@solidjs/signals 2.0.0-rc.3 → 2.0.0-rc.5

package/dist/prod/store/next/store.js

@@ -1,14 +1,16 @@
-import { unwrapOverride, $REFRESH, CONFIG_OWNED_WRITE, NOT_PENDING, CONFIG_OPTIMISTIC, STATUS_UNINITIALIZED, STATUS_ERROR, CONFIG_CHILDREN_FORBIDDEN } from "../../core/constants.js";
+import { unwrapOverride, $REFRESH, CONFIG_OWNED_WRITE, NOT_PENDING, CONFIG_OPTIMISTIC, CONFIG_HELD_TRUTH, STATUS_UNINITIALIZED, STATUS_ERROR, CONFIG_CHILDREN_FORBIDDEN, CONFIG_AUTHORITATIVE_READ } from "../../core/constants.js";
 
-import { setSignal, isEqual, read, pendingCheckActive, readNodeFast, READ_SLOW, signal, ext } from "../../core/core.js";
+import { setSignal, isEqual, read, pendingCheckActive, latestReadActive, readNodeFast, READ_SLOW, signal, ext, setLatestReadActive, prepareComputed, context } from "../../core/core.js";
 
-import { projectionWriteActive, setProjectionWriteActive, schedule, setStoreCommitHook } from "../../core/scheduler.js";
+import { projectionWriteActive, setProjectionWriteActive, activeTransition, schedule, currentTransition, setStoreCommitHook } from "../../core/scheduler.js";
 
 import { getObserver, getOwner } from "../../core/owner.js";
 
 import { $TARGET, isWrappable, markRawIngest, $PROXY, getWriteOverride, markRawOne, witnessAffectsMark, $TRACK, affectsScopesLive, inheritAffectsMarks, $AFFECTS, rawValuesUsed, isRawValue, setNextAffectsNodeResolver } from "../store.js";
 
-import { storeNextLookup, optHooks, ownedRaw, devAssertNeverUserMutation } from "./target.js";
+import { storeNextLookup, optHooks, ownedRaw, markDescendants, devAssertNeverUserMutation } from "./target.js";
+
+import { patchHooks, rowHooks } from "./patch-hooks.js";
 
 /**
  * Store rewrite — increment 2: plain deep stores with pending-backing writes.
@@ -38,8 +40,13 @@ import { storeNextLookup, optHooks, ownedRaw, devAssertNeverUserMutation } from
  * headroom for future fields. The prototype is reset to `Object.prototype`
  * so proxy-forwarded semantics (getPrototypeOf, constructor) are exactly a
  * plain object's. Array targets keep the bare-`[]` path — they must carry
- * the array exotic class for `Array.isArray(proxy)`, and arrays store named
- * fields off-object where this cliff does not apply. */
+ * the array exotic class for `Array.isArray(proxy)`.
+ *
+ * ARRAY SHAPE RULE: arrays normalize their named properties to dictionary
+ * mode as the count grows (V8 13.x: counts ≡ 0 mod 3 from 18 up), so the
+ * target's named field count is capped at 20 — write-side patch-channel
+ * state lives inside the single `pc` extension (see target.ts), never as
+ * new named fields here. */
 function TargetShape() {
     this.v = undefined;
     this.ch = undefined;
@@ -60,11 +67,24 @@ function TargetShape() {
     this.s = undefined;
     this.ovl = undefined;
     this.del = undefined;
-    this.wk = undefined;
+    this.pc = undefined;
+    this.hv = undefined;
+    this.ht = undefined;
 }
 
 TargetShape.prototype = Object.prototype;
 
+/** Lazily allocate the patch-channel extension (one literal shape). */ function pcOf(e) {
+    return e.pc ?? (e.pc = {
+        sp: null,
+        p: null,
+        ro: null,
+        wk: null,
+        qa: null,
+        qe: null
+    });
+}
+
 function createTarget(e, t, n, r = t?.fam ?? null) {
     // The proxy target carries the array exotic class when the value is an
     // array, so Array.isArray(proxy) is true; the fields live on it directly.
@@ -81,6 +101,7 @@ function createTarget(e, t, n, r = t?.fam ?? null) {
     i.h = null;
     i.k = null;
     i.dk = null;
+    i.pc = null;
     i.u = t;
     i.pk = n;
     i.px = null;
@@ -93,7 +114,8 @@ function createTarget(e, t, n, r = t?.fam ?? null) {
     i.s = false;
     i.ovl = false;
     i.del = null;
-    i.wk = null;
+    i.hv = null;
+    i.ht = null;
     i.px = new Proxy(i, traps);
     // Legacy interop: shared machinery (affects walks, wrap dedupe) reads the
     // proxy off looked-up targets as a field.
@@ -171,7 +193,7 @@ function getNode(e, t, n) {
         // Optimistic families: arm the override slot — setSignal routes armed
         // nodes through the core engine (lanes, ownership, reverts all native).
                 if (e.fam?.opt) {
-            ext(o).De = NOT_PENDING;
+            ext(o).Oe = NOT_PENDING;
             o.T |= CONFIG_OPTIMISTIC;
         }
         // A node born inside a live mark's identity scope inherits the mark
@@ -204,7 +226,7 @@ function getHasNode(e, t, n) {
         }, e.fam?.node ?? undefined);
         o.T |= CONFIG_OWNED_WRITE;
         if (e.fam?.opt) {
-            ext(o).De = NOT_PENDING;
+            ext(o).Oe = NOT_PENDING;
             o.T |= CONFIG_OPTIMISTIC;
         }
         if (affectsScopesLive()) inheritAffectsMarks(o, e.v, t);
@@ -225,7 +247,7 @@ function getKeySetNode(e) {
         }, e.fam?.node ?? undefined);
         n.T |= CONFIG_OWNED_WRITE;
         if (e.fam?.opt) {
-            ext(n).De = NOT_PENDING;
+            ext(n).Oe = NOT_PENDING;
             n.T |= CONFIG_OPTIMISTIC;
         }
         e.k = t;
@@ -245,7 +267,7 @@ function getDeepNode(e) {
         }, e.fam?.node ?? undefined);
         n.T |= CONFIG_OWNED_WRITE;
         if (e.fam?.opt) {
-            ext(n).De = NOT_PENDING;
+            ext(n).Oe = NOT_PENDING;
             n.T |= CONFIG_OPTIMISTIC;
         }
         if (affectsScopesLive()) inheritAffectsMarks(n, e.v, $TRACK);
@@ -260,14 +282,6 @@ function getDeepNode(e) {
     if (e.dk !== null) setSignal(e.dk, 1);
 }
 
-function markDescendants(e) {
-    let t = e;
-    while (t && !t.d) {
-        t.d = true;
-        t = t.u;
-    }
-}
-
 // ---------------------------------------------------------------------------
 // pending backing + fold (the single mutation point)
 /** target → committed backing at batch start (the fold diff's old side). */ const foldOlds = new Map;
@@ -291,6 +305,12 @@ function cloneRaw(e, t) {
     return Array.isArray(e) ? Object.defineProperties([], n) : Object.create(Object.getPrototypeOf(e), n);
 }
 
+/** Scanned plainness for patch admission (patchableRaw): runs the one-time
+ * accessor scan if it hasn't happened yet — the sticky `a` flag alone is not
+ * trustworthy before a scan (it starts false and is discovered lazily). */ function targetIsPlain(e) {
+    return e.sc ? !e.a : scanAccessorsOnce(e);
+}
+
 /** One-time own-accessor scan (Annex-B probes, no descriptor allocation);
  * returns true when the container is plain data (overlay-safe). */ function scanAccessorsOnce(e) {
     const t = e.v;
@@ -331,6 +351,21 @@ function cloneRaw(e, t) {
 
 function ensurePB(e) {
     let t = e.pb;
+    // Truth-staged backing hand-off (#3164 fold): a TENTATIVE draft opening on
+    // a target whose pending backing is truth-staged (a landing folded into a
+    // retaining transaction — it carries a foldBatches stamp) must not share
+    // the container. Tentative writes would pollute staged truth, and the
+    // tentative discard (notifyOptimisticWrites nulls pb) would destroy the
+    // landing. Park the staged backing and open a fresh draft seeded from the
+    // optimistic view below; the tentative discard restores it. The
+    // tentativePBs guard scopes this to draft OPEN: the draft's own backing
+    // (foldBatches-stamped by its first write when an action's transition is
+    // ambient) must not be parked by its own later writes.
+        if (t !== null && !tentativePBs.has(t) && e.fam?.opt === true && !projectionWriteActive && !getWriteOverride() && foldBatches.has(e)) {
+        stagedTruthPB.set(e, t);
+        t = e.pb = null;
+    }
+    if (activeTransition !== null) foldBatches.set(e, activeTransition);
     if (t === null) {
         // Prototype-chain overlay (#3044): plain-data non-array containers
         // outside projection/optimistic families open drafts in O(1) — own keys
@@ -348,18 +383,19 @@ function ensurePB(e) {
         // seed from committed truth — seeding overrides there would fold a lane
         // value into the committed home ("authority wins at reveal" would break).
                 if (e.fam?.opt && !projectionWriteActive && !getWriteOverride()) {
+            tentativePBs.add(t);
             const n = e.n;
             if (n !== null) {
                 for (const e of Reflect.ownKeys(n)) {
                     const r = n[e];
-                    if (hasActiveOverride(r)) t[e] = unwrapOverride(r.o?.De);
+                    if (hasActiveOverride(r)) t[e] = unwrapOverride(r.o?.Oe);
                 }
             }
             const r = e.h;
             if (r !== null) {
                 for (const e of Reflect.ownKeys(r)) {
                     const n = r[e];
-                    if (hasActiveOverride(n) && !unwrapOverride(n.o?.De)) delete t[e];
+                    if (hasActiveOverride(n) && !unwrapOverride(n.o?.Oe)) delete t[e];
                 }
             }
         }
@@ -370,6 +406,25 @@ function ensurePB(e) {
     return t;
 }
 
+/** Sentinel holder for `t.ht`: a latest()-pull staged this adoption outside
+ * any transition — the hold lasts until the fold commit (drainFolds). */ const PLAIN_HOLD = Symbol("plainHold");
+
+/** True while a latest() read is pulling the projection computed up to date
+ * (see the get trap): adoptions landing during the pull are speculative
+ * against the un-flushed batch and stage a held view. (Not injectable — the
+ * derived createStore overload retains projection machinery in every store
+ * bundle, see treeshake.test.ts.) */ let latestPullActive = false;
+
+/** Resolve the held committed view (#3074): answers the masked old backing
+ * while the hold is live, and lazily clears a hold whose transition has
+ * committed (transitions merge — resolve through currentTransition, same as
+ * foldHeld's node stamps). */ function heldMaskView(e) {
+    const t = e.ht;
+    if (t === null) return null;
+    if (t !== PLAIN_HOLD && currentTransition(t)?.sn === true) return e.ht = e.hv = null;
+    return e.hv;
+}
+
 /**
  * Adoption (2026-08-16c): the incoming object becomes the committed backing
  * IMMEDIATELY — reconcile is eagerly visible to every reader (shipped
@@ -385,6 +440,20 @@ function ensurePB(e) {
         queueFold(e);
  // records the pre-batch old before we swap
                 e.adopted = true;
+        // #3074/#3075: a projection recompute deriving from uncommitted inputs
+        // swaps the backing SPECULATIVELY — committed-visibility readers must
+        // keep the pre-hold view until the hold resolves (a source held by a
+        // live transition, or a latest()-pull ahead of the flush). Post-await
+        // landings (write-override) stay immediately visible — landed truth —
+        // and clear any hold; optimistic families ride the lane machinery.
+                if (e.fam?.opt !== true) {
+            if (getWriteOverride()) {
+                e.ht = e.hv = null;
+            } else if (activeTransition !== null || latestPullActive) {
+                if (heldMaskView(e) === null) e.hv = e.v;
+                e.ht = activeTransition ?? PLAIN_HOLD;
+            }
+        }
     }
     e.pb = null;
     // Overlay and accessor-scan state describe the OUTGOING backing — a
@@ -396,28 +465,58 @@ function ensurePB(e) {
     // draft rescans once (#3044 audit follow-up).
         e.ovl = false;
     e.del = null;
-    e.wk = null;
- // adoption supersedes any staged trap writes
-        e.sc = false;
+    e.sc = false;
     e.a = false;
-    e.v = t;
+    if (e.pc !== null) e.pc.wk = null;
+ // adoption supersedes staged trap writes
+        e.v = t;
     e.ch = t[$TARGET] !== undefined;
     (e.fam?.map ?? storeNextLookup).set(t, e);
 }
 
+/** Sentinel for `t.wk`: the written-keys bound is unusable this batch (an
+ * array length write implicitly deleted indices) — consumers full-scan. */ const WK_ALL = new Set;
+
+const plainProto = e => {
+    const t = Object.getPrototypeOf(e);
+    return t === Object.prototype || t === Array.prototype || t === null;
+};
+
 function queueFold(e) {
     if (foldOlds.has(e)) return;
-    if (foldOlds.size === 0) {
-        if (!hookInstalled) {
-            hookInstalled = true;
-            setStoreCommitHook(drainFolds);
-        }
+    if (!hookInstalled) {
+        hookInstalled = true;
+        setStoreCommitHook(drainFolds);
+    }
+    // Always arm — "map non-empty ⇒ drain scheduled" is NOT an invariant: a
+    // held re-queue, or an incomplete-transition flush (which skips
+    // commitPendingNodes entirely), leaves entries behind after `scheduled`
+    // was consumed. A size-gated arm then strands every LATER fold — queued
+    // silently, never drained, committed base frozen at stale state while its
+    // nodes commit (#3089). schedule() early-returns when already armed.
         schedule();
- // once per batch — drain clears the map
-        }
     foldOlds.set(e, e.v);
 }
 
+/** Fold write-attribution (#3089): a draft written while a transition is
+ * active belongs to that transition — its fold must not commit before the
+ * transition settles. Observed keys already defer through the held check in
+ * drainFolds (their nodes carry _pendingValue); this write-time stamp is the
+ * equivalent hold for UNOBSERVED keys, which have no node to consult.
+ * Refreshed on every write; resolved through currentTransition at drain
+ * (transitions merge — same rule as heldMaskView). */ const foldBatches = new WeakMap;
+
+/** Parked truth-staged pending backings (#3164 fold): a tentative draft that
+ * opens while a folded landing's backing is live moves the staged container
+ * here (see ensurePB); the tentative discard in notifyOptimisticWrites
+ * restores it in place of the usual null. */ const stagedTruthPB = new WeakMap;
+
+/** Backings opened by TENTATIVE drafts (optimistic user setters): ensurePB's
+ * truth-park must not fire against the draft's own container on its second
+ * and later writes (the first write stamps foldBatches whenever an action's
+ * transition is ambient). Entries die with their draft — tentative backings
+ * are consumed at setter exit. */ const tentativePBs = new WeakSet;
+
 /** Committed-time privatization for parent-chain slot updates (path copying). */ function privatizeCommitted(e) {
     if (ownedRaw.has(e.v)) return;
     const t = cloneRaw(e.v, e);
@@ -437,29 +536,52 @@ function drainFolds() {
     const e = [ ...foldOlds ];
     foldOlds.clear();
     for (const [t, n] of e) {
+        // A latest()-pull staging holds only until the fold commit: this flush
+        // is committing the batch the pull ran ahead of. Transition holds stay —
+        // they clear when their transition is done (heldMaskView).
+        if (t.ht === PLAIN_HOLD) t.ht = t.hv = null;
+        // Eager (write-override) family folds swap pb -> v at notifyWrites'
+        // tail: by the time this drain runs they carry no pb, and their
+        // structural ops must emit at the fold-commit site below (the clone
+        // branch never sees them). Re-audit blocker 4.
+                const e = t.pb === null;
         if (t.pb !== null) {
+            // #3089: a fold written under a still-running transition defers to
+            // that transition's settle (the write-time stamp covers unobserved
+            // keys; observed keys also hit the pending-node held check below).
+            const e = foldBatches.get(t);
+            if (e !== undefined) {
+                if (currentTransition(e).sn === false) {
+                    foldOlds.set(t, n);
+                    continue;
+                }
+                foldBatches.delete(t);
+            }
             // Setter path: nodes were setSignal'd at setter exit (write-time
             // notification — transitions/holds ride core machinery). Commit the
             // backing only for keys whose nodes have committed; a still-pending
             // node (transition-held) re-queues the target for the settling flush.
-            let e = false;
-            const r = t.pb;
-            const i = t.n;
-            if (i !== null) {
+                        let r = false;
+            const i = t.pb;
+            const o = t.n;
+            if (o !== null) {
                 // Only written keys can hold (their nodes took the setSignal); the
                 // wk bound keeps this O(written) — see notifyWrites. Same fallback
                 // rules as the notify (WK_ALL / accessors / non-plain prototypes).
-                const n = t.wk;
-                const o = n === null || n === WK_ALL || t.a === true || !plainProto(t.ovl ? t.v : r) ? Reflect.ownKeys(i) : n;
-                for (const t of o) {
-                    const n = i[t];
-                    if (n !== undefined && n.Pe !== NOT_PENDING) {
-                        e = true;
+                const e = t.pc !== null ? t.pc.wk : null;
+                const n = e === null || e === WK_ALL || t.a === true || 
+                // Overlay pbs chain to the COMMITTED object (#3044) — plainness is
+                // the committed container's prototype, not the overlay's.
+                !plainProto(t.ovl ? t.v : i) ? Reflect.ownKeys(o) : e;
+                for (const e of n) {
+                    const t = o[e];
+                    if (t !== undefined && t.Pe !== NOT_PENDING) {
+                        r = true;
                         break;
                     }
                 }
             }
-            if (e) {
+            if (r) {
                 foldOlds.set(t, n);
  // re-queue: commit happens when the hold settles
                                 continue;
@@ -474,30 +596,68 @@ function drainFolds() {
                 // — the never-mutate-user-data contract holds.
                 privatizeCommitted(t);
                 const e = t.v;
-                for (const t of Reflect.ownKeys(r)) {
-                    const n = Object.getOwnPropertyDescriptor(r, t);
+                for (const t of Reflect.ownKeys(i)) {
+                    const n = Object.getOwnPropertyDescriptor(i, t);
                     if (n.get || n.set || !n.enumerable || !n.writable || !n.configurable) Object.defineProperty(e, t, n); else e[t] = n.value;
                 }
                 if (t.del !== null) {
                     for (const n of t.del) delete e[n];
                     t.del = null;
                 }
-                (t.fam?.map ?? storeNextLookup).delete(r);
+                (t.fam?.map ?? storeNextLookup).delete(i);
                 t.pb = null;
                 t.ovl = false;
-                t.wk = null;
+                if (t.pc !== null) t.pc.wk = null;
  // written-keys window closes with the fold commit
                         } else {
-                t.v = r;
+                // Setter-channel structural ops: a fold that changes an array's shape
+                // (push/splice/permutation through the setter — the reconcile walk
+                // never queues here) is a structural visibility transition for any
+                // registered list driver. Identity-keyed; aligned folds emit nothing.
+                // Family targets defer to their own adoption emission (fam reconcile).
+                // Arrays always fold on this clone branch (overlay is non-array only).
+                // Family setter drafts (writable projection push/splice through the
+                // masked setter) fold on this branch too and the fold IS their
+                // visibility moment — emit unless the structure already rode another
+                // channel: adoption folds (reconcile walk emitted ops) and
+                // optimistic families (lane-timed override channel). Re-audit
+                // blocker 4.
+                if (t.pc !== null && t.pc.ro !== null && !t.adopted && t.fam?.opt !== true && Array.isArray(i) && Array.isArray(t.v)) rowHooks.emitSetterRowOps(t, t.v, i);
+                t.v = i;
                 t.ch = false;
  // pb is always a plain clone
                                 t.pb = null;
-                t.wk = null;
+                if (t.pc !== null) t.pc.wk = null;
  // written-keys window closes with the fold commit
                         }
         }
-        if (t.v === n) continue;
- // adopted then re-adopted back, or no-op
+        if (t.v === n) {
+            // A no-op adoption (A -> B -> A before flush) still consumed its walk:
+            // clear the flag or every later setter row-op gate (!t.adopted) stays
+            // failed and a driven family list freezes (re-audit 5, P1-1).
+            t.adopted = false;
+            continue;
+        }
+        // Patch channel (fold-commit site): family targets emit HERE — the fold
+        // IS their visibility moment (held folds re-queued above emit when they
+        // actually commit) — and so do PLAIN fold-adopted targets (setter-
+        // returned root replacements, chained-store swaps: adoptions WITHOUT a
+        // reconcile walk, so no walk-site emission ever happened — re-audit 2,
+        // P1-2). Plain eager targets emitted at their walk/setter sites already.
+                if (t.pc !== null && (t.fam !== null || t.adopted)) {
+            // Structural ops for folds whose structure rode no other channel:
+            // eager-folded family SETTER drafts (write-override swaps pb -> v at
+            // notifyWrites' tail — the clone branch never sees them; adoption
+            // folds re-emitting would double the walk's ops) and PLAIN fold
+            // adoptions (no walk at all). Optimistic families ride the override
+            // channel (lane-timed ops + revert RESYNC) — never re-emit here.
+            if (t.pc.ro !== null && t.fam?.opt !== true && (t.fam !== null ? e && !t.adopted : t.adopted) && Array.isArray(t.v) && Array.isArray(n)) rowHooks.emitSetterRowOps(t, n, t.v);
+            if (t.pc.p !== null) {
+                // Accessor demotion at the fold-commit seam is DEV-ONLY (see the
+                // reconcile seam note: prod never pays per-adoption scans).
+                patchHooks.emitPatchLocal(t, t.v, n);
+            }
+        }
         // Path copying (CAS: see the eager-fold twin above).
                 if (t.u && t.u.v[t.pk] === n) {
             privatizeCommitted(t.u);
@@ -518,19 +678,7 @@ function drainFolds() {
  * isPending, affects, and lane machinery ride the core natively (§3's
  * "pending home = the node when a node exists"). Unobserved keys stay in the
  * pending backing and fold directly at commit.
- */
-/** Sentinel for `t.wk`: the written-keys bound is unusable this batch (an
- * array length write implicitly deleted indices) — consumers full-scan. */ const WK_ALL = new Set;
-
-/** Plain-prototype check for the written-keys bound: prototype getters on
- * class instances can derive from ANY field, so only plain-data containers
- * may bound the notify to written keys. Overlay pbs chain to the COMMITTED
- * object (#3044), so overlay plainness is judged on the committed proto. */ const plainProto = e => {
-    const t = Object.getPrototypeOf(e);
-    return t === Object.prototype || t === Array.prototype || t === null;
-};
-
-function notifyWrites(e) {
+ */ function notifyWrites(e) {
     let t = e.pb;
     if (t === null) return;
     // Optimistic channel: user writes on an optimistic family become node-level
@@ -567,9 +715,16 @@ function notifyWrites(e) {
     // not a full scan). Falls back to the full node scan when the bound can't
     // hold: no trap granularity (wk null), an array length write (WK_ALL —
     // implicit index deletes), accessors on the record (t.a — a getter node's
-    // value can change when ANY key is written), or a non-plain prototype.
-        const i = e.wk;
-    const o = i === WK_ALL || e.a === true || !plainProto(e.ovl ? e.v : t) ? null : i;
+    // value can change when ANY key is written), or a non-plain prototype
+    // (class instances: prototype getters derive from arbitrary fields).
+        const i = e.pc !== null ? e.pc.wk : null;
+    // Overlay pbs chain to the COMMITTED object (#3044): a prototype-overlay
+    // draft is plain data on its own layer, but its getPrototypeOf is the
+    // committed container — judge plainness by the COMMITTED prototype or the
+    // bound never engages for overlay writes (every plain-object setter batch
+    // would full-scan: the exact selection-map workload wk exists for; jf
+    // `select` regressed 2x on this).
+        const o = i === WK_ALL || e.a === true || !plainProto(e.ovl ? e.v : t) ? null : i;
     if (r !== null) {
         const i = o ?? Reflect.ownKeys(r);
         for (const o of i) {
@@ -600,12 +755,16 @@ function notifyWrites(e) {
     }
     const f = e.h;
     if (f !== null) {
-        for (const n of Reflect.ownKeys(f)) setSignal(f[n], n in t && !(e.del !== null && e.del.has(n)));
+        const n = o ?? Reflect.ownKeys(f);
+        for (const r of n) {
+            const n = f[r];
+            if (n !== undefined) setSignal(n, r in t && !(e.del !== null && e.del.has(r)));
+        }
     }
     // Deep-witness (dk): setter writes must notify a deep() subscriber even on
-    // keys with no node. O(pb keys) equality only when a witness exists.
+    // keys with no node. O(written/pb keys) equality only when a witness exists.
         if (e.dk !== null) {
-        if (e.del !== null && e.del.size !== 0) bumpDeep(e); else for (const r of Reflect.ownKeys(t)) {
+        if (e.del !== null && e.del.size !== 0) bumpDeep(e); else for (const r of o ?? Reflect.ownKeys(t)) {
             const i = t[r];
             const o = n[r];
             if (i !== null && typeof i === "object" ? !targetsEqual(o, i) : !isEqual(o, i)) {
@@ -632,6 +791,12 @@ function notifyWrites(e) {
         }
         if (r) setSignal(e.k, e => e + 1);
     }
+    // Patch channel (setter site): a committed write transitions this record —
+    // queue its patches and bubble to ancestors (targeted nested writes must
+    // reach the row patch, §4b). One number compare when no patches exist.
+    // Family targets skip this site: their visibility moment is the FOLD
+    // commit (drainFolds emits), not the recompute/draft write.
+        if (e.fam === null && patchHooks !== null && patchHooks.hasPatches()) patchHooks.emitPatch(e, t, n);
     // Projection backing folds split by channel (two pinned contracts):
     // - sync-derive drafts (recompute body): NEVER eager — a downstream async
     //   hold can form LATER in the same flush and the leaf must stay at stale
@@ -642,12 +807,19 @@ function notifyWrites(e) {
     //   IMMEDIATE — landed truth shows to untracked readers even while a
     //   downstream consumer's own async still holds the effect-level reveal
     //   (spec-async "verdicts never inherit consumers' in-flight state").
-        if (e.fam !== null && e.pb !== null && getWriteOverride()) {
+    //   EXCEPT under an active transaction (#3164 fold): a landing riding a
+    //   retaining transaction (the optimistic module's aroundWrite binds it)
+    //   stages instead — ensurePB stamped foldBatches, so the backing commits
+    //   with the transaction and the reveal is atomic at settle. The pinned
+    //   immediate-commit contract is stated over the no-transaction microtask
+    //   posture, which `activeTransition === null` is exactly.
+        if (e.fam !== null && e.pb !== null && getWriteOverride() && activeTransition === null) {
+        // Landed truth (post-await write-override): immediately visible to every
+        // reader — any staged held view is superseded.
+        if (e.ht !== null) e.ht = e.hv = null;
         const n = e.v;
         e.pb = null;
-        e.wk = null;
- // written-keys window closes with the eager fold
-                e.v = t;
+        e.v = t;
         e.ch = false;
         if (e.u && e.u.v[e.pk] === n) {
             privatizeCommitted(e.u);
@@ -710,8 +882,8 @@ i = true) {
             return;
         }
         const f = i?.value;
-        const u = o?.value;
-        if (!isEqual(f, u) && !targetsEqual(f, u)) setSignal(e, typeof u === "function" ? () => u : u);
+        const l = o?.value;
+        if (!isEqual(f, l) && !targetsEqual(f, l)) setSignal(e, typeof l === "function" ? () => l : l);
     } else {
         const i = n[t];
         const o = r[t];
@@ -836,10 +1008,21 @@ const UNSAFE_KEYS = new Set([ "__proto__", "prototype", "constructor" ]);
  * / onSettled callbacks) get COMMITTED visibility (#3006), same as core. */ function inOwnerContext() {
     const e = getOwner();
     if (e === null) return false;
-    const t = e.Ct ? e.Ot : e;
+    const t = e.Gt ? e.Dt : e;
     return t != null && !(t.T & CONFIG_CHILDREN_FORBIDDEN);
 }
 
+/** CHILDREN_FORBIDDEN execution scope (createTrackedEffect / onSettled
+ * callbacks). Distinct from context-free: these scopes get committed
+ * visibility even against a projection's authoritative-elect pending
+ * backing (#3082) — parity with signals, where core read() serves
+ * committed to them regardless of staged writes. */ function inForbiddenScope() {
+    const e = getOwner();
+    if (e === null) return false;
+    const t = e.Gt ? e.Dt : e;
+    return t != null && !!(t.T & CONFIG_CHILDREN_FORBIDDEN);
+}
+
 /** A pending fold is transition-held when any written node's parked value is
  * stamped by a live transition (a plain batch parking — the lazy-recompute
  * read case — has no transition stamp and serves fresh). */ function foldHeld(e) {
@@ -847,26 +1030,57 @@ const UNSAFE_KEYS = new Set([ "__proto__", "prototype", "constructor" ]);
     if (t === null) return false;
     for (const e of Reflect.ownKeys(t)) {
         const n = t[e];
-        if (n.Pe !== NOT_PENDING && n._e != null && n._e.an !== true) return true;
+        if (n.Pe !== NOT_PENDING && n.Ae != null && n.Ae.sn !== true) return true;
     }
     return false;
 }
 
 function readSource(e) {
+    // Held view first (#3074): an adoption staged under a live hold serves the
+    // pre-hold committed backing to committed-visibility readers. Speculative
+    // readers — drafts, write-override, owner-context computeds recomputing
+    // inside the transaction, and latest() reads — see the adopted backing.
+    if (e.ht !== null && !latestReadActive && !inDraft(e) && !getWriteOverride() && !inOwnerContext()) {
+        const t = heldMaskView(e);
+        if (t !== null) return t;
+    }
     // Signal-parity visibility (core read(): owner-context reads serve
     // _pendingValue, context-free reads serve committed — effects recompute
     // BEFORE commitPendingNodes in the flush, so the pending view must be
     // servable). Drafts (setter window OR projection write-override) and
     // owner-context reads see the pending backing; context-free reads see
     // committed. Node reads apply the same rule, so both homes agree.
-    if (e.pb !== null && (inDraft(e) || getWriteOverride() || inOwnerContext() || 
+        if (e.pb !== null && (inDraft(e) || getWriteOverride() || 
+    // Owner-context readers see the pending backing — EXCEPT held truth
+    // on an optimistic family (#3164 fold): a live pb on an opt family
+    // outside the draft/write-override windows is a staged landing
+    // (tentative drafts never outlive their setter), and only the
+    // authoritative postures and latest() see it (the backing-level twin
+    // of core read()'s A17-for-held-truth arm; ordinary readers keep
+    // committed until the transaction's reveal).
+    inOwnerContext() && !heldTruthMasked(e) || 
     // A projection's pending backing is authoritative-elect: serve it to
     // context-free readers too UNLESS a transition is holding the node
-    // commits (downstream async hold — stale committed is the contract).
-    e.fam !== null && !foldHeld(e))) return e.pb;
+    // commits (downstream async hold — stale committed is the contract)
+    // or the reader is a CHILDREN_FORBIDDEN scope, which never observes
+    // its own unsettled write (#3082, signal parity per #3006).
+    e.fam !== null && !heldTruthMasked(e) && !foldHeld(e) && !inForbiddenScope())) return e.pb;
     return e.v;
 }
 
+/** #3164 fold: HELD truth on an optimistic family — a pending backing
+ * stamped by a live transition that retains optimism — is masked from
+ * ordinary readers (they keep committed until the transaction's reveal);
+ * the authoritative postures and latest() tunnel through. Un-stamped
+ * backings and optimism-free transitions keep ordinary mid-batch/
+ * speculation visibility. */ function heldTruthMasked(e) {
+    if (e.fam?.opt !== true || latestReadActive || authoritativeServe()) return false;
+    const t = foldBatches.get(e);
+    // opt families are only created by createOptimisticStore, whose module
+    // install populates optHooks — the assertion holds by construction.
+        return t !== undefined && optHooks.retainsOptimism(t);
+}
+
 const hasOwn = Object.prototype.hasOwnProperty;
 
 // Allocation-free own-accessor probe (replaces eager descriptor scans — the
@@ -896,7 +1110,27 @@ function isOwnAccessor(e, t) {
 
 /** Active optimistic override on an armed node (armed slot idles at
  * NOT_PENDING; undefined = unarmed plain node). */ function hasActiveOverride(e) {
-    return e.o?.De !== undefined && e.o?.De !== NOT_PENDING;
+    return e.o?.Oe !== undefined && e.o?.Oe !== NOT_PENDING;
+}
+
+/** The reading computation is until()'s authoritative-view predicate — same
+ * source of truth as core read()'s A17 carve-out (`context`, which persists
+ * under untrack). optimisticView()'s composition gate consults exactly this:
+ * write-side machinery (patch emission, tentative re-application) must keep
+ * composing even when it runs inside an authoritative-write bracket. */ function authoritativeRead() {
+    const e = context;
+    return e !== null && (e.T & CONFIG_AUTHORITATIVE_READ) !== 0;
+}
+
+/** Serve-side authoritative gate: until()'s predicate PLUS truth authors —
+ * the projection derive's draft (wrapDraft trap brackets, runAuthoritative;
+ * the same posture pair ensurePB classifies drafts by). A source computing
+ * the next truth must never read its callers' tentative overlays: a derive
+ * continuation's `store.push` computing its index from an action's
+ * optimistic row landed truth in the wrong slot and corrupted committed
+ * state (#3108). Trap-level overlay serves gate on this so values, length,
+ * membership, and keys leave the authoritative view together. */ function authoritativeServe() {
+    return projectionWriteActive || getWriteOverride() || authoritativeRead();
 }
 
 /** Context-aware node view for reads outside tracking: active override >
@@ -906,7 +1140,19 @@ function isOwnAccessor(e, t) {
  * reader that forced it (backing commits eagerly; node values fold at flush).
  * FORCE sentinels never surface (they only bump subscribers of accessor
  * keys, which are served by the trap, not the node). */ function nodeValue(e, t) {
-    const n = hasActiveOverride(e) ? unwrapOverride(e.o?.De) : e.Pe !== NOT_PENDING && inOwnerContext() ? e.Pe : t;
+    // latest() sees the in-flight parked value like an owner-context reader
+    // does (#3075) — signal/memo parity for store-node-backed keys.
+    // Authoritative-view reads (until()'s predicate) skip the override arm
+    // only: staged pending values are authoritative, overrides are the
+    // caller's optimism.
+    const n = !authoritativeServe() && hasActiveOverride(e) ? unwrapOverride(e.o?.Oe) : e.Pe !== NOT_PENDING && (latestReadActive || 
+    // Owner-context pending visibility — except HELD truth (#3164,
+    // see CONFIG_HELD_TRUTH: fold-staged or entangle-stolen
+    // confirming truth), which only authoritative/latest readers
+    // see (core read()'s A17-for-held-truth twin; ordinary readers
+    // keep committed until the transaction's reveal — latest() is
+    // exempted by the leading arm above).
+    (inOwnerContext() || authoritativeServe()) && !(e.T & CONFIG_HELD_TRUTH && !authoritativeServe())) ? e.Pe : t;
     return n === FORCE ? t : n;
 }
 
@@ -931,15 +1177,20 @@ function isOwnAccessor(e, t) {
                 read(getNode(e, t, n));
             }
         }
-        return optHooks.optimisticView(e, r).length;
+        // Truth authors read the backing's own length — an optimistic row from
+        // the caller's transaction must not shift where the author's next write
+        // lands (#3108).
+                return (authoritativeServe() ? r : optHooks.optimisticView(e, r)).length;
     }
     if (inDraft(e)) {
         // Optimistic drafts before their first write have no pending backing yet;
         // reads must still see the live optimistic view (compose, not clobber —
         // #2951). Once ensurePB runs, the seeded clone carries the view.
-        if (e.fam?.opt && e.pb === null) {
+        // AUTHORITATIVE drafts (projection derive) never overlay — ensurePB's
+        // seeding rule, applied to the read side (#3108).
+        if (e.fam?.opt && e.pb === null && !authoritativeServe()) {
             const n = e.n?.[t];
-            if (n !== undefined && hasActiveOverride(n)) f = unwrapOverride(n.o?.De);
+            if (n !== undefined && hasActiveOverride(n)) f = unwrapOverride(n.o?.Oe);
         }
     } else {
         if (i !== undefined) {
@@ -995,6 +1246,27 @@ function isOwnAccessor(e, t) {
     if (t != null && t.S & (STATUS_UNINITIALIZED | STATUS_ERROR)) read(t);
 }
 
+/** latest() pull (#3075): bring the projection computed up to date so the
+ * read serves the IN-FLIGHT derivation — signal/memo parity, where core
+ * read() routes latest() through a companion that recomputes speculatively.
+ * The latest flag is suspended for the recompute (the derive's own reads
+ * are normal reads), and latestPullActive marks any adoption it commits as
+ * staged (see adoptPB) — the speculative swap must not leak to
+ * committed-visibility readers before the flush. */ function pullProjectionForLatest(e) {
+    const t = e.fam.node;
+    if (t == null) return;
+    const n = latestReadActive;
+    setLatestReadActive(false);
+    const r = latestPullActive;
+    latestPullActive = true;
+    try {
+        prepareComputed(t, true);
+    } finally {
+        latestPullActive = r;
+        setLatestReadActive(n);
+    }
+}
+
 const traps = {
     get(e, t, n) {
         // One typeof gates every brand-symbol compare off the hot string path
@@ -1022,6 +1294,10 @@ const traps = {
                 }
         if (pendingCheckActive) witnessAffectsMark(e, t);
         if (e.fam !== null && getObserver() === null && !inDraft(e)) firewallGate(e);
+        // latest() pull (#3075): store traps never reach core read() without an
+        // observer, so bring the projection computed up to date here — signal/
+        // memo parity for latest() reads through a projection.
+                if (e.fam !== null && latestReadActive && !inDraft(e) && !getWriteOverride()) pullProjectionForLatest(e);
         const r = readSource(e);
         // Overlay delete (#3044): a prototype overlay cannot shadow a delete, so
         // deleted keys are tracked aside and read as absent in the pending view.
@@ -1097,9 +1373,12 @@ const traps = {
                     if (e.s) return serveShallow(e, t, r);
                     return isWrappable(r) ? draftServe(e, wrapNext(r, e, t)) : r;
                 }
-            } else if (f === undefined && inDraft(e) && e.fam?.opt && e.pb === null) {
+            } else if (f === undefined && inDraft(e) && e.fam?.opt && e.pb === null && 
+            // AUTHORITATIVE drafts (landing folds) never seed from overrides —
+            // the caller's optimism is not truth (has-trap twin below).
+            !authoritativeServe()) {
                 const n = e.n?.[t];
-                if (n !== undefined && hasActiveOverride(n)) f = unwrapOverride(n.o?.De);
+                if (n !== undefined && hasActiveOverride(n)) f = unwrapOverride(n.o?.Oe);
             }
             if (e.s) return serveShallow(e, t, f);
             return isWrappable(f) ? draftServe(e, wrapNext(f, e, t)) : f;
@@ -1119,15 +1398,17 @@ const traps = {
         if (!inDraft(e)) {
             if (getObserver() !== null) {
                 const n = getHasNode(e, t, r);
-                const i = read(n);
+                // Authoritative-view readers get the right answer for free: core read()
+                // skips the override arm for them, so nv is authoritative presence.
+                                const i = read(n);
                 if (hasActiveOverride(n)) r = !!i;
-            } else {
+            } else if (!authoritativeServe()) {
                 const n = e.h?.[t];
-                if (n !== undefined && hasActiveOverride(n)) r = !!unwrapOverride(n.o?.De);
+                if (n !== undefined && hasActiveOverride(n)) r = !!unwrapOverride(n.o?.Oe);
             }
-        } else if (e.fam?.opt && e.pb === null) {
+        } else if (e.fam?.opt && e.pb === null && !authoritativeServe()) {
             const n = e.h?.[t];
-            if (n !== undefined && hasActiveOverride(n)) r = !!unwrapOverride(n.o?.De);
+            if (n !== undefined && hasActiveOverride(n)) r = !!unwrapOverride(n.o?.Oe);
         }
         return r;
     },
@@ -1150,14 +1431,15 @@ const traps = {
         // Optimistic membership overlay: presence-node overrides add/remove keys
         // (per-transaction lifecycle rides the nodes — §6, FINDING-2's fix).
         // Draft reads before the first write overlay too (pb, once created, is
-        // seeded with the view).
-                if (e.fam?.opt && e.h !== null && (!inDraft(e) || e.pb === null)) {
+        // seeded with the view). Authoritative-view reads (until()'s predicate,
+        // truth-author drafts) skip the overlay.
+                if (!authoritativeServe() && e.fam?.opt && e.h !== null && (!inDraft(e) || e.pb === null)) {
             let t = null;
             for (const r of Reflect.ownKeys(e.h)) {
                 const i = e.h[r];
                 if (!hasActiveOverride(i)) continue;
                 t ??= new Set(n);
-                if (unwrapOverride(i.o?.De)) t.add(r); else t.delete(r);
+                if (unwrapOverride(i.o?.Oe)) t.add(r); else t.delete(r);
             }
             if (t !== null) return [ ...t ];
         }
@@ -1172,10 +1454,10 @@ const traps = {
             if (e.del !== null && e.del.has(t)) return undefined;
             if (r === undefined) r = Object.getOwnPropertyDescriptor(e.v, t);
         }
-        if (e.fam?.opt && !inDraft(e)) {
+        if (!authoritativeServe() && e.fam?.opt && !inDraft(e)) {
             const n = e.h?.[t];
             if (n !== undefined && hasActiveOverride(n)) {
-                if (!unwrapOverride(n.o?.De)) return undefined;
+                if (!unwrapOverride(n.o?.Oe)) return undefined;
  // opt delete
                                 if (r === undefined) {
                     const n = e.n?.[t];
@@ -1216,13 +1498,14 @@ const traps = {
         // Array length writes implicitly delete indices — the written-keys bound
         // can't see them, so poison to the full scan for this batch. Index
         // writes implicitly GROW length, so arrays always record it alongside.
-                if (Array.isArray(f)) {
-            if (t === "length") e.wk = WK_ALL; else if (e.wk !== WK_ALL) {
-                const n = e.wk ??= new Set;
-                n.add(t);
-                n.add("length");
+                const l = pcOf(e);
+        if (Array.isArray(f)) {
+            if (t === "length") l.wk = WK_ALL; else if (l.wk !== WK_ALL) {
+                const e = l.wk ??= new Set;
+                e.add(t);
+                e.add("length");
             }
-        } else if (e.wk !== WK_ALL) (e.wk ??= new Set).add(t);
+        } else if (l.wk !== WK_ALL) (l.wk ??= new Set).add(t);
         // Own data keys literally named "prototype"/"constructor" land as data —
         // defineProperty sidesteps a proto-chain setter named the same.
                 if (UNSAFE_KEYS.has(t)) {
@@ -1260,7 +1543,14 @@ const traps = {
         const i = !r && getWriteOverride();
         if (!r && !i) return true;
         if (t === "__proto__") return true;
-        if (n.get || n.set) e.a = true;
+        if (n.get || n.set) {
+            e.a = true;
+            // Accessor demotion (re-audit blocker 3): a record that acquires an
+            // accessor after patch registration stops being patchable — pull its
+            // patches and re-drive them as tracked effect fallbacks. Hooks are
+            // installed whenever pc.p exists (registration installs them).
+                        if (e.pc !== null && e.pc.p !== null) patchHooks.demoteToEffects(e);
+        }
         // Unwrap before ensurePB (see the set trap: self-reference materializes).
                 if ("value" in n) n = {
             ...n,
@@ -1268,7 +1558,8 @@ const traps = {
         };
         const o = ensurePB(e);
         pendingNotify.add(e);
-        if (e.wk !== WK_ALL) (e.wk ??= new Set).add(t);
+        const f = pcOf(e);
+        if (f.wk !== WK_ALL) (f.wk ??= new Set).add(t);
         Object.defineProperty(o, t, n);
         if (e.del !== null) e.del.delete(t);
         if (i) notifyWrites(e);
@@ -1280,7 +1571,8 @@ const traps = {
         if (!n && !r) return true;
         const i = ensurePB(e);
         pendingNotify.add(e);
-        if (e.wk !== WK_ALL) (e.wk ??= new Set).add(t);
+        const o = pcOf(e);
+        if (o.wk !== WK_ALL) (o.wk ??= new Set).add(t);
         delete i[t];
         // A prototype overlay cannot shadow a delete of a committed key —
         // record it aside (#3044); reads/has/ownKeys/commit consult the set.
@@ -1344,8 +1636,39 @@ function createStoreNext(e, t = false) {
     return [ n, setter ];
 }
 
+/** True when `proxy` is a SHALLOW store (children served verbatim, slots
+ * replaced by reference — #2932). The list driver uses this to choose the
+ * slot-patch channel (collected row bodies) over per-record registration. */ function storeIsShallow(e) {
+    const t = e?.[$TARGET];
+    return t !== undefined && t.s === true;
+}
+
+/** True when `proxy` belongs to a projection/optimistic FAMILY. The list
+ * driver must DECLINE family arrays (external audit finding): family
+ * structural changes never emit row/slot ops (the setter channel is
+ * fam-gated; optimistic writes ride node overrides), and the proxy identity
+ * is stable so the each-watch cannot catch the change either — an engaged
+ * list would freeze on optimistic/projection structural updates. Record-
+ * level family patches are unaffected (they have their own emission). */ function storeHasFamily(e) {
+    const t = e?.[$TARGET];
+    return t !== undefined && t.fam !== null;
+}
+
+/** True when `proxy` belongs to an OPTIMISTIC family specifically. The list
+ * driver declines these (audit finding, narrowed): optimistic user writes
+ * ride node-level overrides — they never enter the reconcile walk, so no
+ * row/slot ops are emitted and an engaged list would freeze on optimistic
+ * structural changes. PROJECTION (non-optimistic) families are drivable:
+ * their recomputes go through the reconcile walk, whose emissions are
+ * transition-stamped in the apply queue like any other (equivalence-matrix
+ * gated). Re-admitting optimistic families requires a lane-timed structural
+ * emission mirroring emitPatchOptimistic, plus revert resync. */ function storeHasOptimisticFamily(e) {
+    const t = e?.[$TARGET];
+    return t !== undefined && t.fam?.opt === true;
+}
+
 /** Tracking deep snapshot (`deep()` for next targets): subscribes to the
- * key-set and every property node at every reachable level, then returns the
+ * key-set and deep-witness node at every reachable level, then returns the
  * plain view. Shared references and cycles handled via the visited set. */ function deepNext(e) {
     const t = e?.[$TARGET];
     if (t === undefined || t.px !== e) return e;
@@ -1465,11 +1788,11 @@ function snapshotWalk(e, t, n) {
                 Object.defineProperty(i, o, f);
                 continue;
             }
-            const u = f.value;
-            const l = u !== null && typeof u === "object" ? snapshotWalk(u, t, n) : u;
-            if (f.enumerable && f.writable && f.configurable) i[o] = l; else Object.defineProperty(i, o, {
+            const l = f.value;
+            const u = l !== null && typeof l === "object" ? snapshotWalk(l, t, n) : l;
+            if (f.enumerable && f.writable && f.configurable) i[o] = u; else Object.defineProperty(i, o, {
                 ...f,
-                value: l
+                value: u
             });
         }
         if (e && i.length !== r.length) i.length = r.length;
@@ -1484,16 +1807,16 @@ function snapshotWalk(e, t, n) {
         if (!i || i.get || i.set) continue;
         const o = i.value;
         if (o === null || typeof o !== "object") continue;
-        const u = snapshotWalk(o, t, n);
-        if (u !== o) {
+        const l = snapshotWalk(o, t, n);
+        if (l !== o) {
             if (f === null) {
                 f = Array.isArray(r) ? [ ...r ] : Object.create(Object.getPrototypeOf(r), Object.getOwnPropertyDescriptors(r));
                 t.set(r, f);
             }
-            f[e] = u;
+            f[e] = l;
         }
     }
     return f ?? r;
 }
 
-export { adoptPB, bumpDeep, createStoreNext, deepNext, getHasNode, getKeySetNode, getNode, hasAccessorFlag, hasActiveOverride, materializePB, notifyFold, notifyFoldTail, notifyKeyDiff, notifyKeyValue, runAuthoritative, snapshotNext, storeSetterNext, targetsEqual, unwrapValue, wrapNext };
+export { adoptPB, arrayStructureChanged, authoritativeRead, authoritativeServe, bumpDeep, createStoreNext, deepNext, getHasNode, getKeySetNode, getNode, hasAccessorFlag, hasActiveOverride, materializePB, membershipChanged, notifyFold, notifyFoldTail, notifyKeyDiff, notifyKeyValue, pcOf, runAuthoritative, snapshotNext, stagedTruthPB, storeHasFamily, storeHasOptimisticFamily, storeIsShallow, storeSetterNext, targetIsPlain, targetsEqual, unwrapValue, wrapNext };