@solidjs/signals 2.0.0-rc.4 → 2.0.0-rc.6

package/dist/dev.js

@@ -42,6 +42,18 @@ class StatusError extends Error {
 function unwrapStatusError(error) {
   return error instanceof StatusError ? error.cause : error;
 }
+/**
+ * Rejection value of `until(fn, { timeout })` when the predicate does not turn
+ * truthy within the window. Inside an `action()`, the rejection is thrown back
+ * in at the `yield` point — catchable there, or the action fails and its
+ * optimistic state reverts.
+ */
+class TimeoutError extends Error {
+  constructor(message = "Timed out waiting for condition") {
+    super(message);
+    this.name = "TimeoutError";
+  }
+}
 class NoOwnerError extends Error {
   constructor() {
     super("Context can only be accessed under a reactive root.");
@@ -117,6 +129,60 @@ const CONFIG_CHILD_COMPANIONS = 1 << 11;
  * moved into the cold extension (§12), and an unconditional `_x` deref per
  * marked node measurably taxed the propagation hot path (diamond -22%). */
 const CONFIG_FW_CHILDREN = 1 << 12;
+/** Authoritative-view reader (`until()`): while this node computes, reads
+ * dodge active optimistic OVERRIDES only — the predicate must observe
+ * arriving truth, never the caller's own tentative writes (which would
+ * trivially satisfy it). Everything else reads normally, INCLUDING
+ * transition-staged `_pendingValue`: staged data is authoritative (optimism
+ * lives only in override slots), and a hold that refused staged reads would
+ * deadlock on data the open transaction itself is holding (a refresh the
+ * action issued lands staged and cannot commit until the hold releases).
+ * read() checks the bit on the reading computation (`context`) directly — no
+ * ambient flag — so a shared computed the predicate pulls recomputes as
+ * itself (no bit) under the normal view, and its cache never forks. */
+const CONFIG_AUTHORITATIVE_READ = 1 << 13;
+/** Sticky mark: an authoritative-view reader read this node PAST an active
+ * override. The ack shape — an authoritative arrival EQUAL to the override —
+ * rides paths that are deliberately silent under A17 (every ordinary reader
+ * sees the override, so an equal landing changes nothing for them). A marked
+ * node notifies those readers on such paths anyway, so the landed truth is
+ * seen without re-firing ordinary subscribers. Never cleared — only nodes an
+ * until() predicate observed mid-override pay. */
+const CONFIG_AUTHORITATIVE_OBSERVED = 1 << 14;
+/** Promise-delivery effect (resolve()/until()): commits its computed value
+ * directly even when recomputing under its own held transition. These
+ * effects deliver applies on a microtask (#2930) instead of the stashed
+ * effect queues, so the value must ride the same immediate schedule — a
+ * staged value with an immediate apply delivers stale state (resolve) or
+ * deadlocks the hold (until). Safe because the node is a private leaf: no
+ * subscriber reads an effect's value, only its own apply does. */
+const CONFIG_DIRECT_COMMIT = 1 << 15;
+/** Fresh-pull reader (awaitable `refresh()`'s waiter effect): a read of a
+ * dirty source recomputes it inline even when the height gate defers to the
+ * flush. Closes the same-flush ordering race where a waiter created
+ * alongside a refresh() mark read the PRE-re-ask value as settled and
+ * delivered stale; with the pull, the waiter either parks on the re-ask's
+ * pending window (async — woken by the settle walk, which runs on every
+ * landing including equal-value ones) or serves its sync answer. resolve()
+ * deliberately keeps that race — its contract is "first settled value"
+ * (#2930), not "next quiescent state". */
+const CONFIG_FRESH_READ = 1 << 16;
+/** HELD truth (#3164): this node's staged `_pendingValue` is confirming
+ * truth riding a transaction that retains optimism, revealed only at that
+ * transaction's settle. Two arming sites, one meaning: the store fold
+ * (a landing staged into the retaining transaction) and until()'s
+ * flip-entanglement (a foreign carrier's staged write, stolen when it
+ * flipped the awaited predicate truthy). Until the reveal, ordinary
+ * readers — lane and speculative recomputes included — keep committed:
+ * the staging notified subscribers as a plain write, so without the mask
+ * a mid-hold recompute composes live optimism with the confirming truth,
+ * a frame no timeline contains (GabbeV's union tear). Authoritative
+ * readers (until()'s predicate) and latest() tunnel through — the
+ * exemption that keeps holds deadlock-free. Override-covered nodes never
+ * arm: the override is their display and its revert their notification
+ * (A17). Cleared at commit (the commit IS the reveal); subscribers masked
+ * during the hold are woken by finalizePureQueue's post-revert pass. */
+const CONFIG_HELD_TRUTH = 1 << 17;
 const STATUS_PENDING = 1 << 0;
 const STATUS_ERROR = 1 << 1;
 const STATUS_UNINITIALIZED = 1 << 2;
@@ -166,7 +232,8 @@ const defaultOptions = {
   wideDeps: 30,
   hotTime: { budgetMs: 8, windowMs: 1000 },
   unstableMemos: 4,
-  wideWrites: 250
+  wideWrites: 250,
+  waterfalls: { minFlightMs: 50 }
 };
 let options = { ...defaultOptions };
 const listeners = new Set();
@@ -359,10 +426,13 @@ function checkDepWidth(el) {
   });
   console.warn(message);
 }
+const hotCauses = new Map();
+const HOT_FANOUT_FIRST_MILESTONE = 5;
 /**
  * Hot-scope warning — flags a scope that re-ran more than `count` times
  * inside one `windowMs` window. Warned once per window, with the most recent
  * cause chain named so the leaking signal is identified in the message.
+ * Fan-out spam is folded per root cause (see HotCauseWindow above).
  */
 function checkHotRuns(el, event) {
   const cfg = options.hotRuns;
@@ -377,22 +447,55 @@ function checkHotRuns(el, event) {
   node._devWinCount = (node._devWinCount ?? 0) + 1;
   if (node._devHotWarned || node._devWinCount < cfg.count) return;
   node._devHotWarned = true;
-  const rootCause = event.causes.map(c => `"${c.name}" (${c.kind})`).join(", ");
+  // Root-cause key: the set of originating writes behind this scope's latest
+  // re-run. Scopes hot from the SAME roots share one aggregation window.
+  const roots = new Set();
+  rootsOf(event.causes, roots);
+  const causeKey = roots.size > 0 ? [...roots].sort().join(", ") : "(untracked)";
+  let window = hotCauses.get(causeKey);
+  if (window === undefined || now - window.winStart > cfg.windowMs) {
+    window = { winStart: now, scopes: 0, runs: 0, nextMilestone: HOT_FANOUT_FIRST_MILESTONE };
+    hotCauses.set(causeKey, window);
+  }
+  window.scopes++;
+  window.runs += node._devWinCount;
+  if (window.scopes === 1) {
+    const rootCause = event.causes.map(c => `"${c.name}" (${c.kind})`).join(", ");
+    const message =
+      `[HOT_SCOPE_RERUNS] ${event.nodeKind} "${event.nodeName}" re-ran ${node._devWinCount} times ` +
+      `in ${Math.max(1, now - node._devWinStart)}ms — a hot signal is likely leaking into this ` +
+      `scope. Latest cause: ${rootCause || "(untracked pull)"}`;
+    emitDiagnostic({
+      code: "HOT_SCOPE_RERUNS",
+      kind: "perf",
+      severity: "warn",
+      message,
+      nodeName: event.nodeName,
+      data: {
+        runs: node._devWinCount,
+        windowMs: cfg.windowMs,
+        causes: event.causes.map(c => c.name)
+      }
+    });
+    console.warn(message);
+    return;
+  }
+  // Additional scopes hot from the same cause: silent until a milestone —
+  // the culprit is the cause, and it has already been named once.
+  if (window.scopes < window.nextMilestone) return;
+  window.nextMilestone *= 10;
   const message =
-    `[HOT_SCOPE_RERUNS] ${event.nodeKind} "${event.nodeName}" re-ran ${node._devWinCount} times ` +
-    `in ${Math.max(1, now - node._devWinStart)}ms — a hot signal is likely leaking into this ` +
-    `scope. Latest cause: ${rootCause || "(untracked pull)"}`;
+    `[HOT_SCOPE_FANOUT] ${window.scopes} scopes have gone hot (${window.runs} re-runs) within ` +
+    `${cfg.windowMs}ms, all driven by ${causeKey} — one hot cause is re-running a large part ` +
+    `of the graph. Per-scope warnings are suppressed; fix the cause. If consumers ask keyed ` +
+    `questions of it, invert with createSelector or createProjection.`;
   emitDiagnostic({
-    code: "HOT_SCOPE_RERUNS",
+    code: "HOT_SCOPE_FANOUT",
     kind: "perf",
     severity: "warn",
     message,
-    nodeName: event.nodeName,
-    data: {
-      runs: node._devWinCount,
-      windowMs: cfg.windowMs,
-      causes: event.causes.map(c => c.name)
-    }
+    nodeName: causeKey,
+    data: { cause: causeKey, scopes: window.scopes, runs: window.runs, windowMs: cfg.windowMs }
   });
   console.warn(message);
 }
@@ -571,6 +674,120 @@ function checkUnstableOutput(el, prevValue, newValue) {
   });
   console.warn(message);
 }
+// WeakMaps: an errored/abandoned flight must not leak its node or block GC.
+const liveFlights = new WeakMap();
+const landedFlights = new WeakMap();
+/**
+ * Flight-object identity → earliest known start. Fed by markFlight() (the
+ * cooperative preload/cache declaration — populated even while attribution
+ * is disabled, so navigation-time marks survive a later enable()) and by
+ * first sightings at registration.
+ */
+const flightOrigins = new WeakMap();
+let waterfallLog = [];
+/** Deepest landed-flight cause reachable through a cause list (derived links included). */
+function flightCauseIn(causes) {
+  let best = null;
+  for (const c of causes) {
+    let found = null;
+    if (c.kind === "async") found = landedFlights.get(c) ?? null;
+    else if (c.kind === "derived" && c.causes) found = flightCauseIn(c.causes);
+    if (found !== null && (best === null || found.chain.length > best.chain.length)) best = found;
+  }
+  return best;
+}
+function trackFlightStart(el, flight) {
+  if (options.waterfalls === false) return;
+  const at = now();
+  const origin = flightOrigins.get(flight) ?? at;
+  if (origin === at) flightOrigins.set(flight, at);
+  // Nearest enclosing frame with causes: create runs carry null (a node born
+  // inside a parent's recompute inherits the parent's causality — the
+  // boundary-reveal case, and the lazy sibling whose first pull is gated
+  // behind an earlier not-ready read), so walk down to the first re-run frame.
+  let parent = null;
+  for (let i = frames.length - 1; i >= 0; i--) {
+    const causes = frames[i].causes;
+    if (causes !== null) {
+      parent = flightCauseIn(causes);
+      break;
+    }
+  }
+  // The sequentiality test. A marked/previously-seen flight whose origin
+  // predates the upstream landing was in the air alongside it: parallel.
+  if (parent !== null && origin < parent.landedAt) parent = null;
+  liveFlights.set(el, {
+    origin,
+    startSeq: changeSeq,
+    chain: parent === null ? [] : [...parent.chain, { name: parent.name, ms: parent.ms }]
+  });
+}
+/**
+ * Flight landed (whether or not the value committed — the wall time was
+ * spent either way). Attach the measurement to the landing's fresh "async"
+ * stamp so downstream flights can chain through it, then judge the chain.
+ */
+function finalizeFlight(el) {
+  const flight = liveFlights.get(el);
+  if (flight === undefined) return;
+  liveFlights.delete(el);
+  const landedAt = now();
+  const ms = landedAt - flight.origin;
+  const record = el._devChange;
+  // Only a stamp this landing produced may carry the measurement — a stale
+  // async record from a previous landing must not be re-labeled.
+  if (record !== undefined && record.kind === "async" && record.seq > flight.startSeq)
+    landedFlights.set(record, { name: nodeName(el), ms, chain: flight.chain, landedAt });
+  checkWaterfall(el, flight.chain, ms);
+}
+function checkWaterfall(el, chain, ms) {
+  const cfg = options.waterfalls;
+  if (cfg === false) return;
+  if (chain.length > 0) {
+    waterfallLog.push({
+      chain: [...chain, { name: nodeName(el), ms }],
+      sequentialMs: chain.reduce((sum, l) => sum + l.ms, ms)
+    });
+    if (waterfallLog.length > options.historyLimit) waterfallLog.shift();
+  }
+  // The verdict: trailing run of links that were each a real wait. A fast
+  // tail (settled preload/cache hit) or a fast upstream breaks the sequence.
+  if (ms < cfg.minFlightMs) return;
+  let seq = 1;
+  let totalMs = ms;
+  for (let i = chain.length - 1; i >= 0 && chain[i].ms >= cfg.minFlightMs; i--) {
+    seq++;
+    totalMs += chain[i].ms;
+  }
+  if (seq < 2) return;
+  const node = el;
+  if ((node._devWaterfallWarnedAt ?? 0) >= seq) return;
+  node._devWaterfallWarnedAt = seq;
+  const links = [...chain.slice(chain.length - (seq - 1)), { name: nodeName(el), ms }];
+  const path = links.map(l => `"${l.name}" (${l.ms.toFixed(0)}ms)`).join(" → ");
+  const message =
+    `[ASYNC_WATERFALL] ${seq} sequential async flights — ${path} — ` +
+    `${totalMs.toFixed(0)}ms serialized: each began only after the previous resolved ` +
+    `(as far as this graph can see). If a later request doesn't need the earlier ` +
+    `response, derive both from the same inputs so they start together; if the ` +
+    `dependency is intrinsic, preload the dependent data or join the requests ` +
+    `server-side. If this work WAS already started elsewhere (a preloader or request ` +
+    `cache), have that layer stamp its promises with DEV.attribution.markFlight().`;
+  // Depth 2 is advisory-only (structured consumers see it; the console does
+  // not): a 2-chain can be an intrinsic data dependency or an unmarked
+  // preload. A 3+ chain that survived the origin test is near-certainly
+  // structural — that one earns the console.
+  const severity = seq > 2 ? "warn" : "info";
+  emitDiagnostic({
+    code: "ASYNC_WATERFALL",
+    kind: "perf",
+    severity,
+    message,
+    nodeName: nodeName(el),
+    data: { chain: links.map(l => ({ name: l.name, ms: l.ms })), sequentialMs: totalMs }
+  });
+  if (severity === "warn") console.warn(message);
+}
 // The engine's implementation of the core's dev hook points. Installed by
 // enable(), uninstalled by disable() — while uninstalled the core pays one
 // null check per site and nothing else.
@@ -600,6 +817,18 @@ const engineHooks = {
     const totalMs = now() - frame.start;
     if (frames.length > 0) frames[frames.length - 1].childMs += totalMs;
     const selfMs = Math.max(0, totalMs - frame.childMs);
+    // Effect-output honesty: effects run with `_equals: false`, so core
+    // reports EVERY effect recompute as changed — which made effect waste
+    // invisible to costs() (and compiled JSX bindings are effects: the
+    // fan-out waste a naive selected-row produces is all effects). The
+    // engine re-derives the fact from its own snapshot: an identical
+    // committed compute output is an unchanged run. `undefined` outputs are
+    // exempt — a side-effect-only compute's work IS its effect phase, and
+    // identity of `undefined` proves nothing.
+    if (changed && frame.causes !== null && el._type) {
+      const committed = el._pendingValue !== NOT_PENDING ? el._pendingValue : el._value;
+      if (committed !== undefined && committed === frame.prevValue) changed = false;
+    }
     // Unstable-output check: memos only, non-create, plain runs with a
     // committed change. The fresh value sits in `_pendingValue` for held
     // plain-flush memo commits and in `_value` for direct ones. Overlay runs
@@ -632,6 +861,9 @@ const engineHooks = {
   refreshed(el) {
     stampWrite(el, "refresh");
   },
+  flightStart(el, flight) {
+    trackFlightStart(el, flight);
+  },
   asyncStart(el) {
     asyncStartSeq = el._devChange?.seq ?? 0;
     asyncStartTime = el._time;
@@ -648,6 +880,9 @@ const engineHooks = {
       const committed =
         el._value !== asyncStartValue || el._time !== asyncStartTime || el._pendingValue === value;
       if (committed) stampWrite(el, "async", prev === undefined ? NO_VALUES : prev, value);
+      // Flight over either way — an equality-swallowed landing still spent
+      // the wall time (finalizeFlight only chains through a fresh stamp).
+      finalizeFlight(el);
       return;
     }
     // Landed through setSignal: reclassify its "write" stamp as an async
@@ -656,6 +891,7 @@ const engineHooks = {
     const change = el._devChange;
     if (change !== undefined && change.seq > asyncStartSeq && change.kind === "write")
       stampWrite(el, "async", NO_VALUES, value);
+    finalizeFlight(el);
   }
 };
 const attribution = {
@@ -664,6 +900,8 @@ const attribution = {
     frames.length = 0;
     scopeCosts.clear();
     writeCosts.clear();
+    waterfallLog = [];
+    hotCauses.clear();
     setAttributionHooks(engineHooks);
   },
   disable() {
@@ -672,6 +910,8 @@ const attribution = {
     frames.length = 0;
     scopeCosts.clear();
     writeCosts.clear();
+    waterfallLog = [];
+    hotCauses.clear();
     setAttributionHooks(null);
   },
   subscribe(listener) {
@@ -697,6 +937,15 @@ const attribution = {
       writes: [...writeCosts.values()].sort((a, b) => b.downstreamMs - a.downstreamMs)
     };
   },
+  waterfalls() {
+    return waterfallLog;
+  },
+  markFlight(flight, startedAt = now()) {
+    // Earliest wins: re-marking (a cache re-serving the same promise) must
+    // not move the origin later.
+    const existing = flightOrigins.get(flight);
+    if (existing === undefined || startedAt < existing) flightOrigins.set(flight, startedAt);
+  },
   format: formatRerun
 };
 
@@ -1248,6 +1497,107 @@ function mergeTransitionState(target, outgoing) {
   }
   for (const sub of outgoing._gatedSubs) target._gatedSubs.add(sub);
 }
+/**
+ * Flip-entanglement (#3164 follow-up): `until()` is a declaration of
+ * relatedness — the predicate names the condition that confirms the awaiting
+ * transaction. When the predicate settles truthy, every live foreign
+ * transition whose staged write it read IS the confirming event by the
+ * user's own definition, so it merges into the awaiting transaction and
+ * reveals at the joint settle — the cross-primitive twin of the family fold
+ * (a landing on an optimism-carrying family joins the retaining
+ * transaction). Non-flipping updates never pass through here: falsy
+ * evaluations don't entangle, so unrelated traffic on the watched sources
+ * reveals freely on its own schedule.
+ *
+ * Runs inside the predicate's compute (pure phase) — the confirming
+ * transition's stamps are still live and its commit decision hasn't run, so
+ * the merge lands before any reveal. Only the tree-shaken graphs that call
+ * `until()` retain this.
+ */
+function entangleConfirmingTransitions(obs, target) {
+  target = currentTransition(target);
+  if (target._done === true) return;
+  // The confirming evidence is a dep whose value is STAGED (pending,
+  // uncommitted) at flip evaluation — committed deps are public already and
+  // carry nothing to entangle. A staged dep lives in one of two carriers: a
+  // stamped transition, or the queue's current batch (ambient registrations
+  // don't stamp; "ambient work IS a transaction" — the batch is the
+  // carrier). The entangle STEALS the carrier's staged cargo — its pending
+  // nodes move (re-stamped) into the awaiting transaction and reveal at its
+  // settle — but never the carrier itself: its async reporters, actions,
+  // and stashes are its own future (a live stream's flight must not chain
+  // the awaiting transaction to landings that haven't happened; a merged
+  // reporter deadlocked exactly that way).
+  let stole = false;
+  for (let l = obs._deps; l !== null; l = l._nextDep) {
+    const dep = l._dep;
+    if (dep._pendingValue !== NOT_PENDING) {
+      const stamp = dep._transition;
+      const t = stamp != null ? currentTransition(stamp) : null;
+      // Skip the awaiting transaction's own cargo (t === target: a
+      // fold-staged landing or a write the action itself issued — hold and
+      // reveal already correct) and dead carriers. Ambient-batch staging
+      // (t === null) must leave the batch NOW — it commits at this flush's
+      // end, which would reveal the confirmation under the live optimism
+      // it just confirmed.
+      const carrier =
+        t === null
+          ? currentBatch._pendingNodes
+          : t !== target && t._done !== true
+            ? t._pendingNodes
+            : null;
+      if (carrier !== null) stole = stealEntangledCargo(carrier, target) || stole;
+    }
+    if (l === obs._depsTail) break;
+  }
+  // The steal never activates the awaiting transaction: the predicate can
+  // flip inside another transaction's finalize heap, and adopting the queue
+  // batch there hands the stolen cargo to that finalize's commit sweep — a
+  // premature reveal at a foreign settle. Subscribers that computed against
+  // the pre-steal world were re-dirtied by the steal itself, so this
+  // flush's applies paint the masked (mid-hold) view; the cargo commits at
+  // the awaiting transaction's own settle.
+}
+/** Move a confirming carrier's staged nodes into the awaiting transaction:
+ * re-stamp and arm the held-truth mask (override-covered nodes skip it —
+ * the override already hides their staged value per A17, and is usually
+ * the very optimism this confirmation settles); the mask's commit
+ * registers the settle-side post-revert wake. The carrier's array is
+ * emptied so its own commit point commits none of the stolen cargo.
+ *
+ * EFFECT subs of stolen nodes re-run: any that recomputed against the
+ * staging BEFORE the steal (the carrier's landing notified them as a plain
+ * write) hold a private torn result — override composed with confirming
+ * truth — that the next paint gate (stash-point lane run, a foreign
+ * flush's completion drain) would show. Re-running them under the mask
+ * re-derives the mid-hold view in this same heap pass. PURE computeds are
+ * deliberately NOT re-run: a torn staged value of theirs is itself stolen
+ * cargo — masked at read, so ordinary readers already serve their
+ * committed value — while re-running them would re-derive the OLD world
+ * and re-stage it over the held truth. The reveal re-notifies
+ * (commitPendingNodes), which is when they re-derive for real. */
+function stealEntangledCargo(carrier, target) {
+  if (carrier === target._pendingNodes || carrier.length === 0) return false;
+  for (let i = 0; i < carrier.length; i++) {
+    const node = carrier[i];
+    node._transition = target;
+    target._pendingNodes.push(node);
+    // Override-covered nodes stay silent AND unmasked: the override is the
+    // display (A17 — its staging never notified, its revert will), so their
+    // subs saw nothing and re-running one would break the silence with a
+    // duplicate fire of an unchanged view.
+    if (!hasActiveOverride$1(node)) {
+      node._config |= CONFIG_HELD_TRUTH;
+      for (let s = node._subs; s !== null; s = s._nextSub) {
+        const sub = s._sub;
+        if (sub._type && !(sub._config & CONFIG_AUTHORITATIVE_READ)) enqueueSub(sub);
+      }
+    }
+  }
+  carrier.length = 0;
+  transitions.add(target);
+  return true;
+}
 function schedule() {
   if (halted) {
     notifyHalted();
@@ -1446,6 +1796,10 @@ class GlobalQueue extends Queue {
   static _laneReadsCommitted = null;
   static _recomputeLane = null;
   static _laneAsyncPending = null;
+  /** Authoritative-view reader wakeup (until()): installed at first until() call.
+   * Call sites are gated by CONFIG_AUTHORITATIVE_OBSERVED, which only until()'s
+   * carve-out read can set, so `!` invocations are safe once the gate holds. */
+  static _notifyAuthoritativeObservers = null;
   static _laneAsyncSettled = null;
   static _trackOptimisticStore = null;
   flush() {
@@ -1589,8 +1943,17 @@ class GlobalQueue extends Queue {
     return false;
   }
   initTransition(transition) {
-    if (transition) transition = currentTransition(transition);
-    if (transition && transition === activeTransition) return;
+    if (transition) {
+      transition = currentTransition(transition);
+      // A finished transaction cannot be re-entered: its state is committed
+      // or reverted, so "rejoining" it (A26) is meaningless and re-activating
+      // it spins the drain loop (#3140). The refusal must be a bare return —
+      // redirecting the caller to a fresh batch would re-arm the loop with a
+      // new transaction identity each pass. Stamps are cleared at commit, so
+      // this is a belt for paths that hand over a chased-dead reference
+      // (merged chains, async settles racing completion).
+      if (transition._done === true || transition === activeTransition) return;
+    }
     if (!transition && activeTransition && activeTransition._time === clock) return;
     if (!activeTransition) {
       activeTransition = transition ?? createBatch();
@@ -1634,11 +1997,25 @@ class GlobalQueue extends Queue {
     for (const lane of activeLanes) {
       if (!lane._transition) lane._transition = activeTransition;
     }
+    // A transaction's ambient window is one flush. Entering must therefore
+    // guarantee a flush: a transaction opened with no writes (an action whose
+    // first statements only await) otherwise leaves activeTransition and the
+    // adopted batch armed across the async gap, and the next unrelated work
+    // to arrive — an optimistic store's authoritative landing, a plain async
+    // settle — is adopted into a transaction it has nothing to do with
+    // (#3141). The scheduled flush parks the incomplete transaction through
+    // the normal machinery and detaches the ambient slots first.
+    schedule();
   }
 }
 function queuePendingNode(node) {
+  lastStagedNodeName = node._name ?? null;
   currentBatch._pendingNodes.push(node);
 }
+// Dev-only attribution for the flush loop guard (#3140): when the guard
+// trips, naming what the loop kept chewing on lets the app author attribute
+// the runaway without patching dist.
+let lastStagedNodeName = null;
 // Sticky: flips true on the first refresh() ever (the only setter of
 // REACTIVE_REASK) so the hot notification loop skips the per-subscriber flag
 // clear entirely in apps that never refresh.
@@ -1714,6 +2091,12 @@ function commitPendingNode(n) {
     n._pendingValue = NOT_PENDING;
     // Set _modified for effects, but not for tracked effects (they handle their own scheduling)
     if (n._type && n._type !== EFFECT_TRACKED) n._modified = true;
+    // A quiet re-ask classification preserved through a held landing dies
+    // with the value commit — the commit IS the reveal (#3178). Gated on the
+    // staged value: status propagation queues pending nodes whose windows
+    // are still OPEN (no staged value), and their live classification must
+    // survive this sweep.
+    if (n._x) n._x._reask = false;
   }
   // The committed hold is the first observable answer for a loading-window
   // node — the window closes here, not at compute time (#2990). Unconditional
@@ -1744,10 +2127,34 @@ let patchCommitHook = null;
 function setPatchCommitHook(fn) {
   patchCommitHook = fn;
 }
+/** Held truth committed this finalize, awaiting its post-revert wake (see
+ * finalizePureQueue): the commit IS the reveal, but subscribers must not
+ * re-derive until the settling transaction's optimistic overrides have
+ * reverted — a commit-time wake recomputes them in the window where
+ * confirming truth is committed and the override still displays, a torn
+ * frame no timeline contains. */
+const heldRevealed = [];
 function commitPendingNodes() {
   const pendingNodes = currentBatch._pendingNodes;
   for (let i = 0; i < pendingNodes.length; i++) {
-    commitPendingNode(pendingNodes[i]);
+    const node = pendingNodes[i];
+    commitPendingNode(node);
+    // The stamp dies with the commit (#3143) — symmetric with
+    // resolveOptimisticNodes clearing optimistic stamps. A stamp outliving
+    // its transaction let any later write (even a value-equal no-op, which
+    // re-opens before the equality bail) resurrect the finished transaction;
+    // a boundary flag rewritten every finalize pass then spun the drain loop
+    // forever (#3140). The held-truth mark dies the same death — the commit
+    // IS the reveal — but its wake defers to the post-revert pass: ordinary
+    // subscribers were masked to committed all hold (some re-derived against
+    // that old view and cached it), and commits are otherwise silent
+    // (staging already notified), so without a wake they'd hold the old
+    // world forever.
+    node._transition = null;
+    if (node._config & CONFIG_HELD_TRUTH) {
+      node._config &= ~CONFIG_HELD_TRUTH;
+      heldRevealed.push(node);
+    }
   }
   pendingNodes.length = 0;
   storeCommitHook?.();
@@ -1799,6 +2206,22 @@ function finalizePureQueue(completingTransition = null, incomplete = false) {
     // completing transition scopes the clear to its own layer keys (#2899).
     if (batch._optimisticStores.size)
       GlobalQueue._clearOptimisticStores(batch._optimisticStores, completingTransition);
+    // Held-truth reveal wake (#3164), post-revert by construction: this
+    // finalize committed confirming truth whose subscribers were masked all
+    // hold — some re-derived against the committed view (the staging, or a
+    // confirming carrier's landing, notified them as a plain write) and
+    // cached it, and stash-restored applies may carry those torn values.
+    // Waking and recomputing HERE — after _resolveOptimistic and the store
+    // clears above — means every apply paints the settled view; a wake at
+    // commit time would recompute them in the window where truth is
+    // committed but the settling transaction's overrides still display.
+    if (heldRevealed.length !== 0) {
+      while (heldRevealed.length) insertSubs(heldRevealed.pop());
+      if (dirtyQueue._max >= dirtyQueue._min) {
+        runHeap(dirtyQueue, GlobalQueue._update);
+        commitPendingNodes();
+      }
+    }
     sweepTransientStoreNodes();
     // Lanes only enter activeLanes through the engine's getOrCreateLane.
     if (activeLanes.size) GlobalQueue._cleanupLanes(completingTransition);
@@ -1879,7 +2302,20 @@ function flush(fn) {
   // `flush()` is an explicit drain point, so it must also process an active
   // transition even if no microtask was scheduled for it yet.
   while (scheduled$1 || activeTransition) {
-    if (++count === 1e5) throw new Error("Potential Infinite Loop Detected.");
+    if (++count === 1e5) {
+      // Attribution beats a bare guard (#3140): say what kept the loop alive.
+      // A completed transition being re-activated reads `done=true` here —
+      // the corpse-revival signature — while application-driven runaways
+      // (#2843) usually show staged work naming the culprit node.
+      const t = activeTransition;
+      throw new Error(
+        `Potential Infinite Loop Detected. Kept alive by ${scheduled$1 ? "scheduled work" : "an active transition"}${
+          t
+            ? `; transition: done=${t._done === true}, pending=${t._pendingNodes.length}, optimistic=${t._optimisticNodes.length}, asyncReporters=${t._asyncReporters.size}`
+            : ""
+        }${lastStagedNodeName ? `; last staged node: ${lastStagedNodeName}` : ""}`
+      );
+    }
     globalQueue.flush();
   }
 }
@@ -1928,6 +2364,13 @@ function transitionComplete(transition) {
   done && (transition._done = true);
   return done;
 }
+/** A fresh, unentered transaction (#3146): the optimistic store's truth
+ * flight DECLARES an owned transaction instead of relying on whatever the
+ * ambient adoption machinery stamped on its firewall. Activate it with
+ * initTransition; it is a plain batch until then. */
+function createTransition() {
+  return createBatch();
+}
 function currentTransition(transition) {
   while (transition._done && typeof transition._done === "object") transition = transition._done;
   return transition;
@@ -1941,6 +2384,29 @@ function runInTransition(transition, fn) {
     activeTransition = prevTransition;
   }
 }
+/** Run `fn` with `transition` as BOTH the ambient transaction and the
+ * registration batch, restoring both after. runInTransition alone is not
+ * enough for code that WRITES on behalf of a transaction from inside someone
+ * else's window (optimistic replay re-arming a still-open action's edits
+ * during a landing commit, #3123): registrations route through the queue's
+ * batch pointer, and a bare activeTransition swap leaves them in the ambient
+ * batch — a plain batch "completes" at the next flush and reverts optimistic
+ * registrations that were supposed to live with the transaction.
+ * initTransition is the wrong tool here: it MERGES the currently ambient
+ * transaction into the target, entangling whatever the interrupted window
+ * belonged to. */
+function runAsTransitionBatch(transition, fn) {
+  const prevTransition = activeTransition;
+  const prevBatch = globalQueue._batch;
+  try {
+    activeTransition = currentTransition(transition);
+    currentBatch = globalQueue._batch = activeTransition;
+    return fn();
+  } finally {
+    activeTransition = prevTransition;
+    currentBatch = globalQueue._batch = prevBatch;
+  }
+}
 
 /** The queue a node belongs to, picked from its own zombie flag. */
 function queueFor(n) {
@@ -2569,12 +3035,14 @@ function addPendingSource(el, source) {
   return true;
 }
 function removePendingSource(el, source) {
-  if (!el._x?._pendingSources?.delete(source)) return false;
-  if (el._x?._pendingSources.size === 0) if (el._x !== null) el._x._pendingSources = undefined;
+  const sources = el._x?._pendingSources;
+  if (!sources?.delete(source)) return false;
+  if (!sources.size) el._x._pendingSources = undefined;
   return true;
 }
 function clearPendingSources(el) {
-  el._x?._pendingSources?.clear();
+  // This set is node-owned and never shared; dropping the sole reference
+  // releases the set and every entry without a redundant clear() walk.
   if (el._x !== null) el._x._pendingSources = undefined;
 }
 // A rejection-pending only resolves through the settle sweep over the
@@ -2691,6 +3159,49 @@ function settleErroredDependents(el, error) {
   if (scheduled) schedule();
 }
 function settlePendingSource(el) {
+  // Invariant: walking a settle implies truth exists. A caller reaching this
+  // with an uninitialized source is announcing a settle that has not
+  // happened — parked readers would wake into a value that was never
+  // produced (the rc.5 regression: the recompute-side walk fired on a
+  // projection driver whose first flight was superseded before any commit
+  // reached the observable store). "Uninitialized" alone is not the tell,
+  // though: a first landing whose commit is transition-held (streamed
+  // hydration rides this) parks its value in `_pendingValue` with the flag
+  // still set, and a comparator throw on that landing leaves the node
+  // uninitialized but errored — both have real truth to reveal. Only an
+  // uninitialized node with neither a held value nor an error is a settle
+  // that never happened. Silent in production; loud in dev so a future
+  // call site that violates the contract fails in its author's test run
+  // instead of wedging a downstream app.
+  {
+    const sources = el._x?._pendingSources;
+    if (
+      el._statusFlags & STATUS_UNINITIALIZED &&
+      el._pendingValue === NOT_PENDING &&
+      !el._x?._error &&
+      // A replacement source makes this a cleanup-only transfer: removing
+      // self leaves the source and every propagated dependent parked. No
+      // sources (or self alone) would release readers without truth.
+      !(sources?.size && (sources.size > 1 || !sources.has(el)))
+    ) {
+      emitDiagnostic({
+        code: "SETTLE_WALK_UNINITIALIZED_SOURCE",
+        kind: "lifecycle",
+        severity: "error",
+        message:
+          "[SETTLE_WALK_UNINITIALIZED_SOURCE] settlePendingSource was called on a source that " +
+          "never produced a value. Settling parked readers requires truth to reveal — an " +
+          "uninitialized source waking its dependents serves them its initial face instead of " +
+          "settled data.",
+        ownerId: el.id,
+        ownerName: el._name
+      });
+    }
+  }
+  // The normal landing path already cleared the source's own set. Superseded
+  // re-parks arrive here with an abandoned self entry, which must retire in
+  // the same walk as its propagated copies.
+  removePendingSource(el, el);
   let scheduled = false;
   let released;
   const visited = new Set();
@@ -2709,11 +3220,11 @@ function settlePendingSource(el) {
     const errored = node._statusFlags & STATUS_ERROR;
     if (remaining) {
       if (!errored) setPendingError(node, remaining);
-      updateCompanions !== null && updateCompanions(node);
+      updateCompanions?.(node);
     } else {
       node._statusFlags &= ~STATUS_PENDING;
       if (!errored) setPendingError(node);
-      updateCompanions !== null && updateCompanions(node);
+      updateCompanions?.(node);
       if (node._x?._blocked) {
         enqueueSub(node);
         scheduled = true;
@@ -2736,6 +3247,14 @@ function settlePendingSource(el) {
 function isThenable(value) {
   return value != null && typeof value === "object" && typeof value.then === "function";
 }
+/** Fire and clear a node's iterator-flight cancellation hook (#3122). */
+function releaseFlightTeardown(el) {
+  const teardown = el._x?._flightTeardown;
+  if (teardown != null) {
+    el._x._flightTeardown = null;
+    teardown();
+  }
+}
 function handleAsync(el, result, setter) {
   let iterator = false;
   let thenable = false;
@@ -2773,7 +3292,18 @@ function handleAsync(el, result, setter) {
     });
     throw new Error(message);
   }
+  // Flight replacement relies on recompute's supersede release for iterator
+  // teardown (#3122): every handleAsync call — including the projection
+  // self-registration — runs during a recompute of `el`, which has already
+  // fired _flightTeardown. A future non-recompute registration path must
+  // release it here before overwriting _inFlight.
   ext(el)._inFlight = result;
+  // Attribution hook: a new flight is registered. Fired here (not in the
+  // branches below) so every flight shape — plain thenable, iterator, the
+  // flattened combinations — is announced exactly once, while the recompute
+  // frame that caused it is still on the engine's stack. Not inside a try
+  // (#2883 — see attribution-hooks.ts).
+  if (attrHooks !== null) attrHooks.flightStart(el, result);
   let syncValue;
   // Settle-time transition re-entry. The loading rail is invisible to
   // transactions (#2933): a boundary-caught first load never registers as an
@@ -2832,6 +3362,10 @@ function handleAsync(el, result, setter) {
     }
     settleTransition();
     notifyStatus(el, stillPending ? STATUS_PENDING : STATUS_ERROR, error);
+    // A NotReady rejection is a landing into another pending source. The
+    // rejected flight will never settle its self entry, so transfer ownership
+    // after notifyStatus has propagated the replacement source.
+    if (stillPending) settlePendingSource(el);
     el._time = clock;
     // A real error settles derivatively-pending dependents (notifyStatus
     // cleared their pending sources), so stranded lazy ones release here —
@@ -2846,8 +3380,16 @@ function handleAsync(el, result, setter) {
     if (el._flags & (REACTIVE_DIRTY | REACTIVE_OPTIMISTIC_DIRTY)) return;
     settleTransition();
     const wasUninitialized = !!(el._statusFlags & STATUS_UNINITIALIZED);
+    // Captured before clearStatus wipes it: a quiet re-ask's landing may be
+    // transition-held below, and the displayed value keeps answering the same
+    // question until the hold commits — the classification must survive to
+    // that reveal or companion synchronization briefly classifies the held
+    // old value as pending, a one-frame pulse to direct observers (#3178).
+    // A truthy capture implies `_x` exists, so the restore writes it directly.
+    const wasReask = el._x?._reask;
     trimStaleDeps(el);
     clearStatus(el);
+    if (wasReask) el._x._reask = true;
     const lane = resolveLane(el);
     if (lane) lane._pendingAsync.delete(el);
     // Attribution hook: lets the engine snapshot state before the landing
@@ -2876,10 +3418,21 @@ function handleAsync(el, result, setter) {
       // only notified when the hold is visible to them: under an active
       // override every reader sees the override (A17), so waking subs would
       // re-show an unchanged view — the revert is the notification point.
-      GlobalQueue._syncCompanions !== null && GlobalQueue._syncCompanions(el, value);
+      GlobalQueue._syncCompanions?.(el, value);
       if (!hasActiveOverride$1(el)) {
         if (attrHooks !== null) attrHooks.asyncEnd(el, undefined, value, true);
         insertSubs(el);
+      } else if (el._config & CONFIG_AUTHORITATIVE_OBSERVED) {
+        // A17 silence is stated over ordinary readers; an authoritative-view
+        // reader (until()'s predicate) observed this node PAST its override
+        // and is waiting for exactly this staged truth. Without the wake the
+        // hold deadlocks: the landing waits on the transaction, the
+        // transaction on the action, the action on an until() that was never
+        // re-notified (#3164). Same selective wake as the equal-landing
+        // branch in recompute(). Optional call: the bit implies the
+        // optimistic engine WAS consulted, but the hook only installs with
+        // it — a bare-core build must not crash here.
+        GlobalQueue._notifyAuthoritativeObservers?.(el);
       }
       el._time = clock;
     } else if (lane) {
@@ -2894,7 +3447,7 @@ function handleAsync(el, result, setter) {
           // The latest() shadow write gives latest() effects independent lanes; the
           // _pendingSignal update is a no-op repeat of the clearStatus() call above
           // (computePendingState doesn't read _value).
-          GlobalQueue._syncCompanions !== null && GlobalQueue._syncCompanions(el, value);
+          GlobalQueue._syncCompanions?.(el, value);
           insertSubs(el, true);
         }
       } catch (e) {
@@ -2930,8 +3483,12 @@ function handleAsync(el, result, setter) {
     // (`_pendingValue` set above or inside setSignal) is not — the verdict's
     // held-value branch is window-gated, and commitPendingNode closes the
     // window when the hold commits, so no one-frame isPending pulse can leak
-    // to live observers between the landing and its commit (#2990).
-    if (el._pendingValue === NOT_PENDING) el._loading = false;
+    // to live observers between the landing and its commit (#2990). The
+    // quiet re-ask classification follows the same schedule (#3178).
+    if (el._pendingValue === NOT_PENDING) {
+      el._loading = false;
+      if (wasReask) el._x._reask = false;
+    }
     settlePendingSource(el);
     schedule();
     flush();
@@ -2976,6 +3533,11 @@ function handleAsync(el, result, setter) {
       } catch {}
     };
     registerClose ? registerClose(close) : cleanup(close);
+    // Flight-identity cancellation (#3122): the registration above is the
+    // owner-death backstop, but its disposal list can be zombie-deferred
+    // until the SUPERSEDING flight settles. The teardown slot fires at the
+    // _inFlight release sites so supersede stops this stream immediately.
+    ext(el)._flightTeardown = close;
     // Release check before each next pull: an unobserved lazy node must tear
     // down (its close above runs via disposal, closing the iterator) instead
     // of pumping the stream forever with zero subscribers (#2935).
@@ -3207,7 +3769,7 @@ function notifyStatus(el, status, error, blockStatus, lane) {
         status | (status !== STATUS_ERROR ? el._statusFlags & STATUS_UNINITIALIZED : 0);
       ext(el)._error = error;
     }
-    GlobalQueue._updatePendingSignal !== null && GlobalQueue._updatePendingSignal(el);
+    GlobalQueue._updatePendingSignal?.(el);
     if (
       el._x?._child &&
       el._config & CONFIG_CHILD_COMPANIONS &&
@@ -3352,7 +3914,15 @@ function recompute(el, create = false) {
     if (el._transition && (!isEffect || activeTransition) && activeTransition !== el._transition)
       globalQueue.initTransition(el._transition);
     deleteFromHeap(el, queueFor(el));
-    if (el._x !== null) el._x._inFlight = null;
+    if (el._x !== null) {
+      el._x._inFlight = null;
+      // Supersede is where an iterator flight dies (#3122): close it now.
+      // Its cleanup(close) registration may sit in a zombie-deferred
+      // disposal list that a held transition only drains when the
+      // SUPERSEDING flight settles — cancellation must not wait for the
+      // work that replaced it. Idempotent with the cleanup-channel close.
+      releaseFlightTeardown(el);
+    }
     // Tracked effects run after finalizePureQueue, so dispose immediately instead of deferring
     if (el._transition || isEffect === EFFECT_TRACKED) disposeChildren(el);
     else if (el._firstChild !== null || el._disposal !== null) {
@@ -3376,6 +3946,13 @@ function recompute(el, create = false) {
   // recovers to an unchanged value, dependents still holding this object must
   // be swept (settleErroredDependents, #2949).
   const outgoingError = el._statusFlags & STATUS_ERROR ? el._x?._error : undefined;
+  // Pending SOURCE-hood, captured before the compute clears status: a node
+  // whose own flight parked dependents self-registers in _pendingSources
+  // (notifyStatus, isSource). If this recompute supersedes that flight and
+  // settles synchronously, those dependents settle HERE — asyncWrite's
+  // settlePendingSource walk never runs for a landing that was preempted
+  // (#3181).
+  const wasPendingSource = el._x?._pendingSources?.has(el);
   // Re-ask classification lives in the verdict module; capture the flag before
   // the recompute wipes _flags below.
   const hadReask = (el._flags & REACTIVE_REASK) !== 0;
@@ -3489,6 +4066,9 @@ function recompute(el, create = false) {
         undefined,
         notReady ? el._x?._optimisticLane : undefined
       );
+      // The replacement source is fully propagated now. If no new flight
+      // re-owned self, retire the superseded flight and its dependent copies.
+      if (notReady && wasPendingSource && !el._x?._inFlight) settlePendingSource(el);
       if (reaskChanged) GlobalQueue._repollVerdicts(el);
     }
   } finally {
@@ -3550,7 +4130,14 @@ function recompute(el, create = false) {
         // values directly — the pending round-trip (queuePendingNode +
         // commitPendingNodes) exists to sequence transition reveals, and
         // paying it per effect on the plain path is pure overhead.
-        (isEffect && (activeTransition !== el._transition || activeTransition === null)) ||
+        // DIRECT_COMMIT effects (resolve/until) commit directly even under
+        // their own held transition: their applies deliver on a microtask,
+        // not the stashed queues, so a staged value would hand the immediate
+        // apply stale state — see CONFIG_DIRECT_COMMIT.
+        (isEffect &&
+          (activeTransition !== el._transition ||
+            activeTransition === null ||
+            el._config & CONFIG_DIRECT_COMMIT)) ||
         isOptimisticDirty
         // NOTE (stage-3, 2026-08-21): a quiet-world MEMO direct-commit was
         // attempted here and REVERTED — memo staging is load-bearing beyond
@@ -3596,6 +4183,12 @@ function recompute(el, create = false) {
       if (el._pendingValue === NOT_PENDING) queuePendingNode(el);
       el._pendingValue = value;
       if (wasLoading) el._loading = true; // see the held branch above (#2990)
+      // A authoritative-view reader (until()) observed this node past its
+      // override — and "authoritative arrival equal to the override" is
+      // exactly the acknowledgment it waits for. Wake those readers only;
+      // A17 silence holds for every ordinary subscriber. (Hook installed by
+      // until(), the only setter of the gating bit.)
+      if (el._config & CONFIG_AUTHORITATIVE_OBSERVED) GlobalQueue._notifyAuthoritativeObservers(el);
     } else if (el._height != oldHeight) {
       for (let s = el._subs; s !== null; s = s._nextSub) {
         insertIntoHeapHeight(s._sub, queueFor(s._sub));
@@ -3608,6 +4201,11 @@ function recompute(el, create = false) {
     // (el._x?._error re-set), so this only runs on a genuinely clean recovery.
     if (outgoingError !== undefined && !valueChanged && !el._x?._error)
       settleErroredDependents(el, outgoingError);
+    // #3181: a synchronous settle supersedes the old landing callback, so
+    // recompute owns its pending-source sweep. An uninitialized node without
+    // a replacement source still has no truth to reveal and must stay parked.
+    if (wasPendingSource && !(el._statusFlags & (STATUS_PENDING | STATUS_UNINITIALIZED)))
+      settlePendingSource(el);
   }
   // Attribution hook: fired before the lane restore so `currentOptimisticLane`
   // still reflects THIS run's posture. The facts distinguish an overlay
@@ -3656,7 +4254,9 @@ function updateIfNecessary(el) {
   // (_depsTail/_depGen) is live, and a nested recompute would corrupt it.
   // A mid-pass mark stays latched for recompute's own tail to reschedule
   // (#3037); readers meanwhile serve the values the pass has so far.
-  if (el._flags & REACTIVE_RECOMPUTING_DEPS) return;
+  // Never recompute a DISPOSED node either: recompute rewrites _flags and
+  // would resurrect it (#2983) — readers serve its last value.
+  if (el._flags & (REACTIVE_RECOMPUTING_DEPS | REACTIVE_DISPOSED)) return;
   if (el._flags & REACTIVE_CHECK) {
     for (let d = el._deps; d; d = d._nextDep) {
       const dep1 = d._dep;
@@ -3692,7 +4292,7 @@ function computed(fn, options) {
       (options?.sync ? CONFIG_SYNC : 0) |
       (options?._noSnapshot ? CONFIG_NO_SNAPSHOT : 0) |
       (snapshotCaptureActive && ownerInSnapshotScope(context) ? CONFIG_IN_SNAPSHOT_SCOPE : 0),
-    _equals: options?.equals != null ? options.equals : isEqual,
+    _equals: options?.equals ?? isEqual,
     _disposal: null,
     _queue: context?._queue ?? globalQueue,
     _context: context?._context ?? defaultContext,
@@ -3744,6 +4344,7 @@ function ext(el) {
     _parentSource: undefined,
     _affectsCount: 0,
     _inFlight: null,
+    _flightTeardown: null,
     _error: undefined,
     _blocked: undefined,
     _pendingSources: undefined,
@@ -3771,6 +4372,7 @@ function createEffectNode(fn, effectFn, errorFn, type, options) {
       (transparent ? CONFIG_TRANSPARENT : 0) |
       (options?.ownedWrite ? CONFIG_OWNED_WRITE : 0) |
       (options?.sync ? CONFIG_SYNC : 0) |
+      (options?._extraConfig ?? 0) |
       (snapshotCaptureActive && ownerInSnapshotScope(context) ? CONFIG_IN_SNAPSHOT_SCOPE : 0),
     _equals: false,
     _disposal: null,
@@ -3832,8 +4434,7 @@ function setEffectStatusNotify(fn) {
  * "display consumer" membership test in the status walks, exactly as the
  * per-node field did when every effect carried one. */
 function statusNotifierOf(el) {
-  const x = el._x;
-  const own = x !== null && x !== undefined ? x._notifyStatus : undefined;
+  const own = el._x?._notifyStatus;
   if (own !== undefined) return own;
   return el._type ? (effectStatusNotify ?? undefined) : undefined;
 }
@@ -3876,7 +4477,7 @@ function setupComputedNode(self, options) {
 }
 function signal(v, options, firewall = null) {
   const s = {
-    _equals: options?.equals != null ? options.equals : isEqual,
+    _equals: options?.equals ?? isEqual,
     _config:
       (options?.ownedWrite ? CONFIG_OWNED_WRITE : 0) |
       (options?._noSnapshot ? CONFIG_NO_SNAPSHOT : 0),
@@ -4013,6 +4614,35 @@ const READ_SLOW = Symbol("read-slow");
  * snapshot / transition / lane / dev-strictRead state all take the full
  * resolution. Anything slow returns READ_SLOW; the caller then calls read().
  */
+/**
+ * Wake only authoritative-view readers (until() predicates) subscribed to `el`.
+ * The A17-silent ack paths — an authoritative arrival equal to the active
+ * override — use this so the predicate re-evaluates without re-firing
+ * ordinary subscribers whose visible (override) value did not change.
+ * Pay-for-use: reached through GlobalQueue._notifyAuthoritativeObservers,
+ * installed at first until() call — apps that never use until() shake it.
+ */
+function notifyAuthoritativeObservers(el) {
+  for (let s = el._subs; s !== null; s = s._nextSub) {
+    const sub = s._sub;
+    if (!(sub._config & CONFIG_AUTHORITATIVE_READ)) continue;
+    // Missed-wake latch (#3037), same contract as insertSubs: the reader may
+    // itself have pulled this recompute (updateIfNecessary from its own
+    // read), and the heap refuses RECOMPUTING nodes — latch so recompute's
+    // tail reschedules it with the staged value visible.
+    if (sub._flags & REACTIVE_RECOMPUTING_DEPS && s._gen === sub._depGen && s !== sub._depsTail)
+      sub._flags |= REACTIVE_MISSED_WAKE;
+    enqueueSub(sub);
+  }
+  schedule();
+}
+/** Installs the until() machinery hook. Idempotent; called by until() before
+ * any authoritative-view read happens (same late-binding contract as the
+ * optimistic engine). */
+function installAuthoritativeRead() {
+  if (GlobalQueue._notifyAuthoritativeObservers === null)
+    GlobalQueue._notifyAuthoritativeObservers = notifyAuthoritativeObservers;
+}
 function readNodeFast(el) {
   if (
     latestReadActive ||
@@ -4092,6 +4722,13 @@ function read(el) {
         markHeap(elQueue);
         updateIfNecessary(owner);
       }
+      // Fresh-pull readers (awaitable refresh's waiter) recompute a dirty
+      // source inline even when the height gate defers to the flush: the
+      // waiter must park on the re-ask's window (or serve its sync answer),
+      // never read the PRE-re-ask value as settled. Self-guarded: a clean
+      // node no-ops and updateIfNecessary refuses disposed nodes (#2983) —
+      // a dead target serves its last value, which is already quiescent.
+      else if (c._config & CONFIG_FRESH_READ) updateIfNecessary(owner);
       const height = owner._height;
       // parent check is shallow, might need to be recursive
       if (height >= c._height && el._parent !== c) {
@@ -4170,8 +4807,18 @@ function read(el) {
       nodeName: owner?._name
     });
   if (el._x?._overrideValue !== undefined && el._x?._overrideValue !== NOT_PENDING) {
-    // A17: the override IS the value for every reader.
-    return unwrapOverride(el._x?._overrideValue);
+    // A17: the override IS the value for every reader — except an authoritative
+    // reader (until()'s predicate carries CONFIG_AUTHORITATIVE_READ): it must
+    // observe independently-arriving truth, and serving it the caller's own
+    // tentative write would trivially satisfy the predicate. The bit is checked
+    // on the reading computation itself, so a shared computed the predicate
+    // pulls recomputes as ITSELF (context = the memo, no bit) under the normal
+    // view. Fall through to normal value selection (staged `_pendingValue` is
+    // authoritative — optimism never lives there); the sticky mark makes the
+    // A17-silent "landing equals override" paths notify this node's subs so
+    // the reader re-runs when truth arrives.
+    if (!(c && c._config & CONFIG_AUTHORITATIVE_READ)) return unwrapOverride(el._x?._overrideValue);
+    el._config |= CONFIG_AUTHORITATIVE_OBSERVED;
   }
   // Entanglement gate: a reader recomputing under an optimistic lane that reads
   // a pending mid-transition write sees the committed value. Projection-store
@@ -4199,7 +4846,18 @@ function read(el) {
     (currentOptimisticLane !== null && GlobalQueue._laneReadsCommitted(el, owner, c)) ||
     el._pendingValue === NOT_PENDING ||
     c._config & CONFIG_CHILDREN_FORBIDDEN ||
-    (stale && el._transition && activeTransition !== el._transition)
+    (stale && el._transition && activeTransition !== el._transition) ||
+    // A17 for HELD truth (#3164, see CONFIG_HELD_TRUTH): staged confirming
+    // truth — fold-staged onto an armed family, or entangle-stolen by an
+    // awaited until() — is masked from ordinary readers until its
+    // transaction's reveal; the retaining transaction's own speculative
+    // recomputes included (partial override coverage would otherwise
+    // compose override + staged truth into a state no timeline contains).
+    // Authoritative readers (until()'s predicate) and latest() see the
+    // staged truth — the tunnel that keeps the hold deadlock-free.
+    (el._config & CONFIG_HELD_TRUTH &&
+      !latestReadActive &&
+      !(c._config & CONFIG_AUTHORITATIVE_READ))
       ? el._value
       : el._pendingValue;
   // Record that this isPending() probe observed the fresh pending value, so
@@ -4244,9 +4902,17 @@ function devGuardStoreSetterWrite() {
       ownerName: context._name,
       data: { operation: "setStore" }
     });
-    throw new Error(REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE);
+    // the owner name reaches the THROWN message too, not just the
+    // diagnostics channel apps don't subscribe to by default (#3157)
+    throw new Error(ownedScopeWriteMessage(context));
   }
 }
+function ownedScopeWriteMessage(owner) {
+  const name = owner._name;
+  return name
+    ? `${REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE} (in ${name})`
+    : REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE;
+}
 function setSignal(el, v) {
   if (
     !(el._config & CONFIG_OWNED_WRITE) &&
@@ -4264,7 +4930,7 @@ function setSignal(el, v) {
       nodeName: el._name,
       data: { operation: "setSignal" }
     });
-    throw new Error(REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE);
+    throw new Error(ownedScopeWriteMessage(context));
   }
   if (el._transition && activeTransition !== el._transition)
     globalQueue.initTransition(el._transition);
@@ -4390,41 +5056,13 @@ function staleValues(fn, set = true) {
   }
 }
 /**
- * Invalidates one reactive source, forcing it to re-execute even if its inputs
- * haven't changed.
- *
- * Pass either a Solid-created accessor or a projected store created from
- * `createStore(fn, ...)` / `createProjection(...)`. `refresh()` is a
- * write-like invalidation operation: it does not read the target's value, and
- * refreshing a plain signal accessor is a no-op.
- *
- * Use it to invalidate cached async values (e.g. force a re-fetch) without
- * tearing the consumer down.
- *
- * @example
- * ```ts
- * const user = createMemo(async () => fetch(`/users/${id()}`).then(r => r.json()));
- *
- * // Re-fetch on demand
- * <button onClick={() => refresh(user)}>Reload</button>
- * ```
+ * Core marking half of `refresh()` (the public wrapper lives in signals.ts —
+ * it validates the target, marks through here, then builds the quiescence
+ * promise on the resolve()/until() effect machinery). Flags the node's next
+ * recompute as a quiet re-ask and schedules it; no-ops for non-derived or
+ * disposed targets and for same-tick manual writes.
  */
-function refresh(target) {
-  const node = target?.[$REFRESH];
-  if (!node) {
-    {
-      const message =
-        "[INVALID_REFRESH_TARGET] refresh() expects a Solid source accessor or refreshable store. " +
-        "Pass the original source target, not a wrapper function or derived property read.";
-      emitDiagnostic({
-        code: "INVALID_REFRESH_TARGET",
-        kind: "write",
-        severity: "error",
-        message
-      });
-      throw new Error(message);
-    }
-  }
+function markRefresh(node) {
   if (
     context &&
     !((node._config ?? 0) & CONFIG_OWNED_WRITE) &&
@@ -5076,7 +5714,11 @@ function computePendingState(el) {
   ) {
     if (hasActiveOverride$1(el))
       return !el._equals || !el._equals(el._pendingValue, unwrapOverride(el._x?._overrideValue));
-    return true;
+    // A quiet re-ask's held landing still answers the same question: the
+    // classification survives the landing (asyncWrite) and dies with the
+    // commit (commitPendingNode) — verdict-quiet through the reveal, like
+    // the loading window above (#3178).
+    if (!comp._x?._reask) return true;
   }
   return newQuestionInFlight(comp);
 }
@@ -5236,7 +5878,22 @@ function latestRead(el) {
       !(pendingComputed._flags & (REACTIVE_DISPOSED | REACTIVE_ZOMBIE))
     ) {
       markHeap(queue);
-      prepareComputed(pendingComputed, true);
+      // Suspend probe collection during the pull (mirrors pendingCheckRead's
+      // prepare): a probe through latest() answers for the SHADOW — the
+      // read() dispatch collects it deliberately, so the verdict reflects
+      // async still in flight for the latest view, not the parent's held
+      // write. A stale shadow recomputing HERE ran its `read(parent)` with
+      // the probe still live and collected the parent too, so the verdict
+      // depended on whether anything had pulled the shadow current earlier
+      // in the tick (#3104: reading latest(m) flipped a later
+      // latest(() => isPending(x)) from true to false).
+      const prevCheck = pendingCheckActive;
+      setPendingCheckActive(false);
+      try {
+        prepareComputed(pendingComputed, true);
+      } finally {
+        setPendingCheckActive(prevCheck);
+      }
     }
     value = read(pendingComputed);
   } catch (e) {
@@ -5266,12 +5923,42 @@ function latestRead(el) {
     return pendingComputed._pendingValue;
   return value;
 }
+/**
+ * A latest() shadow that is uninitialized only because it was CREATED during
+ * an active flight — its parent source already has a committed value, so
+ * latest() serves that as the visible value and a tracked reader has
+ * something to pair a verdict with (#3166). Same parent resolution as
+ * computePendingState. The pending signal companion also carries
+ * `_parentSource` but is a plain signal (no `_fn`) that never goes pending,
+ * so the `_fn` check is belt-and-braces for this call site.
+ */
+function latestShadowWithInitializedParent(owner) {
+  if (typeof owner._fn !== "function") return false;
+  const parentNode = owner._x?._parentSource;
+  if (parentNode === undefined) return false;
+  const parent = parentNode._firewall || parentNode;
+  return !(parent._statusFlags & STATUS_UNINITIALIZED);
+}
 /** The isPending()-probe read path, installed as GlobalQueue._pendingCheck. */
 function pendingCheckRead(el, c, owner, firewall) {
   setPendingCheckActive(false);
   if (typeof el._fn === "function") prepareComputed(el, true);
   const ownerStatus = owner._statusFlags;
-  if (c && ownerStatus & STATUS_PENDING && ownerStatus & STATUS_UNINITIALIZED) {
+  if (
+    c &&
+    ownerStatus & STATUS_PENDING &&
+    ownerStatus & STATUS_UNINITIALIZED &&
+    // The suspend-throw is for a genuinely-first-load source: the tracked
+    // reader has nothing to pair a verdict with, so it parks on the source.
+    // A latest() SHADOW created lazily mid-flight is born uninitialized even
+    // though its parent has a committed value latest() will serve — throwing
+    // here (swallowed by latestRead's fallback) dropped the shadow from the
+    // probe, so a tracked latest(isPending()) probe created during a
+    // new-question flight cached `false` for that whole flight (#3166).
+    // Defer to the PARENT's initialization state and fall through to normal
+    // collection; the plain pending throw downstream still links the reader.
+    !latestShadowWithInitializedParent(owner)
+  ) {
     if (tracking && el !== c) link(el, c);
     setPendingCheckActive(true);
     throw owner._x?._error;
@@ -5352,6 +6039,17 @@ function isPending(fn) {
   });
   const collectPending = () => {
     setPendingCheckActive(false);
+    // Companion reads are mode-neutral plumbing: under an outer latest()
+    // (isPending inside a latest window — #3104's memo shape) leaving latest
+    // mode active dispatched these reads through latestRead, which built a
+    // SHADOW OF THE PENDING SIGNAL itself. The next updatePendingSignal then
+    // wrote that companion-on-companion from inside a recompute
+    // (syncCompanions → setSignal on a shadow created without ownedWrite)
+    // and halted dev with the owned-scope write guard. The creation paths
+    // (getLatestValueComputed / getPendingSignal) already suspend both
+    // modes; this read site must too.
+    const prevLatest = latestReadActive;
+    setLatestReadActive(false);
     const prevStrictRead = strictRead;
     setStrictRead(false);
     try {
@@ -5363,6 +6061,7 @@ function isPending(fn) {
       });
     } finally {
       setStrictRead(prevStrictRead);
+      setLatestReadActive(prevLatest);
       setPendingCheckActive(true);
     }
     // A "not pending" verdict that exists only because this reader saw the
@@ -5868,6 +6567,74 @@ function createSignal(first, second) {
 function createMemo(compute, options) {
   return accessor(computed(compute, options));
 }
+/**
+ * Creates a reactive effect with **separate compute and effect phases**.
+ *
+ * - `compute(prev)` runs reactively — *put all reactive reads here*. The
+ *   returned value is passed to `effect` and is also the new "previous" value
+ *   for the next run.
+ * - `effect(next, prev?)` runs imperatively (untracked) after the queue
+ *   flushes. *Put DOM writes / fetch / logging / subscriptions here.* It may
+ *   return a cleanup function which runs before the next effect or on
+ *   disposal.
+ *
+ * Reactive reads inside `effect` will *not* re-trigger this effect — that's
+ * intentional. If you need a single-phase tracked effect, use
+ * `createTrackedEffect` (with the tradeoffs noted there).
+ *
+ * Pass an `EffectBundle` (`{ effect, error }`) instead of a plain function to
+ * intercept **compute-phase** errors — errors thrown by `compute` or arriving
+ * from upstream reactive sources (including async rejections), which your own
+ * code has no frame to `try/catch`. The `error` handler is the error arm of
+ * the effect phase: it runs on the same schedule and in the same imperative,
+ * writable scope as `effect` (setting error state via signals is fine), and
+ * only for *settled* errors — a transient error that recovers before the
+ * effect phase runs `effect` with the recovered value instead, and a held
+ * transition defers it exactly as it defers `effect`. Without an `error`
+ * handler a compute-phase error is logged and the effect simply skips that
+ * run — a non-render effect's reactivity failing does not crash the app.
+ * Rethrowing from `error` escalates it to the nearest error boundary
+ * (halting the system if none exists).
+ *
+ * The **effect phase is different**: it is your own imperative code, so handle
+ * failures with `try/catch` where they occur. An uncaught effect-phase throw
+ * is treated as an unhandled application error — caught by the nearest
+ * `createErrorBoundary`/`<Errored>`, and permanently halting the reactive
+ * system if there is none. It is *not* routed to the bundle's `error` handler.
+ *
+ * ```typescript
+ * createEffect<T>(compute, effectFn | { effect, error }, options?: EffectOptions);
+ * ```
+ * @param compute a function that receives its previous value and returns a new value used to react on a computation
+ * @param effectFn a function that receives the new value and is used to perform side effects (return a cleanup function), or an `EffectBundle` with `effect` and `error` handlers
+ * @param options `EffectOptions` -- name, defer, schedule, transparent
+ *
+ * @example
+ * ```ts
+ * const [count, setCount] = createSignal(0);
+ *
+ * createEffect(
+ *   () => count(),                  // compute: tracks `count`
+ *   value => console.log(value)     // effect: side effect
+ * );
+ *
+ * setCount(1); // logs 1 after the next flush
+ * ```
+ *
+ * @example
+ * ```ts
+ * createEffect(
+ *   () => userId(),
+ *   id => {
+ *     const ctrl = new AbortController();
+ *     fetch(`/users/${id}`, { signal: ctrl.signal });
+ *     return () => ctrl.abort(); // cleanup before next run / disposal
+ *   }
+ * );
+ * ```
+ *
+ * @description https://docs.solidjs.com/reference/basic-reactivity/create-effect
+ */
 function createEffect(compute, effectFn, options) {
   if (effectFn === undefined) {
     const message =
@@ -6086,11 +6853,259 @@ function resolve(fn) {
           rej(err);
           dispose();
         },
-        { user: true }
+        // DIRECT_COMMIT: a source settling INTO the held transaction (e.g. a
+        // refresh this action issued) stages its landing; the effect's own
+        // recompute must not stage too, or the microtask apply reads the
+        // stale mainline value and resolves with old data.
+        { user: true, _extraConfig: CONFIG_DIRECT_COMMIT }
       );
     });
   });
 }
+/**
+ * Invalidates one reactive source, forcing it to re-execute even if its inputs
+ * haven't changed, and returns a promise for the target's NEXT QUIESCENT
+ * STATE — the re-ask (and anything that supersedes it) has settled.
+ *
+ * Pass either a Solid-created accessor or a projected store created from
+ * `createStore(fn, ...)` / `createProjection(...)`. `refresh()` is a
+ * write-like invalidation operation: it does not read the target's value, and
+ * refreshing a plain signal accessor is a no-op that resolves immediately.
+ *
+ * The returned promise is safe to ignore (fire-and-forget refresh is
+ * unchanged, and a failed refetch will not surface an unhandled rejection).
+ * Awaiting it gives imperative flows the settle point without a reactive
+ * read:
+ * - Accessor targets resolve with the settled value; store targets resolve
+ *   with the store node passed (reads through it are fresh after the await).
+ * - A failed re-ask rejects with the error (inside an action's generator,
+ *   `yield refresh(x)` throws back at the yield point and the action reverts
+ *   like any other failure).
+ * - Semantics are quiescence, not flight identity: if another refresh (or
+ *   any invalidation) supersedes this one mid-flight, the promise waits for
+ *   — and delivers — whatever finally lands.
+ * - Inside an action, truth landing into the held transaction is STAGED;
+ *   the promise still settles then (matching `resolve()`/`until()`, #2930)
+ *   and delivers the staged value — the caller's own optimistic override is
+ *   never the delivered value.
+ * - The re-ask itself stays verdict-quiet exactly as before: `isPending`
+ *   does not flip for a bare refresh (pair with `affects()` for a visible
+ *   pending window).
+ *
+ * @example
+ * ```ts
+ * const user = createMemo(async () => fetch(`/users/${id()}`).then(r => r.json()));
+ *
+ * // Fire-and-forget re-fetch
+ * <button onClick={() => refresh(user)}>Reload</button>;
+ *
+ * // Imperative settle point
+ * const fresh = await refresh(user);
+ * ```
+ */
+function refresh(target) {
+  const node = target?.[$REFRESH];
+  if (!node) {
+    {
+      const message =
+        "[INVALID_REFRESH_TARGET] refresh() expects a Solid source accessor or refreshable store. " +
+        "Pass the original source target, not a wrapper function or derived property read.";
+      emitDiagnostic({
+        code: "INVALID_REFRESH_TARGET",
+        kind: "write",
+        severity: "error",
+        message
+      });
+      throw new Error(message);
+    }
+  }
+  // Mark now, watch on a microtask. The waiter is resolve()'s machinery with
+  // two extra reader bits, but it must NOT compute at call time (effects
+  // recompute eagerly on creation): same-tick refreshes coalesce into ONE
+  // re-ask only because every mark lands before anything pulls, and eager
+  // per-call pulls turned three refreshes into three fetches. Deferred, the
+  // waiter's first read sees the coalesced state: FRESH_READ pulls the node
+  // through recompute if it is still dirty (self-deduping — a clean node
+  // no-ops, so N waiters cost one pull; this also closes the race where a
+  // waiter reads the PRE-re-ask value as settled and delivers stale), after
+  // which the read either parks on the re-ask's pending window (async — the
+  // settle walk re-runs it on every landing, equal-value and
+  // staged-under-hold included, and a rejection arrives through the effect's
+  // error channel) or serves the sync answer. AUTHORITATIVE_READ keeps an
+  // action's own optimistic override out of the delivered value. resolve()'s
+  // own eager compute is untouched: created after a refresh it still settles
+  // stale-while-revalidate (#2930) — its contract is "first settled value",
+  // not "next quiescent state".
+  markRefresh(node);
+  const promise = new Promise((res, rej) => {
+    queueMicrotask(() => {
+      // No createRoot: the microtask has no ambient owner, so the effect is
+      // naturally detached, and settle disposes the node directly — the root
+      // added ~560B of otherwise-shakeable machinery for nothing but the
+      // dev-mode NO_OWNER_EFFECT warning, so dev keeps a root husk purely to
+      // stay quiet. The waiter swaps in its microtask queue during its own
+      // first compute (before the initial apply enqueue), replacing the
+      // root-owner plumbing.
+      // Typed as the effect node, not Owner: the capture runs inside the
+      // effect's own compute, where the ambient owner IS the effect —
+      // exactly what dispose() takes.
+      let waiter = null;
+      const make = () =>
+        effect(
+          () => {
+            if (waiter === null) {
+              waiter = getOwner();
+              const queue = new MicrotaskQueue();
+              queue._parent = waiter._queue;
+              waiter._queue = queue;
+            }
+            return read(node);
+          },
+          value => {
+            res(typeof target === "function" ? value : target);
+            dispose(waiter);
+          },
+          err => {
+            rej(err);
+            dispose(waiter);
+          },
+          {
+            user: true,
+            _extraConfig: CONFIG_DIRECT_COMMIT | CONFIG_AUTHORITATIVE_READ | CONFIG_FRESH_READ
+          }
+        );
+      createRoot(make);
+    });
+  });
+  // Fire-and-forget refresh must not turn a failed refetch into an unhandled
+  // rejection; awaiting callers attach their own handlers to `promise`.
+  promise.catch(() => {});
+  return promise;
+}
+/**
+ * Awaits a reactive predicate and resolves the first time it settles *truthy*,
+ * with that (narrowed) value. Falsy results and pending async reads both mean
+ * "not yet": the subscription stays live and re-evaluates as sources change.
+ * If the predicate settles with an error — a throw, or an async source that
+ * rejects — the promise rejects with it, as do timeout and abort.
+ *
+ * Where {@link resolve} answers "what is this value" (first settled value,
+ * whatever it is), `until` answers "when does the world confirm this
+ * condition". The difference matters inside an `action()`: `yield until(...)`
+ * holds the action's transaction — and any optimistic state riding it — open
+ * until the condition is independently true.
+ *
+ * To make that sound, `until`'s predicate reads the AUTHORITATIVE view — and
+ * this is the one read-semantics difference from `resolve`, which reads the
+ * normal (transaction's own) view where overrides are visible:
+ *
+ * - **Optimistic overrides are invisible** to the predicate. Your own
+ *   tentative write can never satisfy your own ack, even on the
+ *   single-primitive shape where the optimistic store IS the live-fed store.
+ *   (Derived computeds serve their normal cached values — express the
+ *   condition over sources of truth, not derived views of the overlay.)
+ * - **Everything else reads normally, including uncommitted transition-staged
+ *   data.** Real data is real wherever it currently lives. This is
+ *   load-bearing, not a loophole: truth that arrives *into* the open
+ *   transaction (a `refresh()` this action issued, an entangled landing)
+ *   stages and cannot commit until the hold releases — a predicate that
+ *   refused staged reads would deadlock on the very data it is waiting for.
+ *
+ * This is the acknowledgment mechanism for mutations confirmed on a live data
+ * channel (sockets, subscriptions, live queries) rather than by the mutation's
+ * own response: correlate by a client-generated id or version in the predicate,
+ * and let truth arrive however it arrives — push, refetch, or another tab.
+ *
+ * Failure composes with action semantics: a rejection is thrown back into the
+ * generator at the `yield` point — catchable there, or the action fails and
+ * its optimistic state reverts.
+ *
+ * Must be called *outside* a tracking scope.
+ *
+ * @example
+ * ```ts
+ * const send = action(async function* (text: string) {
+ *   const clientId = crypto.randomUUID();
+ *   setMessages(m => { m.push({ clientId, text, pending: true }); }); // optimistic
+ *   await socket.send({ clientId, text }); // fire-and-forget transport
+ *   // Hold until the live source echoes the write (authoritative view —
+ *   // the optimistic row above cannot satisfy this):
+ *   yield until(() => messages.some(m => m.clientId === clientId), { timeout: 10_000 });
+ * });
+ * ```
+ *
+ * @param fn a reactive predicate over authoritative state
+ * @param options optional `timeout` (ms) and abort `signal`
+ */
+function until(fn, options) {
+  if (getObserver()) {
+    throw new Error(
+      "Cannot call until inside a reactive scope; await it from an action or another imperative scope."
+    );
+  }
+  // Late-bind the wakeup hook for the A17-silent ack paths (pay-for-use:
+  // apps that never call until() never retain it).
+  installAuthoritativeRead();
+  // Flip-entanglement (#3164 follow-up): the transaction this until() holds
+  // open (the action's, when yielded from one). The predicate is the user's
+  // declaration of what confirms it — when a foreign transition's staged
+  // write flips it truthy, that transition merges here and reveals at the
+  // joint settle instead of painting the confirmation under live optimism.
+  const awaiting = activeTransition;
+  return new Promise((res, rej) => {
+    const signal = options?.signal;
+    if (signal?.aborted) return rej(signal.reason);
+    createRoot(dispose => {
+      // Same delivery contract as resolve() (#2930): effect applies ride a
+      // microtask so the promise can settle while the transaction the caller
+      // yielded it into is still open — that transaction being open is the
+      // entire point of the hold.
+      const owner = getOwner();
+      const queue = new MicrotaskQueue();
+      queue._parent = owner._queue;
+      owner._queue = queue;
+      let timer;
+      let onAbort;
+      const settle = fire => {
+        if (timer !== undefined) clearTimeout(timer);
+        if (onAbort !== undefined) signal.removeEventListener("abort", onAbort);
+        fire();
+        dispose();
+      };
+      effect(
+        awaiting === null
+          ? fn
+          : () => {
+              const value = fn();
+              // Runs inside the compute (pure phase): the confirming
+              // transition's stamps are live and its commit hasn't run, so
+              // the merge lands before any reveal. Falsy evaluations skip —
+              // non-flipping updates were never named as the confirmation.
+              if (value) entangleConfirmingTransitions(getObserver(), awaiting);
+              return value;
+            },
+        value => {
+          // Falsy is "not yet": keep the subscription live and wait for the
+          // next evaluation. Only a truthy settled value resolves.
+          if (value) settle(() => res(value));
+        },
+        err => settle(() => rej(err)),
+        // AUTHORITATIVE_READ: overrides invisible to the predicate.
+        // DIRECT_COMMIT: truth that stages into the held transaction (a
+        // refresh the action issued) must flow through to the microtask
+        // apply — a staged effect value would deadlock the hold on data
+        // the hold itself is keeping uncommitted.
+        { user: true, _extraConfig: CONFIG_AUTHORITATIVE_READ | CONFIG_DIRECT_COMMIT }
+      );
+      if (options?.timeout !== undefined)
+        timer = setTimeout(() => settle(() => rej(new TimeoutError())), options.timeout);
+      if (signal !== undefined) {
+        onAbort = () => settle(() => rej(signal.reason));
+        signal.addEventListener("abort", onAbort, { once: true });
+      }
+    });
+  });
+}
 function createOptimistic(first, second) {
   // Install before the node exists: only engine-installed programs can carry
   // an _overrideValue slot (same runtime-install pattern as
@@ -7060,8 +8075,29 @@ function materializePB(target) {
   target.ovl = false;
 }
 function ensurePB(target) {
-  if (activeTransition !== null) foldBatches.set(target, activeTransition);
   let pb = target.pb;
+  // Truth-staged backing hand-off (#3164 fold): a TENTATIVE draft opening on
+  // a target whose pending backing is truth-staged (a landing folded into a
+  // retaining transaction — it carries a foldBatches stamp) must not share
+  // the container. Tentative writes would pollute staged truth, and the
+  // tentative discard (notifyOptimisticWrites nulls pb) would destroy the
+  // landing. Park the staged backing and open a fresh draft seeded from the
+  // optimistic view below; the tentative discard restores it. The
+  // tentativePBs guard scopes this to draft OPEN: the draft's own backing
+  // (foldBatches-stamped by its first write when an action's transition is
+  // ambient) must not be parked by its own later writes.
+  if (
+    pb !== null &&
+    !tentativePBs.has(pb) &&
+    target.fam?.opt === true &&
+    !projectionWriteActive &&
+    !getWriteOverride() &&
+    foldBatches.has(target)
+  ) {
+    stagedTruthPB.set(target, pb);
+    pb = target.pb = null;
+  }
+  if (activeTransition !== null) foldBatches.set(target, activeTransition);
   if (pb === null) {
     // Prototype-chain overlay (#3044): plain-data non-array containers
     // outside projection/optimistic families open drafts in O(1) — own keys
@@ -7083,6 +8119,7 @@ function ensurePB(target) {
     // seed from committed truth — seeding overrides there would fold a lane
     // value into the committed home ("authority wins at reveal" would break).
     if (target.fam?.opt && !projectionWriteActive && !getWriteOverride()) {
+      tentativePBs.add(pb);
       const nodes = target.n;
       if (nodes !== null) {
         for (const key of Reflect.ownKeys(nodes)) {
@@ -7200,6 +8237,17 @@ function queueFold(target) {
  * Refreshed on every write; resolved through currentTransition at drain
  * (transitions merge — same rule as heldMaskView). */
 const foldBatches = new WeakMap();
+/** Parked truth-staged pending backings (#3164 fold): a tentative draft that
+ * opens while a folded landing's backing is live moves the staged container
+ * here (see ensurePB); the tentative discard in notifyOptimisticWrites
+ * restores it in place of the usual null. */
+const stagedTruthPB = new WeakMap();
+/** Backings opened by TENTATIVE drafts (optimistic user setters): ensurePB's
+ * truth-park must not fire against the draft's own container on its second
+ * and later writes (the first write stamps foldBatches whenever an action's
+ * transition is ambient). Entries die with their draft — tentative backings
+ * are consumed at setter exit. */
+const tentativePBs = new WeakSet();
 /** Committed-time privatization for parent-chain slot updates (path copying). */
 function privatizeCommitted(target) {
   if (ownedRaw.has(target.v)) return;
@@ -7533,7 +8581,13 @@ function notifyWrites(t) {
   //   IMMEDIATE — landed truth shows to untracked readers even while a
   //   downstream consumer's own async still holds the effect-level reveal
   //   (spec-async "verdicts never inherit consumers' in-flight state").
-  if (t.fam !== null && t.pb !== null && getWriteOverride()) {
+  //   EXCEPT under an active transaction (#3164 fold): a landing riding a
+  //   retaining transaction (the optimistic module's aroundWrite binds it)
+  //   stages instead — ensurePB stamped foldBatches, so the backing commits
+  //   with the transaction and the reveal is atomic at settle. The pinned
+  //   immediate-commit contract is stated over the no-transaction microtask
+  //   posture, which `activeTransition === null` is exactly.
+  if (t.fam !== null && t.pb !== null && getWriteOverride() && activeTransition === null) {
     // Landed truth (post-await write-override): immediately visible to every
     // reader — any staged held view is superseded.
     if (t.ht !== null) t.ht = t.hv = null;
@@ -7786,26 +8840,56 @@ function readSource(target) {
     const hv = heldMaskView(target);
     if (hv !== null) return hv;
   }
-  // Signal-parity visibility (core read(): owner-context reads serve
-  // _pendingValue, context-free reads serve committed — effects recompute
-  // BEFORE commitPendingNodes in the flush, so the pending view must be
-  // servable). Drafts (setter window OR projection write-override) and
-  // owner-context reads see the pending backing; context-free reads see
-  // committed. Node reads apply the same rule, so both homes agree.
-  if (
+  return pendingBackingVisible(target, false) ? target.pb : target.v;
+}
+/** The single pb-vs-committed visibility decision (#3147), shared by per-key
+ * backing reads (readSource) and deep()/snapshot composition (snapshotWalk)
+ * so the two reader families can never disagree about a HELD landing.
+ *
+ * Signal-parity visibility (core read(): owner-context reads serve
+ * _pendingValue, context-free reads serve committed — effects recompute
+ * BEFORE commitPendingNodes in the flush, so the pending view must be
+ * servable). Drafts (setter window OR projection write-override) and
+ * owner-context reads see the pending backing; context-free reads see
+ * committed. Node reads apply the same rule, so all homes agree.
+ *
+ * `speculative` is deep()/snapshot's posture: an untrack/deep PEEK that sees
+ * ordinary pending staging regardless of owner context (the documented
+ * divergence from context-free per-key reads) — but never through a hold:
+ * held truth stays masked exactly as it is for per-key readers. */
+function pendingBackingVisible(target, speculative) {
+  return (
     target.pb !== null &&
     (inDraft(target) ||
       getWriteOverride() ||
-      inOwnerContext() ||
+      // Owner-context (and speculative-peek) readers see the pending
+      // backing — EXCEPT held truth on an optimistic family (#3164 fold):
+      // a live pb on an opt family outside the draft/write-override windows
+      // is a staged landing (tentative drafts never outlive their setter),
+      // and only the authoritative postures and latest() see it (the
+      // backing-level twin of core read()'s A17-for-held-truth arm;
+      // ordinary readers keep committed until the transaction's reveal).
+      ((speculative || inOwnerContext()) && !heldTruthMasked(target)) ||
       // A projection's pending backing is authoritative-elect: serve it to
       // context-free readers too UNLESS a transition is holding the node
       // commits (downstream async hold — stale committed is the contract)
       // or the reader is a CHILDREN_FORBIDDEN scope, which never observes
       // its own unsettled write (#3082, signal parity per #3006).
-      (target.fam !== null && !foldHeld(target) && !inForbiddenScope()))
-  )
-    return target.pb;
-  return target.v;
+      (target.fam !== null && !heldTruthMasked(target) && !foldHeld(target) && !inForbiddenScope()))
+  );
+}
+/** #3164 fold: HELD truth on an optimistic family — a pending backing
+ * stamped by a live transition that retains optimism — is masked from
+ * ordinary readers (they keep committed until the transaction's reveal);
+ * the authoritative postures and latest() tunnel through. Un-stamped
+ * backings and optimism-free transitions keep ordinary mid-batch/
+ * speculation visibility. */
+function heldTruthMasked(target) {
+  if (target.fam?.opt !== true || latestReadActive || authoritativeServe()) return false;
+  const fb = foldBatches.get(target);
+  // opt families are only created by createOptimisticStore, whose module
+  // install populates optHooks — the assertion holds by construction.
+  return fb !== undefined && optHooks.retainsOptimism(fb);
 }
 const hasOwn = Object.prototype.hasOwnProperty;
 // Allocation-free own-accessor probe (replaces eager descriptor scans — the
@@ -7838,6 +8922,26 @@ function runAuthoritative(fn) {
 function hasActiveOverride(node) {
   return node._x?._overrideValue !== undefined && node._x?._overrideValue !== NOT_PENDING;
 }
+/** The reading computation is until()'s authoritative-view predicate — same
+ * source of truth as core read()'s A17 carve-out (`context`, which persists
+ * under untrack). optimisticView()'s composition gate consults exactly this:
+ * write-side machinery (patch emission, tentative re-application) must keep
+ * composing even when it runs inside an authoritative-write bracket. */
+function authoritativeRead() {
+  const c = context;
+  return c !== null && (c._config & CONFIG_AUTHORITATIVE_READ) !== 0;
+}
+/** Serve-side authoritative gate: until()'s predicate PLUS truth authors —
+ * the projection derive's draft (wrapDraft trap brackets, runAuthoritative;
+ * the same posture pair ensurePB classifies drafts by). A source computing
+ * the next truth must never read its callers' tentative overlays: a derive
+ * continuation's `store.push` computing its index from an action's
+ * optimistic row landed truth in the wrong slot and corrupted committed
+ * state (#3108). Trap-level overlay serves gate on this so values, length,
+ * membership, and keys leave the authoritative view together. */
+function authoritativeServe() {
+  return projectionWriteActive || getWriteOverride() || authoritativeRead();
+}
 /** Context-aware node view for reads outside tracking: active override >
  * held pending (owner context) > the BACKING value. Committed truth lives in
  * the backing (single-home rule, O6) — node `_value` is never served here,
@@ -7848,11 +8952,24 @@ function hasActiveOverride(node) {
 function nodeValue(node, backing) {
   // latest() sees the in-flight parked value like an owner-context reader
   // does (#3075) — signal/memo parity for store-node-backed keys.
-  const v = hasActiveOverride(node)
-    ? unwrapOverride(node._x?._overrideValue)
-    : node._pendingValue !== NOT_PENDING && (latestReadActive || inOwnerContext())
-      ? node._pendingValue
-      : backing;
+  // Authoritative-view reads (until()'s predicate) skip the override arm
+  // only: staged pending values are authoritative, overrides are the
+  // caller's optimism.
+  const v =
+    !authoritativeServe() && hasActiveOverride(node)
+      ? unwrapOverride(node._x?._overrideValue)
+      : node._pendingValue !== NOT_PENDING &&
+          (latestReadActive ||
+            // Owner-context pending visibility — except HELD truth (#3164,
+            // see CONFIG_HELD_TRUTH: fold-staged or entangle-stolen
+            // confirming truth), which only authoritative/latest readers
+            // see (core read()'s A17-for-held-truth twin; ordinary readers
+            // keep committed until the transaction's reveal — latest() is
+            // exempted by the leading arm above).
+            ((inOwnerContext() || authoritativeServe()) &&
+              !(node._config & CONFIG_HELD_TRUTH && !authoritativeServe())))
+        ? node._pendingValue
+        : backing;
   return v === FORCE ? backing : v;
 }
 /** Serve an own data key: node-first when a node exists (pending visibility,
@@ -7877,13 +8994,18 @@ function serveDataKey(target, key, backingValue, src, node) {
         read(getNode(target, key, backingValue));
       }
     }
-    return optHooks.optimisticView(target, src).length;
+    // Truth authors read the backing's own length — an optimistic row from
+    // the caller's transaction must not shift where the author's next write
+    // lands (#3108).
+    return (authoritativeServe() ? src : optHooks.optimisticView(target, src)).length;
   }
   if (inDraft(target)) {
     // Optimistic drafts before their first write have no pending backing yet;
     // reads must still see the live optimistic view (compose, not clobber —
     // #2951). Once ensurePB runs, the seeded clone carries the view.
-    if (target.fam?.opt && target.pb === null) {
+    // AUTHORITATIVE drafts (projection derive) never overlay — ensurePB's
+    // seeding rule, applied to the read side (#3108).
+    if (target.fam?.opt && target.pb === null && !authoritativeServe()) {
       const node = target.n?.[key];
       if (node !== undefined && hasActiveOverride(node))
         v = unwrapOverride(node._x?._overrideValue);
@@ -8092,7 +9214,15 @@ const traps = {
           if (target.s) return serveShallow(target, key, nv);
           return isWrappable(nv) ? draftServe(target, wrapNext(nv, target, key)) : nv;
         }
-      } else if (v === undefined && inDraft(target) && target.fam?.opt && target.pb === null) {
+      } else if (
+        v === undefined &&
+        inDraft(target) &&
+        target.fam?.opt &&
+        target.pb === null &&
+        // AUTHORITATIVE drafts (landing folds) never seed from overrides —
+        // the caller's optimism is not truth (has-trap twin below).
+        !authoritativeServe()
+      ) {
         const node = target.n?.[key];
         if (node !== undefined && hasActiveOverride(node))
           v = unwrapOverride(node._x?._overrideValue);
@@ -8119,14 +9249,16 @@ const traps = {
     if (!inDraft(target)) {
       if (getObserver() !== null) {
         const node = getHasNode(target, key, present);
+        // Authoritative-view readers get the right answer for free: core read()
+        // skips the override arm for them, so nv is authoritative presence.
         const nv = read(node);
         if (hasActiveOverride(node)) present = !!nv;
-      } else {
+      } else if (!authoritativeServe()) {
         const node = target.h?.[key];
         if (node !== undefined && hasActiveOverride(node))
           present = !!unwrapOverride(node._x?._overrideValue);
       }
-    } else if (target.fam?.opt && target.pb === null) {
+    } else if (target.fam?.opt && target.pb === null && !authoritativeServe()) {
       const node = target.h?.[key];
       if (node !== undefined && hasActiveOverride(node))
         present = !!unwrapOverride(node._x?._overrideValue);
@@ -8152,8 +9284,14 @@ const traps = {
     // Optimistic membership overlay: presence-node overrides add/remove keys
     // (per-transaction lifecycle rides the nodes — §6, FINDING-2's fix).
     // Draft reads before the first write overlay too (pb, once created, is
-    // seeded with the view).
-    if (target.fam?.opt && target.h !== null && (!inDraft(target) || target.pb === null)) {
+    // seeded with the view). Authoritative-view reads (until()'s predicate,
+    // truth-author drafts) skip the overlay.
+    if (
+      !authoritativeServe() &&
+      target.fam?.opt &&
+      target.h !== null &&
+      (!inDraft(target) || target.pb === null)
+    ) {
       let set = null;
       for (const key of Reflect.ownKeys(target.h)) {
         const node = target.h[key];
@@ -8175,7 +9313,7 @@ const traps = {
       if (target.del !== null && target.del.has(key)) return undefined;
       if (desc === undefined) desc = Object.getOwnPropertyDescriptor(target.v, key);
     }
-    if (target.fam?.opt && !inDraft(target)) {
+    if (!authoritativeServe() && target.fam?.opt && !inDraft(target)) {
       const node = target.h?.[key];
       if (node !== undefined && hasActiveOverride(node)) {
         if (!unwrapOverride(node._x?._overrideValue)) return undefined; // opt delete
@@ -8466,10 +9604,15 @@ function snapshotWalk(value, seen, fam) {
     if (t === undefined) break;
     if (t.fam !== null) fam = t.fam;
     if (t.fam?.opt === true) (optOwners ??= []).push(t);
+    // The shared visibility decision (#3147): the speculative peek serves
+    // pending staging, but a HELD landing is masked to committed exactly as
+    // it is for per-key readers — the two families must answer alike while
+    // a transaction holds store landings.
+    const usePB = pendingBackingVisible(t, true);
     // Snapshot runs mid-flush (tracked memos execute before commit), so a
     // pending prototype overlay must present as a REAL merged container.
-    if (t.ovl) materializePB(t);
-    const backing = t.pb ?? t.v;
+    if (usePB && t.ovl) materializePB(t);
+    const backing = usePB ? t.pb : t.v;
     if (backing === src) break;
     src = backing;
   }
@@ -9138,7 +10281,8 @@ function descend(pv, nv, keyFn, fam, proj = false) {
  * driven from inside an enclosing authoritative-write scope (next-store
  * optimistic derives), and a hard `false` would clobber it mid-derive.
  */
-function wrapDraft(inner, isActive, onDraftWrite) {
+function wrapDraft(inner, isActive, aroundWrite) {
+  const write = op => (aroundWrite ? aroundWrite(op) : op());
   const traps = {
     get(_, prop) {
       let value;
@@ -9153,7 +10297,7 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       }
       if (prop === $TARGET) return value;
       return typeof value === "object" && value !== null
-        ? wrapDraft(value, isActive, onDraftWrite)
+        ? wrapDraft(value, isActive, aroundWrite)
         : value;
     },
     has(_, prop) {
@@ -9175,8 +10319,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        inner[prop] = value;
-        onDraftWrite?.();
+        write(() => {
+          inner[prop] = value;
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -9189,8 +10334,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        delete inner[prop];
-        onDraftWrite?.();
+        write(() => {
+          delete inner[prop];
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -9231,8 +10377,9 @@ function wrapDraft(inner, isActive, onDraftWrite) {
       setWriteOverride(true);
       setProjectionWriteActive(true);
       try {
-        Reflect.defineProperty(inner, prop, desc);
-        onDraftWrite?.();
+        write(() => {
+          Reflect.defineProperty(inner, prop, desc);
+        });
       } finally {
         setWriteOverride(false);
         setProjectionWriteActive(was);
@@ -9284,7 +10431,7 @@ function createStoreDerivedNext(fn, seed, options) {
     }
   ];
 }
-function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWrite) {
+function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, aroundDraftWrite) {
   const owner = getOwner();
   let settled = false;
   let result;
@@ -9298,7 +10445,7 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
   const draft = wrapDraft(
     wrappedStore,
     () => !settled || owner._x?._inFlight === result,
-    onDraftWrite
+    aroundDraftWrite
   );
   storeSetterNext(
     draft,
@@ -9313,7 +10460,7 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, onDraftWri
         if (v === s || v === undefined) return;
         const write = () =>
           storeSetterNext(wrappedStore, st => reconcileNextState(v, st, key, true), false);
-        wrapCommit ? wrapCommit(write) : write();
+        wrapCommit ? wrapCommit(write, v) : write();
       };
       const sync = handleAsync(owner, result, commit);
       if (!owner._loading) commit(sync);
@@ -9884,12 +11031,31 @@ function armRowHooks() {
  * armed presence nodes (the §6 overlay), so structural optimism reverts with
  * the same per-transaction granularity (FINDING-2's fix by construction).
  *
- * Derived form = an optimistic projection: the derive's recompute and its
- * async commits run under projectionWriteActive (authoritative landings
- * commit silently beneath any active overrides). The transitionBlocked
- * store-half (#2951) is installed here for next-shaped targets, chaining the
+ * Derived form = an optimistic projection. Landings follow the fold rule
+ * (#3164, RUL-2 as re-ruled): while a transaction retains optimistic edits
+ * on the family, truth that lands STAGES into that transaction — a keyed
+ * identity-preserving walk written through the ordinary staged setter
+ * channel — and reveals atomically at settle, exactly like a signal landing
+ * under an active override (asyncWrite's held branch). Optimistic edits are
+ * never consumed by landings; they live exactly as long as their transaction
+ * and die by engine-native revert. With no retainer, landings commit
+ * immediately under projectionWriteActive (authoritative, silently beneath
+ * any bare-write overrides — those ride the flight's own transition, #2951).
+ * Authoritative readers (until()'s predicate) tunnel into staged truth via
+ * the node read path's pending-value arm. The transitionBlocked store-half
+ * (#2951) is installed here for next-shaped targets, chaining the
  * legacy/engine checks.
  */
+/** #3164 fold: a stamped truth is HELD (masked from ordinary readers until
+ * the reveal) only while its transition is live AND retaining optimism —
+ * overrides are what make partial-coverage composition a tear. A plain
+ * async transition carries no overrides, so downstream computes must see
+ * staged values to converge (normal speculation). Resolves merges first:
+ * merge unions optimistic nodes/stores into the target. */
+function transitionHoldsOptimism(transition) {
+  const t = currentTransition(transition);
+  return t._done !== true && (t._optimisticNodes.length !== 0 || t._optimisticStores.size !== 0);
+}
 let blockedInstalled = false;
 function installNextBlockedHalf() {
   if (blockedInstalled) return;
@@ -9897,7 +11063,12 @@ function installNextBlockedHalf() {
   // Late-bind the optimistic machinery into the plain store/reconcile paths
   // (all call sites are fam?.opt-gated, so this always runs first) and the
   // affects witness's view resolver.
-  setOptHooks({ notifyOptimisticWrites, optimisticView, applyTentative });
+  setOptHooks({
+    notifyOptimisticWrites,
+    optimisticView,
+    applyTentative,
+    retainsOptimism: transitionHoldsOptimism
+  });
   setNextOptimisticViewResolver((t, raw) => optimisticView(t, raw));
   // Scheduler flush tails call _clearOptimisticStores whenever tracked
   // stores exist; next has no layer to clear — reverts are engine-native —
@@ -9918,6 +11089,13 @@ function installNextBlockedHalf() {
             // row identity against the post-revert view (resolved from the
             // target at drain — overrides are gone by then).
             if (ot.pc !== null && ot.pc.ro !== null) rowHooks.emitRowOpsOptimistic(ot, null, null);
+            // Keyset resync (classic channel twin): the keyset node's own
+            // revert can compare EQUAL (a landing's bump matched the
+            // tentative bump) while the arrangement underneath changed —
+            // mapArray/ownKeys subscribers must re-read the post-revert
+            // view. Authoritative bump: never re-arm the node we are
+            // clearing.
+            if (ot.k !== null) runAuthoritative(() => setSignal(ot.k, v => v + 1));
           }
         }
       }
@@ -9928,14 +11106,21 @@ function installNextBlockedHalf() {
   GlobalQueue._transitionBlocked = transition => {
     for (const store of transition._optimisticStores) {
       const t = store?.[$TARGET];
-      const fw = t?.fam?.node;
+      const fam = t?.fam;
+      const fw = fam?.node;
       // The hold exists to keep optimistic state alive until the store's own
       // truth lands (#2951). Once the family carries NO live overrides (a
       // landing consumed them, or they never existed), a pending firewall is
       // no reason to park the transaction — blocking then leaks it forever
       // when the in-flight question is never answered (undisposed fixtures).
-      if (fw != null && fw._statusFlags & STATUS_PENDING && familyHasLiveOverrides(t.fam))
-        return true;
+      if (fw == null || !(fw._statusFlags & STATUS_PENDING)) continue;
+      // Ownership is declared (#3146): only the flight's OWN transaction
+      // parks on the flight (the #2951 anchor routed the bare write there).
+      // A transaction that merely brushed the store never waits for truth
+      // it does not carry.
+      const ft = fam.ft != null ? liveTransition(fam.ft) : null;
+      if (ft !== null && ft !== currentTransition(transition)) continue;
+      if (familyHasLiveOverrides(fam)) return true;
     }
     return chained(transition);
   };
@@ -9978,39 +11163,304 @@ function createOptimisticStoreNext(first, second, options) {
   };
   const store = wrapNext(initialValue, null, null, fam);
   fam.px = store;
+  // Same key resolution the projection channels use ("id" default) — replay's
+  // satisfaction rule reads it off the family.
+  const keyOption = options?.key === undefined ? "id" : options.key;
+  fam.key =
+    typeof keyOption === "function"
+      ? keyOption
+      : keyOption === null
+        ? null
+        : row => (isWrappable(row) ? row[keyOption] : undefined);
   if (fam.shallow) {
     store[$TARGET].s = true;
     markRawIngest(initialValue);
   }
   if (derived) {
     const fn = first;
-    // Async commits land outside the computed's sync body — re-apply the
-    // authoritative-write posture there too. Landings consume the family's
-    // tentative overrides (RUL-2: visible landed truth replaces optimism) —
-    // both the reconcile-channel commit and per-op post-await draft writes.
-    const consume = () => consumeOverridesNext(fam);
-    const wrapCommit = write => {
+    // #3146: an async settle event belongs to the flight's OWN transaction.
+    // A live declared one re-enters (a merge if the generic settle path
+    // already entered a graph-stamped stranger — the landing supersedes any
+    // recompute deriving from that stranger's world); a dead one renews (per
+    // A18(1) each arrival reveals on its own schedule, so per-yield
+    // transactions die with their commit and the next settle event opens the
+    // flight's next one — still declared, never anonymous). An UNDECLARED
+    // flight (loading window) keeps the ambient reveal (#2933: the loading
+    // rail is transaction-invisible).
+    const enterFlightTransition = () => {
+      const declared = fam.ft;
+      if (declared == null) return;
+      let ft = liveTransition(declared);
+      if (ft === null) fam.ft = ft = createTransition();
+      fam.node._transition = ft;
+      globalQueue.initTransition(ft);
+    };
+    // Landing router (#3164 fold ruling): while a transaction retains
+    // optimistic edits on this family, truth landings stage INTO it and
+    // reveal atomically at settle; with no retainer they commit immediately
+    // under the authoritative posture (async commits land outside the
+    // computed's sync body, so the posture is re-applied here) — inside the
+    // flight-owned transaction (#3146). Sync commits (the derive's body,
+    // owner is the firewall itself) reveal with their own recompute's flush.
+    const wrapCommit = (write, value) => {
+      const txn = retainingTransition(fam);
+      if (txn !== null) return void stageLanding(fam, txn, value);
+      if (getOwner() !== fam.node) enterFlightTransition();
       runAuthoritative(write);
-      consume();
+    };
+    // Draft writes (the derive mutating its draft, sync body and post-await
+    // continuations alike) are the same truth channel per-operation: bind
+    // each op to the retaining transaction so its node writes stage and its
+    // backing fold defers (ensurePB stamps foldBatches with the swapped-in
+    // batch; the write-override eager-commit branch in notifyWrites yields
+    // to any active transaction).
+    const aroundDraftWrite = op => {
+      const txn = retainingTransition(fam);
+      if (txn === null) op();
+      else runFolded(txn, op);
+    };
+    // Flight declaration (#3146): a recompute that registered a truth-flight
+    // OWNS its transaction. The ask's transaction is recorded on the family
+    // (created by the flight's own pending throw when none was ambient, the
+    // causing write's/refresh's when one was — graph-driven causality) and
+    // the firewall is stamped so every settle path resolves the flight's
+    // transaction by construction, not by whatever last brushed the node.
+    // When the ask took none (a dead stale stamp — the previous flight's,
+    // cleared nowhere — bare-returns the pre-throw entry), the flight opens
+    // its own here, same activation point as the pre-throw's creation: the
+    // ambient batch (the causing write, same-tick bare optimism) adopts into
+    // it exactly as it would have there, and the pending notification that
+    // follows this unwind registers observers against it. The flight
+    // also registers as its own async reporter: the transaction lives
+    // exactly as long as the question is unanswered, observed or not — the
+    // #2951 refetch-hold no longer depends on a tracked observer having
+    // happened to register one. Loading-window flights declare nothing
+    // (#2933: the loading rail is transaction-invisible); a sync run clears
+    // the declaration.
+    const declareFlight = self => {
+      if (self._x?._inFlight == null) {
+        if (!self._loading) fam.ft = null;
+        return;
+      }
+      if (self._loading) return;
+      let txn = activeTransition;
+      if (txn === null) globalQueue.initTransition((txn = createTransition()));
+      fam.ft = txn;
+      self._transition = txn;
+      let reporters = txn._asyncReporters.get(self);
+      if (reporters === undefined) txn._asyncReporters.set(self, (reporters = new Set()));
+      reporters.add(self);
     };
     let nodeOptions;
     if (options?.seedLoadingValue) nodeOptions = { loadingValue: undefined };
     if (options?.name) nodeOptions = { ...nodeOptions, name: options.name };
     const node = computed(() => {
-      runAuthoritative(() =>
-        runProjectionComputedNext(
-          store,
-          fn,
-          options?.key === undefined ? "id" : options.key,
-          wrapCommit,
-          consume
-        )
-      );
+      const self = getOwner();
+      try {
+        runAuthoritative(() =>
+          runProjectionComputedNext(
+            store,
+            fn,
+            options?.key === undefined ? "id" : options.key,
+            wrapCommit,
+            aroundDraftWrite
+          )
+        );
+      } finally {
+        declareFlight(self);
+      }
     }, nodeOptions);
     node._config &= ~CONFIG_AUTO_DISPOSE;
     fam.node = node;
   }
-  return [store, fn => storeSetterNext(store, fn)];
+  return [
+    store,
+    fn => {
+      // Retention ledger (#3164): record the owning transaction so landings
+      // know to fold. Captured at entry — the action machinery has the
+      // transaction ambient while user code runs; a bare write with no
+      // transaction retains nothing (it rides the flight's own transition
+      // per #2951 and dies with it).
+      const txn = activeTransition;
+      storeSetterNext(store, fn);
+      if (txn !== null) (fam.rt ??= new Set()).add(txn);
+    }
+  ];
+}
+/** Resolve a retained transition through its merge chain (`_done` holds the
+ * merge target while merged, `true` once settled). Null = dead. */
+function liveTransition(txn) {
+  while (typeof txn._done === "object") txn = txn._done;
+  return txn._done === true ? null : txn;
+}
+/** The transaction truth landings fold into: the first live member of the
+ * family's retention ledger (dead members prune here). Multiple live
+ * retainers entangle through their shared family writes and settle
+ * together, so folding into the first reaches all of them. */
+function retainingTransition(fam) {
+  const rt = fam.rt;
+  if (rt === undefined || rt.size === 0) return null;
+  let live = null;
+  for (const txn of rt) {
+    const resolved = liveTransition(txn);
+    if (resolved === null) rt.delete(txn);
+    else live ??= resolved;
+  }
+  return live;
+}
+/** Fold a landing into the retaining transaction (#3164): the landed value
+ * is written through the ORDINARY staged setter channel — node writes park
+ * as `_pendingValue` registered with the transaction's batch (speculation
+ * and until()'s authoritative tunnel see them; live view stays coherent),
+ * and the backing fold defers via the foldBatches stamp — under the
+ * authoritative posture, so armed nodes take the engine bypass and no
+ * override is created. The engine's own commit machinery reveals everything
+ * atomically when the transaction settles (transitions never abort: failed
+ * actions still commit — only optimistic overrides revert). */
+function stageLanding(fam, txn, incoming) {
+  runFolded(txn, () =>
+    runAuthoritative(() =>
+      storeSetterNext(
+        fam.px,
+        draft => {
+          stagedApply(draft, unwrapValue(incoming), fam.key ?? null);
+        },
+        false
+      )
+    )
+  );
+}
+/** Run a fold write inside the retaining transaction's batch, then
+ * transition-stamp its staged nodes NOW (parity with the parked-transition
+ * flush path's reassignPendingTransition): the stamp is what routes stale
+ * (render) readers to the committed value — core read's cross-transaction
+ * guard — and what makes foldHeld defer the backing for context-free
+ * readers. A microtask staging never crosses that flush path, so without
+ * the stamp a render effect's speculative recompute would compose staged
+ * truth with live overrides — the #3164 tear, one window later. Armed
+ * nodes additionally raise CONFIG_HELD_TRUTH: their staged value is
+ * confirming truth masked from ordinary readers until the reveal (plain
+ * staged nodes stay visible — normal speculation; override-covered nodes
+ * stay unarmed — the override is their display and its revert their
+ * notification, A17). */
+function runFolded(txn, op) {
+  runAsTransitionBatch(txn, op);
+  const pending = txn._pendingNodes;
+  for (let i = 0; i < pending.length; i++) {
+    const node = pending[i];
+    node._transition = txn;
+    if (node._config & CONFIG_OPTIMISTIC && !hasActiveOverride(node))
+      node._config |= CONFIG_HELD_TRUTH;
+  }
+}
+/** Keyed identity-preserving deep merge through live draft proxies — the
+ * staged twin of the adoption walk. Reads see the pending backing (staged
+ * view), so consecutive landings during one hold compose; key-matched rows
+ * keep their raw (and so their proxy) in the slot with only changed leaves
+ * written; unmatched rows land wholesale. Runs inside stageLanding's
+ * authoritative bracket: drafts seed from committed truth, never overlays. */
+function stagedApply(cur, incoming, keyFn) {
+  const curArr = Array.isArray(cur);
+  if (curArr && Array.isArray(incoming)) {
+    const len = incoming.length;
+    if (keyFn !== null) {
+      // Occurrence-aware key queues (parity with the adoption window):
+      // duplicate keys match per occurrence, each current row consumed once.
+      let byKey = null;
+      const curLen = cur.length;
+      for (let j = 0; j < curLen; j++) {
+        const raw = unwrapValue(cur[j]);
+        if (!isWrappable(raw)) continue;
+        const k = keyFn(raw);
+        if (k === undefined) continue;
+        const q = (byKey ??= new Map()).get(k);
+        if (q === undefined) byKey.set(k, [raw]);
+        else q.push(raw);
+      }
+      // Echo adoption: an optimistic structural add whose key the landing
+      // confirms must keep its raw (and so its proxy — list drivers keep the
+      // DOM row). Tentative rows never reach committed truth (they live in
+      // node overrides), so key-match the draft target's active override
+      // rows as a secondary pool. Committed rows queued first own their
+      // keys; overlay rows only extend coverage. Adopted raws enter staged
+      // truth; at settle the override reverts and the reveal re-seats the
+      // same raw.
+      const overlayNodes = cur[$TARGET]?.n;
+      if (overlayNodes != null) {
+        for (const ok of Reflect.ownKeys(overlayNodes)) {
+          const node = overlayNodes[ok];
+          if (!hasActiveOverride(node)) continue;
+          const raw = unwrapValue(unwrapOverride(node._x._overrideValue));
+          if (!isWrappable(raw)) continue;
+          const k = keyFn(raw);
+          if (k === undefined) continue;
+          const q = (byKey ??= new Map()).get(k);
+          if (q === undefined) byKey.set(k, [raw]);
+          else q.push(raw);
+        }
+      }
+      for (let i = 0; i < len; i++) {
+        const nv = incoming[i];
+        let matched;
+        if (isWrappable(nv) && byKey !== null) {
+          const nk = keyFn(nv);
+          if (nk !== undefined) {
+            for (const [k, q] of byKey) {
+              if (!sameKey(k, nk)) continue;
+              matched = q.shift();
+              if (q.length === 0) byKey.delete(k);
+              break;
+            }
+          }
+        }
+        if (matched !== undefined) {
+          if (unwrapValue(cur[i]) !== matched) cur[i] = matched;
+          stagedApply(cur[i], nv, keyFn);
+        } else {
+          const pv = unwrapValue(cur[i]);
+          if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) cur[i] = nv;
+        }
+      }
+    } else {
+      for (let i = 0; i < len; i++) {
+        const nv = incoming[i];
+        const pv = unwrapValue(cur[i]);
+        if (pv === nv) continue;
+        if (isWrappable(nv) && isWrappable(pv) && Array.isArray(nv) === Array.isArray(pv))
+          stagedApply(cur[i], nv, keyFn);
+        else if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) cur[i] = nv;
+      }
+    }
+    if (cur.length !== len) cur.length = len;
+    return;
+  }
+  // Object merge; also the degenerate root-kind-change shape (arrays accept
+  // keyed writes/deletes, so a wholesale restatement still lands staged).
+  for (const k of Reflect.ownKeys(incoming)) {
+    if (curArr && k === "length") continue;
+    const nv = incoming[k];
+    const pv = unwrapValue(cur[k]);
+    if (pv === nv) continue;
+    if (isWrappable(nv) && isWrappable(pv) && Array.isArray(nv) === Array.isArray(pv)) {
+      // Different-keyed entities never merge (tentative-channel parity):
+      // the incoming object replaces the slot wholesale.
+      if (keyFn !== null) {
+        const pk = keyFn(pv);
+        const nk = keyFn(nv);
+        if (pk !== undefined && nk !== undefined && !sameKey(pk, nk)) {
+          cur[k] = nv;
+          continue;
+        }
+      }
+      stagedApply(cur[k], nv, keyFn);
+    } else if (!isEqual(pv, nv) && !targetsEqual(pv, nv)) {
+      cur[k] = nv;
+    }
+  }
+  for (const k of Reflect.ownKeys(cur)) {
+    if ((curArr && k === "length") || k in incoming) continue;
+    delete cur[k];
+  }
 }
 // ---- optimistic-only store machinery (moved from next/store.ts /
 // next/reconcile.ts so plain-store bundles tree-shake it) ----
@@ -10019,13 +11469,18 @@ function createOptimisticStoreNext(first, second, options) {
  * for exactly the changed keys. Visible-view diffing keeps no-op writes from
  * entangling lanes (RUL-10 / opt R38). */
 function notifyOptimisticWrites(t, pb) {
-  // A bare write while the store's own truth is in flight rides THAT
-  // transaction (#2951, legacy parity): entangle the firewall's transition so
-  // the override survives until the refetch settles instead of flash-reverting
+  // A bare write while the store's own truth is in flight rides the FLIGHT'S
+  // OWN transaction (#2951 via the #3146 declaration): entangle it so the
+  // override survives until the refetch settles instead of flash-reverting
   // at plain flush end. The blocked-check store-half keeps that transaction
-  // from settling while the firewall is pending.
-  const fw = t.fam?.node;
-  if (fw?._transition) globalQueue.initTransition(fw._transition);
+  // from settling while the firewall is pending. Declared ownership replaces
+  // the old circumstantial route through the firewall's `_transition` stamp,
+  // which was whatever last brushed the node.
+  const declared = t.fam?.ft;
+  if (declared != null) {
+    const ft = liveTransition(declared);
+    if (ft !== null) globalQueue.initTransition(ft);
+  }
   const old = t.v;
   // Patch channel (override-application site): the draft IS the intended
   // visible state; prev is the view before these overrides apply. Bypasses
@@ -10093,96 +11548,22 @@ function notifyOptimisticWrites(t, pb) {
   // (structural ones already ride the key-set bump above).
   bumpDeep(t);
   // Discard the draft — committed raw is untouched (revert target by
-  // construction). Register the root store for the scheduler's settle hooks
-  // and the target for landing consumption (RUL-2).
-  t.pb = null;
+  // construction) — restoring any truth-staged backing this draft displaced
+  // (#3164 fold: ensurePB parked it so tentative writes could not pollute
+  // staged truth). Register the root store for the scheduler's settle hooks.
+  t.pb = stagedTruthPB.get(t) ?? null;
+  if (t.pb !== null) stagedTruthPB.delete(t);
   (t.fam.overlaid ??= new Set()).add(t);
   GlobalQueue._trackOptimisticStore?.(t.fam.px ?? t.px);
 }
-/**
- * Landing consumption (RUL-2): fresh authoritative data supersedes every
- * tentative override in the family. Mirrors legacy clearProjectionOverride —
- * drop the override, clear lane/ownership, notify subscribers whose visible
- * value changes (reversion effects go to regular queues via the projection
- * write posture the caller holds).
- */
-function consumeOverridesNext(fam) {
-  const overlaid = fam.overlaid;
-  if (overlaid === undefined || overlaid.size === 0) return;
-  runAuthoritative(() => {
-    for (const t of overlaid) {
-      const drop = (node, committed) => {
-        if (!hasActiveOverride(node)) return;
-        const prev = unwrapOverride(node._x?._overrideValue);
-        // Full legacy reset (clearOptimisticOverride parity): the landing is
-        // authoritative NOW — fold committed into the node directly instead
-        // of riding a transaction's commit (whose queues may be stashed with
-        // the transaction parked; the wake would strand until it settles).
-        ext(node)._overrideValue = NOT_PENDING;
-        node._config |= CONFIG_OPTIMISTIC;
-        const nx = node._x;
-        if (nx) {
-          nx._overrideOwner = null;
-          nx._optimisticLane = undefined;
-        }
-        node._pendingValue = NOT_PENDING;
-        node._value = committed;
-        if (!node._equals || !node._equals(prev, committed)) {
-          insertSubs(node, true);
-          schedule();
-        }
-      };
-      // Landing consumes STRUCTURAL optimism only (legacy layer parity):
-      // membership edits, array length, and the value overrides written WITH
-      // them (a key carrying an active presence override is an add/delete —
-      // classified BEFORE the adoption may have made the key exist in landed
-      // data). A pure value override on a key the landing carries stays with
-      // its owning transaction (rapid-toggle contract: a live action's edit
-      // of an existing entity rides on top of landed truth).
-      const isArr = Array.isArray(t.v);
-      const has = t.h;
-      let structuralKeys = null;
-      if (has !== null) {
-        for (const key of Reflect.ownKeys(has)) {
-          if (hasActiveOverride(has[key])) (structuralKeys ??= new Set()).add(key);
-        }
-      }
-      const nodes = t.n;
-      if (nodes !== null) {
-        for (const key of Reflect.ownKeys(nodes)) {
-          const structural =
-            structuralKeys?.has(key) || !(key in t.v) || (isArr && key === "length");
-          if (!structural) continue;
-          drop(nodes[key], isArr && key === "length" ? t.v.length : t.v[key]);
-        }
-      }
-      if (has !== null) {
-        for (const key of Reflect.ownKeys(has)) drop(has[key], key in t.v);
-      }
-      if (t.k !== null && hasActiveOverride(t.k)) {
-        ext(t.k)._overrideValue = NOT_PENDING;
-        t.k._config |= CONFIG_OPTIMISTIC;
-        const kx = t.k._x;
-        if (kx) {
-          kx._overrideOwner = null;
-          kx._optimisticLane = undefined;
-        }
-        insertSubs(t.k, true);
-        schedule();
-      }
-      // Patch channel (override-consumption site): visible truth flipped to
-      // committed for the consumed keys — force a re-apply from the live
-      // view so the DOM leaves the override state.
-      if (t.pc !== null && t.pc.p !== null) patchHooks.emitPatchOptimistic(t, null, null);
-    }
-    overlaid.clear();
-  });
-}
 /** Optimistic-view composition for snapshot/deep (O1: snapshot is the CURRENT
  * view, lane values included; a fresh copy per call during pending windows —
- * RUL-12). Returns `src` untouched when no override is active on `t`. */
+ * RUL-12). Returns `src` untouched when no override is active on `t`.
+ * Authoritative-view reads (until()'s predicate) skip composition entirely:
+ * the predicate observes authoritative truth, never the caller's tentative
+ * overlay. (Write-side emission callers never run under such a compute.) */
 function optimisticView(t, src) {
-  if (t.fam?.opt !== true) return src;
+  if (t.fam?.opt !== true || authoritativeRead()) return src;
   let out = null;
   const ensure = () => (out ??= Array.isArray(src) ? [...src] : { ...src });
   const nodes = t.n;
@@ -11506,7 +12887,10 @@ function flattenArray(children, results = [], options) {
         } while (typeof child === "function" && !child.length);
       }
       if (Array.isArray(child)) {
-        needsUnwrap = flattenArray(child, results, options);
+        // OR, don't overwrite: an accessor already pushed under doNotUnwrap
+        // still needs the resolving wrapper even when a later sibling
+        // fragment contains no functions (#3133).
+        needsUnwrap = flattenArray(child, results, options) || needsUnwrap;
       } else if (
         options?.skipNonRendered &&
         (child == null || child === true || child === false || child === "")
@@ -11534,6 +12918,7 @@ export {
   NoOwnerError,
   NotReadyError,
   SUPPORTS_PROXY,
+  TimeoutError,
   action,
   affects,
   clearSnapshots,
@@ -11592,5 +12977,6 @@ export {
   storeHasOptimisticFamily,
   storeIsShallow,
   storePath,
+  until,
   untrack
 };