@solidjs/signals 2.0.0-rc.8 → 2.0.0-rc.9

package/dist/dev-shared.js

@@ -200,6 +200,18 @@ const CONFIG_SLOT_NODE = 1 << 18;
  * paths (asyncWrite, transition-held recompute); cleared by a fresh optimistic
  * write (a new override re-masks) and by the revert. */
 const CONFIG_OVERRIDE_SUPERSEDED = 1 << 19;
+/** HELD children (#3404): this node's `_firstChild` chain (and `_disposal`
+ * list) was built by a recompute whose result has not committed — a staged
+ * value, a pending window, or a run under a held transaction. A later
+ * recompute may tear those children down immediately: nothing observable
+ * was ever built on them. Unset, the children belong to the committed frame
+ * and a recompute defers them as zombies (`_pendingFirstChild`) until this
+ * node commits — regardless of whether the recompute runs under a
+ * transaction. A parked node (status propagation stamps `_transition`
+ * without recomputing) recomputed when its source lands otherwise disposed
+ * its committed children mid-hold, running their cleanups before the
+ * transaction's atomic reveal. Cleared by `commitPendingNode`. */
+const CONFIG_HELD_CHILDREN = 1 << 20;
 /** In-flight async node whose inputs were PUBLISHED while it was pending: a
  * batch or transaction committed with the node still `STATUS_PENDING` (an
  * unobserved flight, #3305), so the inputs are on screen and the node's
@@ -211,6 +223,27 @@ const CONFIG_OVERRIDE_SUPERSEDED = 1 << 19;
  * lane-revealed. Set by `commitPendingNodes`; cleared when the node next
  * enters pending fresh (a new flight from a settled state). */
 const CONFIG_INPUTS_PUBLISHED = 1 << 21;
+/** A28 (4): the node was written inside a recompute that ran OUTSIDE a flush
+ * (a creation-time compute — boundary machinery, a mapArray's first run). Such
+ * a write is promoted at that recompute's end: readers in the same block see
+ * it. Cleared when the next flush begins; set only on that rare path. */
+const CONFIG_PROMOTED = 1 << 22;
+/** A28 for same-tick adoption: the node was staged outside a flush and then
+ * adopted by a transaction (initTransition) before any flush carried the
+ * staging — the stamp says "held", but nothing flushed is staged for it, so
+ * on no channel is the write visible yet: `latest()` answers the committed
+ * value, the verdict sees nothing pending (as the store's leaves already did
+ * through their own selection). Cleared when the carrying flush re-stamps the
+ * transaction's pending nodes (reassignPendingTransition). */
+const CONFIG_ADOPTED_UNFLUSHED = 1 << 24;
+/** The node's active override is a DERIVED one: a lane pass published its
+ * speculative result into the override slot instead of `_value` (lanes
+ * stage — an optimistic derivation is an override, #3479). Its truth is not
+ * `_value` but a recompute from its inputs' truth, so the body-end
+ * supersession (`endOptimism`) and the authoritative-flight blockage
+ * (`transitionBlocked`) skip it; the revert drops the override and re-derives
+ * it (`resolveOptimisticNodes`). Cleared with the override. */
+const CONFIG_DERIVED_OVERRIDE = 1 << 23;
 const STATUS_PENDING = 1 << 0;
 const STATUS_ERROR = 1 << 1;
 const STATUS_UNINITIALIZED = 1 << 2;
@@ -249,8 +282,18 @@ const defaultContext = {};
 const $REFRESH = Symbol("refresh");
 
 let attrHooks = null;
+/**
+ * The installed engine, registered on `globalThis` as well (the records
+ * channel's reason, see `Records`): a wire layer bundled without a framework
+ * import — `@solidjs/web`'s server-function client — stamps the records it
+ * emits through the engine's `currentOrigin`, and this is its reach. The
+ * module binding stays the core's own read (one null check per hook site);
+ * the registration mirrors it.
+ */
+const INSTALLED = Symbol.for("@solidjs/signals/observe/attribution");
 function setAttributionHooks(hooks) {
   attrHooks = hooks;
+  globalThis[INSTALLED] = hooks ?? undefined;
 }
 /**
  * Run `fn` as the handler of a user interaction: every root write it performs
@@ -305,6 +348,18 @@ function withOrigin(ref, fn) {
     hooks.originEnd();
   }
 }
+/**
+ * The provenance a root write performed now would carry, as the installed
+ * engine sees it (`AttributionHooks.currentOrigin`); `undefined` with no
+ * engine, or when nothing is in effect. Reachable as
+ * `OBSERVE.attribution.currentOrigin` — how a runtime stamps a fact of its
+ * own (a server-function call) with the interaction or navigation it ran
+ * for, so an observer joins the two by identity.
+ */
+function currentOrigin() {
+  const hooks = attrHooks;
+  return hooks === null ? undefined : hooks.currentOrigin();
+}
 
 /** First warning when a change reaches (or a pass tracks) this many edges. */
 const GRAPH_SIZE_WARN_AT = 2000;
@@ -347,13 +402,59 @@ const attributionSlot = {
     return attrHooks;
   },
   withInteraction,
-  withOrigin
+  withOrigin,
+  currentOrigin
 };
+// The records channel is process-wide (see `Records`): a host that bundles
+// the core into its server build beside an instrumented `--import`ed copy
+// holds two of this module, and a listener installed through one must hear
+// the records the render emits through the other. The registered key makes
+// every copy find the one listener set; the object is generic — a Map of
+// type to listener set — and carries no knowledge of the records.
+const RECORDS = Symbol.for("@solidjs/signals/observe/records");
+function recordsChannel() {
+  const g = globalThis;
+  if (g[RECORDS]) return g[RECORDS];
+  const listeners = new Map();
+  return (g[RECORDS] = {
+    subscribe(type, listener) {
+      let set = listeners.get(type);
+      if (!set) listeners.set(type, (set = new Set()));
+      set.add(listener);
+      return () => {
+        set.delete(listener);
+      };
+    },
+    observed(type) {
+      const set = listeners.get(type);
+      return set !== undefined && set.size > 0;
+    },
+    emit(type, event, live) {
+      const set = listeners.get(type);
+      if (set === undefined || set.size === 0) return;
+      // Snapshot: a listener unsubscribing (itself or another) mid-delivery
+      // must not skip or double-call anyone this round. A throwing listener
+      // is reported; the others, and what was observed, are unaffected.
+      for (const listener of [...set]) {
+        try {
+          listener(event, live);
+        } catch (error) {
+          console.error(error);
+        }
+      }
+    }
+  });
+}
 const OBSERVE = {
   diagnostics,
+  records: recordsChannel(),
   attribution: attributionSlot,
-  subjectOf(event) {
-    return eventSubjects.get(event);
+  // Replaced by solid-js's server entry (see `ServerObserve`); on the
+  // client the slot stays this placeholder. The cast: the interface is
+  // empty HERE and gains its members by augmentation downstream.
+  server: {},
+  subjectOf(record) {
+    return eventSubjects.get(record);
   },
   exclude(owner) {
     excludedOwners.add(owner);
@@ -464,13 +565,26 @@ function takeFooter(entry) {
   return consoleFooter(entry);
 }
 /**
- * The subject each emitted event was about, for the console step: events are
- * serializable records and cannot carry the node, but the console can show
- * what the node knows — a rendering runtime may stamp a binding effect with
- * the DOM element it writes (`_devElement`), and a live element reference
- * beside the message is the most addressable pointer a console can print.
+ * The subject each emitted event was about: events are serializable records
+ * and cannot carry the node, so the node is kept beside the record for the
+ * in-process consumers that want it — the console step, which can show what
+ * the node knows (a rendering runtime may stamp a binding effect with the DOM
+ * element it writes, `_devElement`, and a live element reference beside the
+ * message is the most addressable pointer a console can print), and devtools
+ * that go from a re-run record back to the scope that ran. Keyed by the
+ * record object, so the subject lives exactly as long as some consumer holds
+ * the record (a ring buffer, a captured artifact) — the same lifetime the
+ * node had when records carried it directly.
  */
 const eventSubjects = new WeakMap();
+/** Register `subject` as what `record` was about — see `Observe.subjectOf`. */
+function recordSubject(record, subject) {
+  eventSubjects.set(record, subject);
+}
+/** The live subject `record` was about, if its emitter registered one. */
+function subjectOf(record) {
+  return eventSubjects.get(record);
+}
 /**
  * The console face of a diagnostic — ONE entry per finding: the message, the
  * owner path (`in <App> › <TodoRow> › effect`) so a human can locate it, the
@@ -773,6 +887,47 @@ function laneHeld(lane) {
   for (const node of lane._pendingAsync) if (waitingTransition(node) !== null) return true;
   return false;
 }
+/**
+ * Lanes mirror transitions (#3460): a render effect OFF a HELD lane that reads
+ * a value the lane is revealing — an override, a `latest()` shadow — sees the
+ * committed value, exactly as a stale reader of a held transaction does
+ * (A15 reveal corollary): it publishes now, with the frame that is on screen
+ * (the lane defers its own readers' runs, so the committed value is what is
+ * visible), entangles nothing — a sync write is never held by a lane — and
+ * re-derives at the release. The release re-run rides the lane's own render
+ * queue, which runs when the lane reveals (runLaneEffects) or its transaction
+ * commits (cleanupCompletedLanes). A reader ON the lane computes the lane's
+ * reveal and takes the value as before.
+ *
+ * OFF the lane is provenance, not membership — the transaction mirror
+ * exactly: a stale reader of a transaction is a pass that runs outside it. A
+ * pass under the lane's own transaction is the lane's work — its write (lane
+ * posture), or the landing of its async, which re-enters the transaction
+ * (#3334) and runs a member with no ambient lane. Read as an outsider, that
+ * pass published the committed view and queued a replay that revealed the
+ * override beside its unready derivation at the release (`1:0` for an
+ * optimistic frame that never became ready; #3479 review). Membership is the
+ * wrong test the other way: a member re-run by a sibling's sync write is a
+ * mainline pass and shows the committed view.
+ */
+function readsHeldCommitted(owner, c) {
+  const lane = resolveLane(owner);
+  if (!lane || !laneHeld(lane)) return false;
+  if (ownsLane(lane, owner)) return false;
+  lane._effectQueues[0].push(() => c._flags & REACTIVE_DISPOSED || enqueueSub(c));
+  return true;
+}
+/** The ownership relation for a lane hold (core `ownsHold`, §6 ruling 2): the
+ * running pass owns `lane`'s hold if it runs under the transition that owns
+ * the lane (the node's, resolved through override ownership and merges) or
+ * inside the lane itself. */
+function ownsLane(lane, owner) {
+  if (activeTransition !== null) {
+    const t = resolveTransition(owner);
+    if (t && ownsHold(t)) return true;
+  }
+  return currentOptimisticLane !== null && findLane(currentOptimisticLane) === lane;
+}
 /**
  * Merge two lanes when their dependency graphs overlap.
  */
@@ -816,13 +971,6 @@ function resolveTransition(el) {
   }
   return resolveLane(el)?._transition ?? el._transition;
 }
-/**
- * Check if a node has an active optimistic override.
- */
-function hasActiveOverride(el) {
-  const x = el._x;
-  return x !== null && x._overrideValue !== undefined && x._overrideValue !== NOT_PENDING;
-}
 /**
  * Assign or merge a lane onto a node. At convergence points (node already has
  * a different active lane), merge unless the node has an active override.
@@ -831,17 +979,21 @@ function assignOrMergeLane(el, sourceLane) {
   const sourceRoot = findLane(sourceLane);
   const existing = el._x?._optimisticLane;
   if (existing) {
-    // If the subscriber's lane was merged into another lane, it's stale —
-    // replace it with the new source lane instead of following the merge chain
-    // (which would incorrectly merge the new lane into the old group)
-    if (existing._mergedInto) {
-      ext(el)._optimisticLane = sourceLane;
-      el._config |= CONFIG_HAS_LANE;
-      return;
-    }
+    // A merged lane is followed to its root like any other: the root is where
+    // the subscriber's affinity lives now. Replacing it with the source lane
+    // outright (as this once did) skipped the parent/child check below — an
+    // isPending reader of two async siblings had their two companion lanes
+    // merge, and the next parent-lane notification then moved it onto the
+    // held parent, where its verdict waited on the async it reports (#3409).
     const existingRoot = findLane(existing);
     if (activeLanes.has(existingRoot)) {
-      if (existingRoot !== sourceRoot && !hasActiveOverride(el)) {
+      // A WRITTEN override is its own lane's source and merges nothing
+      // through it; a derived one (lanes stage, #3479) is a plain member —
+      // the shared reader that merges two writers' lanes carries one.
+      if (
+        existingRoot !== sourceRoot &&
+        (!hasActiveOverride(el) || el._config & CONFIG_DERIVED_OVERRIDE)
+      ) {
         // Parent-child lanes stay independent so isPending resolves without
         // waiting for the parent's async. The child keeps ownership.
         if (sourceRoot._parentLane && findLane(sourceRoot._parentLane) === existingRoot) {
@@ -872,8 +1024,16 @@ const zombieQueue = {
 };
 /** runHeap callback that discards a queued zombie recompute instead of running
  * it: unlink pure recompute entries; strip just the recompute bit from dirtied
- * height-adjust entries so their height work still happens. */
+ * height-adjust entries so their height work still happens. A zombie dirtied
+ * through the lane channel (OPTIMISTIC_DIRTY — an override or a `latest()`
+ * companion) runs instead (#3444): a zombie renders mainline until the commit
+ * disposes it, and the lane's values ARE the mainline frame — the still-visible
+ * branch a held `Show` is removing showed the old `latest(count)` beside the
+ * new one outside. Its pass runs under the lane and its run lands on the
+ * lane's effect queue, so a held lane defers it exactly as it defers every
+ * other reader's. */
 function cancelZombieRecompute(el) {
+  if (el._flags & REACTIVE_OPTIMISTIC_DIRTY) return GlobalQueue._update(el);
   if (el._flags & REACTIVE_IN_HEAP_HEIGHT) el._flags &= -12;
   else {
     deleteFromHeap(el, zombieQueue);
@@ -903,11 +1063,19 @@ let _hitUnhandledAsync = false;
 // fact about the MOUNT ("the root mount will be deferred"), not about each
 // pending render effect — N async siblings at mount used to produce N copies.
 let _reportedUnhandledAsync = false;
-// Store property nodes that were created solely to carry a pending write (no
-// subscribers at write time). Swept after each flush that commits pending
-// values — any still without subs get disposed via their `_unobserved` hook,
-// releasing the slot in the parent store's node map.
+// Store property nodes whose last subscriber left while they carried state
+// the backing cannot reconstruct — an optimistic override (overrides live on
+// nodes, over a clone the setter discards) or a staged write. Releasing the
+// slot then would drop the override: an optimistic store key read `0` the
+// moment its only reader gated away while the action was live (S7). Swept
+// after each flush — a node still without subs whose override and staging
+// have resolved is released through the slot hook; one that regained a
+// subscriber leaves the set.
 const transientStoreNodes = new Set();
+/** Slot hook's deferral: release this node when its carried state resolves. */
+function deferSlotRelease(node) {
+  transientStoreNodes.add(node);
+}
 function canUseSimpleSyncFlush(queue) {
   const batch = queue._batch;
   return (
@@ -1000,6 +1168,7 @@ function mergeTransitionState(target, outgoing) {
   if (attrHooks !== null) attrHooks.transitionMerged(target, outgoing);
   outgoing._done = target;
   target._actions.push(...outgoing._actions);
+  target._acted ||= outgoing._acted;
   for (const lane of activeLanes) if (lane._transition === outgoing) lane._transition = target;
   if (outgoing._optimisticNodes.length) {
     // Move (don't copy): the global queue's batch may still be the outgoing
@@ -1134,11 +1303,47 @@ function schedule() {
   scheduled = true;
   if (!syncDepth && !globalQueue._running && !projectionWriteActive) queueMicrotask(flush);
 }
+/**
+ * Parked transactions whose reporter set changed without a write. A
+ * transaction completes when nothing live reports a flight it waits on, but
+ * the flush only judges the ACTIVE transaction: a parked one is re-entered by
+ * a stamped node's landing or an action's resume. A reporter that stops
+ * counting for another reason — its loading boundary flipped to the fallback
+ * (#3375), or it was disposed by ambient work (#3372) — is neither: the
+ * pruning in `reporterBlocksSource` would drop it at the next check, but no
+ * check comes, and the writes held with it stay staged. Such sites record the
+ * transaction here (deduped: one idle pass per transaction, however many
+ * reporters changed); the flush re-enters it on an otherwise idle pass, so
+ * the re-evaluation adopts no unrelated ambient work.
+ */
+const wokenTransitions = [];
+/** Wake every parked transaction — for a site that knows a reporter stopped
+ * counting but not whose (a boundary reset). */
+function wakeParked() {
+  for (const t of transitions) wokenTransitions.includes(t) || wokenTransitions.push(t);
+  schedule();
+}
+/** Transactions a mainline tick has PROPOSED against (A34, #3494): a write to a
+ * node one of them holds — the same value or another — is a second proposal
+ * on a contested node, and the tick reveals with the hold ("both are
+ * suggesting a value; if one finished before the other that would be odd").
+ * Entered at the next flush's start, where the ambient batch is adopted;
+ * never from the write itself, which left `activeTransition` set across the
+ * caller's block and made creation after the write the transaction's (A29). */
+const batchJoins = [];
 /**
  * Permanently halts the reactive system. Called when a user error escapes
  * every boundary — app state is undefined at that point, so scheduling stops
  * entirely rather than limping along with a half-applied update.
  */
+/**
+ * The key a root owner carries its client error hook under (`render`'s
+ * `onError`) — registered, so a runtime writes it with no import of the hook
+ * module (core/error-hooks.ts) and no property mangling in the way. Defined
+ * HERE, not there: a runtime that only writes the key must not retain the
+ * hook machinery (pay-for-use).
+ */
+const ROOT_ERROR_HOOK = Symbol.for("solid-js/root-error-hook");
 function haltReactivity(cause) {
   if (halted) return;
   halted = true;
@@ -1353,11 +1558,29 @@ class GlobalQueue extends Queue {
    * authoritative-observer wake for a silent confirm. Installed with the
    * optimistic engine; only reachable on a node that has an override. */
   static _supersedeOverride = null;
+  /** The flush's pre-verdict step (#3427): once the transaction's action
+   * bodies have all ended and nothing authoritative is left in flight, the
+   * engine supersedes every override still in force with the truth it
+   * reverts to, so the graph re-derives from it now, as the transaction's
+   * held work, instead of after the flights the overrides fed have landed.
+   * True when it superseded something: the caller re-runs the heap ahead of
+   * the verdict. The engine owns every gate (acted, actions drained, has
+   * overrides, no store edits, no authoritative flight); null without it. */
+  static _endOptimism = null;
   /** read()'s value for a TRACKED reader of a superseded node (#3331): the
    * staged truth, unless the reader is a stale (render) reader of another
    * transaction — then the displayed override, as it keeps a foreign
    * transaction's committed value over its staged write. */
-  static _supersededRead = null;
+  /** A tracked read of an active override: the lane outside-view rule
+   * (#3460) and the A18 supersession selection (#3331) — see optimistic.ts. */
+  static _overrideRead = null;
+  /** A lane pass's publish for a memo (#3479, lanes stage): the speculative
+   * result becomes a DERIVED override, `_value` stays committed — see
+   * optimistic.ts laneOverride. Set with the engine, which a lane implies. */
+  static _laneOverride = null;
+  /** Verdict-layer recompute in progress (companion creation, latest()/
+   * isPending() pulls): never born held — see core.ts enterStagedRead. */
+  static _verdictPull = false;
   /** setSignal's authoritative (projection-write) landing on an override-
    * covered node (#3331 store twin): stage the truth for its transaction's
    * commit whatever its relation to the committed value — a landing equal to
@@ -1369,7 +1592,12 @@ class GlobalQueue extends Queue {
   flush() {
     if (this._running) return;
     this._running = true;
+    resyncUnflushedCompanions(); // A28, see above
     try {
+      // The tick proposed against a hold (#3494): adopt its batch into it.
+      // Inside the try: the adoption runs user comparators (the no-proposal
+      // drop), and a throw there must not leave `_running` set.
+      while (batchJoins.length) this.initTransition(batchJoins.pop());
       if (true) devCheckFlushStart();
       // Before runHeap for the same reason as the fast drain above; late
       // subscribers (an effect reading a swept memo this flush) revive it,
@@ -1377,9 +1605,18 @@ class GlobalQueue extends Queue {
       sweepDormant();
       runHeap(dirtyQueue, GlobalQueue._update);
       if (activeTransition) {
+        // The action bodies are over: the overrides they leave in force
+        // revert at this settle, and the correction is this transaction's
+        // held work — re-derived here, under it, ahead of the verdict — not a
+        // waterfall after the flights the overrides fed (#3427). After the
+        // heap, not before: a synchronous body's own writes (a refresh that
+        // puts an override node's source in flight) are judged applied.
+        if (GlobalQueue._endOptimism?.(activeTransition)) runHeap(dirtyQueue, GlobalQueue._update);
         const isComplete = transitionComplete(activeTransition);
         if (!isComplete) {
           const stashedTransition = activeTransition;
+          // Parked: the unchanged passes' inputs are held; their tails stay (A30).
+          heldTrims.length = 0;
           // When the parking batch IS the transition, all of its writes commit
           // only with it — every zombie recompute they queued would run against
           // a world the zombie never displays (zombies render mainline until
@@ -1481,6 +1718,17 @@ class GlobalQueue extends Queue {
       }
       if (true) DEV.hooks.onUpdate?.();
     } finally {
+      // Re-enter a woken transaction (see wokenTransitions) only from an
+      // idle pass: entering adopts the ambient batch, and staged or dirty
+      // ambient work would be held behind flights it never read. `scheduled`
+      // is that test here — after the park exit as well as the normal one:
+      // it was recomputed from the heap this pass, every write since re-armed
+      // it, and optimistic ambient nodes reverted with the finalize — so a
+      // wake in a pass with work simply falls to the next. Entering re-arms
+      // it itself; a dead (completed) wake is a bare return in
+      // initTransition, and the loop moves on to the next.
+      while (!scheduled && !activeTransition && wokenTransitions.length)
+        this.initTransition(wokenTransitions.pop());
       this._running = false;
     }
   }
@@ -1559,9 +1807,45 @@ class GlobalQueue extends Queue {
       // must not entangle unrelated writes to it; the same rule holds one hop
       // downstream: propagation never queues pended subscribers as pending
       // nodes, see propagateAffectsMark, #2893.
+      // Adopted outside a flush: the staging is still unflushed — the stamp
+      // must not make it read as held-and-carried (CONFIG_ADOPTED_UNFLUSHED;
+      // the carrying flush clears it in reassignPendingTransition).
+      const adopted = this._running ? 0 : CONFIG_ADOPTED_UNFLUSHED;
       for (let i = 0; i < batch._pendingNodes.length; i++) {
         const node = batch._pendingNodes[i];
+        // A tick that nets to the committed value proposed nothing (A34, #3494):
+        // `setShow(false); setShow(true)` beside a write that opens a hold
+        // left `show` staged at its own value, stamped, pending to the
+        // verdict, and its next mainline write held by a flight it never
+        // derived from. Unstage it here — its subscribers were walked at the
+        // write and re-derive the same value. Writes only: a signal's staging
+        // is always one, a computed's only under REACTIVE_MANUAL_WRITE
+        // (`createSignal(fn)`'s setter, #3519 review) — otherwise it is its
+        // pass's result, which may equal an uninitialized `undefined` (a
+        // born-held first pass). `_equals: false` opts out. The unstaging is
+        // the commit's own path (commitPendingNode with nothing staged): the
+        // manual-write flag, companions and the rest are cleaned up as a
+        // commit would, and the node is stamped nowhere. Unstamped
+        // only: a node already a transaction's — arriving here as a parked
+        // batch folds into a merge — carries a FLUSHED proposal a later
+        // rewrite brought back to the committed value; it is held, not
+        // proposal-free. Dropped, it kept the dead stamp, and the next write
+        // to it queued under the merged transaction a value the commit then
+        // skipped as another's (fuzzer latest-2 #1470, S3).
+        if (
+          node._transition === null &&
+          node._pendingValue !== NOT_PENDING &&
+          (!node._fn ||
+            (node._flags & REACTIVE_MANUAL_WRITE && !(node._statusFlags & STATUS_UNINITIALIZED))) &&
+          node._equals &&
+          node._equals(node._value, node._pendingValue)
+        ) {
+          node._pendingValue = NOT_PENDING;
+          commitPendingNode(node);
+          continue;
+        }
         node._transition = activeTransition;
+        node._config |= adopted;
         activeTransition._pendingNodes.push(node);
       }
       for (let i = 0; i < batch._optimisticNodes.length; i++) {
@@ -1596,6 +1880,7 @@ class GlobalQueue extends Queue {
 function queuePendingNode(node) {
   lastStagedNodeName = node._name ?? null;
   currentBatch._pendingNodes.push(node);
+  if (!globalQueue._running) markUnflushedStaged(); // A28
 }
 // Dev-only attribution for the flush loop guard (#3140): when the guard
 // trips, naming what the loop kept chewing on lets the app author attribute
@@ -1698,6 +1983,8 @@ function commitPendingNode(n) {
   if (n._pendingValue !== NOT_PENDING) {
     n._value = n._pendingValue;
     n._pendingValue = NOT_PENDING;
+    // A node born held (recompute) initializes at this commit.
+    c._statusFlags &= ~STATUS_UNINITIALIZED;
     // Set _modified for effects, but not for tracked effects (they handle their own scheduling)
     if (n._type && n._type !== EFFECT_TRACKED) n._modified = true;
     // A quiet re-ask classification preserved through a held landing dies
@@ -1712,6 +1999,14 @@ function commitPendingNode(n) {
   // store to an always-present computed slot.
   c._loading = false;
   c._flags &= ~REACTIVE_MANUAL_WRITE;
+  // The children this commit publishes are the frame's now (#3404) — and so
+  // are the dependencies of the pass that produced the value: the previous
+  // frame's tail goes (A30, #3410; `recompute` left it for a staged pass). Only
+  // after a clean pass: `_error` is cleared by a clean pass or by the node's
+  // own landing (whose pass was clean), so a set `_error` means the last pass
+  // threw, kept its full list, and `_depsTail` marks where it stopped.
+  if (c._x?._error == null) trimStaleDeps(c);
+  c._config &= ~CONFIG_HELD_CHILDREN;
   if (!(c._statusFlags & STATUS_PENDING)) c._statusFlags &= ~STATUS_UNINITIALIZED;
   // A flight this commit leaves in the air (unobserved, or observed only by
   // a boundary) now has PUBLISHED inputs: its committed value is stale
@@ -1737,7 +2032,17 @@ function setStoreCommitHook(fn) {
  * confirming truth is committed and the override still displays, a torn
  * frame no timeline contains. */
 const heldRevealed = [];
+/** Unchanged passes with a stale dependency tail, waiting on this flush's
+ * verdict (A30, #3469). A pass that changed nothing replaced nothing either —
+ * and cannot know at its own tail whether the flush that ran it will park:
+ * parked, its inputs are held and the committed frame still derives from the
+ * tail (`b() ? b() : a()` computed `1` from the held `b`, equal to the `1` it
+ * had from `a` — with `a` trimmed, the mainline `a = 2` never reached it).
+ * Trimmed when the flush commits; dropped with a park, the tail stays linked
+ * until a committing pass trims it (one spurious recompute at most). */
+const heldTrims = [];
 function commitPendingNodes() {
+  while (heldTrims.length) trimStaleDeps(heldTrims.pop());
   const pendingNodes = currentBatch._pendingNodes;
   for (let i = 0; i < pendingNodes.length; i++) {
     const node = pendingNodes[i];
@@ -1884,6 +2189,7 @@ function shiftAffectsMarks(delta) {
 function reassignPendingTransition(pendingNodes) {
   for (let i = 0; i < pendingNodes.length; i++) {
     pendingNodes[i]._transition = activeTransition;
+    pendingNodes[i]._config &= ~CONFIG_ADOPTED_UNFLUSHED; // this flush carried it
   }
 }
 const globalQueue = new GlobalQueue();
@@ -1985,13 +2291,65 @@ function flush(fn) {
 function runQueue(queue, type) {
   for (let i = 0; i < queue.length; i++) queue[i](type);
 }
-function reporterBlocksSource(reporter, source) {
-  if (reporter._flags & (REACTIVE_ZOMBIE | REACTIVE_DISPOSED)) return false;
+function reporterBlocksSource(reporter, source, verdict) {
+  const flags = reporter._flags;
+  if (flags & REACTIVE_DISPOSED) return false;
+  // A zombie renders until the commit that disposes it (#3463): while its
+  // removal is staged in a live transaction it is still on screen, and what
+  // it displays must stay consistent with the frame — a held `Show`'s
+  // `Details: 0` beside the lane's `Value: 1` otherwise. Its say is moot for
+  // the verdict of the transaction that stages the removal (`verdict`): done,
+  // and the commit disposes it; not done, and it stays parked regardless. A
+  // zombie whose removal commits this flush (owner's pass not held) is dead.
+  // The owner is stamped when the flush parks; held in this flush, its
+  // staging transaction is the active one.
+  if (flags & REACTIVE_ZOMBIE) {
+    let p = reporter;
+    while (p && p._flags & REACTIVE_ZOMBIE) p = p._parent;
+    let t = p && (p._transition || (p._config & CONFIG_HELD_CHILDREN ? activeTransition : null));
+    if (!t || (t = currentTransition(t))._done === true || t === verdict) return false;
+  }
+  // Fallback-caught async holds nothing. A collecting loading boundary
+  // consumes the notification, so a reader under a fallback never registers —
+  // but a reader registered while its boundary showed content stays
+  // registered when the boundary's `on` later changes and it flips to the
+  // fallback. The reader is behind the fallback now; if nothing outside the
+  // boundary consumes the flight, the hold is over (A33, ruled 2026-09-12, #3375).
+  for (let q = reporter._queue; q; q = q._parent)
+    if (q._collectionType & STATUS_PENDING && !q._initialized) return false;
+  // "Still derives from the source" is a question about THIS pass's reads:
+  // the deps up to `_depsTail`. Past it lie the committed frame's — kept
+  // linked by A30 until the commit trims them (a staged pass, an errored
+  // one). Reading them here made a reporter whose pass had stopped reading
+  // the source (a gate closed in the same flush as the write) look live, and
+  // the hold it kept was the commit that would have trimmed the dep that
+  // kept it (spec O3, same-flush form; fuzzer #3446 P1 cases 21/79). A
+  // trimmed list ends at `_depsTail`, so the bound is free there; a pass
+  // that read nothing has a null tail and derives from nothing.
+  // The registration is trusted: a pending mark rides only this pass's links
+  // (notifyStatus skips the kept tail), so a registered reporter read the
+  // source, or threw on it.
   if (reporter._x?._pendingSources?.has(source)) return true;
-  for (let dep = reporter._deps; dep; dep = dep._nextDep) {
+  const tail = reporter._depsTail;
+  for (
+    let dep = tail === null ? null : reporter._deps;
+    dep;
+    dep = dep === tail ? null : dep._nextDep
+  ) {
     let current = dep._dep;
     while (current) {
-      if (current === source || current._firewall === source) return true;
+      // Or through a memo pending on the flight (#3494): a stale reader
+      // served a held memo's committed value never turned pending itself, so
+      // its only trace of the flight is the memo between them — `copy` of
+      // `details`. Judged dead, its transaction released `count=1` beside
+      // the `Copy: 0` it displays. `_pendingSources` is transitive, so one
+      // hop covers any depth.
+      if (
+        current === source ||
+        current._firewall === source ||
+        current._x?._pendingSources?.has(source)
+      )
+        return true;
       current = current._x?._parentSource;
     }
   }
@@ -2001,6 +2359,30 @@ function reporterBlocksSource(reporter, source) {
     reporter._x?._error.source === source
   );
 }
+/**
+ * Does a live reporter of `transition` still observe `source` pending? Dead
+ * reporters (disposed, behind a fallback, no longer reading the source) are
+ * pruned as they are found, and the source's entry with them. Shared by the
+ * settle verdict and the lane's hold check (`waitingTransition`): a live
+ * action parks its transaction without a verdict, so this prune is the only
+ * one an optimistic lane whose last async reader unmounted mid-action ever
+ * gets — without it the lane held on the dead reporter's registration until
+ * the flight it no longer observed landed (#3426).
+ */
+function sourceObserved(transition, source, verdict) {
+  const reporters = transition._asyncReporters.get(source);
+  let kept = false;
+  for (const reporter of reporters ?? []) {
+    if (reporterBlocksSource(reporter, source, verdict)) return true;
+    // A zombie the verdict passes over is kept, not pruned (#3463): moot for
+    // this verdict, it still holds a lane's reveal while the transaction
+    // stays parked on something else.
+    if (verdict && reporter._flags & REACTIVE_ZOMBIE) kept = true;
+    else reporters.delete(reporter);
+  }
+  if (!kept) transition._asyncReporters.delete(source);
+  return false;
+}
 function transitionComplete(transition) {
   if (transition._done) return true;
   if (transition._actions.length) {
@@ -2009,17 +2391,22 @@ function transitionComplete(transition) {
     return false;
   }
   let done = true;
-  for (const [source, reporters] of transition._asyncReporters) {
-    let hasLive = false;
-    for (const reporter of reporters) {
-      if (reporterBlocksSource(reporter, source)) {
-        hasLive = true;
-        break;
-      }
-      reporters.delete(reporter);
-    }
-    if (!hasLive) transition._asyncReporters.delete(source);
-    else if (source._statusFlags & STATUS_PENDING && source._x?._error?.source === source) {
+  for (const source of transition._asyncReporters.keys()) {
+    // The source blocks while its OWN flight is up — the self entry in its
+    // pending sources (added by notifyStatus's source path, with status;
+    // retired by the landing and the supersede sweep, so it implies
+    // STATUS_PENDING). `_error.source` is not that test: propagation from an
+    // input that went pending later overwrites it with the input (#3375 — a
+    // boundary-consumed load re-asked under a held derivation), and the
+    // still-flying source read as settled, committing the writes it was
+    // asked with ahead of its answer.
+    // Not the self entry alone: a source whose own flight an upstream re-ask
+    // superseded is still pending — on that re-ask (#3462). Its reader cannot
+    // render until the chain lands, and the landing folds this transaction in
+    // (enterWaiting). Judged complete instead, a re-entry between the two (a
+    // repeated write to a held signal) committed the held writes beside the
+    // reader's stale frame.
+    if (sourceObserved(transition, source, transition) && source._x?._pendingSources?.size) {
       done = false;
       break;
     }
@@ -2056,12 +2443,24 @@ function currentTransition(transition) {
  * the node, so a hold check must not assume it was recorded in the transaction
  * it happens to hold — lanes merge across transactions (#2912), and a merged
  * root's transaction knows nothing of the async its members' transactions
- * observed (#3335). Null when nobody is waiting.
+ * observed (#3335). Null when nobody is waiting — a registration whose every
+ * reporter has since died is nobody (#3426).
  */
 function waitingTransition(source) {
-  for (const t of transitions) if (t._asyncReporters.has(source)) return t;
+  for (const t of transitions) if (sourceObserved(t, source)) return t;
   return null;
 }
+/** A landing enters EVERY parked transaction still waiting on `source`, folding
+ * them into the active one (A15: each reveal that discovered the flight
+ * completes at its landing). The fold used to happen as the waiters' stamped
+ * readers recomputed under the landing — recompute re-entering an effect's
+ * stamp — which also folded in writes those readers merely shared a hole
+ * with (#3407); effects no longer re-enter, so the landing folds explicitly.
+ * Live iteration is safe: a merge deletes the outgoing (active) entry and
+ * re-adds the visited one. */
+function enterWaiting(source) {
+  for (const t of transitions) if (sourceObserved(t, source)) globalQueue.initTransition(t);
+}
 function runInTransition(transition, fn) {
   const prevTransition = activeTransition;
   try {
@@ -2279,6 +2678,19 @@ function disposeChildren(node, self = false, zombie) {
     // false, and notifies subscribers still watching the companion.
     const n = node;
     if (n._x?._pendingSignal || n._x?._latestValueComputed) GlobalQueue._snapCompanions(n);
+    // A firewall's leaves have no lifecycle of their own, so a companion on
+    // one of them outlives its source the same way (INV-9's rationale). The
+    // firewall knows which leaves carry companions (CONFIG_CHILD_COMPANIONS,
+    // #3038): snap them with it — the snap retires a shadow whose firewall is
+    // disposed (spec O5).
+    if (n._config & CONFIG_CHILD_COMPANIONS)
+      n._x._companionChildren.forEach(GlobalQueue._snapCompanions);
+    // A pending reader parked in a transaction may be the only thing holding
+    // it (#3372): its death is a completion event the transaction must be
+    // re-judged for, and nothing else re-enters a parked transaction.
+    const t = n._transition;
+    if (t && n._statusFlags & STATUS_PENDING && !wokenTransitions.includes(t))
+      (wokenTransitions.push(t), schedule());
   }
   if (self && true) clearSignals(node);
   if (self && node._fn && node._x !== null) node._x._inFlight = null;
@@ -3002,6 +3414,13 @@ function handleAsync(el, result, setter) {
   // fired _flightTeardown. A future non-recompute registration path must
   // release it here before overwriting _inFlight.
   ext(el)._inFlight = result;
+  // The run that asked this flight read every input without throwing: an
+  // input still in flight was masked for it (an active override, A17), so
+  // pending state those inputs propagated onto the node earlier does not
+  // describe this answer. Drop it — the flight is the node's pending now.
+  // The landing retires only the flight's own entry (landStatus, #3373), so
+  // an entry that survived here would hold the node past its own answer.
+  el._x._pendingSources = undefined;
   // Provenance of the question this flight asks (#3331): the action whose
   // window is registering it, or the flight whose landing is. Its landings
   // propagate under it (asyncWrite) so an override downstream can tell a
@@ -3032,7 +3451,12 @@ function handleAsync(el, result, setter) {
     // waiting on this flight into it at the landing — a reveal that
     // discovered the flight (#3305) would then wait on the owner's action
     // instead of on the flight (#3334). Enter the waiter: the transaction
-    // whose blocker this landing clears.
+    // whose blocker this landing clears. Then every transaction waiting on
+    // the flight folds in (enterWaiting): a reveal that discovered it
+    // completes at its landing (A15) — a stampless node's fresh batch
+    // included (its flight started under a batch that committed beneath it,
+    // #3305). The fold used to happen as each stamped reader recomputed,
+    // which effects no longer do (#3407).
     if (el._x?._optimisticLane) transition = waitingTransition(el) ?? transition;
     if (
       transition &&
@@ -3045,6 +3469,7 @@ function handleAsync(el, result, setter) {
       return;
     }
     globalQueue.initTransition(transition);
+    enterWaiting(el);
   };
   const handleError = error => {
     if (el._x?._inFlight !== result) return;
@@ -3107,8 +3532,7 @@ function handleAsync(el, result, setter) {
     // old value as pending, a one-frame pulse to direct observers (#3178).
     // A truthy capture implies `_x` exists, so the restore writes it directly.
     const wasReask = el._x?._reask;
-    trimStaleDeps(el);
-    clearStatus(el);
+    landStatus(el);
     if (wasReask) el._x._reask = true;
     const lane = resolveLane(el);
     if (lane) lane._pendingAsync.delete(el);
@@ -3123,8 +3547,15 @@ function handleAsync(el, result, setter) {
         handleError(error);
         return;
       }
-      if (wasUninitialized) clearStatus(el, true);
-    } else if (el._x?._overrideValue !== undefined) {
+      if (wasUninitialized) landStatus(el, true);
+    } else if (
+      el._x?._overrideValue !== undefined &&
+      !(lane && el._config & CONFIG_DERIVED_OVERRIDE)
+    ) {
+      // A derived override's landing UNDER its lane is the lane's own work
+      // (the branch below); demoted — its source superseded (A18) — the
+      // landing is the truth the correction asked for, and holds and
+      // supersedes here like the sync twin (recompute). Otherwise:
       // Optimistic node — resting OR covered by an active override — holds
       // through the shared pending-node path, exactly like a plain async memo,
       // so the commit clears STATUS_UNINITIALIZED (#2806) and elevation to
@@ -3162,11 +3593,15 @@ function handleAsync(el, result, setter) {
     } else if (lane) {
       // Route through lane's effect queue for independent flushing
       const isEffect = el._type;
-      const prevValue = el._value;
+      const prevValue = hasActiveOverride(el) ? unwrapOverride(el._x._overrideValue) : el._value;
       const equals = el._equals;
       try {
         if ((!isEffect && wasUninitialized) || !equals || !equals(value, prevValue)) {
-          el._value = value;
+          // Lanes stage (#3479): a memo's landing under its lane is a derived
+          // override, as its sync pass's result is (recompute) — `_value`
+          // stays the committed truth for readers off the lane.
+          if (isEffect) el._value = value;
+          else GlobalQueue._laneOverride(el, value, lane);
           el._time = clock;
           // The latest() shadow write gives latest() effects independent lanes; the
           // _pendingSignal update is a no-op repeat of the clearStatus() call above
@@ -3212,6 +3647,15 @@ function handleAsync(el, result, setter) {
     if (el._pendingValue === NOT_PENDING) {
       el._loading = false;
       if (wasReask) el._x._reask = false;
+      // The landing published: the dependency tail the flight's pass left
+      // linked goes now (A30, #3410). A transition-held landing has not
+      // replaced the committed frame — the committed value still derives
+      // from the previous pass's inputs, and a mainline write to one of them
+      // must reach this node and join its hold (its stamp) instead of
+      // publishing beside the stale derivation (#3461: `b() ? b() : a()`
+      // held on `b` dropped `a` at its landing, and `A: 1` then committed
+      // beside `Selected: 0`). `commitPendingNode` trims a held landing.
+      trimStaleDeps(el);
     }
     settlePendingSource(el);
     schedule();
@@ -3466,6 +3910,41 @@ function clearStatus(el, clearUninitialized = false) {
   const notify = statusNotifierOf(el);
   if (notify) notify.call(el);
 }
+/**
+ * Status clear for a flight LANDING (asyncWrite). A landing answers the
+ * node's OWN question — it retires the node's self entry, not the pending
+ * state its sources propagated onto it. An input re-asked while this flight
+ * was up (a second write to the signal feeding `a` while `b`'s first flight
+ * is in the air, #3373) marks `b` pending on `a` by propagation, with `b`'s
+ * flight still current: nothing superseded it (the re-ask only changed `a`'s
+ * status, not yet its value), so the landing arrives, and a full clear made
+ * `b` answer with the stale value — the transaction's reporter for `a` found
+ * nothing pending below it and committed the newer signal beside the older
+ * derived value (`2 / 1`); `isPending(b)` read false for the gap (#3376).
+ * With another source still pending the node stays derivatively pending on
+ * it; the landed value is written below (the staged answer is still the
+ * answer for the inputs it was asked with) and the input's own settle
+ * releases it, or its value change recomputes the node into a fresh flight.
+ * `_blocked` clears like a full clear: a landing that passed the `_inFlight`
+ * guard was not superseded by a re-run (recompute nulls `_inFlight` first),
+ * so the flag is the flight's own registration throw — the input settling
+ * unchanged must not re-run the node (an extra flight for the same inputs).
+ * The node is already STATUS_PENDING in that branch (only notifyStatus fills
+ * the set, with status; a loading-window park cannot coexist with a live
+ * flight since registration drops the set), so the flags only change when
+ * the first landing retires UNINITIALIZED. `_error` must move off self: a
+ * reader thrown NotReady(self) would park on a retired entry. Companions
+ * keep their verdict (pending before and after; the write re-syncs them).
+ */
+function landStatus(el, clearUninitialized = false) {
+  const sources = el._x?._pendingSources;
+  // (The full clear below drops the set whether or not self was retired first.)
+  if (sources && (sources.delete(el), sources.size)) {
+    el._x._blocked = false;
+    if (clearUninitialized) el._statusFlags = STATUS_PENDING;
+    setPendingError(el, sources.values().next().value);
+  } else clearStatus(el, clearUninitialized);
+}
 function notifyStatus(el, status, error, blockStatus, lane) {
   // Wrap regular errors to track source node
   if (
@@ -3477,10 +3956,24 @@ function notifyStatus(el, status, error, blockStatus, lane) {
   const pendingSource =
     status === STATUS_PENDING && error instanceof NotReadyError ? error.source : undefined;
   const isSource = pendingSource === el;
+  // An optimistic node (a WRITTEN override slot) pending derivatively is a
+  // boundary: its override is the answer, pending stops here (A17). A
+  // derived override (#3479) is a previous speculative answer on a plain
+  // member — pending flows through it as through any memo.
   const isOptimisticBoundary =
-    status === STATUS_PENDING && el._x?._overrideValue !== undefined && !isSource;
+    status === STATUS_PENDING &&
+    el._x?._overrideValue !== undefined &&
+    !(el._config & CONFIG_DERIVED_OVERRIDE) &&
+    !isSource;
   const startsBlocking = isOptimisticBoundary && hasActiveOverride(el);
   if (!blockStatus) {
+    // Lane before companions: the companion pokes below may create the
+    // node's pending-signal lane, whose parent is read from the node's lane
+    // at creation. Assigned after them (as it was), a node made pending by
+    // propagation before it rode the lane got a parentless companion lane,
+    // and the isPending reader that also depends on the node merged it into
+    // the held lane — the verdict then waited on the async it reports (#3379).
+    if (lane) assignOrMergeLane(el, lane);
     if (status === STATUS_PENDING && pendingSource) {
       addPendingSource(el, pendingSource);
       // A fresh flight from a settled state starts with its inputs unpublished
@@ -3505,9 +3998,6 @@ function notifyStatus(el, status, error, blockStatus, lane) {
     )
       GlobalQueue._updateChildCompanions(el);
   }
-  if (lane && !blockStatus) {
-    assignOrMergeLane(el, lane);
-  }
   const downstreamBlockStatus = blockStatus || startsBlocking;
   const downstreamLane = blockStatus || isOptimisticBoundary ? undefined : lane;
   const elNotify = statusNotifierOf(el);
@@ -3524,6 +4014,30 @@ function notifyStatus(el, status, error, blockStatus, lane) {
   }
   forEachDependent(el, (sub, link) => {
     sub._time = clock;
+    // A pending mark on a kept-tail link re-derives the subscriber instead of
+    // marking it (A30, #3494 review; fuzzer latest-1 #2141; #3519 review).
+    // Past `_depsTail` lie the committed frame's deps, kept by A30 because
+    // that frame still derives from them while the pass that dropped them is
+    // held (staged, or unchanged and parked). A source going pending there is
+    // a question for the node's NEXT pass, not a fact about its current one:
+    // marked, the node was registered as the flight's reporter and its holder
+    // entangled with the flight (the A15 arm below) on a dep the held frame
+    // never reads — an orphaned fetch held the truth (a hide joined to a
+    // parked action, A34), and a manual flight nobody awaited held a gated
+    // reader hidden forever (fuzzer branches-1 #1105). Skipped, the committed
+    // frame published stale beside its new inputs (`query=1` beside a
+    // `selected` derived from `remote(0)`). Re-derived, the pass decides: it
+    // reads the dep and registers through its own read, or reads a held input
+    // and enters that transaction (A29), or reads neither and is done. Clears
+    // and errors still ride every link. A link inside the prefix carries the
+    // pass's generation (`link()`), so the test is O(1); mid-pass the prefix
+    // is what the pass has read so far, and the heap refuses a recomputing
+    // node — a dep it has yet to reach registers through its own read.
+    if (status === STATUS_PENDING && link._gen !== sub._depGen) {
+      enqueueSub(sub);
+      schedule();
+      return;
+    }
     if (
       (status === STATUS_PENDING &&
         pendingSource &&
@@ -3540,7 +4054,26 @@ function notifyStatus(el, status, error, blockStatus, lane) {
         schedule();
         return;
       }
-      if (!downstreamBlockStatus && !sub._transition) queuePendingNode(sub);
+      // A memo another live transaction HOLDS — pending on its work, or
+      // staged by it — made pending by THIS flight cannot reveal before the
+      // flight lands: the two settle as one unit (A15, a shared derivation of
+      // both — #3443). Propagation marks the held memo without recomputing it
+      // (its inputs' values are unchanged), so this is the one moment the
+      // entanglement is known; the memo's stamped re-entry at its next pass
+      // came too late — the holder's own flight landed first and revealed the
+      // inputs beside the stale sum. The stamp alone decides nothing (#3334):
+      // a node the transaction once queued but holds nothing of — a switch's
+      // shared output whose first flight the second write superseded — must
+      // not drag the older flight into the newer reveal. Effects entangle
+      // nothing (A15 shared-hole corollary): their reader registers with the
+      // flight's transaction at queue notification.
+      if (!downstreamBlockStatus)
+        sub._transition
+          ? pendingSource &&
+            !sub._type &&
+            (sub._statusFlags & STATUS_PENDING || sub._pendingValue !== NOT_PENDING) &&
+            globalQueue.initTransition(sub._transition)
+          : queuePendingNode(sub);
       notifyStatus(sub, status, error, downstreamBlockStatus, downstreamLane);
     }
   });
@@ -3570,6 +4103,10 @@ const REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE =
 const REACTIVE_WRITE_IN_OWNED_SCOPE_REFRESH_MESSAGE =
   "[REACTIVE_WRITE_IN_OWNED_SCOPE] Calling refresh() inside an owned scope (component, computation) is not allowed. " +
   "Move the invalidation outside pure computation.";
+const ASYNC_STORE_SETTER_MESSAGE =
+  "[ASYNC_STORE_SETTER] Store setter callback returned a Promise. A store setter is a synchronous transaction: " +
+  "the draft closes when the callback returns, so writes after an `await` are lost. " +
+  "Move the await into an action() and call the setter from there.";
 let tracking = false;
 /** @internal verdict-module glue */
 function setPendingCheckActive(v) {
@@ -3633,10 +4170,15 @@ function releaseSubtree(owner) {
 function clearSnapshots() {
   if (snapshotSources) {
     for (const source of snapshotSources) {
-      delete source._x?._snapshotValue;
+      // The extension is a fixed-shape object with `_snapshotValue`
+      // pre-initialized to undefined (see ext()), and every reader tests
+      // `!== undefined` — assign, don't `delete`: deleting a field pushes the
+      // object to dictionary mode for every later read of every field.
+      const x = source._x;
+      if (x != null) x._snapshotValue = undefined;
       // StoreNode targets share one pre-initialized hidden class (see
-      // createStoreProxy) — assign undefined instead of deleting, and only
-      // when present so signal-node sources don't grow the field.
+      // createStoreProxy) — same rule, and only when present so signal-node
+      // sources don't grow the field.
       if (source[STORE_SNAPSHOT_PROPS] !== undefined) source[STORE_SNAPSHOT_PROPS] = undefined;
     }
     snapshotSources = null;
@@ -3653,7 +4195,11 @@ function recompute(el, create = false) {
   let devChanged = false;
   if (attrHooks !== null) attrHooks.recomputeStart(el, create);
   if (!create) {
-    if (el._transition && (!isEffect || activeTransition) && activeTransition !== el._transition)
+    // A stamped memo re-enters its hold: its value is that transaction's work.
+    // An effect's pass belongs to whatever dirtied it (A15 corollary: effects
+    // don't entangle parallel transactions); it joins its stamp only when the
+    // pass observes the held flight — queue notification (#3407).
+    if (el._transition && !isEffect && activeTransition !== el._transition)
       globalQueue.initTransition(el._transition);
     deleteFromHeap(el, queueFor(el));
     if (el._x !== null) {
@@ -3665,8 +4211,14 @@ function recompute(el, create = false) {
       // work that replaced it. Idempotent with the cleanup-channel close.
       releaseFlightTeardown(el);
     }
-    // Tracked effects run after finalizePureQueue, so dispose immediately instead of deferring
-    if (el._transition || isEffect === EFFECT_TRACKED) disposeChildren(el);
+    // Tracked effects run after finalizePureQueue, so dispose immediately
+    // instead of deferring. Children built by an uncommitted recompute
+    // (CONFIG_HELD_CHILDREN) die immediately too: no frame ever showed them.
+    // Everything else is the committed frame's and is deferred as zombies
+    // until this node's commit — a transaction-owned node included (#3404):
+    // a parked node's children predate the hold, and tearing them down when
+    // the source lands ran cleanups before the transaction's atomic reveal.
+    if (isEffect === EFFECT_TRACKED || el._config & CONFIG_HELD_CHILDREN) disposeChildren(el);
     else if (el._firstChild !== null || el._disposal !== null) {
       markDisposal(el);
       const x = ext(el);
@@ -3679,8 +4231,11 @@ function recompute(el, create = false) {
     } else clearSignals(el);
   }
   let isOptimisticDirty = !!(el._flags & REACTIVE_OPTIMISTIC_DIRTY);
+  // A derived override (lanes stage, #3479) is override-covered like a written
+  // one: a plain pass over it — its source superseded (A18) — stages the truth
+  // and supersedes the override through the sync twin below.
   const hasOverride =
-    (el._config & CONFIG_OPTIMISTIC) !== 0 &&
+    (el._config & (CONFIG_OPTIMISTIC | CONFIG_DERIVED_OVERRIDE)) !== 0 &&
     el._x?._overrideValue !== NOT_PENDING &&
     el._x?._overrideValue !== undefined;
   const wasUninitialized = !!(el._statusFlags & STATUS_UNINITIALIZED);
@@ -3688,8 +4243,8 @@ function recompute(el, create = false) {
   // A conditional can drop its pending source and recover to an unchanged
   // value, leaving blocked dependents outside that source’s settle walk.
   const outgoingError = el._statusFlags & STATUS_ERROR ? el._x?._error : undefined;
-  const outgoingPendingSources =
-    el._statusFlags & STATUS_PENDING ? el._x?._pendingSources : undefined;
+  const wasPending = (el._statusFlags & STATUS_PENDING) !== 0;
+  const outgoingPendingSources = wasPending ? el._x?._pendingSources : undefined;
   // Pending SOURCE-hood, captured before the compute clears status: a node
   // whose own flight parked dependents self-registers in _pendingSources
   // (notifyStatus, isSource). If this recompute supersedes that flight and
@@ -3705,6 +4260,11 @@ function recompute(el, create = false) {
   // commits (commitPendingNode) — a closed window plus a held value reads as
   // a pending frame to live observers of the verdict (#2990).
   const wasLoading = el._loading;
+  // Creation-time A29 (see enterStagedRead): a pass outside a flush that is
+  // served a live transaction's staged value records the transaction here
+  // and is staged INTO it below — "born held" — instead of committing.
+  const prevStagedEntry = stagedEntry;
+  stagedEntry = null;
   const oldcontext = context;
   context = el;
   el._depsTail = null;
@@ -3730,6 +4290,17 @@ function recompute(el, create = false) {
   // covers creation-time computes and flushes that run inside the window.
   const prevLatestRead = latestReadActive;
   latestReadActive = false;
+  // A memo computes under its OWN lane posture, never the puller's (A31,
+  // #3442): its value is one shared slot every reader sees, so a pull from a
+  // lane-carrying reader (a probe effect on its companion lane pulling a sync
+  // memo) must not run it with that lane's read carve-outs — under a lane, a
+  // pending node on no lane serves its committed value instead of throwing,
+  // and the memo then published a stale "settled" value, dropped its
+  // pending status, and stopped holding its transaction. The branches below
+  // re-establish the posture the memo itself owns (OPT-dirty, or adopted
+  // through its deps). Effects keep the ambient lane: their runs are the
+  // lane's own view.
+  if (!isEffect) currentOptimisticLane = null;
   // Lane posture lives with the engine: OPTIMISTIC_DIRTY is only ever set by
   // engine-driven paths, and _optimisticNodes is only pushed by
   // _optimisticWrite, so the hook is installed whenever either gate holds.
@@ -3740,6 +4311,21 @@ function recompute(el, create = false) {
     // latest()/isPending() pull stages instead of direct-committing (#3009).
     // The predicate lives with the engine (recomputeLane).
     else if (lane === false) isOptimisticDirty = false;
+  } else if (el._config & CONFIG_DERIVED_OVERRIDE) {
+    // Lanes stage (#3479): a pass over a live lane member carrying a derived
+    // override is the lane's pass whatever channel dirtied it (a boundary
+    // reset, an unrelated sync write) — its inputs serve the lane's view, so
+    // its result is the lane's and belongs in the override slot. Run plain,
+    // A18's sync twin below read that re-derived lane view as a differing
+    // truth (a fresh array), superseded the override and demoted the lane;
+    // the lane's next pass then dropped the staged "truth" and left the node
+    // flagged superseded with nothing to serve (fuzzer latest-1 #2481). A
+    // demoted node resolves no lane and stays plain: its pass IS the truth.
+    const lane = GlobalQueue._recomputeLane(el, true);
+    if (lane) {
+      isOptimisticDirty = true;
+      currentOptimisticLane = lane;
+    }
   } else if (activeTransition && !create && activeTransition._optimisticNodes.length) {
     // Lane adoption: parent-deeper-than-owned-child can run before its OPT-dirty
     // child propagates. Walk deps once and inherit the OPT lane so this node
@@ -3787,7 +4373,9 @@ function recompute(el, create = false) {
     // its body gates on is either _statusFlags or lives in the cold
     // extension — no extension, no status to clear. (_x from an unrelated
     // installer just makes clearStatus a cheap re-verified no-op.)
-    if (el._statusFlags !== 0 || el._x !== null) clearStatus(el, create);
+    // A node born held keeps STATUS_UNINITIALIZED until its transaction
+    // commits: it has no committed value, and read() holds its readers.
+    if (el._statusFlags !== 0 || el._x !== null) clearStatus(el, create && stagedEntry === null);
     // _optimisticLane is only ever assigned by engine paths (CONFIG_HAS_LANE
     // is their sticky presence mark).
     if (el._config & CONFIG_HAS_LANE && el._x?._optimisticLane) GlobalQueue._laneAsyncSettled(el);
@@ -3821,6 +4409,18 @@ function recompute(el, create = false) {
       // The replacement source is fully propagated now. If no new flight
       // re-owned self, retire the superseded flight and its dependent copies.
       if (notReady && wasPendingSource && !el._x?._inFlight) settlePendingSource(el);
+      // A re-park drops what the earlier pass carried (#3456): a source this
+      // pass no longer reaches — its branch switched, or a fresh flight
+      // replaced the inputs' pending with its own — stays copied onto
+      // dependents that reached it only through here, and its landing walk
+      // stops at this node (nothing left to retire) before it finds them. A
+      // dependent then waits forever on a flight it has no path to. The
+      // re-park twin of the unchanged-value recovery sweep below; dependents
+      // with another path keep the source (retryReaches).
+      if (notReady && outgoingPendingSources)
+        for (const source of outgoingPendingSources)
+          if (source !== el && !el._x?._pendingSources?.has(source))
+            settlePendingSource(el, source);
       if (reaskChanged) GlobalQueue._repollVerdicts(el);
     }
   } finally {
@@ -3837,18 +4437,26 @@ function recompute(el, create = false) {
     el._flags = REACTIVE_NONE | (create ? el._flags & REACTIVE_SNAPSHOT_STALE : 0);
     context = oldcontext;
   }
+  // The cast re-widens: TS narrowed `stagedEntry` to `null` at the reset
+  // above and does not invalidate that across the compute call that
+  // `enterStagedRead` runs under. No emitted code.
+  const bornHeld = stagedEntry;
+  stagedEntry = prevStagedEntry;
   if (!el._x?._error) {
-    trimStaleDeps(el);
-    // Observe-tier fan-in (HUGE_FAN_IN): with the stale tail trimmed, the dep
-    // list IS this pass's distinct sources — count it here rather than per
-    // link. A begin/end bracket around the pass plus a per-link increment
-    // measured -5.8% on createRenderEffects:create1to1 (CodSpeed, dev tier)
-    // and cost several points of the shape wins elsewhere; this walk is a
-    // fraction of the reads that built the list and keeps no module state,
-    // so nested pulls need no save/restore.
+    // Observe-tier fan-in (HUGE_FAN_IN): the validated prefix [_deps.._depsTail]
+    // IS this pass's distinct sources — count it here rather than per link. A
+    // begin/end bracket around the pass plus a per-link increment measured
+    // -5.8% on createRenderEffects:create1to1 (CodSpeed, dev tier) and cost
+    // several points of the shape wins elsewhere; this walk is a fraction of
+    // the reads that built the list and keeps no module state, so nested
+    // pulls need no save/restore. (The stale tail is trimmed at the end of
+    // this pass, or at its commit — see recompute's tail.)
     {
       let fanIn = 0;
-      for (let d = el._deps; d !== null; d = d._nextDep) fanIn++;
+      for (let d = el._deps; d !== null; d = d._nextDep) {
+        fanIn++;
+        if (d === el._depsTail) break;
+      }
       if (fanIn >= GRAPH_SIZE_WARN_AT) noteFanIn(el, fanIn);
     }
     // INV-11 (#3330): the equality gate compares against the slot this run
@@ -3921,7 +4529,7 @@ function recompute(el, create = false) {
     else if (valueChanged) {
       const prevVisible = hasOverride ? el._x?._overrideValue : undefined;
       if (
-        create ||
+        (create && bornHeld === null) ||
         // Plain sync flush (no transition on either side) commits effect
         // values directly — the pending round-trip (queuePendingNode +
         // commitPendingNodes) exists to sequence transition reveals, and
@@ -3931,6 +4539,7 @@ function recompute(el, create = false) {
         // not the stashed queues, so a staged value would hand the immediate
         // apply stale state — see CONFIG_DIRECT_COMMIT.
         (isEffect &&
+          bornHeld === null &&
           (activeTransition !== el._transition ||
             activeTransition === null ||
             el._config & CONFIG_DIRECT_COMMIT)) ||
@@ -3943,26 +4552,50 @@ function recompute(el, create = false) {
         // round-trip is that separation; it cannot be skipped on any path a
         // pull can reach.
       ) {
-        el._value = value;
-        // Lane-propagated correction: upstream data is fresh, correct the
-        // override unconditionally. The direct _value commit is the lane's
-        // own reveal schedule; drop any superseded older hold so its queued
-        // commit can't clobber the fresh value.
-        if (hasOverride && isOptimisticDirty) {
-          ext(el)._overrideValue = value === undefined ? OVERRIDE_UNDEFINED : value;
-          el._pendingValue = NOT_PENDING;
-        }
+        // Lanes stage (#3479): a lane pass on a memo publishes its speculative
+        // result as an OVERRIDE — `_value` stays the committed truth, so a
+        // reader off the lane (A17's committed view, #3460) sees a whole
+        // committed frame: the source's shadow and its derivations together,
+        // never a committed shadow beside a speculative memo. The lane's own
+        // readers and untracked reads see the override (A17); the revert
+        // drops it and re-derives (resolveOptimisticNodes). Effects keep the
+        // direct commit — their `_value` is a run result the lane's queues
+        // already sequence. Either way the lane pass drops any superseded
+        // older hold so its queued commit can't clobber the fresh frame: a
+        // hold staged on an earlier, lane-free pass of the SAME transaction
+        // is superseded — left in place, the commit published the older
+        // frame over the fresh one (#3377). A reversion pass (OPT-dirty with
+        // no lane — the override dropped) commits directly: it IS the truth.
+        if (isOptimisticDirty && !isEffect && currentOptimisticLane !== null)
+          GlobalQueue._laneOverride(el, value, currentOptimisticLane);
+        else el._value = value;
+        if (isOptimisticDirty) el._pendingValue = NOT_PENDING;
       } else {
         el._pendingValue = value;
+        if (bornHeld !== null) {
+          // Born held: the pass ran from mainline and derived from this
+          // transaction's staged world (enterStagedRead). Its value is the
+          // transaction's — staged into it directly, stamped, and committed
+          // with it; mainline's batch never sees it. A born-held effect
+          // skips its synchronous first run (effect()) and is replayed by
+          // the commit like a stale reader that showed the committed frame.
+          el._transition = bornHeld;
+          bornHeld._pendingNodes.push(el);
+          if (isEffect) bornHeld._gatedSubs.add(el);
+        }
         // A window landing that gets held re-opens the window until the hold
         // commits — the verdict's held-value branch is window-gated (#2990).
         if (wasLoading) el._loading = true;
-        // Transition-held sync recompute is a write path like setSignal/asyncWrite,
+        // A staged sync recompute is a write path like setSignal/asyncWrite,
         // so sync derivations of held sources stay visible to isPending()/latest()
         // (#2831). Both companion writes are transition-scoped (optimistic) and
-        // auto-revert/re-derive at commit. Skipped for plain flushes where the
-        // pending value commits before effects run.
-        if ((activeTransition || el._transition) && GlobalQueue._syncCompanions !== null)
+        // auto-revert/re-derive at commit. Not gated on an active transition:
+        // a plain flush can still become a hold after this recompute — an
+        // async memo downstream pends and the batch is adopted into a
+        // transaction (scheduler.enterTransition) — and nothing re-derives
+        // the companion at adoption, so a memo held that way read
+        // isPending() false while its held source read true (#3413).
+        if (el._config & CONFIG_HAS_COMPANIONS && GlobalQueue._syncCompanions !== null)
           GlobalQueue._syncCompanions(el, value);
       }
       // insertSubs only walks _subs (no scheduling of its own), so a
@@ -4024,6 +4657,54 @@ function recompute(el, create = false) {
     if (wasPendingSource && !(el._statusFlags & (STATUS_PENDING | STATUS_UNINITIALIZED)))
       settlePendingSource(el);
   }
+  // A REPORTER whose pass stopped reading a source it reported on (a gate
+  // closed) stops counting for the transaction waiting on it (A15 / #3426:
+  // the hold lasts while a live reporter observes the flight). Nothing else
+  // re-judges a parked transaction (see wokenTransitions; the disposal
+  // (#3372) and boundary (#3375) twins of this site), so the writes it held
+  // stayed staged for as long as the flight stayed up — forever, for one
+  // that never lands (fuzzer #3446 P1, spec O3). The event is "this pass
+  // dropped a dep" — deps past `_depsTail` (trimmed below, or kept by A30
+  // for a staged pass), or a pass that read nothing — not "recovered from
+  // pending": a reporter registered by the stale-reader carve-out
+  // (heldFromStale, an INITIALIZED source refetching) displays the committed
+  // value and is never pending (fuzzer case 79). Every parked transaction,
+  // not the reporter's stamp: the transaction waiting on it registered it
+  // without stamping it. One idle pass per parked transaction; done ones
+  // return at re-entry. Effects only — reporters register from render-effect
+  // notification (INV-3).
+  // (`_depsTail` was reset at the top of the pass; TS keeps that narrowing.)
+  const tail = el._depsTail;
+  if (
+    isEffect &&
+    ((wasPending && !(el._statusFlags & STATUS_PENDING)) ||
+      (tail === null ? el._deps !== null : tail._nextDep !== null))
+  )
+    wakeParked();
+  // Dependencies are the committed frame's until it is replaced (A30, #3410; the
+  // deps twin of the held children above): a pass that staged its value
+  // leaves the previous pass's tail linked for `commitPendingNode` to trim,
+  // so a write to a dependency the committed value still derives from
+  // reaches this node — and joins its hold if the stage is transaction-held
+  // by then (a plain flush decides nothing here: the transaction that holds
+  // the pass may open later in the same flush). A pass that published
+  // directly (a first pass, a lane's own reveal) trims now. An errored pass
+  // (a throw, NotReady included, or a comparator throw above) keeps its full
+  // list as before — `_depsTail` marks where it stopped — and the commit
+  // skips it by the same `_error`. An effect's frame is the run its value is
+  // applied by, not the value slot (#3438): a direct-committed pass that
+  // still owes a run (`_modified`) has not replaced what the last run
+  // published — the same flush may stash that run into a transaction it
+  // opens later — so its tail waits for `runEffect` to trim once the run
+  // applies. A pass that changed nothing replaced nothing either (#3469): the
+  // same flush may park with its inputs held, and the committed frame still
+  // derives from the tail — its trim waits on the flush's verdict (heldTrims).
+  // A tracked effect's pass IS its run (it bypasses the heap and runs after
+  // the commit): the frame is replaced, trim now.
+  if (!el._x?._error && el._pendingValue === NOT_PENDING && !(isEffect && el._modified)) {
+    if (create || isOptimisticDirty || isEffect === EFFECT_TRACKED) trimStaleDeps(el);
+    else if (el._depsTail?._nextDep ?? el._deps) heldTrims.push(el);
+  }
   // Attribution hook: fired before the lane restore so `currentOptimisticLane`
   // still reflects THIS run's posture. The facts distinguish an overlay
   // recompute (optimistic lane, transition replay, transition-held commit)
@@ -4048,14 +4729,40 @@ function recompute(el, create = false) {
   // under the override (A17). Revert no longer commits anything, so an
   // unqueued covered hold would leak (INV-7) once the revert clears
   // _transition.
-  needsPendingCommit &&
-    (!create || el._statusFlags & STATUS_PENDING) &&
-    (!el._transition || hasOverride) &&
-    queuePendingNode(el);
-  el._transition &&
-    isEffect &&
-    activeTransition !== el._transition &&
+  //
+  // While a pass's result waits on a commit, its children (and `_disposal`)
+  // wait with it, and a re-run may tear them down immediately
+  // (CONFIG_HELD_CHILDREN, #3404). One exception: a transaction-owned effect
+  // recomputed mainline (contested, #3322) published its value directly — a
+  // `_pendingValue` left from an earlier held pass is that transaction's,
+  // not this one's — so this pass's children are the frame's, and any
+  // zombies deferred at the top are superseded on that same frame. Its
+  // commit rides the transaction, not this flush: release them here rather
+  // than let two generations render at once.
+  let held =
+    needsPendingCommit &&
+    (!create || bornHeld !== null || (el._statusFlags & STATUS_PENDING) !== 0);
+  if (held && (!el._transition || hasOverride)) queuePendingNode(el);
+  else if (
+    held &&
+    activeTransition === null &&
+    !(el._statusFlags & (STATUS_PENDING | STATUS_UNINITIALIZED))
+  ) {
+    held = false;
+    disposeChildren(el, false, true);
+  }
+  if (held) el._config |= CONFIG_HELD_CHILDREN;
+  else el._config &= ~CONFIG_HELD_CHILDREN;
+  // (A born-held pass IS the transaction's staged view — nothing to refresh.)
+  if (el._transition && isEffect && activeTransition !== el._transition && bornHeld === null) {
+    // The re-run refreshes the transaction's STAGED view (_pendingValue); the
+    // value this pass published in _value belongs to the run that just
+    // finished. Keep that ownership, or the effect phase parks a
+    // mainline-computed value with the transaction (#3412).
+    const owner = el._valueTransition;
     runInTransition(el._transition, () => recompute(el));
+    el._valueTransition = owner;
+  }
   // Missed-wake reschedule (see the finally above): values this pass read
   // before the nested commit are stale, so run again now that the heap will
   // accept the node. Equality gates stop same-value landings from cascading,
@@ -4159,6 +4866,7 @@ function ext(el) {
     _overrideValue: undefined,
     _overrideOwner: undefined,
     _overrideTime: 0,
+    _flushedStaged: NOT_PENDING,
     _overrideStamp: 0,
     _optimisticLane: undefined,
     _pendingSignal: undefined,
@@ -4372,9 +5080,10 @@ function linkFirewallChild(firewall, s) {
 /** Release a firewall child the store no longer addresses (unobserved sweep
  * dropped it from its target's cache): unlink it from the chain so the
  * projection stops retaining it and its last value. The node keeps its own
- * `_nextChild` so a walk that is mid-chain on it still terminates. Nodes in
- * `_companionChildren` stay there — companions are permanent by contract
- * and snap through that set, not the chain. */
+ * `_nextChild` so a walk that is mid-chain on it still terminates. It also
+ * leaves `_companionChildren` (#3503): the companions themselves are
+ * permanent on the node, but the node is unreachable through the store, so
+ * the set would only retain it and its last value. */
 function unlinkFirewallChild(node) {
   const n = node;
   const fw = n._firewall;
@@ -4385,6 +5094,11 @@ function unlinkFirewallChild(node) {
   else if (fw._x._child === n) fw._x._child = next;
   if (next !== null) next._prevChild = prev;
   n._prevChild = null;
+  // #3503: the companion set is the last projection-side reference to a
+  // released leaf; leaving it there kept the leaf and its last value alive
+  // for the projection's lifetime after every latest()/isPending() reader
+  // was disposed.
+  fw._x._companionChildren?.delete(n);
 }
 function slotSignal(v, equals, host, key, acc, firewall = null) {
   // Prod and observe boilerplates — see computed(). The store relabels the
@@ -4481,6 +5195,31 @@ function untrack(fn, strictReadLabel) {
     strictRead = prevStrictRead;
   }
 }
+/**
+ * Set while runtime bookkeeping evaluates a user accessor inside another
+ * node's pass (a loading boundary's `on` key, read from `notify` while the
+ * node that went pending is still recomputing). `context` is that node, but
+ * the read is nobody's: the value is compared, never derived from, so the
+ * untracked-pending re-run link (`read`, `!tracking`) must not be recorded on
+ * it — it made the key's source a dependency of an unrelated async memo
+ * (#3528: `isPending(m2)` through a memo in `on()` linked the memo into `m2`,
+ * a cycle that re-derived `m2` on every pending mark and never converged).
+ */
+let spectating = false;
+/**
+ * Evaluates `fn` untracked and without recording a dependency for the
+ * untracked-pending re-run rule on the current `context`. For bookkeeping
+ * reads made mid-propagation on behalf of no node — see `spectating`.
+ */
+function spectate(fn) {
+  const prev = spectating;
+  spectating = true;
+  try {
+    return untrack(fn);
+  } finally {
+    spectating = prev;
+  }
+}
 /**
  * Bring a computed to a readable state: lazy/disposed nodes are (re)computed;
  * an isPending() probe (`refresh`) additionally pulls the node fully up to
@@ -4557,15 +5296,262 @@ function installAuthoritativeRead() {
  * already use). An effect the transaction itself computed re-derives at its
  * commit on its own (parked run, or the contested re-derive, #3322) and is
  * not recorded — replaying it too would publish the frame twice.
+ *
+ * Flight twin (the pending-branch carve-out): the reader is served the
+ * node's committed, pre-flight value and now observes that flight — A15:
+ * async work observed by a reader settles as one unit with the writes that
+ * asked it — so it joins the transaction's reporters for the node. The
+ * reporter the transaction recorded when the flight started may be gone (a
+ * keyed remount disposed it, #3374); a completion check that found no live
+ * reporter committed the writes ahead of the answer, tearing the new
+ * reader's frame (`Count: 1` beside `Details: 0`). Joins an entry the
+ * transaction already holds; a flight nobody had observed yet has none (the
+ * reader is its first observer — a conditional that just revealed it, #3458)
+ * and is notified up the reader's own queue chain under that transaction,
+ * the one sanctioned registration site (INV-3): a collecting boundary above
+ * the reader consumes it as it would any pending, an unboundaried reader
+ * opens the entry — and the transaction, judged complete on its other
+ * flights, revealed the inputs beside the reader's pre-flight value
+ * otherwise (`Count: 1 | A: 1` beside `B: 0`). A staged signal or a settled
+ * node registers nothing. Every reporter dies with its reader
+ * (reporterBlocksSource: the read linked it as a dep). The node's own entry
+ * is the only one that can matter: a chain's intermediate memo is re-pulled
+ * by the read (updateIfNecessary's retry) and enters the transaction, so the
+ * reader holds through the normal path; a node with its own flight that is
+ * also pending on an upstream re-ask blocks through that flight until it
+ * lands, and its landing re-runs the reader into the normal path.
+ */
+/** The replay half of the stale-of-foreign clause (A15 / A26): a stale reader
+ * served the committed value because `txn` holds what it read re-runs at
+ * txn's commit, when the value it was denied becomes the frame — unless its
+ * own last value already came from that transaction. One registration for
+ * the node path (heldFromStale) and the store's backing paths, which have
+ * no node to carry the hold (heldFromReader, the adoption hold view). */
+function recordStaleReplay(txn, c) {
+  const vt = c._valueTransition;
+  if (vt == null || currentTransition(vt) !== txn) txn._gatedSubs.add(c);
+}
+/**
+ * The ownership relation (DESIGN-CONSOLIDATION §6, ruled 2026-09-17): is
+ * `hold` part of the running pass's world? A plain reader's world is the
+ * transaction it runs under, through merges. A lane reader's world is its
+ * lane AND the transition that owns the lane — the one asymmetry between a
+ * lane and a separate transaction (a lane sees what lands from its parent as
+ * its own; a separate transaction would wait for the parent to settle) —
+ * see `ownsLane` in lanes.ts, built on this. One relation for the
+ * stale-of-foreign clause (heldFromStale), the lane arm (readsHeldCommitted)
+ * and the store's backing holds (foreignHold); `serve` has no lane arm of
+ * its own, the lane's extra visibility lives here.
  */
+function ownsHold(hold) {
+  return (
+    activeTransition !== null && currentTransition(hold) === currentTransition(activeTransition)
+  );
+}
 function heldFromStale(el, c) {
   const t = el._transition;
-  if (t === null || t === activeTransition) return false;
+  if (t === null || ownsHold(t)) return false;
   const txn = currentTransition(t);
-  const vt = c._valueTransition;
-  if (vt == null || currentTransition(vt) !== txn) txn._gatedSubs.add(c);
+  recordStaleReplay(txn, c);
+  const reporters = txn._asyncReporters.get(el);
+  if (reporters) reporters.add(c);
+  else if (el._statusFlags & STATUS_PENDING)
+    runInTransition(txn, () => c._queue.notify(c, STATUS_PENDING, STATUS_PENDING, el._x._error));
+  return true;
+}
+/**
+ * A tracked computation about to be served a live transaction's staged value
+ * derives from that transaction's world, so it enters the transaction and
+ * this pass's result is held with it (A29, #3408). The write side (`setSignal`)
+ * and a stamped node's recompute already enter; a reader that only now
+ * starts reading the held node — a conditional memo whose branch flipped —
+ * was the gap: it published a value derived from the staged world into the
+ * mainline frame. Not for a probe (`isPending(() => x())` observes, it does
+ * not derive) and a no-op for the ambient batch (`_transition` null) or the
+ * transaction already active.
+ */
+/** The transaction a pass running OUTSIDE a flush was served a staged value
+ * from (A29, creation-time form). Inside a flush the pass enters through
+ * initTransition; outside one — a memo or effect created from mainline code
+ * while a hold is live — entering would leave `activeTransition` and the
+ * batch pointed at the transaction for the rest of the synchronous block,
+ * so an unrelated write made after the mount was held with someone else's
+ * action. The entry is the pass's alone: recompute stages the node into the
+ * transaction (born held) and mainline is never touched. */
+let stagedEntry = null;
+function enterStagedRead(el, t = el._transition) {
+  if (!t || t === activeTransition || pendingCheckActive) return;
+  // A companion (the latest() shadow, the isPending() verdict signal) is the
+  // engine's mirror of the flushed world — reading it, or being it, is an
+  // observation, not a derivation from the hold: latest(x) never enters x's
+  // transaction, and the shadow's own pass never enters either (it would
+  // flip activeTransition under the reader that pulled it). (`el` is null for
+  // a store backing served under a hold — no node, the transaction is the
+  // fold's.)
+  if (el?._x?._parentSource || context?._x?._parentSource) return;
+  // Verdict machinery (GlobalQueue._verdictPull: companion creation and the
+  // latest()/isPending() pulls — the latest() shadow is created before it is
+  // marked optimistic, so the bit alone cannot tell) and optimistic nodes
+  // (own lane posture, A31) read staged truth by design; they keep the
+  // entering path.
+  // (`context` is non-null here: every caller selected a value for a reader.)
+  const ctx = context;
+  if (activeTransition === null && !globalQueue._running) {
+    // Verdict pulls are observations, not derivations: a latest() /
+    // isPending() call from mainline must never enter a transaction (it
+    // would capture the rest of the caller's synchronous block).
+    if (GlobalQueue._verdictPull) return;
+    if (
+      ctx._flags & REACTIVE_RECOMPUTING_DEPS &&
+      !(ctx._config & CONFIG_OPTIMISTIC) &&
+      (stagedEntry === null || stagedEntry === t)
+    ) {
+      stagedEntry = t;
+      return;
+    }
+  }
+  globalQueue.initTransition(t);
+}
+/**
+ * Rule 1 (value selection), the full arm: does this reader see a STAGED
+ * node's COMMITTED value? One implementation of the rule the fast paths
+ * (readNodeFast, read's fast block) carry as their trivial ternary and that
+ * every slow site — read's tail, the store's backing selection, the lane and
+ * verdict arms — used to restate by hand (docs/DESIGN-CONSOLIDATION.md, move 3b). In order:
+ * - no reader at all (an untracked read) — the committed frame;
+ * - a reader under an optimistic lane the engine says reads committed
+ *   (laneReadsCommitted: another lane's hold, #3460);
+ * - nothing staged;
+ * - a children-forbidden reader (createTrackedEffect / onSettled: the frame,
+ *   never the graph — A32);
+ * - a stale reader (render effect) of a FOREIGN transaction's staged write —
+ *   committed, no entanglement (heldFromStale registers the replay; a node
+ *   born held has no committed frame to fall back to, `noCommitted`);
+ * - A17 for HELD truth (#3164, CONFIG_HELD_TRUTH): staged confirming truth —
+ *   fold-staged onto an armed family, or entangle-stolen by an awaited
+ *   until() — is masked from ordinary readers until its transaction's
+ *   reveal, the retaining transaction's own speculative recomputes included
+ *   (partial override coverage would otherwise compose override + staged
+ *   truth into a state no timeline contains). Authoritative readers
+ *   (until()'s predicate) and latest() see the staged truth — the tunnel that
+ *   keeps the hold deadlock-free.
+ * False means the reader derives from the staged value and enters its
+ * transaction (enterStagedRead, A29).
+ */
+function readerSeesCommitted(el, c, owner, noCommitted) {
+  return !!(
+    !c ||
+    (currentOptimisticLane !== null && GlobalQueue._laneReadsCommitted(el, owner, c)) ||
+    el._pendingValue === NOT_PENDING ||
+    c._config & CONFIG_CHILDREN_FORBIDDEN ||
+    (stale && !noCommitted && heldFromStale(el, c)) ||
+    (el._config & CONFIG_HELD_TRUTH &&
+      !latestReadActive &&
+      !(c._config & CONFIG_AUTHORITATIVE_READ))
+  );
+}
+/** A28 — set when a node is staged (queuePendingNode) or a held node rewritten
+ * (stashHeldRewrite) OUTSIDE a flush; cleared when the next flush begins. The
+ * read sites test this one module boolean instead of `globalQueue._running`:
+ * inside a flush it is false and the A28 arm costs nothing; outside, only a
+ * tick with unflushed writes pays the staged-node check. */
+let unflushedStaged = false;
+function markUnflushedStaged() {
+  unflushedStaged = true;
+}
+/** A28 — a write becomes visible at flush. Outside a flush, a node holding an
+ * AMBIENT staged value (no transaction stamp) was written since the last
+ * flush: ambient staging commits at flush end, so nothing else leaves a node
+ * in this state; a stamped value is the flushed held world, which A28 says
+ * latest() serves. Inside a flush the rule does not apply (A28 (4): promoted
+ * within the round). Structural — no marker on the write path. */
+function unflushed(el) {
+  return unflushedValue(el) !== NOT_PENDING;
+}
+/** The value an unflushed node serves — the committed value for an ambient
+ * write, the flushed staged value for a rewrite of a held node — or
+ * NOT_PENDING when nothing is unflushed. Exempt: owned-write nodes (A28 (4):
+ * a write issued inside a recompute is promoted at that recompute's end —
+ * boundary and loading machinery, until()'s internals, signals declared for
+ * in-computation writes) and engine companions (the isPending() verdict
+ * signal, the latest() shadow: the system's own writes, made at the source's
+ * write to mirror it, installing eagerly — A28, A8). */
+function unflushedValue(el, committed = el._value) {
+  if (
+    globalQueue._running ||
+    el._pendingValue === NOT_PENDING ||
+    el._config & CONFIG_PROMOTED ||
+    el._x?._parentSource
+  )
+    return NOT_PENDING;
+  // Ambient, or adopted by a transaction before any flush carried the staging
+  // (CONFIG_ADOPTED_UNFLUSHED): nothing flushed is staged — the committed
+  // value answers (the caller's notion of committed: a store node's backing).
+  // A held node: unflushed only if rewritten since the last flush (stash).
+  if (el._transition === null || el._config & CONFIG_ADOPTED_UNFLUSHED) return committed;
+  return el._x === null ? NOT_PENDING : el._x._flushedStaged;
+}
+/** Held nodes rewritten since the last flush (setSignal); the flush clears
+ * their stash — from then on latest() answers with the rewrite. */
+const unflushedRewrites = [];
+/** Nodes written inside a creation-time recompute (CONFIG_PROMOTED). */
+const promotedWrites = [];
+/** A28 (5): an optimistic write becomes the ACTIVE override at the flush that
+ * carries it. `_overrideTime` is stamped with `clock` at the write and `clock`
+ * advances after every flush, so "this tick, outside a flush" is unflushed. */
+function unflushedOverride(el) {
+  // Companions are optimistic signals written by the engine (see unflushed).
+  return !globalQueue._running && el._x?._overrideTime === clock && !el._x?._parentSource;
+}
+/** Active optimistic override on an armed node (an armed slot idles at
+ * NOT_PENDING; undefined = unarmed plain node). The writer's own channels —
+ * the draft, `in`/keys inside the setter — compose on this regardless of
+ * flush state. */
+function hasActiveOverride(el) {
+  const x = el._x;
+  return x !== null && x._overrideValue !== undefined && x._overrideValue !== NOT_PENDING;
+}
+/** The override a READER sees: installed, and carried by a flush (A28 (5) —
+ * an optimistic write is a write; until its flush no reader sees it). One
+ * implementation for read()'s override arm, the verdict channels
+ * (latestRead, computePendingState) and the store's selection
+ * (docs/DESIGN-CONSOLIDATION.md, move 3b). */
+function visibleOverride(el) {
+  return hasActiveOverride(el) && !unflushedOverride(el);
+}
+/** A derivation served the committed value because of an unflushed write
+ * (A28) must run again in the flush that carries it — the late-linker case
+ * (#3337's reason to defer the walk): it linked after the write walked. */
+function markLateLinker(c) {
+  // The pass's own tail re-enqueues on this latch (recompute's finally) —
+  // a direct enqueue here would be wiped by the pass's flag reset.
+  c._flags |= REACTIVE_MISSED_WAKE;
   return true;
 }
+/** Companion-bearing nodes written outside a flush (setSignal); the flush
+ * that carries their writes re-syncs their companions (A28). */
+const unflushedCompanions = [];
+function resyncUnflushedCompanions() {
+  unflushedStaged = false;
+  // Length-guarded: the common flush has nothing here, and must allocate nothing.
+  // Length-guarded: the common flush has nothing here and allocates nothing.
+  if (unflushedRewrites.length !== 0) {
+    for (const el of unflushedRewrites) el._x._flushedStaged = NOT_PENDING;
+    unflushedRewrites.length = 0;
+  }
+  if (promotedWrites.length !== 0) {
+    for (const el of promotedWrites) el._config &= ~CONFIG_PROMOTED;
+    promotedWrites.length = 0;
+  }
+  if (unflushedCompanions.length !== 0) {
+    for (const el of unflushedCompanions)
+      GlobalQueue._syncCompanions(
+        el,
+        el._pendingValue !== NOT_PENDING ? el._pendingValue : el._value
+      );
+    unflushedCompanions.length = 0;
+  }
+}
 function readNodeFast(el) {
   if (
     latestReadActive ||
@@ -4577,6 +5563,9 @@ function readNodeFast(el) {
     activeTransition !== null ||
     currentOptimisticLane !== null ||
     snapshotCaptureActive ||
+    // A28: a staged node read outside a flush may serve its committed value;
+    // that arm lives on the slow path so this body stays inlinable.
+    (unflushedStaged && el._pendingValue !== NOT_PENDING) ||
     strictRead
   )
     return READ_SLOW;
@@ -4598,7 +5587,7 @@ function readNodeFast(el) {
     c._config & CONFIG_CHILDREN_FORBIDDEN ||
     (stale && heldFromStale(el, c))
     ? el._value
-    : el._pendingValue;
+    : (enterStagedRead(el), el._pendingValue);
 }
 function read(el) {
   // Handle latest() mode: read from _latestValueComputed
@@ -4627,6 +5616,7 @@ function read(el) {
     activeTransition === null &&
     currentOptimisticLane === null &&
     !snapshotCaptureActive &&
+    (!unflushedStaged || el._pendingValue === NOT_PENDING) && // A28, see readNodeFast
     !strictRead
   ) {
     if (c && tracking) link(el, c);
@@ -4637,7 +5627,7 @@ function read(el) {
       c._config & CONFIG_CHILDREN_FORBIDDEN ||
       (stale && heldFromStale(el, c))
       ? el._value
-      : el._pendingValue;
+      : (enterStagedRead(el), el._pendingValue);
   }
   // The dev component-body safeguard (#2897) must not fire inside an
   // isPending() probe: its plain Error would be swallowed by the probe's
@@ -4724,7 +5714,10 @@ function read(el) {
       // lane (#3276); that check rides laneSuspends so floor bundles don't
       // pay for it.
       if (currentOptimisticLane === null || GlobalQueue._laneSuspends(owner)) {
-        if (!tracking && el !== c) link(el, c);
+        // An untracked read of a pending node still re-runs its reader when
+        // the node settles — unless nobody is reading (`spectating`, #3528)
+        // or the reader is the node itself.
+        if (!tracking && !spectating && el !== c) link(el, c);
         throw owner._x?._error;
       }
     } else if (!c && owner._statusFlags & STATUS_UNINITIALIZED) {
@@ -4760,7 +5753,48 @@ function read(el) {
       ownerName: c?._name,
       nodeName: owner?._name
     });
-  if (el._x?._overrideValue !== undefined && el._x?._overrideValue !== NOT_PENDING) {
+  const value = serve(el, c, owner, el._value);
+  if (
+    !c &&
+    owner === el &&
+    typeof computed._fn === "function" &&
+    el._config & CONFIG_AUTO_DISPOSE &&
+    !(owner._statusFlags & STATUS_PENDING) &&
+    !el._subs &&
+    // An untracked read served a visible override returned before this
+    // sweep registration when the arm was inline; keep that.
+    !visibleOverride(el)
+  ) {
+    // Deferred, not inline (#3078): an inline unobserved() here made untracked
+    // reads destructive — dispose on this read, full revival recompute on the
+    // next — so consecutive reads could answer differently with no write in
+    // between (the revival samples the ambient transition/lane context).
+    // The sweep at flush finalization re-validates and reclaims; schedule()
+    // guarantees that flush happens even if nothing else is queued.
+    dormantNodes.add(el);
+    schedule();
+  }
+  return value;
+}
+/**
+ * Rule 1, the one slow implementation (DESIGN-CONSOLIDATION move 3b, step
+ * 6c): the value a reader `c` (null = untracked, no pass) is served from
+ * `el`, whose committed value is `committed` — the node's own `_value` for
+ * a signal or memo, the BACKING for a store property node (single-home rule,
+ * O6: committed truth lives in the backing and a node's `_value` is never
+ * served for one). Called by read()'s slow tail and by the store's untracked
+ * node path (nodeValue); the fast paths (readNodeFast, read's fast block)
+ * keep their trivial ternary by design (perf, see the doc). Arms, in order:
+ * - the override (A17), routed through the engine for a tracked reader under
+ *   a lane or a supersession (A18), an authoritative reader marked instead;
+ * - the lane entanglement gate (committed, recorded for replay);
+ * - a node born held has nothing for an untracked reader (A19 exception 1);
+ * - an unflushed write serves committed and re-runs the reader in the
+ *   carrying flush (A28);
+ * - readerSeesCommitted, else the staged value and the transaction (A29).
+ */
+function serve(el, c, owner, committed) {
+  if (hasActiveOverride(el)) {
     // A17: the override IS the value for every reader — except an authoritative
     // reader (until()'s predicate carries CONFIG_AUTHORITATIVE_READ): it must
     // observe independently-arriving truth, and serving it the caller's own
@@ -4771,13 +5805,18 @@ function read(el) {
     // authoritative — optimism never lives there); the sticky mark makes the
     // A17-silent "landing equals override" paths notify this node's subs so
     // the reader re-runs when truth arrives.
-    if (!(c && c._config & CONFIG_AUTHORITATIVE_READ)) {
-      // A18 supersession (#3331): the node's own source answered with a
-      // DIFFERENT value. The optimism is over for the graph — a tracked
-      // reader sees the staged truth — while the override remains the
-      // DISPLAYED value for untracked reads (and for a stale reader of some
-      // other transaction). The selection lives with the engine.
-      if (c && el._config & CONFIG_OVERRIDE_SUPERSEDED) return GlobalQueue._supersededRead(el);
+    // A28 (5): an optimistic write written this tick, outside a flush, is not
+    // yet the active override — fall through to the normal selection (the
+    // authoritative mark below still applies: until() must wake on landing).
+    if (!(c && c._config & CONFIG_AUTHORITATIVE_READ) && !unflushedOverride(el)) {
+      // A tracked read of an override is the engine's selection (a lane or a
+      // supersession implies the engine): a render effect OFF the override's
+      // held lane sees the committed value (#3460, lanes mirror transitions);
+      // a node whose own source answered with a DIFFERENT value hands a
+      // tracked reader the staged truth (A18 supersession, #3331). Untracked
+      // reads display the override.
+      if (c && el._config & (CONFIG_HAS_LANE | CONFIG_OVERRIDE_SUPERSEDED))
+        return GlobalQueue._overrideRead(el, c);
       return unwrapOverride(el._x?._overrideValue);
     }
     el._config |= CONFIG_AUTHORITATIVE_OBSERVED;
@@ -4795,7 +5834,7 @@ function read(el) {
     c !== null &&
     GlobalQueue._gatedRead(el, owner, c)
   ) {
-    return el._value;
+    return committed;
   }
   // In optimistic lane context, return _value for optimistic/lane-assigned signals
   // and for regular signals in stale mode (render effects). Non-stale readers (user
@@ -4803,58 +5842,40 @@ function read(el) {
   // (The lane-context clause lives with the engine.) Children-forbidden readers
   // (createTrackedEffect / onSettled callbacks) get committed visibility — see
   // readNodeFast (#3006).
-  const value =
-    !c ||
-    (currentOptimisticLane !== null && GlobalQueue._laneReadsCommitted(el, owner, c)) ||
-    el._pendingValue === NOT_PENDING ||
-    c._config & CONFIG_CHILDREN_FORBIDDEN ||
-    (stale && heldFromStale(el, c)) ||
-    // A17 for HELD truth (#3164, see CONFIG_HELD_TRUTH): staged confirming
-    // truth — fold-staged onto an armed family, or entangle-stolen by an
-    // awaited until() — is masked from ordinary readers until its
-    // transaction's reveal; the retaining transaction's own speculative
-    // recomputes included (partial override coverage would otherwise
-    // compose override + staged truth into a state no timeline contains).
-    // Authoritative readers (until()'s predicate) and latest() see the
-    // staged truth — the tunnel that keeps the hold deadlock-free.
-    (el._config & CONFIG_HELD_TRUTH &&
-      !latestReadActive &&
-      !(c._config & CONFIG_AUTHORITATIVE_READ))
-      ? el._value
-      : el._pendingValue;
+  // A node born held (recompute) has a staged value and no committed one: a
+  // stale reader cannot fall back to the committed frame, so it takes the
+  // staged value and enters like a tracked reader (A29); an untracked reader
+  // has nothing to serve and holds (A19 exception 1).
+  const noCommitted =
+    el._pendingValue !== NOT_PENDING && (el._statusFlags & STATUS_UNINITIALIZED) !== 0;
+  if (noCommitted && !c) throw new NotReadyError(null);
+  const u = c && unflushedStaged ? unflushedValue(el, committed) : NOT_PENDING;
+  if (u !== NOT_PENDING) {
+    markLateLinker(c);
+    if (pendingCheckActive) GlobalQueue._recordFresh(el, u);
+    return u;
+  }
+  const value = readerSeesCommitted(el, c, owner, noCommitted)
+    ? committed
+    : (enterStagedRead(el), el._pendingValue);
   // Record that this isPending() probe observed the fresh pending value, so
   // the probe doesn't pair "pending" with the new value (#2831).
   if (pendingCheckActive) GlobalQueue._recordFresh(el, value);
-  if (
-    !c &&
-    owner === el &&
-    typeof computed._fn === "function" &&
-    el._config & CONFIG_AUTO_DISPOSE &&
-    !(owner._statusFlags & STATUS_PENDING) &&
-    !el._subs
-  ) {
-    // Deferred, not inline (#3078): an inline unobserved() here made untracked
-    // reads destructive — dispose on this read, full revival recompute on the
-    // next — so consecutive reads could answer differently with no write in
-    // between (the revival samples the ambient transition/lane context).
-    // The sweep at flush finalization re-validates and reclaims; schedule()
-    // guarantees that flush happens even if nothing else is queued.
-    dormantNodes.add(el);
-    schedule();
-  }
   return value;
 }
 /**
  * Store-rewrite setter guard: the rewrite parks writes in a pending backing
  * (no setSignal at write time), so the owned-scope write protection must
- * fire at the setter entry instead. Mirrors setSignal's guard condition
+ * fire at the setter entry instead. Exactly setSignal's guard condition
  * minus the node-specific exemptions (ownedWrite/firewall), which don't
- * apply to plain store setters.
+ * apply to plain store setters. Roots are NOT exempt (#3500): a root body is
+ * tree construction — every dev component body, every context Provider, the
+ * top of `render()`, and the whole SSR pass run directly under one — and a
+ * write there re-runs what already read the old value (or on the server,
+ * can't). Same rule as setSignal, which never exempted roots.
  */
 function devGuardStoreSetterWrite() {
-  // Roots are not owned computation scopes — setters inside createRoot bodies
-  // are legal (legacy parity; the guard targets computed/effect bodies).
-  if (context && !context._root && !(context._config & CONFIG_CHILDREN_FORBIDDEN)) {
+  if (context && !(context._config & CONFIG_CHILDREN_FORBIDDEN)) {
     emitDiagnostic({
       code: "REACTIVE_WRITE_IN_OWNED_SCOPE",
       kind: "write",
@@ -4869,12 +5890,59 @@ function devGuardStoreSetterWrite() {
     throw new Error(ownedScopeWriteMessage(context));
   }
 }
+/**
+ * Store setter result guard: the callback's return has one meaning — a
+ * replacement root to adopt — and a thenable can never be that. It is the
+ * signature of `setStore(async d => …)` (or a sync arrow whose helper is
+ * async): only the writes before the first `await` were in the transaction;
+ * the rest land on a closed draft and vanish. Setters are synchronous
+ * transactions; async orchestration is `action()`'s job. Store-specific —
+ * a signal may legitimately hold a promise, so its setter has no such rule.
+ */
+function devGuardStoreSetterResult(result) {
+  if (result == null) return;
+  if (
+    (typeof result === "object" || typeof result === "function") &&
+    typeof result.then === "function"
+  ) {
+    emitDiagnostic({
+      code: "ASYNC_STORE_SETTER",
+      kind: "write",
+      severity: "error",
+      message: ASYNC_STORE_SETTER_MESSAGE,
+      ownerId: context?.id,
+      ownerName: context?._name,
+      data: { operation: "setStore" }
+    });
+    throw new Error(ASYNC_STORE_SETTER_MESSAGE);
+  }
+}
 function ownedScopeWriteMessage(owner) {
   const name = owner._name;
   return name
     ? `${REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE} (in ${name})`
     : REACTIVE_WRITE_IN_OWNED_SCOPE_SIGNAL_MESSAGE;
 }
+/** A28 — a rewrite of a HELD node outside a flush keeps the staged value the
+ * last flush left, for latest()/verdicts, until the next flush carries it
+ * (stash, cleared at that flush). Cold: only stamped nodes reach here. */
+function stashHeldRewrite(el) {
+  if (globalQueue._running) return;
+  const x = ext(el);
+  if (x._flushedStaged === NOT_PENDING) {
+    x._flushedStaged = el._pendingValue;
+    unflushedRewrites.push(el);
+    unflushedStaged = true;
+  }
+}
+/** A28 (4) — written inside a recompute that runs OUTSIDE a flush (a
+ * creation-time compute): promoted at that pass's end, visible to the rest of
+ * the block. Cold: only contextual writes reach here. */
+function notePromotedWrite(el) {
+  if (globalQueue._running || el._config & CONFIG_PROMOTED) return;
+  el._config |= CONFIG_PROMOTED;
+  promotedWrites.push(el);
+}
 function setSignal(el, v) {
   if (
     !(el._config & CONFIG_OWNED_WRITE) &&
@@ -4894,8 +5962,22 @@ function setSignal(el, v) {
     });
     throw new Error(ownedScopeWriteMessage(context));
   }
-  if (el._transition && activeTransition !== el._transition)
-    globalQueue.initTransition(el._transition);
+  // A write to a held node is a second proposal on a contested node (A34, #3494):
+  // the writer's tick reveals with the hold, the same value or another. Inside
+  // a flush the round enters now; from mainline the entry waits for the next
+  // flush's start (batchJoins) — entering here left activeTransition set for
+  // the rest of the caller's block, so a memo created after the write became
+  // the transaction's instead of mainline's (A28, A29). Before the equality
+  // gate below: repeating the held value proposes it too — and that repeat
+  // leaves through the gate, so the join schedules its own flush here; left
+  // for the next flush to find, it adopted an unrelated tick (#3519 review).
+  if (el._transition && activeTransition !== el._transition) {
+    if (globalQueue._running) globalQueue.initTransition(el._transition);
+    else {
+      batchJoins.push(el._transition); // dupes: a bare return in initTransition
+      schedule();
+    }
+  }
   // The optimistic write path lives with the engine: only optimisticSignal /
   // optimisticComputed callers and optimistic store nodes carry an
   // _overrideValue slot (flagged by CONFIG_OPTIMISTIC — a masked read of the
@@ -4919,15 +6001,25 @@ function setSignal(el, v) {
   if (attrHooks !== null) attrHooks.write(el, currentValue, v);
   const wasStaged = el._pendingValue !== NOT_PENDING;
   if (!wasStaged) queuePendingNode(el);
+  // A28 arms, gated on the loads the write already pays for (a plain ambient
+  // rewrite outside a flush — the write-loop shape — costs `_transition` and
+  // `context` here and nothing else; the arms themselves are cold helpers so
+  // setSignal stays within every setter's inlining budget, ~300 B bytecode).
+  else if (el._transition !== null) stashHeldRewrite(el);
   el._pendingValue = v;
+  if (context !== null) notePromotedWrite(el);
   // syncCompanions only pokes _pendingSignal/_latestValueComputed — with
   // neither companion present the call is a guaranteed no-op (companions are
   // only ever created, never removed, and creating one installs the hook and
   // sets CONFIG_HAS_COMPANIONS — one masked read replaces two optional-field
   // probes on every write).
-  el._config & CONFIG_HAS_COMPANIONS &&
-    GlobalQueue._syncCompanions !== null &&
+  if (el._config & CONFIG_HAS_COMPANIONS && GlobalQueue._syncCompanions !== null) {
     GlobalQueue._syncCompanions(el, v);
+    // A28 (2): the verdict computed here is the PRE-flush one (an unflushed
+    // write is not pending); the flush that carries the write re-syncs so
+    // the companions mirror the flushed world. Only companion nodes pay.
+    if (!globalQueue._running) unflushedCompanions.push(el);
+  }
   // _time is a computed-only slot (§12e): writing it on a signal would fork
   // the lean shape. Every read site is computed-typed.
   if (el._fn !== undefined) el._time = clock;
@@ -5091,131 +6183,153 @@ function markRefresh(node) {
 }
 
 export {
-  context as $,
-  findLane as A,
-  stale as B,
+  insertIntoHeap as $,
+  laneHeld as A,
+  CONFIG_AUTHORITATIVE_OBSERVED as B,
   ContextNotFoundError as C,
-  queuePendingNode as D,
+  findLane as D,
   EFFECT_RENDER as E,
-  latestReadActive as F,
+  sourceObserved as F,
   GlobalQueue as G,
-  REACTIVE_MANUAL_WRITE as H,
-  currentOptimisticLane as I,
-  resolveLane as J,
-  REACTIVE_OPTIMISTIC_DIRTY as K,
-  assignOrMergeLane as L,
-  LANE_RUN as M,
+  resolveLane as H,
+  stale as I,
+  readsHeldCommitted as J,
+  enterStagedRead as K,
+  currentTransition as L,
+  queuePendingNode as M,
   NoOwnerError as N,
   OVERRIDE_UNDEFINED as O,
-  attrHooks as P,
-  EFFECT_USER as Q,
+  latestReadActive as P,
+  REACTIVE_MANUAL_WRITE as Q,
   REACTIVE_DIRTY as R,
   STATUS_UNINITIALIZED as S,
-  REACTIVE_DISPOSED as T,
-  insertIntoHeap as U,
-  queueFor as V,
-  REACTIVE_ZOMBIE as W,
-  markHeap as X,
-  pendingCheckActive as Y,
-  setPendingCheckActive as Z,
-  prepareComputed as _,
+  currentOptimisticLane as T,
+  REACTIVE_OPTIMISTIC_DIRTY as U,
+  assignOrMergeLane as V,
+  LANE_RUN as W,
+  attrHooks as X,
+  EFFECT_USER as Y,
+  REACTIVE_DISPOSED as Z,
+  dispose as _,
   setSignal as a,
-  isEqual as a$,
-  tracking as a0,
-  link as a1,
-  currentTransition as a2,
-  enqueueSub as a3,
-  setLatestReadActive as a4,
-  setContextInternal as a5,
-  optimisticComputed as a6,
-  CONFIG_HAS_COMPANIONS as a7,
-  CONFIG_CHILD_COMPANIONS as a8,
-  setStrictRead as a9,
-  enterActionStep as aA,
-  exitActionStep as aB,
-  registerGraph as aC,
-  runWithOwner as aD,
-  setMemo as aE,
-  $REFRESH as aF,
-  installAuthoritativeRead as aG,
-  markRefresh as aH,
-  createRoot as aI,
-  getObserver as aJ,
-  dispose as aK,
-  CONFIG_DIRECT_COMMIT as aL,
-  CONFIG_AUTHORITATIVE_READ as aM,
-  entangleConfirmingTransitions as aN,
-  TimeoutError as aO,
-  untrack as aP,
-  Queue as aQ,
-  CONFIG_FRESH_READ as aR,
-  forEachDependent as aS,
-  statusNotifierOf as aT,
-  shiftAffectsMarks as aU,
-  SUPPORTS_PROXY as aV,
-  setSlotUnobserved as aW,
-  devGuardStoreSetterWrite as aX,
-  projectionWriteActive as aY,
-  setProjectionWriteActive as aZ,
-  DEV as a_,
-  strictRead as aa,
-  optimisticSignal as ab,
-  activeAffectsMarks as ac,
-  STATUS_ERROR as ad,
-  REACTIVE_RECOMPUTING_DEPS as ae,
-  setEffectStatusNotify as af,
-  unwrapStatusError as ag,
-  haltReactivity as ah,
-  StatusError as ai,
-  createEffectNode as aj,
-  recompute as ak,
-  reportDiagnostic as al,
-  emitDiagnostic as am,
-  computed as an,
-  staleValues as ao,
-  CONFIG_AUTO_DISPOSE as ap,
-  CONFIG_CHILDREN_FORBIDDEN as aq,
-  EFFECT_TRACKED as ar,
-  setEffectCallback as as,
-  setTrackedQueueCallback as at,
-  _hitUnhandledAsync as au,
-  resetUnhandledAsync as av,
-  setOrigin as aw,
-  isThenable as ax,
-  actionStepDepth as ay,
-  flush as az,
+  TimeoutError as a$,
+  queueFor as a0,
+  visibleOverride as a1,
+  unflushedValue as a2,
+  context as a3,
+  REACTIVE_RECOMPUTING_DEPS as a4,
+  markLateLinker as a5,
+  prepareComputed as a6,
+  tracking as a7,
+  link as a8,
+  enqueueSub as a9,
+  staleValues as aA,
+  CONFIG_AUTO_DISPOSE as aB,
+  CONFIG_CHILDREN_FORBIDDEN as aC,
+  EFFECT_TRACKED as aD,
+  setEffectCallback as aE,
+  setTrackedQueueCallback as aF,
+  _hitUnhandledAsync as aG,
+  resetUnhandledAsync as aH,
+  setOrigin as aI,
+  isThenable as aJ,
+  actionStepDepth as aK,
+  flush as aL,
+  enterActionStep as aM,
+  exitActionStep as aN,
+  ROOT_ERROR_HOOK as aO,
+  registerGraph as aP,
+  runWithOwner as aQ,
+  setMemo as aR,
+  dirtyQueue as aS,
+  $REFRESH as aT,
+  installAuthoritativeRead as aU,
+  markRefresh as aV,
+  createRoot as aW,
+  getObserver as aX,
+  CONFIG_DIRECT_COMMIT as aY,
+  CONFIG_AUTHORITATIVE_READ as aZ,
+  entangleConfirmingTransitions as a_,
+  setLatestReadActive as aa,
+  setContextInternal as ab,
+  optimisticComputed as ac,
+  CONFIG_HAS_COMPANIONS as ad,
+  unflushed as ae,
+  CONFIG_ADOPTED_UNFLUSHED as af,
+  CONFIG_CHILD_COMPANIONS as ag,
+  runAsTransitionBatch as ah,
+  unflushedCompanions as ai,
+  setPendingCheckActive as aj,
+  setStrictRead as ak,
+  strictRead as al,
+  optimisticSignal as am,
+  activeAffectsMarks as an,
+  pendingCheckActive as ao,
+  STATUS_ERROR as ap,
+  setEffectStatusNotify as aq,
+  unwrapStatusError as ar,
+  haltReactivity as as,
+  StatusError as at,
+  trimStaleDeps as au,
+  createEffectNode as av,
+  recompute as aw,
+  reportDiagnostic as ax,
+  emitDiagnostic as ay,
+  computed as az,
   NOT_PENDING as b,
-  readNodeFast as b0,
-  READ_SLOW as b1,
-  throwPendingUntrackedRead as b2,
-  warnStrictReadUntracked as b3,
-  unlinkFirewallChild as b4,
-  CONFIG_OWNED_WRITE as b5,
-  CONFIG_OPTIMISTIC as b6,
-  slotSignal as b7,
-  CONFIG_HELD_TRUTH as b8,
-  setStoreCommitHook as b9,
-  suppressComputedRecompute as ba,
-  handleAsync as bb,
-  createTransition as bc,
-  runAsTransitionBatch as bd,
-  createOwner as be,
-  OBSERVE as bf,
-  clearSnapshots as bg,
-  enforceLoadingBoundary as bh,
-  getNextChildId as bi,
-  isDisposed as bj,
-  markSnapshotScope as bk,
-  peekNextChildId as bl,
-  releaseSnapshotScope as bm,
-  resetErrorHalt as bn,
-  setSnapshotCapture as bo,
-  setAttributionHooks as bp,
-  ownerPath as bq,
-  isSuppressed as br,
-  anyExcluded as bs,
-  isExcluded as bt,
-  GRAPH_SIZE_WARN_AT as bu,
+  untrack as b0,
+  Queue as b1,
+  CONFIG_FRESH_READ as b2,
+  forEachDependent as b3,
+  statusNotifierOf as b4,
+  shiftAffectsMarks as b5,
+  SUPPORTS_PROXY as b6,
+  setSlotUnobserved as b7,
+  devGuardStoreSetterWrite as b8,
+  devGuardStoreSetterResult as b9,
+  clearSnapshots as bA,
+  enforceLoadingBoundary as bB,
+  getNextChildId as bC,
+  isDisposed as bD,
+  markSnapshotScope as bE,
+  ownerPath as bF,
+  peekNextChildId as bG,
+  releaseSnapshotScope as bH,
+  resetErrorHalt as bI,
+  setSnapshotCapture as bJ,
+  setAttributionHooks as bK,
+  isSuppressed as bL,
+  recordSubject as bM,
+  anyExcluded as bN,
+  isExcluded as bO,
+  GRAPH_SIZE_WARN_AT as bP,
+  subjectOf as bQ,
+  projectionWriteActive as ba,
+  setProjectionWriteActive as bb,
+  DEV as bc,
+  isEqual as bd,
+  readNodeFast as be,
+  READ_SLOW as bf,
+  throwPendingUntrackedRead as bg,
+  warnStrictReadUntracked as bh,
+  unlinkFirewallChild as bi,
+  CONFIG_OWNED_WRITE as bj,
+  ownsHold as bk,
+  deferSlotRelease as bl,
+  slotSignal as bm,
+  serve as bn,
+  recordStaleReplay as bo,
+  setStoreCommitHook as bp,
+  suppressComputedRecompute as bq,
+  handleAsync as br,
+  createTransition as bs,
+  CONFIG_HELD_TRUTH as bt,
+  createOwner as bu,
+  spectate as bv,
+  transitions as bw,
+  wakeParked as bx,
+  REACTIVE_ZOMBIE as by,
+  OBSERVE as bz,
   cleanup as c,
   REACTIVE_CHECK as d,
   resolveTransition as e,
@@ -5230,14 +6344,14 @@ export {
   schedule as n,
   origin as o,
   STATUS_PENDING as p,
-  CONFIG_OVERRIDE_SUPERSEDED as q,
+  CONFIG_DERIVED_OVERRIDE as q,
   read as r,
   signal as s,
-  hasActiveOverride as t,
+  CONFIG_OPTIMISTIC as t,
   unwrapOverride as u,
-  NotReadyError as v,
-  activeLanes as w,
-  signalLanes as x,
-  laneHeld as y,
-  CONFIG_AUTHORITATIVE_OBSERVED as z
+  CONFIG_OVERRIDE_SUPERSEDED as v,
+  hasActiveOverride as w,
+  NotReadyError as x,
+  activeLanes as y,
+  signalLanes as z
 };