nodes = t.n;
@@ -9011,7 +11200,9 @@ function applyTentative(t, incoming, keyFn) {
     if (keyFn) {
       const pk = keyFn(pv);
       const nk = keyFn(nv);
-      if (pk !== undefined && nk !== undefined && pk !== nk) return null;
+      // SameValueZero (re-audit 3, P1-3): parity with the plain reconcile
+      // channel — NaN keys are self-equal.
+      if (pk !== undefined && nk !== undefined && !sameKey(pk, nk)) return null;
     }
     return map.get(unwrapValue(pv)) ?? null;
   };
@@ -9026,16 +11217,31 @@ function applyTentative(t, incoming, keyFn) {
         const nk = keyFn(nv);
         if (nk !== undefined) {
           if (viewByKey === null) {
+            // Occurrence-aware index queues (re-audit 3, P1-3): parity with
+            // the plain adoption window — duplicate keys match per
+            // occurrence, each view row consumed once.
             viewByKey = new Map();
             for (let j = 0; j < viewRows.length; j++) {
               const p = unwrapValue(viewRows[j]);
               if (isWrappable(p)) {
                 const pk = keyFn(p);
-                if (pk !== undefined && !viewByKey.has(pk)) viewByKey.set(pk, p);
+                if (pk === undefined) continue;
+                const existing = viewByKey.get(pk);
+                if (existing === undefined) viewByKey.set(pk, j);
+                else if (Array.isArray(existing)) existing.push(j);
+                else viewByKey.set(pk, [existing, j]);
               }
             }
           }
-          pv = viewByKey.get(nk);
+          const m = viewByKey.get(nk);
+          if (m === undefined) pv = undefined;
+          else if (Array.isArray(m)) {
+            pv = unwrapValue(viewRows[m.shift()]);
+            if (m.length === 1) viewByKey.set(nk, m[0]);
+          } else {
+            pv = unwrapValue(viewRows[m]);
+            viewByKey.delete(nk);
+          }
         } else pv = unwrapValue(viewRows[i]);
       } else pv = unwrapValue(viewRows[i]);
       const ct = match(pv, nv);
@@ -10139,7 +12345,12 @@ function createLoadingBoundary(fn, fallback, options) {
 function createErrorBoundary(fn, fallback) {
   return createCollectionBoundary(STATUS_ERROR, fn, queue => {
     return fallback(accessor(queue._error), () => {
-      for (const source of queue._sources) recompute(source);
+      for (const source of queue._sources) {
+        // Non-computed sources (patch-channel registrations under plain
+        // owners) are not recomputable — their reset is the record's next
+        // transition re-applying the patch (re-audit 2, P1-4).
+        if (source._fn !== undefined) recompute(source);
+      }
       schedule();
     });
   });
@@ -10273,7 +12484,10 @@ function flattenArray(children, results = [], options) {
         } while (typeof child === "function" && !child.length);
       }
       if (Array.isArray(child)) {
-        needsUnwrap = flattenArray(child, results, options);
+        // OR, don't overwrite: an accessor already pushed under doNotUnwrap
+        // still needs the resolving wrapper even when a later sibling
+        // fragment contains no functions (#3133).
+        needsUnwrap = flattenArray(child, results, options) || needsUnwrap;
       } else if (
         options?.skipNonRendered &&
         (child == null || child === true || child === false || child === "")
@@ -10301,6 +12515,7 @@ export {
   NoOwnerError,
   NotReadyError,
   SUPPORTS_PROXY,
+  TimeoutError,
   action,
   affects,
   clearSnapshots,
@@ -10340,9 +12555,13 @@ export {
   omit,
   onCleanup,
   onSettled,
+  patchableRaw,
   peekNextChildId,
   reconcile,
   refresh,
+  registerPatch,
+  registerRowOps,
+  registerSlotPatchNext as registerSlotPatch,
   releaseSnapshotScope,
   repeat,
   resetErrorHalt,
@@ -10351,6 +12570,10 @@ export {
   setContext,
   setSnapshotCapture,
   snapshot,
+  storeHasFamily,
+  storeHasOptimisticFamily,
+  storeIsShallow,
   storePath,
+  until,
   untrack
 };