@solidjs/signals 2.0.0-rc.4 → 2.0.0-rc.5

package/dist/dev.js

@@ -42,6 +42,18 @@ class StatusError extends Error {
 function unwrapStatusError(error) {
   return error instanceof StatusError ? error.cause : error;
 }
+/**
+ * Rejection value of `until(fn, { timeout })` when the predicate does not turn
+ * truthy within the window. Inside an `action()`, the rejection is thrown back
+ * in at the `yield` point — catchable there, or the action fails and its
+ * optimistic state reverts.
+ */
+class TimeoutError extends Error {
+  constructor(message = "Timed out waiting for condition") {
+    super(message);
+    this.name = "TimeoutError";
+  }
+}
 class NoOwnerError extends Error {
   constructor() {
     super("Context can only be accessed under a reactive root.");
@@ -117,6 +129,60 @@ const CONFIG_CHILD_COMPANIONS = 1 << 11;
  * moved into the cold extension (§12), and an unconditional `_x` deref per
  * marked node measurably taxed the propagation hot path (diamond -22%). */
 const CONFIG_FW_CHILDREN = 1 << 12;
+/** Authoritative-view reader (`until()`): while this node computes, reads
+ * dodge active optimistic OVERRIDES only — the predicate must observe
+ * arriving truth, never the caller's own tentative writes (which would
+ * trivially satisfy it). Everything else reads normally, INCLUDING
+ * transition-staged `_pendingValue`: staged data is authoritative (optimism
+ * lives only in override slots), and a hold that refused staged reads would
+ * deadlock on data the open transaction itself is holding (a refresh the
+ * action issued lands staged and cannot commit until the hold releases).
+ * read() checks the bit on the reading computation (`context`) directly — no
+ * ambient flag — so a shared computed the predicate pulls recomputes as
+ * itself (no bit) under the normal view, and its cache never forks. */
+const CONFIG_AUTHORITATIVE_READ = 1 << 13;
+/** Sticky mark: an authoritative-view reader read this node PAST an active
+ * override. The ack shape — an authoritative arrival EQUAL to the override —
+ * rides paths that are deliberately silent under A17 (every ordinary reader
+ * sees the override, so an equal landing changes nothing for them). A marked
+ * node notifies those readers on such paths anyway, so the landed truth is
+ * seen without re-firing ordinary subscribers. Never cleared — only nodes an
+ * until() predicate observed mid-override pay. */
+const CONFIG_AUTHORITATIVE_OBSERVED = 1 << 14;
+/** Promise-delivery effect (resolve()/until()): commits its computed value
+ * directly even when recomputing under its own held transition. These
+ * effects deliver applies on a microtask (#2930) instead of the stashed
+ * effect queues, so the value must ride the same immediate schedule — a
+ * staged value with an immediate apply delivers stale state (resolve) or
+ * deadlocks the hold (until). Safe because the node is a private leaf: no
+ * subscriber reads an effect's value, only its own apply does. */
+const CONFIG_DIRECT_COMMIT = 1 << 15;
+/** Fresh-pull reader (awaitable `refresh()`'s waiter effect): a read of a
+ * dirty source recomputes it inline even when the height gate defers to the
+ * flush. Closes the same-flush ordering race where a waiter created
+ * alongside a refresh() mark read the PRE-re-ask value as settled and
+ * delivered stale; with the pull, the waiter either parks on the re-ask's
+ * pending window (async — woken by the settle walk, which runs on every
+ * landing including equal-value ones) or serves its sync answer. resolve()
+ * deliberately keeps that race — its contract is "first settled value"
+ * (#2930), not "next quiescent state". */
+const CONFIG_FRESH_READ = 1 << 16;
+/** HELD truth (#3164): this node's staged `_pendingValue` is confirming
+ * truth riding a transaction that retains optimism, revealed only at that
+ * transaction's settle. Two arming sites, one meaning: the store fold
+ * (a landing staged into the retaining transaction) and until()'s
+ * flip-entanglement (a foreign carrier's staged write, stolen when it
+ * flipped the awaited predicate truthy). Until the reveal, ordinary
+ * readers — lane and speculative recomputes included — keep committed:
+ * the staging notified subscribers as a plain write, so without the mask
+ * a mid-hold recompute composes live optimism with the confirming truth,
+ * a frame no timeline contains (GabbeV's union tear). Authoritative
+ * readers (until()'s predicate) and latest() tunnel through — the
+ * exemption that keeps holds deadlock-free. Override-covered nodes never
+ * arm: the override is their display and its revert their notification
+ * (A17). Cleared at commit (the commit IS the reveal); subscribers masked
+ * during the hold are woken by finalizePureQueue's post-revert pass. */
+const CONFIG_HELD_TRUTH = 1 << 17;
 const STATUS_PENDING = 1 << 0;
 const STATUS_ERROR = 1 << 1;
 const STATUS_UNINITIALIZED = 1 << 2;
@@ -600,6 +666,18 @@ const engineHooks = {
     const totalMs = now() - frame.start;
     if (frames.length > 0) frames[frames.length - 1].childMs += totalMs;
     const selfMs = Math.max(0, totalMs - frame.childMs);
+    // Effect-output honesty: effects run with `_equals: false`, so core
+    // reports EVERY effect recompute as changed — which made effect waste
+    // invisible to costs() (and compiled JSX bindings are effects: the
+    // fan-out waste a naive selected-row produces is all effects). The
+    // engine re-derives the fact from its own snapshot: an identical
+    // committed compute output is an unchanged run. `undefined` outputs are
+    // exempt — a side-effect-only compute's work IS its effect phase, and
+    // identity of `undefined` proves nothing.
+    if (changed && frame.causes !== null && el._type) {
+      const committed = el._pendingValue !== NOT_PENDING ? el._pendingValue : el._value;
+      if (committed !== undefined && committed === frame.prevValue) changed = false;
+    }
     // Unstable-output check: memos only, non-create, plain runs with a
     // committed change. The fresh value sits in `_pendingValue` for held
     // plain-flush memo commits and in `_value` for direct ones. Overlay runs
@@ -1248,6 +1326,107 @@ function mergeTransitionState(target, outgoing) {
   }
   for (const sub of outgoing._gatedSubs) target._gatedSubs.add(sub);
 }
+/**
+ * Flip-entanglement (#3164 follow-up): `until()` is a declaration of
+ * relatedness — the predicate names the condition that confirms the awaiting
+ * transaction. When the predicate settles truthy, every live foreign
+ * transition whose staged write it read IS the confirming event by the
+ * user's own definition, so it merges into the awaiting transaction and
+ * reveals at the joint settle — the cross-primitive twin of the family fold
+ * (a landing on an optimism-carrying family joins the retaining
+ * transaction). Non-flipping updates never pass through here: falsy
+ * evaluations don't entangle, so unrelated traffic on the watched sources
+ * reveals freely on its own schedule.
+ *
+ * Runs inside the predicate's compute (pure phase) — the confirming
+ * transition's stamps are still live and its commit decision hasn't run, so
+ * the merge lands before any reveal. Only the tree-shaken graphs that call
+ * `until()` retain this.
+ */
+function entangleConfirmingTransitions(obs, target) {
+  target = currentTransition(target);
+  if (target._done === true) return;
+  // The confirming evidence is a dep whose value is STAGED (pending,
+  // uncommitted) at flip evaluation — committed deps are public already and
+  // carry nothing to entangle. A staged dep lives in one of two carriers: a
+  // stamped transition, or the queue's current batch (ambient registrations
+  // don't stamp; "ambient work IS a transaction" — the batch is the
+  // carrier). The entangle STEALS the carrier's staged cargo — its pending
+  // nodes move (re-stamped) into the awaiting transaction and reveal at its
+  // settle — but never the carrier itself: its async reporters, actions,
+  // and stashes are its own future (a live stream's flight must not chain
+  // the awaiting transaction to landings that haven't happened; a merged
+  // reporter deadlocked exactly that way).
+  let stole = false;
+  for (let l = obs._deps; l !== null; l = l._nextDep) {
+    const dep = l._dep;
+    if (dep._pendingValue !== NOT_PENDING) {
+      const stamp = dep._transition;
+      const t = stamp != null ? currentTransition(stamp) : null;
+      // Skip the awaiting transaction's own cargo (t === target: a
+      // fold-staged landing or a write the action itself issued — hold and
+      // reveal already correct) and dead carriers. Ambient-batch staging
+      // (t === null) must leave the batch NOW — it commits at this flush's
+      // end, which would reveal the confirmation under the live optimism
+      // it just confirmed.
+      const carrier =
+        t === null
+          ? currentBatch._pendingNodes
+          : t !== target && t._done !== true
+            ? t._pendingNodes
+            : null;
+      if (carrier !== null) stole = stealEntangledCargo(carrier, target) || stole;
+    }
+    if (l === obs._depsTail) break;
+  }
+  // The steal never activates the awaiting transaction: the predicate can
+  // flip inside another transaction's finalize heap, and adopting the queue
+  // batch there hands the stolen cargo to that finalize's commit sweep — a
+  // premature reveal at a foreign settle. Subscribers that computed against
+  // the pre-steal world were re-dirtied by the steal itself, so this
+  // flush's applies paint the masked (mid-hold) view; the cargo commits at
+  // the awaiting transaction's own settle.
+}
+/** Move a confirming carrier's staged nodes into the awaiting transaction:
+ * re-stamp and arm the held-truth mask (override-covered nodes skip it —
+ * the override already hides their staged value per A17, and is usually
+ * the very optimism this confirmation settles); the mask's commit
+ * registers the settle-side post-revert wake. The carrier's array is
+ * emptied so its own commit point commits none of the stolen cargo.
+ *
+ * EFFECT subs of stolen nodes re-run: any that recomputed against the
+ * staging BEFORE the steal (the carrier's landing notified them as a plain
+ * write) hold a private torn result — override composed with confirming
+ * truth — that the next paint gate (stash-point lane run, a foreign
+ * flush's completion drain) would show. Re-running them under the mask
+ * re-derives the mid-hold view in this same heap pass. PURE computeds are
+ * deliberately NOT re-run: a torn staged value of theirs is itself stolen
+ * cargo — masked at read, so ordinary readers already serve their
+ * committed value — while re-running them would re-derive the OLD world
+ * and re-stage it over the held truth. The reveal re-notifies
+ * (commitPendingNodes), which is when they re-derive for real. */
+function stealEntangledCargo(carrier, target) {
+  if (carrier === target._pendingNodes || carrier.length === 0) return false;
+  for (let i = 0; i < carrier.length; i++) {
+    const node = carrier[i];
+    node._transition = target;
+    target._pendingNodes.push(node);
+    // Override-covered nodes stay silent AND unmasked: the override is the
+    // display (A17 — its staging never notified, its revert will), so their
+    // subs saw nothing and re-running one would break the silence with a
+    // duplicate fire of an unchanged view.
+    if (!hasActiveOverride$1(node)) {
+      node._config |= CONFIG_HELD_TRUTH;
+      for (let s = node._subs; s !== null; s = s._nextSub) {
+        const sub = s._sub;
+        if (sub._type && !(sub._config & CONFIG_AUTHORITATIVE_READ)) enqueueSub(sub);
+      }
+    }
+  }
+  carrier.length = 0;
+  transitions.add(target);
+  return true;
+}
 function schedule() {
   if (halted) {
     notifyHalted();
@@ -1446,6 +1625,10 @@ class GlobalQueue extends Queue {
   static _laneReadsCommitted = null;
   static _recomputeLane = null;
   static _laneAsyncPending = null;
+  /** Authoritative-view reader wakeup (until()): installed at first until() call.
+   * Call sites are gated by CONFIG_AUTHORITATIVE_OBSERVED, which only until()'s
+   * carve-out read can set, so `!` invocations are safe once the gate holds. */
+  static _notifyAuthoritativeObservers = null;
   static _laneAsyncSettled = null;
   static _trackOptimisticStore = null;
   flush() {
@@ -1589,8 +1772,17 @@ class GlobalQueue extends Queue {
     return false;
   }
   initTransition(transition) {
-    if (transition) transition = currentTransition(transition);
-    if (transition && transition === activeTransition) return;
+    if (transition) {
+      transition = currentTransition(transition);
+      // A finished transaction cannot be re-entered: its state is committed
+      // or reverted, so "rejoining" it (A26) is meaningless and re-activating
+      // it spins the drain loop (#3140). The refusal must be a bare return —
+      // redirecting the caller to a fresh batch would re-arm the loop with a
+      // new transaction identity each pass. Stamps are cleared at commit, so
+      // this is a belt for paths that hand over a chased-dead reference
+      // (merged chains, async settles racing completion).
+      if (transition._done === true || transition === activeTransition) return;
+    }
     if (!transition && activeTransition && activeTransition._time === clock) return;
     if (!activeTransition) {
       activeTransition = transition ?? createBatch();
@@ -1634,11 +1826,25 @@ class GlobalQueue extends Queue {
     for (const lane of activeLanes) {
       if (!lane._transition) lane._transition = activeTransition;
     }
+    // A transaction's ambient window is one flush. Entering must therefore
+    // guarantee a flush: a transaction opened with no writes (an action whose
+    // first statements only await) otherwise leaves activeTransition and the
+    // adopted batch armed across the async gap, and the next unrelated work
+    // to arrive — an optimistic store's authoritative landing, a plain async
+    // settle — is adopted into a transaction it has nothing to do with
+    // (#3141). The scheduled flush parks the incomplete transaction through
+    // the normal machinery and detaches the ambient slots first.
+    schedule();
   }
 }
 function queuePendingNode(node) {
+  lastStagedNodeName = node._name ?? null;
   currentBatch._pendingNodes.push(node);
 }
+// Dev-only attribution for the flush loop guard (#3140): when the guard
+// trips, naming what the loop kept chewing on lets the app author attribute
+// the runaway without patching dist.
+let lastStagedNodeName = null;
 // Sticky: flips true on the first refresh() ever (the only setter of
 // REACTIVE_REASK) so the hot notification loop skips the per-subscriber flag
 // clear entirely in apps that never refresh.
@@ -1744,10 +1950,34 @@ let patchCommitHook = null;
 function setPatchCommitHook(fn) {
   patchCommitHook = fn;
 }
+/** Held truth committed this finalize, awaiting its post-revert wake (see
+ * finalizePureQueue): the commit IS the reveal, but subscribers must not
+ * re-derive until the settling transaction's optimistic overrides have
+ * reverted — a commit-time wake recomputes them in the window where
+ * confirming truth is committed and the override still displays, a torn
+ * frame no timeline contains. */
+const heldRevealed = [];
 function commitPendingNodes() {
   const pendingNodes = currentBatch._pendingNodes;
   for (let i = 0; i < pendingNodes.length; i++) {
-    commitPendingNode(pendingNodes[i]);
+    const node = pendingNodes[i];
+    commitPendingNode(node);
+    // The stamp dies with the commit (#3143) — symmetric with
+    // resolveOptimisticNodes clearing optimistic stamps. A stamp outliving
+    // its transaction let any later write (even a value-equal no-op, which
+    // re-opens before the equality bail) resurrect the finished transaction;
+    // a boundary flag rewritten every finalize pass then spun the drain loop
+    // forever (#3140). The held-truth mark dies the same death — the commit
+    // IS the reveal — but its wake defers to the post-revert pass: ordinary
+    // subscribers were masked to committed all hold (some re-derived against
+    // that old view and cached it), and commits are otherwise silent
+    // (staging already notified), so without a wake they'd hold the old
+    // world forever.
+    node._transition = null;
+    if (node._config & CONFIG_HELD_TRUTH) {
+      node._config &= ~CONFIG_HELD_TRUTH;
+      heldRevealed.push(node);
+    }
   }
   pendingNodes.length = 0;
   storeCommitHook?.();
@@ -1799,6 +2029,22 @@ function finalizePureQueue(completingTransition = null, incomplete = false) {
     // completing transition scopes the clear to its own layer keys (#2899).
     if (batch._optimisticStores.size)
       GlobalQueue._clearOptimisticStores(batch._optimisticStores, completingTransition);
+    // Held-truth reveal wake (#3164), post-revert by construction: this
+    // finalize committed confirming truth whose subscribers were masked all
+    // hold — some re-derived against the committed view (the staging, or a
+    // confirming carrier's landing, notified them as a plain write) and
+    // cached it, and stash-restored applies may carry those torn values.
+    // Waking and recomputing HERE — after _resolveOptimistic and the store
+    // clears above — means every apply paints the settled view; a wake at
+    // commit time would recompute them in the window where truth is
+    // committed but the settling transaction's overrides still display.
+    if (heldRevealed.length !== 0) {
+      while (heldRevealed.length) insertSubs(heldRevealed.pop());
+      if (dirtyQueue._max >= dirtyQueue._min) {
+        runHeap(dirtyQueue, GlobalQueue._update);
+        commitPendingNodes();
+      }
+    }
     sweepTransientStoreNodes();
     // Lanes only enter activeLanes through the engine's getOrCreateLane.
     if (activeLanes.size) GlobalQueue._cleanupLanes(completingTransition);
@@ -1879,7 +2125,20 @@ function flush(fn) {
   // `flush()` is an explicit drain point, so it must also process an active
   // transition even if no microtask was scheduled for it yet.
   while (scheduled$1 || activeTransition) {
-    if (++count === 1e5) throw new Error("Potential Infinite Loop Detected.");
+    if (++count === 1e5) {
+      // Attribution beats a bare guard (#3140): say what kept the loop alive.
+      // A completed transition being re-activated reads `done=true` here —
+      // the corpse-revival signature — while application-driven runaways
+      // (#2843) usually show staged work naming the culprit node.
+      const t = activeTransition;
+      throw new Error(
+        `Potential Infinite Loop Detected. Kept alive by ${scheduled$1 ? "scheduled work" : "an active transition"}${
+          t
+            ? `; transition: done=${t._done === true}, pending=${t._pendingNodes.length}, optimistic=${t._optimisticNodes.length}, asyncReporters=${t._asyncReporters.size}`
+            : ""
+        }${lastStagedNodeName ? `; last staged node: ${lastStagedNodeName}` : ""}`
+      );
+    }
     globalQueue.flush();
   }
 }
@@ -1941,6 +2200,29 @@ function runInTransition(transition, fn) {
     activeTransition = prevTransition;
   }
 }
+/** Run `fn` with `transition` as BOTH the ambient transaction and the
+ * registration batch, restoring both after. runInTransition alone is not
+ * enough for code that WRITES on behalf of a transaction from inside someone
+ * else's window (optimistic replay re-arming a still-open action's edits
+ * during a landing commit, #3123): registrations route through the queue's
+ * batch pointer, and a bare activeTransition swap leaves them in the ambient
+ * batch — a plain batch "completes" at the next flush and reverts optimistic
+ * registrations that were supposed to live with the transaction.
+ * initTransition is the wrong tool here: it MERGES the currently ambient
+ * transaction into the target, entangling whatever the interrupted window
+ * belonged to. */
+function runAsTransitionBatch(transition, fn) {
+  const prevTransition = activeTransition;
+  const prevBatch = globalQueue._batch;
+  try {
+    activeTransition = currentTransition(transition);
+    currentBatch = globalQueue._batch = activeTransition;
+    return fn();
+  } finally {
+    activeTransition = prevTransition;
+    currentBatch = globalQueue._batch = prevBatch;
+  }
+}
 
 /** The queue a node belongs to, picked from its own zombie flag. */
 function queueFor(n) {
@@ -2709,11 +2991,11 @@ function settlePendingSource(el) {
     const errored = node._statusFlags & STATUS_ERROR;
     if (remaining) {
       if (!errored) setPendingError(node, remaining);
-      updateCompanions !== null && updateCompanions(node);
+      updateCompanions?.(node);
     } else {
       node._statusFlags &= ~STATUS_PENDING;
       if (!errored) setPendingError(node);
-      updateCompanions !== null && updateCompanions(node);
+      updateCompanions?.(node);
       if (node._x?._blocked) {
         enqueueSub(node);
         scheduled = true;
@@ -2736,6 +3018,14 @@ function settlePendingSource(el) {
 function isThenable(value) {
   return value != null && typeof value === "object" && typeof value.then === "function";
 }
+/** Fire and clear a node's iterator-flight cancellation hook (#3122). */
+function releaseFlightTeardown(el) {
+  const teardown = el._x?._flightTeardown;
+  if (teardown != null) {
+    el._x._flightTeardown = null;
+    teardown();
+  }
+}
 function handleAsync(el, result, setter) {
   let iterator = false;
   let thenable = false;
@@ -2773,6 +3063,11 @@ function handleAsync(el, result, setter) {
     });
     throw new Error(message);
   }
+  // Flight replacement relies on recompute's supersede release for iterator
+  // teardown (#3122): every handleAsync call — including the projection
+  // self-registration — runs during a recompute of `el`, which has already
+  // fired _flightTeardown. A future non-recompute registration path must
+  // release it here before overwriting _inFlight.
   ext(el)._inFlight = result;
   let syncValue;
   // Settle-time transition re-entry. The loading rail is invisible to
@@ -2876,10 +3171,21 @@ function handleAsync(el, result, setter) {
       // only notified when the hold is visible to them: under an active
       // override every reader sees the override (A17), so waking subs would
       // re-show an unchanged view — the revert is the notification point.
-      GlobalQueue._syncCompanions !== null && GlobalQueue._syncCompanions(el, value);
+      GlobalQueue._syncCompanions?.(el, value);
       if (!hasActiveOverride$1(el)) {
         if (attrHooks !== null) attrHooks.asyncEnd(el, undefined, value, true);
         insertSubs(el);
+      } else if (el._config & CONFIG_AUTHORITATIVE_OBSERVED) {
+        // A17 silence is stated over ordinary readers; an authoritative-view
+        // reader (until()'s predicate) observed this node PAST its override
+        // and is waiting for exactly this staged truth. Without the wake the
+        // hold deadlocks: the landing waits on the transaction, the
+        // transaction on the action, the action on an until() that was never
+        // re-notified (#3164). Same selective wake as the equal-landing
+        // branch in recompute(). Optional call: the bit implies the
+        // optimistic engine WAS consulted, but the hook only installs with
+        // it — a bare-core build must not crash here.
+        GlobalQueue._notifyAuthoritativeObservers?.(el);
       }
       el._time = clock;
     } else if (lane) {
@@ -2894,7 +3200,7 @@ function handleAsync(el, result, setter) {
           // The latest() shadow write gives latest() effects independent lanes; the
           // _pendingSignal update is a no-op repeat of the clearStatus() call above
           // (computePendingState doesn't read _value).
-          GlobalQueue._syncCompanions !== null && GlobalQueue._syncCompanions(el, value);
+          GlobalQueue._syncCompanions?.(el, value);
           insertSubs(el, true);
         }
       } catch (e) {
@@ -2976,6 +3282,11 @@ function handleAsync(el, result, setter) {
       } catch {}
     };
     registerClose ? registerClose(close) : cleanup(close);
+    // Flight-identity cancellation (#3122): the registration above is the
+    // owner-death backstop, but its disposal list can be zombie-deferred
+    // until the SUPERSEDING flight settles. The teardown slot fires at the
+    // _inFlight release sites so supersede stops this stream immediately.
+    ext(el)._flightTeardown = close;
     // Release check before each next pull: an unobserved lazy node must tear
     // down (its close above runs via disposal, closing the iterator) instead
     // of pumping the stream forever with zero subscribers (#2935).
@@ -3207,7 +3518,7 @@ function notifyStatus(el, status, error, blockStatus, lane) {
         status | (status !== STATUS_ERROR ? el._statusFlags & STATUS_UNINITIALIZED : 0);
       ext(el)._error = error;
     }
-    GlobalQueue._updatePendingSignal !== null && GlobalQueue._updatePendingSignal(el);
+    GlobalQueue._updatePendingSignal?.(el);
     if (
       el._x?._child &&
       el._config & CONFIG_CHILD_COMPANIONS &&
@@ -3352,7 +3663,15 @@ function recompute(el, create = false) {
     if (el._transition && (!isEffect || activeTransition) && activeTransition !== el._transition)
       globalQueue.initTransition(el._transition);
     deleteFromHeap(el, queueFor(el));
-    if (el._x !== null) el._x._inFlight = null;
+    if (el._x !== null) {
+      el._x._inFlight = null;
+      // Supersede is where an iterator flight dies (#3122): close it now.
+      // Its cleanup(close) registration may sit in a zombie-deferred
+      // disposal list that a held transition only drains when the
+      // SUPERSEDING flight settles — cancellation must not wait for the
+      // work that replaced it. Idempotent with the cleanup-channel close.
+      releaseFlightTeardown(el);
+    }
     // Tracked effects run after finalizePureQueue, so dispose immediately instead of deferring
     if (el._transition || isEffect === EFFECT_TRACKED) disposeChildren(el);
     else if (el._firstChild !== null || el._disposal !== null) {
@@ -3376,6 +3695,14 @@ function recompute(el, create = false) {
   // recovers to an unchanged value, dependents still holding this object must
   // be swept (settleErroredDependents, #2949).
   const outgoingError = el._statusFlags & STATUS_ERROR ? el._x?._error : undefined;
+  // Pending SOURCE-hood, captured before the compute clears status: a node
+  // whose own flight parked dependents self-registers in _pendingSources
+  // (notifyStatus, isSource). If this recompute supersedes that flight and
+  // settles synchronously, those dependents settle HERE — asyncWrite's
+  // settlePendingSource walk never runs for a landing that was preempted
+  // (#3181).
+  const wasPendingSource =
+    (el._statusFlags & STATUS_PENDING) !== 0 && el._x?._pendingSources?.has(el) === true;
   // Re-ask classification lives in the verdict module; capture the flag before
   // the recompute wipes _flags below.
   const hadReask = (el._flags & REACTIVE_REASK) !== 0;
@@ -3550,7 +3877,14 @@ function recompute(el, create = false) {
         // values directly — the pending round-trip (queuePendingNode +
         // commitPendingNodes) exists to sequence transition reveals, and
         // paying it per effect on the plain path is pure overhead.
-        (isEffect && (activeTransition !== el._transition || activeTransition === null)) ||
+        // DIRECT_COMMIT effects (resolve/until) commit directly even under
+        // their own held transition: their applies deliver on a microtask,
+        // not the stashed queues, so a staged value would hand the immediate
+        // apply stale state — see CONFIG_DIRECT_COMMIT.
+        (isEffect &&
+          (activeTransition !== el._transition ||
+            activeTransition === null ||
+            el._config & CONFIG_DIRECT_COMMIT)) ||
         isOptimisticDirty
         // NOTE (stage-3, 2026-08-21): a quiet-world MEMO direct-commit was
         // attempted here and REVERTED — memo staging is load-bearing beyond
@@ -3596,6 +3930,12 @@ function recompute(el, create = false) {
       if (el._pendingValue === NOT_PENDING) queuePendingNode(el);
       el._pendingValue = value;
       if (wasLoading) el._loading = true; // see the held branch above (#2990)
+      // A authoritative-view reader (until()) observed this node past its
+      // override — and "authoritative arrival equal to the override" is
+      // exactly the acknowledgment it waits for. Wake those readers only;
+      // A17 silence holds for every ordinary subscriber. (Hook installed by
+      // until(), the only setter of the gating bit.)
+      if (el._config & CONFIG_AUTHORITATIVE_OBSERVED) GlobalQueue._notifyAuthoritativeObservers(el);
     } else if (el._height != oldHeight) {
       for (let s = el._subs; s !== null; s = s._nextSub) {
         insertIntoHeapHeight(s._sub, queueFor(s._sub));
@@ -3608,6 +3948,17 @@ function recompute(el, create = false) {
     // (el._x?._error re-set), so this only runs on a genuinely clean recovery.
     if (outgoingError !== undefined && !valueChanged && !el._x?._error)
       settleErroredDependents(el, outgoingError);
+    // Pending twin of the sweep above (#3181): a flight superseded by this
+    // synchronous settle leaves every registered dependent still flagged
+    // STATUS_PENDING with a pending source that will never land — asyncWrite
+    // owns the walk only for flights that actually land. An unchanged value
+    // is the dangerous shape (a projection reconciling in place: a memo over
+    // it re-throws its cached NotReadyError forever, and every reader that
+    // suspended through that memo re-parks on the dead source), but the walk
+    // runs on the changed shape too, exactly as the landing path does —
+    // insertSubs notifies value SUBSCRIBERS, not pending REGISTRANTS, and
+    // the two sets only partially overlap.
+    if (wasPendingSource && !(el._statusFlags & STATUS_PENDING)) settlePendingSource(el);
   }
   // Attribution hook: fired before the lane restore so `currentOptimisticLane`
   // still reflects THIS run's posture. The facts distinguish an overlay
@@ -3656,7 +4007,9 @@ function updateIfNecessary(el) {
   // (_depsTail/_depGen) is live, and a nested recompute would corrupt it.
   // A mid-pass mark stays latched for recompute's own tail to reschedule
   // (#3037); readers meanwhile serve the values the pass has so far.
-  if (el._flags & REACTIVE_RECOMPUTING_DEPS) return;
+  // Never recompute a DISPOSED node either: recompute rewrites _flags and
+  // would resurrect it (#2983) — readers serve its last value.
+  if (el._flags & (REACTIVE_RECOMPUTING_DEPS | REACTIVE_DISPOSED)) return;
   if (el._flags & REACTIVE_CHECK) {
     for (let d = el._deps; d; d = d._nextDep) {
       const dep1 = d._dep;
@@ -3692,7 +4045,7 @@ function computed(fn, options) {
       (options?.sync ? CONFIG_SYNC : 0) |
       (options?._noSnapshot ? CONFIG_NO_SNAPSHOT : 0) |
       (snapshotCaptureActive && ownerInSnapshotScope(context) ? CONFIG_IN_SNAPSHOT_SCOPE : 0),
-    _equals: options?.equals != null ? options.equals : isEqual,
+    _equals: options?.equals ?? isEqual,
     _disposal: null,
     _queue: context?._queue ?? globalQueue,
     _context: context?._context ?? defaultContext,
@@ -3744,6 +4097,7 @@ function ext(el) {
     _parentSource: undefined,
     _affectsCount: 0,
     _inFlight: null,
+    _flightTeardown: null,
     _error: undefined,
     _blocked: undefined,
     _pendingSources: undefined,
@@ -3771,6 +4125,7 @@ function createEffectNode(fn, effectFn, errorFn, type, options) {
       (transparent ? CONFIG_TRANSPARENT : 0) |
       (options?.ownedWrite ? CONFIG_OWNED_WRITE : 0) |
       (options?.sync ? CONFIG_SYNC : 0) |
+      (options?._extraConfig ?? 0) |
       (snapshotCaptureActive && ownerInSnapshotScope(context) ? CONFIG_IN_SNAPSHOT_SCOPE : 0),
     _equals: false,
     _disposal: null,
@@ -3832,8 +4187,7 @@ function setEffectStatusNotify(fn) {
  * "display consumer" membership test in the status walks, exactly as the
  * per-node field did when every effect carried one. */
 function statusNotifierOf(el) {
-  const x = el._x;
-  const own = x !== null && x !== undefined ? x._notifyStatus : undefined;
+  const own = el._x?._notifyStatus;
   if (own !== undefined) return own;
   return el._type ? (effectStatusNotify ?? undefined) : undefined;
 }
@@ -3876,7 +4230,7 @@ function setupComputedNode(self, options) {
 }
 function signal(v, options, firewall = null) {
   const s = {
-    _equals: options?.equals != null ? options.equals : isEqual,
+    _equals: options?.equals ?? isEqual,
     _config:
       (options?.ownedWrite ? CONFIG_OWNED_WRITE : 0) |
       (options?._noSnapshot ? CONFIG_NO_SNAPSHOT : 0),
@@ -4013,6 +4367,35 @@ const READ_SLOW = Symbol("read-slow");
  * snapshot / transition / lane / dev-strictRead state all take the full
  * resolution. Anything slow returns READ_SLOW; the caller then calls read().
  */
+/**
+ * Wake only authoritative-view readers (until() predicates) subscribed to `el`.
+ * The A17-silent ack paths — an authoritative arrival equal to the active
+ * override — use this so the predicate re-evaluates without re-firing
+ * ordinary subscribers whose visible (override) value did not change.
+ * Pay-for-use: reached through GlobalQueue._notifyAuthoritativeObservers,
+ * installed at first until() call — apps that never use until() shake it.
+ */
+function notifyAuthoritativeObservers(el) {
+  for (let s = el._subs; s !== null; s = s._nextSub) {
+    const sub = s._sub;
+    if (!(sub._config & CONFIG_AUTHORITATIVE_READ)) continue;
+    // Missed-wake latch (#3037), same contract as insertSubs: the reader may
+    // itself have pulled this recompute (updateIfNecessary from its own
+    // read), and the heap refuses RECOMPUTING nodes — latch so recompute's
+    // tail reschedules it with the staged value visible.
+    if (sub._flags & REACTIVE_RECOMPUTING_DEPS && s._gen === sub._depGen && s !== sub._depsTail)
+      sub._flags |= REACTIVE_MISSED_WAKE;
+    enqueueSub(sub);
+  }
+  schedule();
+}
+/** Installs the until() machinery hook. Idempotent; called by until() before
+ * any authoritative-view read happens (same late-binding contract as the
+ * optimistic engine). */
+function installAuthoritativeRead() {
+  if (GlobalQueue._notifyAuthoritativeObservers === null)
+    GlobalQueue._notifyAuthoritativeObservers = notifyAuthoritativeObservers;
+}
 function readNodeFast(el) {
   if (
     latestReadActive ||
@@ -4092,6 +4475,13 @@ function read(el) {
         markHeap(elQueue);
         updateIfNecessary(owner);
       }
+      // Fresh-pull readers (awaitable refresh's waiter) recompute a dirty
+      // source inline even when the height gate defers to the flush: the
+      // waiter must park on the re-ask's window (or serve its sync answer),
+      // never read the PRE-re-ask value as settled. Self-guarded: a clean
+      // node no-ops and updateIfNecessary refuses disposed nodes (#2983) —
+      // a dead target serves its last value, which is already quiescent.
+      else if (c._config & CONFIG_FRESH_READ) updateIfNecessary(owner);
       const height = owner._height;
       // parent check is shallow, might need to be recursive
       if (height >= c._height && el._parent !== c) {
@@ -4170,8 +4560,18 @@ function read(el) {
       nodeName: owner?._name
     });
   if (el._x?._overrideValue !== undefined && el._x?._overrideValue !== NOT_PENDING) {
-    // A17: the override IS the value for every reader.
-    return unwrapOverride(el._x?._overrideValue);
+    // A17: the override IS the value for every reader — except an authoritative
+    // reader (until()'s predicate carries CONFIG_AUTHORITATIVE_READ): it must
+    // observe independently-arriving truth, and serving it the caller's own
+    // tentative write would trivially satisfy the predicate. The bit is checked
+    // on the reading computation itself, so a shared computed the predicate
+    // pulls recomputes as ITSELF (context = the memo, no bit) under the normal
+    // view. Fall through to normal value selection (staged `_pendingValue` is
+    // authoritative — optimism never lives there); the sticky mark makes the
+    // A17-silent "landing equals override" paths notify this node's subs so
+    // the reader re-runs when truth arrives.
+    if (!(c && c._config & CONFIG_AUTHORITATIVE_READ)) return unwrapOverride(el._x?._overrideValue);
+    el._config |= CONFIG_AUTHORITATIVE_OBSERVED;
   }
   // Entanglement gate: a reader recomputing under an optimistic lane that reads
   // a pending mid-transition write sees the committed value. Projection-store
@@ -4199,7 +4599,18 @@ function read(el) {
     (currentOptimisticLane !== null && GlobalQueue._laneReadsCommitted(el, owner, c)) ||
     el._pendingValue === NOT_PENDING ||
     c._config & CONFIG_CHILDREN_FORBIDDEN ||
-    (stale && el._transition && activeTransition !== el._transition)
+    (stale && el._transition && activeTransition !== el._transition) ||
+    // A17 for HELD truth (#3164, see CONFIG_HELD_TRUTH): staged confirming
+    // truth — fold-staged onto an armed family, or entangle-stolen by an
+    // awaited until() — is masked from ordinary readers until its
+    // transaction's reveal; the retaining transaction's own speculative
+    // recomputes included (partial override coverage would otherwise
+    // compose override + staged truth into a state no timeline contains).
+    // Authoritative readers (until()'s predicate) and latest() see the
+    // staged truth — the tunnel that keeps the hold deadlock-free.
+    (el._config & CONFIG_HELD_TRUTH &&
+      !latestReadActive &&
+      !(c._config & CONFIG_AUTHORITATIVE_READ))
       ? el._value
       : el._pendingValue;
   // Record that this isPending() probe observed the fresh pending value, so
@@ -4244,9 +4655,17 @@ function devGuardStoreSetterWrite() {
       ownerName: context._name,
       data: { operation: "setStore" }
     });
-    throw new Error(REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE);
+    // the owner name reaches the THROWN message too, not just the
+    // diagnostics channel apps don't subscribe to by default (#3157)
+    throw new Error(ownedScopeWriteMessage(context));
   }
 }
+function ownedScopeWriteMessage(owner) {
+  const name = owner._name;
+  return name
+    ? `${REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE} (in ${name})`
+    : REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE;
+}
 function setSignal(el, v) {
   if (
     !(el._config & CONFIG_OWNED_WRITE) &&
@@ -4264,7 +4683,7 @@ function setSignal(el, v) {
       nodeName: el._name,
       data: { operation: "setSignal" }
     });
-    throw new Error(REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE);
+    throw new Error(ownedScopeWriteMessage(context));
   }
   if (el._transition && activeTransition !== el._transition)
     globalQueue.initTransition(el._transition);
@@ -4390,41 +4809,13 @@ function staleValues(fn, set = true) {
   }
 }
 /**
- * Invalidates one reactive source, forcing it to re-execute even if its inputs
- * haven't changed.
- *
- * Pass either a Solid-created accessor or a projected store created from
- * `createStore(fn, ...)` / `createProjection(...)`. `refresh()` is a
- * write-like invalidation operation: it does not read the target's value, and
- * refreshing a plain signal accessor is a no-op.
- *
- * Use it to invalidate cached async values (e.g. force a re-fetch) without
- * tearing the consumer down.
- *
- * @example
- * ```ts
- * const user = createMemo(async () => fetch(`/users/${id()}`).then(r => r.json()));
- *
- * // Re-fetch on demand
- * <button onClick={() => refresh(user)}>Reload</button>
- * ```
+ * Core marking half of `refresh()` (the public wrapper lives in signals.ts —
+ * it validates the target, marks through here, then builds the quiescence
+ * promise on the resolve()/until() effect machinery). Flags the node's next
+ * recompute as a quiet re-ask and schedules it; no-ops for non-derived or
+ * disposed targets and for same-tick manual writes.
  */
-function refresh(target) {
-  const node = target?.[$REFRESH];
-  if (!node) {
-    {
-      const message =
-        "[INVALID_REFRESH_TARGET] refresh() expects a Solid source accessor or refreshable store. " +
-        "Pass the original source target, not a wrapper function or derived property read.";
-      emitDiagnostic({
-        code: "INVALID_REFRESH_TARGET",
-        kind: "write",
-        severity: "error",
-        message
-      });
-      throw new Error(message);
-    }
-  }
+function markRefresh(node) {
   if (
     context &&
     !((node._config ?? 0) & CONFIG_OWNED_WRITE) &&
@@ -5236,7 +5627,22 @@ function latestRead(el) {
       !(pendingComputed._flags & (REACTIVE_DISPOSED | REACTIVE_ZOMBIE))
     ) {
       markHeap(queue);
-      prepareComputed(pendingComputed, true);
+      // Suspend probe collection during the pull (mirrors pendingCheckRead's
+      // prepare): a probe through latest() answers for the SHADOW — the
+      // read() dispatch collects it deliberately, so the verdict reflects
+      // async still in flight for the latest view, not the parent's held
+      // write. A stale shadow recomputing HERE ran its `read(parent)` with
+      // the probe still live and collected the parent too, so the verdict
+      // depended on whether anything had pulled the shadow current earlier
+      // in the tick (#3104: reading latest(m) flipped a later
+      // latest(() => isPending(x)) from true to false).
+      const prevCheck = pendingCheckActive;
+      setPendingCheckActive(false);
+      try {
+        prepareComputed(pendingComputed, true);
+      } finally {
+        setPendingCheckActive(prevCheck);
+      }
     }
     value = read(pendingComputed);
   } catch (e) {
@@ -5266,12 +5672,42 @@ function latestRead(el) {
     return pendingComputed._pendingValue;
   return value;
 }
+/**
+ * A latest() shadow that is uninitialized only because it was CREATED during
+ * an active flight — its parent source already has a committed value, so
+ * latest() serves that as the visible value and a tracked reader has
+ * something to pair a verdict with (#3166). Same parent resolution as
+ * computePendingState. The pending signal companion also carries
+ * `_parentSource` but is a plain signal (no `_fn`) that never goes pending,
+ * so the `_fn` check is belt-and-braces for this call site.
+ */
+function latestShadowWithInitializedParent(owner) {
+  if (typeof owner._fn !== "function") return false;
+  const parentNode = owner._x?._parentSource;
+  if (parentNode === undefined) return false;
+  const parent = parentNode._firewall || parentNode;
+  return !(parent._statusFlags & STATUS_UNINITIALIZED);
+}
 /** The isPending()-probe read path, installed as GlobalQueue._pendingCheck. */
 function pendingCheckRead(el, c, owner, firewall) {
   setPendingCheckActive(false);
   if (typeof el._fn === "function") prepareComputed(el, true);
   const ownerStatus = owner._statusFlags;
-  if (c && ownerStatus & STATUS_PENDING && ownerStatus & STATUS_UNINITIALIZED) {
+  if (
+    c &&
+    ownerStatus & STATUS_PENDING &&
+    ownerStatus & STATUS_UNINITIALIZED &&
+    // The suspend-throw is for a genuinely-first-load source: the tracked
+    // reader has nothing to pair a verdict with, so it parks on the source.
+    // A latest() SHADOW created lazily mid-flight is born uninitialized even
+    // though its parent has a committed value latest() will serve — throwing
+    // here (swallowed by latestRead's fallback) dropped the shadow from the
+    // probe, so a tracked latest(isPending()) probe created during a
+    // new-question flight cached `false` for that whole flight (#3166).
+    // Defer to the PARENT's initialization state and fall through to normal
+    // collection; the plain pending throw downstream still links the reader.
+    !latestShadowWithInitializedParent(owner)
+  ) {
     if (tracking && el !== c) link(el, c);
     setPendingCheckActive(true);
     throw owner._x?._error;
@@ -5352,6 +5788,17 @@ function isPending(fn) {
   });
   const collectPending = () => {
     setPendingCheckActive(false);
+    // Companion reads are mode-neutral plumbing: under an outer latest()
+    // (isPending inside a latest window — #3104's memo shape) leaving latest
+    // mode active dispatched these reads through latestRead, which built a
+    // SHADOW OF THE PENDING SIGNAL itself. The next updatePendingSignal then
+    // wrote that companion-on-companion from inside a recompute
+    // (syncCompanions → setSignal on a shadow created without ownedWrite)
+    // and halted dev with the owned-scope write guard. The creation paths
+    // (getLatestValueComputed / getPendingSignal) already suspend both
+    // modes; this read site must too.
+    const prevLatest = latestReadActive;
+    setLatestReadActive(false);
     const prevStrictRead = strictRead;
     setStrictRead(false);
     try {
@@ -5363,6 +5810,7 @@ function isPending(fn) {
       });
     } finally {
       setStrictRead(prevStrictRead);
+      setLatestReadActive(prevLatest);
       setPendingCheckActive(true);
     }
     // A "not pending" verdict that exists only because this reader saw the
@@ -6086,11 +6534,259 @@ function resolve(fn) {
           rej(err);
           dispose();
         },
-        { user: true }
+        // DIRECT_COMMIT: a source settling INTO the held transaction (e.g. a
+        // refresh this action issued) stages its landing; the effect's own
+        // recompute must not stage too, or the microtask apply reads the
+        // stale mainline value and resolves with old data.
+        { user: true, _extraConfig: CONFIG_DIRECT_COMMIT }
       );
     });
   });
 }
+/**
+ * Invalidates one reactive source, forcing it to re-execute even if its inputs
+ * haven't changed, and returns a promise for the target's NEXT QUIESCENT
+ * STATE — the re-ask (and anything that supersedes it) has settled.
+ *
+ * Pass either a Solid-created accessor or a projected store created from
+ * `createStore(fn, ...)` / `createProjection(...)`. `refresh()` is a
+ * write-like invalidation operation: it does not read the target's value, and
+ * refreshing a plain signal accessor is a no-op that resolves immediately.
+ *
+ * The returned promise is safe to ignore (fire-and-forget refresh is
+ * unchanged, and a failed refetch will not surface an unhandled rejection).
+ * Awaiting it gives imperative flows the settle point without a reactive
+ * read:
+ * - Accessor targets resolve with the settled value; store targets resolve
+ *   with the store node passed (reads through it are fresh after the await).
+ * - A failed re-ask rejects with the error (inside an action's generator,
+ *   `yield refresh(x)` throws back at the yield point and the action reverts
+ *   like any other failure).
+ * - Semantics are quiescence, not flight identity: if another refresh (or
+ *   any invalidation) supersedes this one mid-flight, the promise waits for
+ *   — and delivers — whatever finally lands.
+ * - Inside an action, truth landing into the held transaction is STAGED;
+ *   the promise still settles then (matching `resolve()`/`until()`, #2930)
+ *   and delivers the staged value — the caller's own optimistic override is
+ *   never the delivered value.
+ * - The re-ask itself stays verdict-quiet exactly as before: `isPending`
+ *   does not flip for a bare refresh (pair with `affects()` for a visible
+ *   pending window).
+ *
+ * @example
+ * ```ts
+ * const user = createMemo(async () => fetch(`/users/${id()}`).then(r => r.json()));
+ *
+ * // Fire-and-forget re-fetch
+ * <button onClick={() => refresh(user)}>Reload</button>;
+ *
+ * // Imperative settle point
+ * const fresh = await refresh(user);
+ * ```
+ */
+function refresh(target) {
+  const node = target?.[$REFRESH];
+  if (!node) {
+    {
+      const message =
+        "[INVALID_REFRESH_TARGET] refresh() expects a Solid source accessor or refreshable store. " +
+        "Pass the original source target, not a wrapper function or derived property read.";
+      emitDiagnostic({
+        code: "INVALID_REFRESH_TARGET",
+        kind: "write",
+        severity: "error",
+        message
+      });
+      throw new Error(message);
+    }
+  }
+  // Mark now, watch on a microtask. The waiter is resolve()'s machinery with
+  // two extra reader bits, but it must NOT compute at call time (effects
+  // recompute eagerly on creation): same-tick refreshes coalesce into ONE
+  // re-ask only because every mark lands before anything pulls, and eager
+  // per-call pulls turned three refreshes into three fetches. Deferred, the
+  // waiter's first read sees the coalesced state: FRESH_READ pulls the node
+  // through recompute if it is still dirty (self-deduping — a clean node
+  // no-ops, so N waiters cost one pull; this also closes the race where a
+  // waiter reads the PRE-re-ask value as settled and delivers stale), after
+  // which the read either parks on the re-ask's pending window (async — the
+  // settle walk re-runs it on every landing, equal-value and
+  // staged-under-hold included, and a rejection arrives through the effect's
+  // error channel) or serves the sync answer. AUTHORITATIVE_READ keeps an
+  // action's own optimistic override out of the delivered value. resolve()'s
+  // own eager compute is untouched: created after a refresh it still settles
+  // stale-while-revalidate (#2930) — its contract is "first settled value",
+  // not "next quiescent state".
+  markRefresh(node);
+  const promise = new Promise((res, rej) => {
+    queueMicrotask(() => {
+      // No createRoot: the microtask has no ambient owner, so the effect is
+      // naturally detached, and settle disposes the node directly — the root
+      // added ~560B of otherwise-shakeable machinery for nothing but the
+      // dev-mode NO_OWNER_EFFECT warning, so dev keeps a root husk purely to
+      // stay quiet. The waiter swaps in its microtask queue during its own
+      // first compute (before the initial apply enqueue), replacing the
+      // root-owner plumbing.
+      // Typed as the effect node, not Owner: the capture runs inside the
+      // effect's own compute, where the ambient owner IS the effect —
+      // exactly what dispose() takes.
+      let waiter = null;
+      const make = () =>
+        effect(
+          () => {
+            if (waiter === null) {
+              waiter = getOwner();
+              const queue = new MicrotaskQueue();
+              queue._parent = waiter._queue;
+              waiter._queue = queue;
+            }
+            return read(node);
+          },
+          value => {
+            res(typeof target === "function" ? value : target);
+            dispose(waiter);
+          },
+          err => {
+            rej(err);
+            dispose(waiter);
+          },
+          {
+            user: true,
+            _extraConfig: CONFIG_DIRECT_COMMIT | CONFIG_AUTHORITATIVE_READ | CONFIG_FRESH_READ
+          }
+        );
+      createRoot(make);
+    });
+  });
+  // Fire-and-forget refresh must not turn a failed refetch into an unhandled
+  // rejection; awaiting callers attach their own handlers to `promise`.
+  promise.catch(() => {});
+  return promise;
+}
+/**
+ * Awaits a reactive predicate and resolves the first time it settles *truthy*,
+ * with that (narrowed) value. Falsy results and pending async reads both mean
+ * "not yet": the subscription stays live and re-evaluates as sources change.
+ * If the predicate settles with an error — a throw, or an async source that
+ * rejects — the promise rejects with it, as do timeout and abort.
+ *
+ * Where {@link resolve} answers "what is this value" (first settled value,
+ * whatever it is), `until` answers "when does the world confirm this
+ * condition". The difference matters inside an `action()`: `yield until(...)`
+ * holds the action's transaction — and any optimistic state riding it — open
+ * until the condition is independently true.
+ *
+ * To make that sound, `until`'s predicate reads the AUTHORITATIVE view — and
+ * this is the one read-semantics difference from `resolve`, which reads the
+ * normal (transaction's own) view where overrides are visible:
+ *
+ * - **Optimistic overrides are invisible** to the predicate. Your own
+ *   tentative write can never satisfy your own ack, even on the
+ *   single-primitive shape where the optimistic store IS the live-fed store.
+ *   (Derived computeds serve their normal cached values — express the
+ *   condition over sources of truth, not derived views of the overlay.)
+ * - **Everything else reads normally, including uncommitted transition-staged
+ *   data.** Real data is real wherever it currently lives. This is
+ *   load-bearing, not a loophole: truth that arrives *into* the open
+ *   transaction (a `refresh()` this action issued, an entangled landing)
+ *   stages and cannot commit until the hold releases — a predicate that
+ *   refused staged reads would deadlock on the very data it is waiting for.
+ *
+ * This is the acknowledgment mechanism for mutations confirmed on a live data
+ * channel (sockets, subscriptions, live queries) rather than by the mutation's
+ * own response: correlate by a client-generated id or version in the predicate,
+ * and let truth arrive however it arrives — push, refetch, or another tab.
+ *
+ * Failure composes with action semantics: a rejection is thrown back into the
+ * generator at the `yield` point — catchable there, or the action fails and
+ * its optimistic state reverts.
+ *
+ * Must be called *outside* a tracking scope.
+ *
+ * @example
+ * ```ts
+ * const send = action(async function* (text: string) {
+ *   const clientId = crypto.randomUUID();
+ *   setMessages(m => { m.push({ clientId, text, pending: true }); }); // optimistic
+ *   await socket.send({ clientId, text }); // fire-and-forget transport
+ *   // Hold until the live source echoes the write (authoritative view —
+ *   // the optimistic row above cannot satisfy this):
+ *   yield until(() => messages.some(m => m.clientId === clientId), { timeout: 10_000 });
+ * });
+ * ```
+ *
+ * @param fn a reactive predicate over authoritative state
+ * @param options optional `timeout` (ms) and abort `signal`
+ */
+function until(fn, options) {
+  if (getObserver()) {
+    throw new Error(
+      "Cannot call until inside a reactive scope; await it from an action or another imperative scope."
+    );
+  }
+  // Late-bind the wakeup hook for the A17-silent ack paths (pay-for-use:
+  // apps that never call until() never retain it).
+  installAuthoritativeRead();
+  // Flip-entanglement (#3164 follow-up): the transaction this until() holds
+  // open (the action's, when yielded from one). The predicate is the user's
+  // declaration of what confirms it — when a foreign transition's staged
+  // write flips it truthy, that transition merges here and reveals at the
+  // joint settle instead of painting the confirmation under live optimism.
+  const awaiting = activeTransition;
+  return new Promise((res, rej) => {
+    const signal = options?.signal;
+    if (signal?.aborted) return rej(signal.reason);
+    createRoot(dispose => {
+      // Same delivery contract as resolve() (#2930): effect applies ride a
+      // microtask so the promise can settle while the transaction the caller
+      // yielded it into is still open — that transaction being open is the
+      // entire point of the hold.
+      const owner = getOwner();
+      const queue = new MicrotaskQueue();
+      queue._parent = owner._queue;
+      owner._queue = queue;
+      let timer;
+      let onAbort;
+      const settle = fire => {
+        if (timer !== undefined) clearTimeout(timer);
+        if (onAbort !== undefined) signal.removeEventListener("abort", onAbort);
+        fire();
+        dispose();
+      };
+      effect(
+        awaiting === null
+          ? fn
+          : () => {
+              const value = fn();
+              // Runs inside the compute (pure phase): the confirming
+              // transition's stamps are live and its commit hasn't run, so
+              // the merge lands before any reveal. Falsy evaluations skip —
+              // non-flipping updates were never named as the confirmation.
+              if (value) entangleConfirmingTransitions(getObserver(), awaiting);
+              return value;
+            },
+        value => {
+          // Falsy is "not yet": keep the subscription live and wait for the
+          // next evaluation. Only a truthy settled value resolves.
+          if (value) settle(() => res(value));
+        },
+        err => settle(() => rej(err)),
+        // AUTHORITATIVE_READ: overrides invisible to the predicate.
+        // DIRECT_COMMIT: truth that stages into the held transaction (a
+        // refresh the action issued) must flow through to the microtask
+        // apply — a staged effect value would deadlock the hold on data
+        // the hold itself is keeping uncommitted.
+        { user: true, _extraConfig: CONFIG_AUTHORITATIVE_READ | CONFIG_DIRECT_COMMIT }
+      );
+      if (options?.timeout !== undefined)
+        timer = setTimeout(() => settle(() => rej(new TimeoutError())), options.timeout);
+      if (signal !== undefined) {
+        onAbort = () => settle(() => rej(signal.reason));
+        signal.addEventListener("abort", onAbort, { once: true });
+      }
+    });
+  });
+}
 function createOptimistic(first, second) {
   // Install before the node exists: only engine-installed programs can carry
   // an _overrideValue slot (same runtime-install pattern as
@@ -7060,8 +7756,29 @@ function materializePB(target) {
   target.ovl = false;
 }
 function ensurePB(target) {
-  if (activeTransition !== null) foldBatches.set(target, activeTransition);
   let pb = target.pb;
+  // Truth-staged backing hand-off (#3164 fold): a TENTATIVE draft opening on
+  // a target whose pending backing is truth-staged (a landing folded into a
+  // retaining transaction — it carries a foldBatches stamp) must not share
+  // the container. Tentative writes would pollute staged truth, and the
+  // tentative discard (notifyOptimisticWrites nulls pb) would destroy the
+  // landing. Park the staged backing and open a fresh draft seeded from the
+  // optimistic view below; the tentative discard restores it. The
+  // tentativePBs guard scopes this to draft OPEN: the draft's own backing
+  // (foldBatches-stamped by its first write when an action's transition is
+  // ambient) must not be parked by its own later writes.
+  if (
+    pb !== null &&
+    !tentativePBs.has(pb) &&
+    target.fam?.opt === true &&
+    !projectionWriteActive &&
+    !getWriteOverride() &&
+    foldBatches.has(target)
+  ) {
+    stagedTruthPB.set(target, pb);
+    pb = target.pb = null;
+  }
+  if (activeTransition !== null) foldBatches.set(target, activeTransition);
   if (pb === null) {
     // Prototype-chain overlay (#3044): plain-data non-array containers
     // outside projection/optimistic families open drafts in O(1) — own keys
@@ -7083,6 +7800,7 @@ function ensurePB(target) {
     // seed from committed truth — seeding overrides there would fold a lane
     // value into the committed home ("authority wins at reveal" would break).
     if (target.fam?.opt && !projectionWriteActive && !getWriteOverride()) {
+      tentativePBs.add(pb);
       const nodes = target.n;
       if (nodes !== null) {
         for (const key of Reflect.ownKeys(nodes)) {
@@ -7200,6 +7918,17 @@ function queueFold(target) {
  * Refreshed on every write; resolved through currentTransition at drain
  * (transitions merge — same rule as heldMaskView). */
 const foldBatches = new WeakMap();
+/** Parked truth-staged pending backings (#3164 fold): a tentative draft that
+ * opens while a folded landing's backing is live moves the staged container
+ * here (see ensurePB); the tentative discard in notifyOptimisticWrites
+ * restores it in place of the usual null. */
+const stagedTruthPB = new WeakMap();
+/** Backings opened by TENTATIVE drafts (optimistic user setters): ensurePB's
+ * truth-park must not fire against the draft's own container on its second
+ * and later writes (the first write stamps foldBatches whenever an action's
+ * transition is ambient). Entries die with their draft — tentative backings
+ * are consumed at setter exit. */
+const tentativePBs = new WeakSet();
 /** Committed-time privatization for parent-chain slot updates (path copying). */
 function privatizeCommitted(target) {
   if (ownedRaw.has(target.v)) return;
@@ -7533,7 +8262,13 @@ function notifyWrites(t) {
   //   IMMEDIATE — landed truth shows to untracked readers even while a
   //   downstream consumer's own async still holds the effect-level reveal
   //   (spec-async "verdicts never inherit consumers' in-flight state").
-  if (t.fam !== null && t.pb !== null && getWriteOverride()) {
+  //   EXCEPT under an active transaction (#3164 fold): a landing riding a
+  //   retaining transaction (the optimistic module's aroundWrite binds it)
+  //   stages instead — ensurePB stamped foldBatches, so the backing commits
+  //   with the transaction and the reveal is atomic at settle. The pinned
+  //   immediate-commit contract is stated over the no-transaction microtask
+  //   posture, which `activeTransition === null` is exactly.
+  if (t.fam !== null && t.pb !== null && getWriteOverride() && activeTransition === null) {
     // Landed truth (post-await write-override): immediately visible to every
     // reader — any staged held view is superseded.
     if (t.ht !== null) t.ht = t.hv = null;
@@ -7796,17 +8531,37 @@ function readSource(target) {
     target.pb !== null &&
     (inDraft(target) ||
       getWriteOverride() ||
-      inOwnerContext() ||
+      // Owner-context readers see the pending backing — EXCEPT held truth
+      // on an optimistic family (#3164 fold): a live pb on an opt family
+      // outside the draft/write-override windows is a staged landing
+      // (tentative drafts never outlive their setter), and only the
+      // authoritative postures and latest() see it (the backing-level twin
+      // of core read()'s A17-for-held-truth arm; ordinary readers keep
+      // committed until the transaction's reveal).
+      (inOwnerContext() && !heldTruthMasked(target)) ||
       // A projection's pending backing is authoritative-elect: serve it to
       // context-free readers too UNLESS a transition is holding the node
       // commits (downstream async hold — stale committed is the contract)
       // or the reader is a CHILDREN_FORBIDDEN scope, which never observes
       // its own unsettled write (#3082, signal parity per #3006).
-      (target.fam !== null && !foldHeld(target) && !inForbiddenScope()))
+      (target.fam !== null && !heldTruthMasked(target) && !foldHeld(target) && !inForbiddenScope()))
   )
     return target.pb;
   return target.v;
 }
+/** #3164 fold: HELD truth on an optimistic family — a pending backing
+ * stamped by a live transition that retains optimism — is masked from
+ * ordinary readers (they keep committed until the transaction's reveal);
+ * the authoritative postures and latest() tunnel through. Un-stamped
+ * backings and optimism-free transitions keep ordinary mid-batch/
+ * speculation visibility. */
+function heldTruthMasked(target) {
+  if (target.fam?.opt !== true || latestReadActive || authoritativeServe()) return false;
+  const fb = foldBatches.get(target);
+  // opt families are only created by createOptimisticStore, whose module
+  // install populates optHooks — the assertion holds by construction.
+  return fb !== undefined && optHooks.retainsOptimism(fb);
+}
 const hasOwn = Object.prototype.hasOwnProperty;
 // Allocation-free own-accessor probe (replaces eager descriptor scans — the
 // single biggest creation cost in the uibench profile): Annex-B lookups
@@ -7838,6 +8593,26 @@ function runAuthoritative(fn) {
 function hasActiveOverride(node) {
   return node._x?._overrideValue !== undefined && node._x?._overrideValue !== NOT_PENDING;
 }
+/** The reading computation is until()'s authoritative-view predicate — same
+ * source of truth as core read()'s A17 carve-out (`context`, which persists
+ * under untrack). optimisticView()'s composition gate consults exactly this:
+ * write-side machinery (patch emission, tentative re-application) must keep
+ * composing even when it runs inside an authoritative-write bracket. */
+function authoritativeRead() {
+  const c = context;
+  return c !== null && (c._config & CONFIG_AUTHORITATIVE_READ) !== 0;
+}
+/** Serve-side authoritative gate: until()'s predicate PLUS truth authors —
+ * the projection derive's draft (wrapDraft trap brackets, runAuthoritative;
+ * the same posture pair ensurePB classifies drafts by). A source computing
+ * the next truth must never read its callers' tentative overlays: a derive
+ * continuation's `store.push` computing its index from an action's
+ * optimistic row landed truth in the wrong slot and corrupted committed
+ * state (#3108). Trap-level overlay serves gate on this so values, length,
+ * membership, and keys leave the authoritative view together. */
+function authoritativeServe() {
+  return projectionWriteActive || getWriteOverride() || authoritativeRead();
+}
 /** Context-aware node view for reads outside tracking: active override >
  * held pending (owner context) > the BACKING value. Committed truth lives in
  * the backing (single-home rule, O6) — node `_value` is never served here,
@@ -7848,11 +8623,24 @@ function hasActiveOverride(node) {
 function nodeValue(node, backing) {
   // latest() sees the in-flight parked value like an owner-context reader
   // does (#3075) — signal/memo parity for store-node-backed keys.
-  const v = hasActiveOverride(node)
-    ? unwrapOverride(node._x?._overrideValue)
-    : node._pendingValue !== NOT_PENDING && (latestReadActive || inOwnerContext())
-      ? node._pendingValue
-      : backing;
+  // Authoritative-view reads (until()'s predicate) skip the override arm
+  // only: staged pending values are authoritative, overrides are the
+  // caller's optimism.
+  const v =
+    !authoritativeServe() && hasActiveOverride(node)
+      ? unwrapOverride(node._x?._overrideValue)
+      : node._pendingValue !== NOT_PENDING &&
+          (latestReadActive ||
+            // Owner-context pending visibility — except HELD truth (#3164,
+            // see CONFIG_HELD_TRUTH: fold-staged or entangle-stolen
+            // confirming truth), which only authoritative/latest readers
+            // see (core read()'s A17-for-held-truth twin; ordinary readers
+            // keep committed until the transaction's reveal — latest() is
+            // exempted by the leading arm above).
+            ((inOwnerContext() || authoritativeServe()) &&
+              !(node._config & CONFIG_HELD_TRUTH && !authoritativeServe())))
+        ? node._pendingValue
+        : backing;
   return v === FORCE ? backing : v;
 }
 /** Serve an own data key: node-first when a node exists (pending visibility,
@@ -7877,13 +8665,18 @@ function serveDataKey(target, key, backingValue, src, node) {
         read(getNode(target, key, backingValue));
       }
     }
-    return optHooks.optimisticView(target, src).length;
+    // Truth authors read the backing's own length — an optimistic row from
+    // the caller's transaction must not shift where the author's next write
+    // lands (#3108).
+    return (authoritativeServe() ? src : optHooks.optimisticView(target, src)).length;
   }
   if (inDraft(target)) {
     // Optimistic drafts before their first write have no pending backing yet;
     // reads must still see the live optimistic view (compose, not clobber —
     // #2951). Once ensurePB runs, the seeded clone carries the view.
-    if (target.fam?.opt && target.pb === null) {
+    // AUTHORITATIVE drafts (projection derive) never overlay — ensurePB's
+    // seeding rule, applied to the read side (#3108).
+    if (target.fam?.opt && target.pb === null && !authoritativeServe()) {
       const node = target.n?.[key];
       if (node !== undefined && hasActiveOverride(node))
         v = unwrapOverride(node._x?._overrideValue);
@@ -8092,7 +8885,15 @@ const traps = {
           if (target.s) return serveShallow(target, key, nv);
           return isWrappable(nv) ? draftServe(target, wrapNext(nv, target, key)) : nv;
         }
-      } else if (v === undefined && inDraft(target) && target.fam?.opt && target.pb === null) {
+      } else if (
+        v === undefined &&
+        inDraft(target) &&
+        target.fam?.opt &&
+        target.pb === null &&
+        // AUTHORITATIVE drafts (landing folds) never seed from overrides —
+        // the caller's optimism is not truth (has-trap twin below).
+        !authoritativeServe()
+      ) {
         const node = target.n?.[key];
         if (node !== undefined && hasActiveOverride(node))
           v = unwrapOverride(node._x?._overrideValue);
@@ -8119,14 +8920,16 @@ const traps = {
     if (!inDraft(target)) {
       if (getObserver() !== null) {
         const node = getHasNode(target, key, present);
+        // Authoritative-view readers get the right answer for free: core read()
+        // skips the override arm for them, so nv is authoritative presence.
         const nv = read(node);
         if (hasActiveOverride(node)) present = !!nv;
-      } else {
+      } else if (!authoritativeServe()) {
         const node = target.h?.[key];
         if (node !== undefined && hasActiveOverride(node))
           present = !!unwrapOverride(node._x?._overrideValue);
       }
-    } else if (target.fam?.opt && target.pb === null) {
+    } else if (target.fam?.opt && target.pb === null && !authoritativeServe()) {
       const node = target.h?.[key];
       if (node !== undefined && hasActiveOverride(node))
         present = !!unwrapOverride(node._x?._overrideValue);
@@ -8152,8 +8955,14 @@ const traps = {
     // Optimistic membership overlay: presence-node overrides add/remove keys
     // (per-transaction lifecycle rides the nodes — §6, FINDING-2's fix).
     // Draft reads before the first write overlay too (pb, once created, is
-    // seeded with the view).
-    if (target.fam?.opt && target.h !== null && (!inDraft(target) || target.pb === null)) {
+    // seeded with the view). Authoritative-view reads (until()'s predicate,
+    // truth-author drafts) skip the overlay.
+    if (
+      !authoritativeServe() &&
+      target.fam?.opt &&
+      target.h !== null &&
+      (!inDraft(target) || target.pb === null)
+    ) {
       let set = null;
       for (const key of Reflect.ownKeys(target.h)) {
         const node = target.h[key];
@@ -8175,7 +8984,7 @@ const traps = {
       if (target.del !== null && target.del.has(key)) return undefined;
       if (desc === undefined) desc = Object.getOwnPropertyDescriptor(target.v, key);
     }
-    if (target.fam?.opt && !inDraft(target)) {
+    if (!authoritativeServe() && target.fam?.opt && !inDraft(target)) {
       const node = target.h?.[key];
       if (node !== undefined && hasActiveOverride(node)) {
         if (!unwrapOverride(node._x?._overrideValue)) return undefined; // opt delete
@@ -9138,7 +9947,8 @@ function descend(pv, nv, keyFn, fam, proj = false) {
  * driven from inside an enclosing authoritative-write scope (next-store
  * optimistic derives), and a hard `false` would clobber it mid-derive.
  */
-function wrapDraft(inner, isActive, onDraftWrite) {
+function wrapDraft(inner, isActive, aroundWrite) {
+  const write = op => (aroundWrite ? aroundWrite(op) : op());
   const traps = {
     get(_, prop) {
       let value;
@@ -9153,7 +9963,7 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       }
       if (prop === $TARGET) return value;
       return typeof value === "object" && value !== null
-        ? wrapDraft(value, isActive, onDraftWrite)
+        ? wrapDraft(value, isActive, aroundWrite)
         : value;
     },
     has(_, prop) {
@@ -9175,8 +9985,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        inner[prop] = value;
-        onDraftWrite?.();
+        write(() => {
+          inner[prop] = value;
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -9189,8 +10000,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        delete inner[prop];
-        onDraftWrite?.();
+        write(() => {
+          delete inner[prop];
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -9231,8 +10043,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        Reflect.defineProperty(inner, prop, desc);
-        onDraftWrite?.();
+        write(() => {
+          Reflect.defineProperty(inner, prop, desc);
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -9284,7 +10097,7 @@ function createStoreDerivedNext(fn, seed, options) {
     }
   ];
 }
-function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWrite) {
+function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, aroundDraftWrite) {
   const owner = getOwner();
   let settled = false;
   let result;
@@ -9298,7 +10111,7 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
   const draft = wrapDraft(
     wrappedStore,
     () => !settled || owner._x?._inFlight === result,
-    onDraftWrite
+    aroundDraftWrite
   );
   storeSetterNext(
     draft,
@@ -9313,7 +10126,7 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
         if (v === s || v === undefined) return;
         const write = () =>
           storeSetterNext(wrappedStore, st => reconcileNextState(v, st, key, true), false);
-        wrapCommit ? wrapCommit(write) : write();
+        wrapCommit ? wrapCommit(write, v) : write();
       };
       const sync = handleAsync(owner, result, commit);
       if (!owner._loading) commit(sync);
@@ -9884,12 +10697,31 @@ function armRowHooks() {
  * armed presence nodes (the §6 overlay), so structural optimism reverts with
  * the same per-transaction granularity (FINDING-2's fix by construction).
  *
- * Derived form = an optimistic projection: the derive's recompute and its
- * async commits run under projectionWriteActive (authoritative landings
- * commit silently beneath any active overrides). The transitionBlocked
- * store-half (#2951) is installed here for next-shaped targets, chaining the
+ * Derived form = an optimistic projection. Landings follow the fold rule
+ * (#3164, RUL-2 as re-ruled): while a transaction retains optimistic edits
+ * on the family, truth that lands STAGES into that transaction — a keyed
+ * identity-preserving walk written through the ordinary staged setter
+ * channel — and reveals atomically at settle, exactly like a signal landing
+ * under an active override (asyncWrite's held branch). Optimistic edits are
+ * never consumed by landings; they live exactly as long as their transaction
+ * and die by engine-native revert. With no retainer, landings commit
+ * immediately under projectionWriteActive (authoritative, silently beneath
+ * any bare-write overrides — those ride the flight's own transition, #2951).
+ * Authoritative readers (until()'s predicate) tunnel into staged truth via
+ * the node read path's pending-value arm. The transitionBlocked store-half
+ * (#2951) is installed here for next-shaped targets, chaining the
  * legacy/engine checks.
  */
+/** #3164 fold: a stamped truth is HELD (masked from ordinary readers until
+ * the reveal) only while its transition is live AND retaining optimism —
+ * overrides are what make partial-coverage composition a tear. A plain
+ * async transition carries no overrides, so downstream computes must see
+ * staged values to converge (normal speculation). Resolves merges first:
+ * merge unions optimistic nodes/stores into the target. */
+function transitionHoldsOptimism(transition) {
+  const t = currentTransition(transition);
+  return t._done !== true && (t._optimisticNodes.length !== 0 || t._optimisticStores.size !== 0);
+}
 let blockedInstalled = false;
 function installNextBlockedHalf() {
   if (blockedInstalled) return;
@@ -9897,7 +10729,12 @@ function installNextBlockedHalf() {
   // Late-bind the optimistic machinery into the plain store/reconcile paths
   // (all call sites are fam?.opt-gated, so this always runs first) and the
   // affects witness's view resolver.
-  setOptHooks({ notifyOptimisticWrites, optimisticView, applyTentative });
+  setOptHooks({
+    notifyOptimisticWrites,
+    optimisticView,
+    applyTentative,
+    retainsOptimism: transitionHoldsOptimism
+  });
   setNextOptimisticViewResolver((t, raw) => optimisticView(t, raw));
   // Scheduler flush tails call _clearOptimisticStores whenever tracked
   // stores exist; next has no layer to clear — reverts are engine-native —
@@ -9918,6 +10755,13 @@ function installNextBlockedHalf() {
             // row identity against the post-revert view (resolved from the
             // target at drain — overrides are gone by then).
             if (ot.pc !== null && ot.pc.ro !== null) rowHooks.emitRowOpsOptimistic(ot, null, null);
+            // Keyset resync (classic channel twin): the keyset node's own
+            // revert can compare EQUAL (a landing's bump matched the
+            // tentative bump) while the arrangement underneath changed —
+            // mapArray/ownKeys subscribers must re-read the post-revert
+            // view. Authoritative bump: never re-arm the node we are
+            // clearing.
+            if (ot.k !== null) runAuthoritative(() => setSignal(ot.k, v => v + 1));
           }
         }
       }
@@ -9978,20 +10822,41 @@ function createOptimisticStoreNext(first, second, options) {
   };
   const store = wrapNext(initialValue, null, null, fam);
   fam.px = store;
+  // Same key resolution the projection channels use ("id" default) — replay's
+  // satisfaction rule reads it off the family.
+  const keyOption = options?.key === undefined ? "id" : options.key;
+  fam.key =
+    typeof keyOption === "function"
+      ? keyOption
+      : keyOption === null
+        ? null
+        : row => (isWrappable(row) ? row[keyOption] : undefined);
   if (fam.shallow) {
     store[$TARGET].s = true;
     markRawIngest(initialValue);
   }
   if (derived) {
     const fn = first;
-    // Async commits land outside the computed's sync body — re-apply the
-    // authoritative-write posture there too. Landings consume the family's
-    // tentative overrides (RUL-2: visible landed truth replaces optimism) —
-    // both the reconcile-channel commit and per-op post-await draft writes.
-    const consume = () => consumeOverridesNext(fam);
-    const wrapCommit = write => {
-      runAuthoritative(write);
-      consume();
+    // Landing router (#3164 fold ruling): while a transaction retains
+    // optimistic edits on this family, truth landings stage INTO it and
+    // reveal atomically at settle; with no retainer they commit immediately
+    // under the authoritative posture (async commits land outside the
+    // computed's sync body, so the posture is re-applied here).
+    const wrapCommit = (write, value) => {
+      const txn = retainingTransition(fam);
+      if (txn === null) runAuthoritative(write);
+      else stageLanding(fam, txn, value);
+    };
+    // Draft writes (the derive mutating its draft, sync body and post-await
+    // continuations alike) are the same truth channel per-operation: bind
+    // each op to the retaining transaction so its node writes stage and its
+    // backing fold defers (ensurePB stamps foldBatches with the swapped-in
+    // batch; the write-override eager-commit branch in notifyWrites yields
+    // to any active transaction).
+    const aroundDraftWrite = op => {
+      const txn = retainingTransition(fam);
+      if (txn === null) op();
+      else runFolded(txn, op);
     };
     let nodeOptions;
     if (options?.seedLoadingValue) nodeOptions = { loadingValue: undefined };
@@ -10003,14 +10868,201 @@ function createOptimisticStoreNext(first, second, options) {
           fn,
           options?.key === undefined ? "id" : options.key,
           wrapCommit,
-          consume
+          aroundDraftWrite
         )
       );
     }, nodeOptions);
     node._config &= ~CONFIG_AUTO_DISPOSE;
     fam.node = node;
   }
-  return [store, fn => storeSetterNext(store, fn)];
+  return [
+    store,
+    fn => {
+      // Retention ledger (#3164): record the owning transaction so landings
+      // know to fold. Captured at entry — the action machinery has the
+      // transaction ambient while user code runs; a bare write with no
+      // transaction retains nothing (it rides the flight's own transition
+      // per #2951 and dies with it).
+      const txn = activeTransition;
+      storeSetterNext(store, fn);
+      if (txn !== null) (fam.rt ??= new Set()).add(txn);
+    }
+  ];
+}
+/** Resolve a retained transition through its merge chain (`_done` holds the
+ * merge target while merged, `true` once settled). Null = dead. */
+function liveTransition(txn) {
+  while (typeof txn._done === "object") txn = txn._done;
+  return txn._done === true ? null : txn;
+}
+/** The transaction truth landings fold into: the first live member of the
+ * family's retention ledger (dead members prune here). Multiple live
+ * retainers entangle through their shared family writes and settle
+ * together, so folding into the first reaches all of them. */
+function retainingTransition(fam) {
+  const rt = fam.rt;
+  if (rt === undefined || rt.size === 0) return null;
+  let live = null;
+  for (const txn of rt) {
+    const resolved = liveTransition(txn);
+    if (resolved === null) rt.delete(txn);
+    else live ??= resolved;
+  }
+  return live;
+}
+/** Fold a landing into the retaining transaction (#3164): the landed value
+ * is written through the ORDINARY staged setter channel — node writes park
+ * as `_pendingValue` registered with the transaction's batch (speculation
+ * and until()'s authoritative tunnel see them; live view stays coherent),
+ * and the backing fold defers via the foldBatches stamp — under the
+ * authoritative posture, so armed nodes take the engine bypass and no
+ * override is created. The engine's own commit machinery reveals everything
+ * atomically when the transaction settles (transitions never abort: failed
+ * actions still commit — only optimistic overrides revert). */
+function stageLanding(fam, txn, incoming) {
+  runFolded(txn, () =>
+    runAuthoritative(() =>
+      storeSetterNext(
+        fam.px,
+        draft => {
+          stagedApply(draft, unwrapValue(incoming), fam.key ?? null);
+        },
+        false
+      )
+    )
+  );
+}
+/** Run a fold write inside the retaining transaction's batch, then
+ * transition-stamp its staged nodes NOW (parity with the parked-transition
+ * flush path's reassignPendingTransition): the stamp is what routes stale
+ * (render) readers to the committed value — core read's cross-transaction
+ * guard — and what makes foldHeld defer the backing for context-free
+ * readers. A microtask staging never crosses that flush path, so without
+ * the stamp a render effect's speculative recompute would compose staged
+ * truth with live overrides — the #3164 tear, one window later. Armed
+ * nodes additionally raise CONFIG_HELD_TRUTH: their staged value is
+ * confirming truth masked from ordinary readers until the reveal (plain
+ * staged nodes stay visible — normal speculation; override-covered nodes
+ * stay unarmed — the override is their display and its revert their
+ * notification, A17). */
+function runFolded(txn, op) {
+  runAsTransitionBatch(txn, op);
+  const pending = txn._pendingNodes;
+  for (let i = 0; i < pending.length; i++) {
+    const node = pending[i];
+    node._transition = txn;
+    if (node._config & CONFIG_OPTIMISTIC && !hasActiveOverride(node))
+      node._config |= CONFIG_HELD_TRUTH;
+  }
+}
+/** Keyed identity-preserving deep merge through live draft proxies — the
+ * staged twin of the adoption walk. Reads see the pending backing (staged
+ * view), so consecutive landings during one hold compose; key-matched rows
+ * keep their raw (and so their proxy) in the slot with only changed leaves
+ * written; unmatched rows land wholesale. Runs inside stageLanding's
+ * authoritative bracket: drafts seed from committed truth, never overlays. */
+function stagedApply(cur, incoming, keyFn) {
+  const curArr = Array.isArray(cur);
+  if (curArr && Array.isArray(incoming)) {
+    const len = incoming.length;
+    if (keyFn !== null) {
+      // Occurrence-aware key queues (parity with the adoption window):
+      // duplicate keys match per occurrence, each current row consumed once.
+      let byKey = null;
+      const curLen = cur.length;
+      for (let j = 0; j < curLen; j++) {
+        const raw = unwrapValue(cur[j]);
+        if (!isWrappable(raw)) continue;
+        const k = keyFn(raw);
+        if (k === undefined) continue;
+        const q = (byKey ??= new Map()).get(k);
+        if (q === undefined) byKey.set(k, [raw]);
+        else q.push(raw);
+      }
+      // Echo adoption: an optimistic structural add whose key the landing
+      // confirms must keep its raw (and so its proxy — list drivers keep the
+      // DOM row). Tentative rows never reach committed truth (they live in
+      // node overrides), so key-match the draft target's active override
+      // rows as a secondary pool. Committed rows queued first own their
+      // keys; overlay rows only extend coverage. Adopted raws enter staged
+      // truth; at settle the override reverts and the reveal re-seats the
+      // same raw.
+      const overlayNodes = cur[$TARGET]?.n;
+      if (overlayNodes != null) {
+        for (const ok of Reflect.ownKeys(overlayNodes)) {
+          const node = overlayNodes[ok];
+          if (!hasActiveOverride(node)) continue;
+          const raw = unwrapValue(unwrapOverride(node._x._overrideValue));
+          if (!isWrappable(raw)) continue;
+          const k = keyFn(raw);
+          if (k === undefined) continue;
+          const q = (byKey ??= new Map()).get(k);
+          if (q === undefined) byKey.set(k, [raw]);
+          else q.push(raw);
+        }
+      }
+      for (let i = 0; i < len; i++) {
+        const nv = incoming[i];
+        let matched;
+        if (isWrappable(nv) && byKey !== null) {
+          const nk = keyFn(nv);
+          if (nk !== undefined) {
+            for (const [k, q] of byKey) {
+              if (!sameKey(k, nk)) continue;
+              matched = q.shift();
+              if (q.length === 0) byKey.delete(k);
+              break;
+            }
+          }
+        }
+        if (matched !== undefined) {
+          if (unwrapValue(cur[i]) !== matched) cur[i] = matched;
+          stagedApply(cur[i], nv, keyFn);
+        } else {
+          const pv = unwrapValue(cur[i]);
+          if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) cur[i] = nv;
+        }
+      }
+    } else {
+      for (let i = 0; i < len; i++) {
+        const nv = incoming[i];
+        const pv = unwrapValue(cur[i]);
+        if (pv === nv) continue;
+        if (isWrappable(nv) && isWrappable(pv) && Array.isArray(nv) === Array.isArray(pv))
+          stagedApply(cur[i], nv, keyFn);
+        else if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) cur[i] = nv;
+      }
+    }
+    if (cur.length !== len) cur.length = len;
+    return;
+  }
+  // Object merge; also the degenerate root-kind-change shape (arrays accept
+  // keyed writes/deletes, so a wholesale restatement still lands staged).
+  for (const k of Reflect.ownKeys(incoming)) {
+    if (curArr && k === "length") continue;
+    const nv = incoming[k];
+    const pv = unwrapValue(cur[k]);
+    if (pv === nv) continue;
+    if (isWrappable(nv) && isWrappable(pv) && Array.isArray(nv) === Array.isArray(pv)) {
+      // Different-keyed entities never merge (tentative-channel parity):
+      // the incoming object replaces the slot wholesale.
+      if (keyFn !== null) {
+        const pk = keyFn(pv);
+        const nk = keyFn(nv);
+        if (pk !== undefined && nk !== undefined && !sameKey(pk, nk)) {
+          cur[k] = nv;
+          continue;
+        }
+      }
+      stagedApply(cur[k], nv, keyFn);
+    } else if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) {
+      cur[k] = nv;
+    }
+  }
+  for (const k of Reflect.ownKeys(cur)) {
+    if ((curArr && k === "length") || k in incoming) continue;
+    delete cur[k];
+  }
 }
 // ---- optimistic-only store machinery (moved from next/store.ts /
 // next/reconcile.ts so plain-store bundles tree-shake it) ----
@@ -10093,96 +11145,22 @@ function notifyOptimisticWrites(t, pb) {
   // (structural ones already ride the key-set bump above).
   bumpDeep(t);
   // Discard the draft — committed raw is untouched (revert target by
-  // construction). Register the root store for the scheduler's settle hooks
-  // and the target for landing consumption (RUL-2).
-  t.pb = null;
+  // construction) — restoring any truth-staged backing this draft displaced
+  // (#3164 fold: ensurePB parked it so tentative writes could not pollute
+  // staged truth). Register the root store for the scheduler's settle hooks.
+  t.pb = stagedTruthPB.get(t) ?? null;
+  if (t.pb !== null) stagedTruthPB.delete(t);
   (t.fam.overlaid ??= new Set()).add(t);
   GlobalQueue._trackOptimisticStore?.(t.fam.px ?? t.px);
 }
-/**
- * Landing consumption (RUL-2): fresh authoritative data supersedes every
- * tentative override in the family. Mirrors legacy clearProjectionOverride —
- * drop the override, clear lane/ownership, notify subscribers whose visible
- * value changes (reversion effects go to regular queues via the projection
- * write posture the caller holds).
- */
-function consumeOverridesNext(fam) {
-  const overlaid = fam.overlaid;
-  if (overlaid === undefined || overlaid.size === 0) return;
-  runAuthoritative(() => {
-    for (const t of overlaid) {
-      const drop = (node, committed) => {
-        if (!hasActiveOverride(node)) return;
-        const prev = unwrapOverride(node._x?._overrideValue);
-        // Full legacy reset (clearOptimisticOverride parity): the landing is
-        // authoritative NOW — fold committed into the node directly instead
-        // of riding a transaction's commit (whose queues may be stashed with
-        // the transaction parked; the wake would strand until it settles).
-        ext(node)._overrideValue = NOT_PENDING;
-        node._config |= CONFIG_OPTIMISTIC;
-        const nx = node._x;
-        if (nx) {
-          nx._overrideOwner = null;
-          nx._optimisticLane = undefined;
-        }
-        node._pendingValue = NOT_PENDING;
-        node._value = committed;
-        if (!node._equals || !node._equals(prev, committed)) {
-          insertSubs(node, true);
-          schedule();
-        }
-      };
-      // Landing consumes STRUCTURAL optimism only (legacy layer parity):
-      // membership edits, array length, and the value overrides written WITH
-      // them (a key carrying an active presence override is an add/delete —
-      // classified BEFORE the adoption may have made the key exist in landed
-      // data). A pure value override on a key the landing carries stays with
-      // its owning transaction (rapid-toggle contract: a live action's edit
-      // of an existing entity rides on top of landed truth).
-      const isArr = Array.isArray(t.v);
-      const has = t.h;
-      let structuralKeys = null;
-      if (has !== null) {
-        for (const key of Reflect.ownKeys(has)) {
-          if (hasActiveOverride(has[key])) (structuralKeys ??= new Set()).add(key);
-        }
-      }
-      const nodes = t.n;
-      if (nodes !== null) {
-        for (const key of Reflect.ownKeys(nodes)) {
-          const structural =
-            structuralKeys?.has(key) || !(key in t.v) || (isArr && key === "length");
-          if (!structural) continue;
-          drop(nodes[key], isArr && key === "length" ? t.v.length : t.v[key]);
-        }
-      }
-      if (has !== null) {
-        for (const key of Reflect.ownKeys(has)) drop(has[key], key in t.v);
-      }
-      if (t.k !== null && hasActiveOverride(t.k)) {
-        ext(t.k)._overrideValue = NOT_PENDING;
-        t.k._config |= CONFIG_OPTIMISTIC;
-        const kx = t.k._x;
-        if (kx) {
-          kx._overrideOwner = null;
-          kx._optimisticLane = undefined;
-        }
-        insertSubs(t.k, true);
-        schedule();
-      }
-      // Patch channel (override-consumption site): visible truth flipped to
-      // committed for the consumed keys — force a re-apply from the live
-      // view so the DOM leaves the override state.
-      if (t.pc !== null && t.pc.p !== null) patchHooks.emitPatchOptimistic(t, null, null);
-    }
-    overlaid.clear();
-  });
-}
 /** Optimistic-view composition for snapshot/deep (O1: snapshot is the CURRENT
  * view, lane values included; a fresh copy per call during pending windows —
- * RUL-12). Returns `src` untouched when no override is active on `t`. */
+ * RUL-12). Returns `src` untouched when no override is active on `t`.
+ * Authoritative-view reads (until()'s predicate) skip composition entirely:
+ * the predicate observes authoritative truth, never the caller's tentative
+ * overlay. (Write-side emission callers never run under such a compute.) */
 function optimisticView(t, src) {
-  if (t.fam?.opt !== true) return src;
+  if (t.fam?.opt !== true || authoritativeRead()) return src;
   let out = null;
   const ensure = () => (out ??= Array.isArray(src) ? [...src] : { ...src });
   const nodes = t.n;
@@ -11506,7 +12484,10 @@ function flattenArray(children, results = [], options) {
         } while (typeof child === "function" && !child.length);
       }
       if (Array.isArray(child)) {
-        needsUnwrap = flattenArray(child, results, options);
+        // OR, don't overwrite: an accessor already pushed under doNotUnwrap
+        // still needs the resolving wrapper even when a later sibling
+        // fragment contains no functions (#3133).
+        needsUnwrap = flattenArray(child, results, options) || needsUnwrap;
       } else if (
         options?.skipNonRendered &&
         (child == null || child === true || child === false || child === "")
@@ -11534,6 +12515,7 @@ export {
   NoOwnerError,
   NotReadyError,
   SUPPORTS_PROXY,
+  TimeoutError,
   action,
   affects,
   clearSnapshots,
@@ -11592,5 +12574,6 @@ export {
   storeHasOptimisticFamily,
   storeIsShallow,
   storePath,
+  until,
   untrack
 };