@solidjs/signals 2.0.0-rc.8 → 2.0.0-rc.9

package/dist/dev.js

@@ -24,126 +24,147 @@ import {
   m as insertSubs,
   n as schedule,
   p as STATUS_PENDING,
-  q as CONFIG_OVERRIDE_SUPERSEDED,
-  t as hasActiveOverride$1,
-  v as NotReadyError,
-  w as activeLanes,
-  x as signalLanes,
-  y as laneHeld,
+  q as CONFIG_DERIVED_OVERRIDE,
+  t as CONFIG_OPTIMISTIC,
+  v as CONFIG_OVERRIDE_SUPERSEDED,
+  w as hasActiveOverride,
+  x as NotReadyError,
+  y as activeLanes,
+  z as signalLanes,
+  A as laneHeld,
   E as EFFECT_RENDER,
-  z as CONFIG_AUTHORITATIVE_OBSERVED,
-  A as findLane,
-  B as stale,
-  D as queuePendingNode,
-  F as latestReadActive,
-  H as REACTIVE_MANUAL_WRITE,
-  I as currentOptimisticLane,
-  J as resolveLane,
-  K as REACTIVE_OPTIMISTIC_DIRTY,
-  L as assignOrMergeLane,
-  M as LANE_RUN,
-  P as attrHooks,
-  Q as EFFECT_USER,
-  T as REACTIVE_DISPOSED,
-  U as insertIntoHeap,
-  V as queueFor,
-  W as REACTIVE_ZOMBIE,
-  X as markHeap,
-  Y as pendingCheckActive,
-  Z as setPendingCheckActive,
-  _ as prepareComputed,
-  $ as context,
-  a0 as tracking,
-  a1 as link,
-  a2 as currentTransition,
-  a3 as enqueueSub,
-  a4 as setLatestReadActive,
-  a5 as setContextInternal,
-  a6 as optimisticComputed,
-  a7 as CONFIG_HAS_COMPANIONS,
-  a8 as CONFIG_CHILD_COMPANIONS,
-  a9 as setStrictRead,
-  aa as strictRead,
-  ab as optimisticSignal,
-  ac as activeAffectsMarks,
-  ad as STATUS_ERROR,
-  ae as REACTIVE_RECOMPUTING_DEPS,
-  af as setEffectStatusNotify,
-  ag as unwrapStatusError,
-  ah as haltReactivity,
-  ai as StatusError,
-  aj as createEffectNode,
-  ak as recompute,
-  al as reportDiagnostic,
-  am as emitDiagnostic,
-  an as computed,
-  ao as staleValues,
-  ap as CONFIG_AUTO_DISPOSE,
-  aq as CONFIG_CHILDREN_FORBIDDEN,
-  ar as EFFECT_TRACKED,
-  as as setEffectCallback,
-  at as setTrackedQueueCallback,
-  au as _hitUnhandledAsync,
-  av as resetUnhandledAsync,
-  aw as setOrigin,
-  ax as isThenable,
-  ay as actionStepDepth,
-  az as flush,
-  aA as enterActionStep,
-  aB as exitActionStep,
-  aC as registerGraph,
-  aD as runWithOwner,
-  aE as setMemo,
-  aF as $REFRESH,
-  aG as installAuthoritativeRead,
-  aH as markRefresh,
-  aI as createRoot,
-  aJ as getObserver,
-  aK as dispose,
-  aL as CONFIG_DIRECT_COMMIT,
-  aM as CONFIG_AUTHORITATIVE_READ,
-  aN as entangleConfirmingTransitions,
-  aO as TimeoutError,
-  aP as untrack,
-  aQ as Queue,
-  aR as CONFIG_FRESH_READ,
-  aS as forEachDependent,
-  aT as statusNotifierOf,
-  aU as shiftAffectsMarks,
-  aV as SUPPORTS_PROXY,
-  aW as setSlotUnobserved,
-  aX as devGuardStoreSetterWrite,
-  aY as projectionWriteActive,
-  aZ as setProjectionWriteActive,
-  a_ as DEV$1,
-  a$ as isEqual,
-  b0 as readNodeFast,
-  b1 as READ_SLOW,
-  b2 as throwPendingUntrackedRead,
-  b3 as warnStrictReadUntracked,
-  b4 as unlinkFirewallChild,
-  b5 as CONFIG_OWNED_WRITE,
-  b6 as CONFIG_OPTIMISTIC,
-  b7 as slotSignal,
-  b8 as CONFIG_HELD_TRUTH,
-  b9 as setStoreCommitHook,
-  ba as suppressComputedRecompute,
-  bb as handleAsync,
-  bc as createTransition,
-  bd as runAsTransitionBatch,
-  be as createOwner,
-  bf as OBSERVE$1
+  B as CONFIG_AUTHORITATIVE_OBSERVED,
+  D as findLane,
+  F as sourceObserved,
+  H as resolveLane,
+  I as stale,
+  J as readsHeldCommitted,
+  K as enterStagedRead,
+  L as currentTransition,
+  M as queuePendingNode,
+  P as latestReadActive,
+  Q as REACTIVE_MANUAL_WRITE,
+  T as currentOptimisticLane,
+  U as REACTIVE_OPTIMISTIC_DIRTY,
+  V as assignOrMergeLane,
+  W as LANE_RUN,
+  X as attrHooks,
+  Y as EFFECT_USER,
+  Z as REACTIVE_DISPOSED,
+  _ as dispose,
+  $ as insertIntoHeap,
+  a0 as queueFor,
+  a1 as visibleOverride,
+  a2 as unflushedValue,
+  a3 as context,
+  a4 as REACTIVE_RECOMPUTING_DEPS,
+  a5 as markLateLinker,
+  a6 as prepareComputed,
+  a7 as tracking,
+  a8 as link,
+  a9 as enqueueSub,
+  aa as setLatestReadActive,
+  ab as setContextInternal,
+  ac as optimisticComputed,
+  ad as CONFIG_HAS_COMPANIONS,
+  ae as unflushed,
+  af as CONFIG_ADOPTED_UNFLUSHED,
+  ag as CONFIG_CHILD_COMPANIONS,
+  ah as runAsTransitionBatch,
+  ai as unflushedCompanions,
+  aj as setPendingCheckActive,
+  ak as setStrictRead,
+  al as strictRead,
+  am as optimisticSignal,
+  an as activeAffectsMarks,
+  ao as pendingCheckActive,
+  ap as STATUS_ERROR,
+  aq as setEffectStatusNotify,
+  ar as unwrapStatusError,
+  as as haltReactivity,
+  at as StatusError,
+  au as trimStaleDeps,
+  av as createEffectNode,
+  aw as recompute,
+  ax as reportDiagnostic,
+  ay as emitDiagnostic,
+  az as computed,
+  aA as staleValues,
+  aB as CONFIG_AUTO_DISPOSE,
+  aC as CONFIG_CHILDREN_FORBIDDEN,
+  aD as EFFECT_TRACKED,
+  aE as setEffectCallback,
+  aF as setTrackedQueueCallback,
+  aG as _hitUnhandledAsync,
+  aH as resetUnhandledAsync,
+  aI as setOrigin,
+  aJ as isThenable,
+  aK as actionStepDepth,
+  aL as flush,
+  aM as enterActionStep,
+  aN as exitActionStep,
+  aO as ROOT_ERROR_HOOK,
+  aP as registerGraph,
+  aQ as runWithOwner,
+  aR as setMemo,
+  aS as dirtyQueue,
+  aT as $REFRESH,
+  aU as installAuthoritativeRead,
+  aV as markRefresh,
+  aW as createRoot,
+  aX as getObserver,
+  aY as CONFIG_DIRECT_COMMIT,
+  aZ as CONFIG_AUTHORITATIVE_READ,
+  a_ as entangleConfirmingTransitions,
+  a$ as TimeoutError,
+  b0 as untrack,
+  b1 as Queue,
+  b2 as CONFIG_FRESH_READ,
+  b3 as forEachDependent,
+  b4 as statusNotifierOf,
+  b5 as shiftAffectsMarks,
+  b6 as SUPPORTS_PROXY,
+  b7 as setSlotUnobserved,
+  b8 as devGuardStoreSetterWrite,
+  b9 as devGuardStoreSetterResult,
+  ba as projectionWriteActive,
+  bb as setProjectionWriteActive,
+  bc as DEV$1,
+  bd as isEqual,
+  be as readNodeFast,
+  bf as READ_SLOW,
+  bg as throwPendingUntrackedRead,
+  bh as warnStrictReadUntracked,
+  bi as unlinkFirewallChild,
+  bj as CONFIG_OWNED_WRITE,
+  bk as ownsHold,
+  bl as deferSlotRelease,
+  bm as slotSignal,
+  bn as serve,
+  bo as recordStaleReplay,
+  bp as setStoreCommitHook,
+  bq as suppressComputedRecompute,
+  br as handleAsync,
+  bs as createTransition,
+  bt as CONFIG_HELD_TRUTH,
+  bu as createOwner,
+  bv as spectate,
+  bw as transitions,
+  bx as wakeParked,
+  by as REACTIVE_ZOMBIE,
+  bz as OBSERVE$1
 } from "./dev-shared.js";
 export {
-  bg as clearSnapshots,
-  bh as enforceLoadingBoundary,
-  bi as getNextChildId,
-  bj as isDisposed,
-  bk as markSnapshotScope,
-  bl as peekNextChildId,
-  bm as releaseSnapshotScope,
-  bn as resetErrorHalt,
-  bo as setSnapshotCapture
+  bA as clearSnapshots,
+  bB as enforceLoadingBoundary,
+  bC as getNextChildId,
+  bD as isDisposed,
+  bE as markSnapshotScope,
+  bF as ownerPath,
+  bG as peekNextChildId,
+  bH as releaseSnapshotScope,
+  bI as resetErrorHalt,
+  bJ as setSnapshotCapture
 } from "./dev-shared.js";
 
 let externalSourceConfig = null;
@@ -341,7 +362,7 @@ function optimisticWrite(el, v) {
   ext(el)._optimisticLane = lane;
   // A fresh override re-masks: whatever truth is staged, this write is the
   // value for the graph again until the source answers it (#3331).
-  el._config = (el._config | CONFIG_HAS_LANE) & ~CONFIG_OVERRIDE_SUPERSEDED;
+  el._config = (el._config | CONFIG_HAS_LANE) & -8912897;
   // Literal undefined must not land raw: the slot doubles as the optimistic
   // brand, and erasing it makes the write invisible and routes follow-up
   // writes off the optimistic path into permanent commits (#2898).
@@ -356,16 +377,72 @@ function optimisticWrite(el, v) {
   schedule();
   return v;
 }
+/**
+ * Lanes stage (#3479): a lane pass's publish for a memo. An optimistic
+ * derivation is an override — the speculative result lives in the override
+ * slot, `_value` stays the committed truth. The whole optimistic frame is then
+ * in one place: the lane's readers and untracked reads see it (A17), a render
+ * effect off the held lane sees the committed frame whole (readsHeldCommitted,
+ * #3460) — the source's shadow AND its derivations — where a speculative
+ * `_value` beside a committed shadow tore it. The node joins the
+ * transaction's optimistic nodes on its first speculative publish; the revert
+ * drops the override and re-derives it from the truth (a derived override has
+ * no truth of its own — see resolveOptimisticNodes, endOptimism).
+ */
+function laneOverride(el, value, lane) {
+  // The wake-only channel (#3009, see recomputeLane): a plain write to a
+  // latest()-tracked source rides a companion-sourced lane with no
+  // transaction on either side only to wake the verdict companions. Nothing
+  // is speculative — the pass commits directly, as any plain write does.
+  lane = findLane(lane);
+  if (!lane._transition && !activeTransition && lane._source._x?._parentSource !== undefined) {
+    el._value = value;
+    return;
+  }
+  if (!hasActiveOverride(el)) {
+    // It reverts with the lane's transaction (a landing runs outside any
+    // flush, where the ambient batch would revert it at its own end); an
+    // orphan lane's falls to the batch, adopted with it (initTransition) as a
+    // write's is. No `_overrideOwner`: a derived override is a plain member,
+    // its transaction its lane's (resolveTransition), and it merges lanes
+    // through itself as any shared reader does (assignOrMergeLane). No
+    // provenance stamp either: not an intent, any truth supersedes it.
+    (lane._transition
+      ? currentTransition(lane._transition)
+      : globalQueue._batch
+    )._optimisticNodes.push(el);
+  }
+  // A lane pass's output is a derivation — also over a WRITTEN guess it
+  // corrects (a `createOptimistic(fn)` re-derived from fresh upstream data):
+  // the guess is gone, the slot holds fn's answer, and the revert promotes it
+  // rather than dropping to a stale `_value` and re-asking downstream (the
+  // next user write re-arms the guess: optimisticWrite clears the bit). No
+  // `_overrideTime` stamp: that marks a user WRITE unflushed until the flush
+  // that carries it (A28) and shields it from same-tick supersession — a pass's
+  // result is neither (a pulled ownerless memo publishes outside any flush).
+  // A fresh lane frame ends a supersession in force: the pass just dropped
+  // the staged truth it pointed at (recompute, INV-11 corollary) — left set,
+  // the flag served a `_value` never committed (fuzzer latest-1 #2481).
+  el._config = (el._config | CONFIG_DERIVED_OVERRIDE) & ~CONFIG_OVERRIDE_SUPERSEDED;
+  el._x._overrideValue = value === undefined ? OVERRIDE_UNDEFINED : value;
+}
 /**
  * transitionComplete's override blockage: a settling transition stays open
  * while one of its optimistic nodes holds an active override that is still
- * pending on real (non-affects-sentinel) async.
+ * pending on real (non-affects-sentinel) async. A derived override's flight is
+ * the lane's own work, never authoritative — it does not hold the settle.
+ * Neither is a companion's (#3494): the `latest()` shadow backfilled under the
+ * owner's transaction (A28 (3)) is an observation of the flight, and a
+ * mainline `latest(details)` after the flight's last reader unmounted held the
+ * released write until the orphaned request landed.
  */
 function transitionBlocked(transition) {
   for (let i = 0; i < transition._optimisticNodes.length; i++) {
     const node = transition._optimisticNodes[i];
     if (
-      hasActiveOverride$1(node) &&
+      !(node._config & CONFIG_DERIVED_OVERRIDE) &&
+      node._x?._parentSource === undefined &&
+      hasActiveOverride(node) &&
       "_statusFlags" in node &&
       node._statusFlags & STATUS_PENDING &&
       node._x?._error instanceof NotReadyError
@@ -388,14 +465,31 @@ function resolveOptimisticNodes(nodes) {
     // elevate on their OWN transition's schedule (A18 as re-ruled 2026-07-07).
     if (!(node._statusFlags & STATUS_PENDING)) node._statusFlags &= ~STATUS_UNINITIALIZED;
     const prevOverride = node._x?._overrideValue;
-    ext(node)._overrideValue = NOT_PENDING;
+    // A derived override (lanes stage, #3479) has no truth of its own: the
+    // slot disarms — the memo is plain again — and the override PROMOTES to
+    // `_value`. Not superseded, nothing it derives from told it otherwise
+    // (a source override that reverts to a differing truth dirties it just
+    // above — sources join this list before their derivations — and its
+    // recompute then replaces the promotion), so by the graph's invariant
+    // the override IS what a recompute from the truth yields. Re-deriving
+    // instead re-asked an async member's flight and held the transaction on
+    // it — a waterfall after the reveal.
+    const derived = node._config & CONFIG_DERIVED_OVERRIDE;
+    ext(node)._overrideValue =
+      derived && !(node._config & CONFIG_OPTIMISTIC) ? undefined : NOT_PENDING;
     // A superseded override's subscribers already re-derived from the truth
     // when it arrived (#3331) — the drop changes nothing they read. Everyone
     // else learns of the correction here: this drop IS their notification.
     const superseded = (node._config & CONFIG_OVERRIDE_SUPERSEDED) !== 0;
-    node._config &= ~CONFIG_OVERRIDE_SUPERSEDED;
-    if (!superseded && prevOverride !== NOT_PENDING && node._value !== unwrapOverride(prevOverride))
-      insertSubs(node, true);
+    node._config &= -8912897;
+    if (
+      !superseded &&
+      prevOverride !== NOT_PENDING &&
+      node._value !== unwrapOverride(prevOverride)
+    ) {
+      if (derived) node._value = unwrapOverride(prevOverride);
+      else insertSubs(node, true);
+    }
     node._transition = null;
     if (node._x !== null) node._x._overrideOwner = null;
   }
@@ -476,6 +570,77 @@ function supersedeOverride(el, value) {
   if (attrHooks !== null) attrHooks.asyncEnd(el, undefined, value, true);
   insertSubs(el);
 }
+/**
+ * The flush's pre-verdict step once the action bodies have ended (#3427).
+ * The bodies were the optimism's justification; with them over, the
+ * overrides still in force revert at the settle — unless the transaction is
+ * still waiting on AUTHORITATIVE work: an override node's own source in
+ * flight (`transitionBlocked` — that answer supersedes or confirms on
+ * arrival), or a held flight that does not derive from an override (a plain
+ * write's load the action asked for). Through that window the optimistic
+ * world stands: a co-written "saving" flag stays rendered until the page it
+ * covers lands (A17 — the optimistic world is one).
+ *
+ * The flights that DO derive from an override — routed through a live lane —
+ * are obsolete: their input is the guess that is about to revert, and nobody
+ * will read their answer. With nothing authoritative left, each override's
+ * truth is already here (the staged value an A17-silent landing left, else
+ * the committed value) and supersedes it now, exactly as an arriving
+ * differing truth does (A18, #3331): the graph re-derives from it as this
+ * transaction's held work — a lane-derived memo re-asks with the truth, its
+ * other changed inputs included — and the transaction settles when THAT
+ * lands. Before this the settle first waited for the obsolete flight,
+ * revealed the obsolete optimistic frame when it landed, and only then
+ * started the correction — a waterfall with a flash in the middle. Returns
+ * whether it superseded anything (the caller re-runs the heap).
+ *
+ * The optimistic world is one, so it ends early only when all of it can. An
+ * optimistic STORE edit cannot yet: its truth is the base layer under an
+ * overlay that `_clearOptimisticStores` folds off at settlement, with no
+ * tracked/displayed split — superseding its tracking signals alone would
+ * re-derive readers against a still-displayed overlay (and a memo reading
+ * both a signal and the store would ask a mixed question). A transaction
+ * holding one keeps the settle-then-revert order throughout. Companions
+ * (`_parentSource` set) are optimistic nodes too — a verdict written through
+ * the optimistic path so it flushes ahead of the hold — but they answer for
+ * their owner and snap at settlement (`_snapCompanions`), not here.
+ */
+function endOptimism(transition) {
+  if (
+    !transition._acted ||
+    transition._actions.length ||
+    !transition._optimisticNodes.length ||
+    transition._optimisticStores.size ||
+    transitionBlocked(transition)
+  )
+    return false;
+  for (const source of transition._asyncReporters.keys())
+    if (
+      sourceObserved(transition, source, transition) &&
+      source._x?._pendingSources?.has(source) &&
+      !resolveLane(source)
+    )
+      return false;
+  let superseded = false;
+  for (const node of transition._optimisticNodes) {
+    if (
+      !hasActiveOverride(node) ||
+      node._x._parentSource ||
+      // A derived override re-derives when its source's is superseded.
+      node._config & (CONFIG_OVERRIDE_SUPERSEDED | CONFIG_DERIVED_OVERRIDE) ||
+      node._statusFlags & STATUS_UNINITIALIZED
+    )
+      continue;
+    const truth = node._pendingValue !== NOT_PENDING ? node._pendingValue : node._value;
+    if (!node._equals || !node._equals(truth, unwrapOverride(node._x._overrideValue))) {
+      supersedeOverride(node, truth);
+      // Judged by the mark, not the call: a provenance refusal (an older
+      // action's window is still open) leaves the node for a later pass.
+      if (node._config & CONFIG_OVERRIDE_SUPERSEDED) superseded = true;
+    }
+  }
+  return superseded;
+}
 /** read()'s value for a tracked reader of a superseded node: the truth —
  * staged, or already committed (a mainline landing commits at the head of
  * its flush, ahead of the heap run, and the override drops only at the
@@ -483,9 +648,35 @@ function supersedeOverride(el, value) {
  * has left) — or the displayed override for a stale (render) reader of some
  * OTHER transaction, the same visibility a foreign transaction's staged
  * write has. */
-function supersededRead(el) {
-  if (stale && el._transition && activeTransition !== el._transition)
-    return unwrapOverride(el._x?._overrideValue);
+/**
+ * A tracked read of an active override (read()'s override arm). Lanes mirror
+ * transitions (#3460): a render effect OFF the override's held lane — re-run
+ * by a sync write, or mounted mid-hold — sees the committed value, as a stale
+ * reader of a held transaction does, and publishes now; the lane's release
+ * re-runs it (readsHeldCommitted). The lane defers the override's own readers'
+ * runs, so the committed value is what is on screen — the override is the
+ * visible value only once the lane has revealed (or, demoted at body-end,
+ * A18). Otherwise the override displays, unless the node's own source
+ * answered with a DIFFERENT value (A18 supersession, #3331): the optimism is
+ * over for the graph — a tracked reader sees the staged truth — while the
+ * override remains the DISPLAYED value for untracked reads (and for a stale
+ * reader of some other transaction).
+ */
+function overrideRead(el, c) {
+  if (stale && readsHeldCommitted(el, c)) return el._value;
+  if (!(el._config & CONFIG_OVERRIDE_SUPERSEDED)) return unwrapOverride(el._x?._overrideValue);
+  // The owning transaction: `_overrideOwner` (#2912), not the stamp — an
+  // override written directly inside an action never passes the adoption
+  // loop that stamps `_transition`, and a body-end supersession (#3427)
+  // stages nothing that would queue it. Without the owner a stale reader of
+  // a body-ended node read the committed truth beside a display still
+  // showing the override.
+  const owner = resolveTransition(el);
+  if (stale && owner && activeTransition !== owner) return unwrapOverride(el._x?._overrideValue);
+  // A superseded read is a staged read (A29) whether the truth is staged or
+  // already committed: the pass that derives from it derives from the
+  // owning transaction's world (the override is still displayed by it).
+  enterStagedRead(el, owner);
   return el._pendingValue !== NOT_PENDING ? el._pendingValue : el._value;
 }
 /**
@@ -561,11 +752,16 @@ function laneSuspends(owner) {
   // this is only reachable under a lane, which implies the engine.
   if (owner._statusFlags & STATUS_UNINITIALIZED) return true;
   // Per-lane suspension: only throw if in same lane as pending async
-  // AND the node doesn't have an active override (overrides are the visible value,
-  // downstream in the lane should read the override, not throw)
+  // AND the node doesn't have an active WRITTEN override (overrides are the
+  // visible value, downstream in the lane should read the override, not
+  // throw). A derived override (#3479) is a previous speculative answer, not
+  // an intent: the re-ask pending behind it suspends like any lane async.
   const pendingLane = owner._x?._optimisticLane;
   if (!pendingLane) return false;
-  return findLane(pendingLane) === findLane(currentOptimisticLane) && !hasActiveOverride$1(owner);
+  return (
+    findLane(pendingLane) === findLane(currentOptimisticLane) &&
+    (!hasActiveOverride(owner) || (owner._config & CONFIG_DERIVED_OVERRIDE) !== 0)
+  );
 }
 /**
  * read()'s reveal carve-out asks whether a pending node is routed through a
@@ -722,7 +918,9 @@ function installOptimisticEngine() {
   GlobalQueue._cleanupLanes = cleanupCompletedLanes;
   GlobalQueue._runLaneEffects = runLaneEffects;
   GlobalQueue._supersedeOverride = supersedeOverride;
-  GlobalQueue._supersededRead = supersededRead;
+  GlobalQueue._endOptimism = endOptimism;
+  GlobalQueue._overrideRead = overrideRead;
+  GlobalQueue._laneOverride = laneOverride;
   GlobalQueue._landOnOverride = landOnOverride;
   GlobalQueue._gatedRead = gatedRead;
   GlobalQueue._laneSuspends = laneSuspends;
@@ -760,9 +958,10 @@ const suppressedProbes = new Map();
  * the one-load gate at the call sites). The snap then iterates exactly the
  * children someone asked verdicts of — O(companions) — never the full
  * `_child` chain, which carries one node per materialized leaf (the
- * O(all-leaves-ever-read)-per-update pathology). Entries are permanent like
- * the companions themselves; a store with no leaf-level isPending()/latest()
- * reads never allocates the set or pays the walk. */
+ * O(all-leaves-ever-read)-per-update pathology). Entries live as long as the
+ * store addresses the leaf — the unobserved sweep's `unlinkFirewallChild`
+ * drops them (#3503); a store with no leaf-level isPending()/latest() reads
+ * never allocates the set or pays the walk. */
 function markFirewallChildCompanions(el) {
   const fw = el._firewall;
   if (!fw) return;
@@ -778,10 +977,53 @@ function getPendingSignal(el) {
     el._config |= CONFIG_HAS_COMPANIONS;
     markFirewallChildCompanions(el);
     ext(ps)._parentSource = el;
-    if (computePendingState(el)) setSignal(ps, true);
+    if (computePendingState(el)) backfillCompanion(el, ps, true);
+    joinUnflushedResync(el);
   }
   return ps;
 }
+/**
+ * A lazily created companion's first write mirrors state the owner already
+ * carries — a held write, a pending verdict. The companion is created wherever
+ * the first latest()/isPending() read happens to run, but the write belongs
+ * to whatever HOLDS that state: written in the ambient window, the override
+ * would register in the ambient batch and revert when that flush's round ends
+ * — the shadow re-derived from the committed view, the verdict flipped false —
+ * while the owner's hold was still on (#3336: A and B differing only in
+ * whether a companion existed before the hold). A companion created lazily
+ * answers as if it had always existed: its backfill is registered with the
+ * owner's transaction and lives and reverts with it. A hold with no
+ * transaction (a pending async, a same-flush staged write) is ambient and the
+ * write stays ambient. (A28 (3), lifted from #3337.)
+ */
+function backfillCompanion(el, companion, value) {
+  const transition = el._transition;
+  if (transition) runAsTransitionBatch(transition, () => setSignal(companion, value));
+  else setSignal(companion, value);
+}
+/** A28: a companion created while its source carries an UNFLUSHED write joins
+ * the flush-start re-sync like a companion that existed at the write —
+ * syncCompanions only reaches companions that exist at write time. Without
+ * this the flush brings it current by a plain recompute instead of the
+ * optimistic write: its readers are then staged under whatever transaction
+ * the round entered (a memo over latest() of a held source was held with the
+ * source, and its untracked reads answered the previous value until the hold
+ * committed) rather than direct-committed as the optimistic view they are. */
+function joinUnflushedResync(el) {
+  if (unflushed(el)) unflushedCompanions.push(el);
+}
+/** The staged value the verdict channels answer for (A28): while a node
+ * carries an unflushed write its `_pendingValue` is not yet part of any
+ * flushed world, so the channels answer for the value the last flush left
+ * staged (a held node's stash) or for nothing (NOT_PENDING). */
+function flushedStaged(el) {
+  if (!unflushed(el)) return el._pendingValue;
+  // Ambient, or adopted before any flush (CONFIG_ADOPTED_UNFLUSHED): nothing
+  // a flush carried is staged for it. A held rewrite: the stash.
+  return el._transition === null || el._config & CONFIG_ADOPTED_UNFLUSHED
+    ? NOT_PENDING
+    : el._x._flushedStaged;
+}
 function collectPendingSources(el) {
   if (!pendingProbe) return;
   pendingProbe.sources.add(el);
@@ -869,7 +1111,8 @@ function computePendingState(el) {
     const parent = parentNode._firewall || parentNode;
     return newQuestionInFlight(parent);
   }
-  if (firewall && el._pendingValue !== NOT_PENDING && !hasActiveOverride$1(el)) {
+  const staged = flushedStaged(el);
+  if (firewall && staged !== NOT_PENDING && !hasActiveOverride(el)) {
     return (
       !!(firewall._flags & REACTIVE_MANUAL_WRITE) ||
       (!firewall._x?._inFlight && !(firewall._statusFlags & STATUS_PENDING)) ||
@@ -880,18 +1123,41 @@ function computePendingState(el) {
   // the window's own landing in flight to its commit — verdict-quiet like the
   // rest of the window (the UNINITIALIZED check suppresses exactly this frame
   // for windowless first loads; born-committed nodes need their own gate, #2990).
+  // A18 (d) for a body-end supersession (#3427): the truth at hand is the
+  // COMMITTED value — nothing staged — yet the display still shows the
+  // override; pending iff they differ, as for a staged arrival below.
   if (
-    el._pendingValue !== NOT_PENDING &&
-    !(comp._statusFlags & STATUS_UNINITIALIZED) &&
-    !comp._loading
-  ) {
-    if (hasActiveOverride$1(el))
-      return !el._equals || !el._equals(el._pendingValue, unwrapOverride(el._x?._overrideValue));
+    el._config & CONFIG_OVERRIDE_SUPERSEDED &&
+    el._pendingValue === NOT_PENDING &&
+    visibleOverride(el)
+  )
+    return !el._equals || !el._equals(el._value, unwrapOverride(el._x?._overrideValue));
+  // A28 (2): an unflushed write is not yet observable — the verdict answers
+  // for the flushed staged value.
+  if (staged !== NOT_PENDING && !comp._loading) {
+    // A18 (d): under a displayed override the observable value is the
+    // override, so the verdict is "the arrived truth differs from it" —
+    // even before the node's first commit. The UNINITIALIZED suppression
+    // below is A19 exception (1), "no observable value exists to be
+    // non-final"; an override is one (a node whose first landing was held
+    // by a reveal it never got to commit, then superseded under its
+    // override, read false here).
+    if (visibleOverride(el))
+      return !el._equals || !el._equals(staged, unwrapOverride(el._x?._overrideValue));
     // A quiet re-ask's held landing still answers the same question: the
     // classification survives the landing (asyncWrite) and dies with the
     // commit (commitPendingNode) — verdict-quiet through the reveal, like
     // the loading window above (#3178).
-    if (!comp._x?._reask) return true;
+    // A staged value equal to the committed one is no proposal (A34, #3494): the
+    // observable value IS final (A19). The coalesced `setShow(false);
+    // setShow(true)` read pending through the flush that carried it — and,
+    // stamped into a hold that flush opened, until the hold settled.
+    if (
+      !(comp._statusFlags & STATUS_UNINITIALIZED) &&
+      !comp._x?._reask &&
+      (!el._equals || !el._equals(el._value, staged))
+    )
+      return true;
   }
   return newQuestionInFlight(comp);
 }
@@ -982,6 +1248,18 @@ function snapCompanionsToState(owner) {
   }
   const shadow = owner._x?._latestValueComputed;
   if (shadow && !(shadow._flags & REACTIVE_DISPOSED)) {
+    // A leaf whose firewall is disposed (the projection's teardown snaps its
+    // companion-bearing leaves): the shadow's compute reads through a
+    // disposed, possibly still-pending projection and would sit
+    // NotReady/uninitialized forever — never derived, its backfilled override
+    // dropped at the settle — against a leaf whose committed value differs
+    // (INV-4 at the next quiescence; spec O5). It dies with its source;
+    // getLatestValueComputed treats a disposed shadow as absent, so a later
+    // read recreates it from the committed view.
+    if (owner._firewall?._flags & REACTIVE_DISPOSED) {
+      dispose(shadow);
+      return;
+    }
     if (
       (shadow._x?._overrideValue === undefined || shadow._x?._overrideValue === NOT_PENDING) &&
       shadow._pendingValue === NOT_PENDING &&
@@ -1012,7 +1290,12 @@ function getLatestValueComputed(el) {
     setPendingCheckActive(false);
     const prevContext = context;
     setContextInternal(null); // Detach from owner so it isn't disposed with effects
-    lvc = optimisticComputed(() => read(el));
+    GlobalQueue._verdictPull = true;
+    try {
+      lvc = optimisticComputed(() => read(el), { ownedWrite: true });
+    } finally {
+      GlobalQueue._verdictPull = false;
+    }
     ext(el)._latestValueComputed = lvc;
     el._config |= CONFIG_HAS_COMPANIONS;
     markFirewallChildCompanions(el);
@@ -1021,8 +1304,9 @@ function getLatestValueComputed(el) {
     // created lazily, possibly after the write was processed — syncCompanions
     // only pushes into companions that already exist, so the first latest()
     // read inside a held transition showed the committed value (#3041).
-    if (el._pendingValue !== NOT_PENDING && !hasActiveOverride$1(el))
-      setSignal(lvc, el._pendingValue);
+    const staged = flushedStaged(el);
+    if (staged !== NOT_PENDING && !hasActiveOverride(el)) backfillCompanion(el, lvc, staged);
+    joinUnflushedResync(el);
     setContextInternal(prevContext);
     setPendingCheckActive(prevCheck);
     setLatestReadActive(prevPending);
@@ -1030,67 +1314,84 @@ function getLatestValueComputed(el) {
   return lvc;
 }
 /** The latest()-mode read path, installed as GlobalQueue._latestRead. */
+/** A7: the source has no visible value yet — judged on the OWNER, as read()
+ * does: a store leaf behind a projection's firewall is a plain signal whose
+ * `_value` is the seed (A25: a draft, never a value), and read() routes a
+ * latest() read here before its own firewall/status logic. An override
+ * displays a value even before the first commit (A17). */
+function uninitializedSource(el) {
+  const owner = el._firewall || el;
+  return !!(owner._statusFlags & STATUS_UNINITIALIZED) && !hasActiveOverride(el);
+}
 function latestRead(el) {
+  // A leaf of a DISPOSED projection has no flushed world left to mirror: a
+  // shadow created for it now would read through the dead firewall, sit
+  // NotReady/uninitialized forever, and no teardown would ever retire it (the
+  // firewall's already ran — spec O5). Serve the committed value; create
+  // nothing. (A read of a disposed node freezes at its last commit, #3024.)
+  if (el._firewall?._flags & REACTIVE_DISPOSED) return el._value;
   const pendingComputed = getLatestValueComputed(el);
   const prevPending = latestReadActive;
   setLatestReadActive(false);
-  const visibleValue =
-    el._x?._overrideValue !== undefined && el._x?._overrideValue !== NOT_PENDING
-      ? unwrapOverride(el._x?._overrideValue)
-      : el._value;
+  const visibleValue = visibleOverride(el) ? unwrapOverride(el._x?._overrideValue) : el._value;
+  // A28: an unflushed write is not the staged value latest() serves. The
+  // shadow was written at the source's write to mirror it (A8) — consult it
+  // only once a flush has carried the write.
+  const u = unflushedValue(el);
+  if (u !== NOT_PENDING) {
+    // The reader derived from the flushed world because of an unflushed
+    // write: it runs again in the flush that carries it (late linker) —
+    // a pull may have cleared the mark the write's walk set.
+    if (context !== null && context._flags & REACTIVE_RECOMPUTING_DEPS) markLateLinker(context);
+    // Link the reader to the shadow so the flush that carries the write
+    // updates it (the shadow itself already mirrors the write, A8).
+    try {
+      read(pendingComputed);
+    } catch {
+      /* the flushed value answers */
+    } finally {
+      setLatestReadActive(prevPending);
+    }
+    // An ambient write: the visible value (override or committed). A rewrite
+    // of a held node: the staged value the last flush left.
+    return el._transition === null ? visibleValue : u;
+  }
   let value;
   try {
-    // An untracked latest() read has no reading context, so read() never
-    // performs its mid-tick pull — a plain write queued between two latest()
-    // calls left a still-subscribed shadow at its previous speculative value
-    // until the flush (#2922). Mirror the tracked-read pull here: mark the
-    // queued staleness through the graph, then bring the shadow up to date.
-    const queue = queueFor(pendingComputed);
-    if (
-      pendingComputed._height >= queue._min &&
-      !(pendingComputed._flags & (REACTIVE_DISPOSED | REACTIVE_ZOMBIE))
-    ) {
-      markHeap(queue);
-      // Suspend probe collection during the pull (mirrors pendingCheckRead's
-      // prepare): a probe through latest() answers for the SHADOW — the
-      // read() dispatch collects it deliberately, so the verdict reflects
-      // async still in flight for the latest view, not the parent's held
-      // write. A stale shadow recomputing HERE ran its `read(parent)` with
-      // the probe still live and collected the parent too, so the verdict
-      // depended on whether anything had pulled the shadow current earlier
-      // in the tick (#3104: reading latest(m) flipped a later
-      // latest(() => isPending(x)) from true to false).
-      const prevCheck = pendingCheckActive;
-      setPendingCheckActive(false);
-      try {
-        prepareComputed(pendingComputed, true);
-      } finally {
-        setPendingCheckActive(prevCheck);
-      }
-    }
+    // No mid-tick pull: writes become visible at flush (A28), so before the
+    // flush the shadow is exactly as current as the flushed world — the read
+    // below serves it as is. (#2922's pull, which brought the shadow current
+    // against the unflushed write, is superseded: `flush()` first to read
+    // your own write.)
     value = read(pendingComputed);
   } catch (e) {
-    if (e instanceof NotReadyError && (!context || !(el._statusFlags & STATUS_UNINITIALIZED)))
-      return visibleValue;
+    // A NotReady from the shadow of an INITIALIZED source means the shadow
+    // is mid-flight: serve the visible (committed / override) value. An
+    // uninitialized source has no visible value — latest() throws in every
+    // scope rather than fabricate `undefined` for a `T` that excludes it
+    // (A7; the unowned scope used to return undefined here).
+    if (e instanceof NotReadyError && !uninitializedSource(el)) return visibleValue;
     throw e;
   } finally {
     setLatestReadActive(prevPending);
   }
-  if (pendingComputed._statusFlags & STATUS_PENDING) return visibleValue;
-  if (stale && currentOptimisticLane && pendingComputed._x?._optimisticLane) {
-    const pcLane = findLane(pendingComputed._x?._optimisticLane);
-    const curLane = findLane(currentOptimisticLane);
-    if (pcLane !== curLane && laneHeld(pcLane)) {
-      return visibleValue;
-    }
+  if (pendingComputed._statusFlags & STATUS_PENDING) {
+    if (uninitializedSource(el)) throw new NotReadyError(el);
+    return visibleValue;
   }
+  // A render effect off the shadow's HELD lane sees the committed value and
+  // re-runs at the release (#3460; lanes mirror transitions — see
+  // readsHeldCommitted). Was: only a reader under ANOTHER lane; a mainline
+  // reader, mounted or re-run by a sync write mid-hold, showed the
+  // speculative value beside the lane's deferred readers.
+  if (stale && context !== null && readsHeldCommitted(pendingComputed, context)) return el._value;
   // A shadow recomputed by the pull above (not at creation) holds its fresh
   // speculative value in _pendingValue; a contextless read() only surfaces
   // _value. Overrides stay authoritative (A17), and stale readers keep the
   // other transition's committed view, matching read()'s own selection.
   if (
     pendingComputed._pendingValue !== NOT_PENDING &&
-    !hasActiveOverride$1(pendingComputed) &&
+    !hasActiveOverride(pendingComputed) &&
     !(stale && pendingComputed._transition && activeTransition !== pendingComputed._transition)
   )
     return pendingComputed._pendingValue;
@@ -1115,7 +1416,14 @@ function latestShadowWithInitializedParent(owner) {
 /** The isPending()-probe read path, installed as GlobalQueue._pendingCheck. */
 function pendingCheckRead(el, c, owner, firewall) {
   setPendingCheckActive(false);
-  if (typeof el._fn === "function") prepareComputed(el, true);
+  if (typeof el._fn === "function") {
+    GlobalQueue._verdictPull = true;
+    try {
+      prepareComputed(el, true);
+    } finally {
+      GlobalQueue._verdictPull = false;
+    }
+  }
   const ownerStatus = owner._statusFlags;
   if (
     c &&
@@ -1162,10 +1470,15 @@ function heldAwaitingAsync(el) {
   // action (#2831: a reader that saw the new value must not also see
   // pending); still-computing answers are covered by the reporter scan.
   if (t._actions.length && !el._fn) return true;
-  // A node not yet stamped with a transition only qualifies through the
-  // action check above; the reporter scan below is for transition-held
-  // writes whose source async is still computing.
-  if (!et) return false;
+  // The reporter scan runs for an unstamped node too (#3457): a node staged
+  // AFTER the transaction opened is pushed straight into the transaction's
+  // batch (queuePendingNode, once initTransition adopted it) and only gets
+  // its `_transition` stamp when the flush stashes the hold, but its staged
+  // value is already the transaction's, and `t` resolved to that very
+  // transaction above. Gating on the stamp let a memo whose recompute read
+  // a sync memo's fresh staged value mid-flush pair "not pending" with it
+  // (A10) while the transaction's async source was still computing, so a
+  // memo-wrapped isPending() read false where a direct probe read true.
   for (const [source, reporters] of t._asyncReporters) {
     if (
       reporters.size &&
@@ -1297,7 +1610,11 @@ function effect(compute, effect, error, options) {
     options
   );
   recompute(node, true);
+  // A first pass that derived from a live transaction's staged world was
+  // staged into that transaction (recompute: born held); the transaction's
+  // commit replays this effect. Its first run is not this creation's (A29).
   !options?.defer &&
+    node._pendingValue === NOT_PENDING &&
     (node._type === EFFECT_USER || options?.schedule
       ? node._queue.enqueue(node._type, runEffect.bind(null, node))
       : runEffect(node, LANE_RUN));
@@ -1430,6 +1747,9 @@ function runEffect(node, type) {
     }
     return;
   }
+  // Captured before the callback: its own throw errors the node below, but
+  // the compute pass that produced `_value` was clean, so its tail still goes.
+  const cleanPass = node._x?._error == null;
   let prevStrictRead = false;
   {
     prevStrictRead = setStrictRead("an effect callback");
@@ -1462,6 +1782,12 @@ function runEffect(node, type) {
     }
     node._prevValue = node._value;
     node._modified = false;
+    // The run applied: this is the frame now, so the dependency tail the
+    // compute pass left linked goes (A30, #3438 — `recompute` defers an
+    // effect's trim while a run is owed; the twin of `commitPendingNode`'s
+    // trim for a staged pass). An errored compute kept its full list with
+    // `_depsTail` marking where it stopped; leave it, as the commit does.
+    if (cleanPass) trimStaleDeps(node);
   }
   // Outside the try (see the rule in attribution-hooks.ts). Reached whether or
   // not the callback threw — a throw that escapes the catch above halts.
@@ -1587,15 +1913,22 @@ function restoreTransition(seq, transition, fn) {
  * `yield` is the transaction-safe suspension point: the action waits for a
  * yielded promise and re-enters the transaction before running the code after
  * it. A plain `await` does NOT — the runtime has no hook into an async
- * generator's internal await continuations, so writes to fresh signals
- * between an `await` and the next `yield` escape the transaction and commit
- * immediately. `await` is still the ergonomic choice for typed results; just
- * put a bare `yield` before any writes that follow it:
+ * generator's internal await continuations, so code between an `await` and
+ * the next `yield` runs OUTSIDE the transaction: writes to fresh signals
+ * commit immediately, and anything that creates a reader there — `until()`,
+ * `latest()`, a memo or effect, a mount — is created mainline, where a read of
+ * this action's held state makes it born held (A29): staged with the
+ * transaction and replayed at its commit. For `until()` that commit is the
+ * settle its own promise holds open (#3482). `await` is still the ergonomic
+ * choice for typed results; just put a bare `yield` before any write or
+ * reader creation that follows it — including the expression of the next
+ * `yield`, which is evaluated before the step re-enters:
  *
  * ```ts
  * const saved = await api.createTodo(text); // typed result
- * yield; // re-enter the transaction before writing
+ * yield; // re-enter the transaction before writing or reading
  * setTodos(t => { ... });
+ * yield until(() => todos.some(t => t.id === saved.id));
  * ```
  *
  * (For the same reason, don't call `flush()` inside an action body — it
@@ -1658,6 +1991,7 @@ function action(genFn) {
       globalQueue.initTransition();
       let ctx = activeTransition;
       ctx._actions.push(it);
+      ctx._acted = true;
       const done = (v, e, failed = false) => {
         ctx = currentTransition(ctx);
         const i = ctx._actions.indexOf(it);
@@ -1731,6 +2065,73 @@ function action(genFn) {
   };
 }
 
+let ambientHook;
+const reported = new WeakSet();
+/**
+ * Registers the ambient client error hook — the one call a browser `init()`
+ * makes to see every failure a boundary renders a fallback for, in
+ * production. (Uncaught errors reach `reportError` / `window.onerror`.)
+ *
+ * ```ts
+ * configureClientErrors({
+ *   onError: (error, { ownerPath }) =>
+ *     Sentry.captureException(error, {
+ *       mechanism: { type: "solid.error_boundary", handled: true }
+ *     })
+ * });
+ * ```
+ */
+function configureClientErrors(config) {
+  if (config && config.onError !== undefined && typeof config.onError !== "function") {
+    throw new TypeError(`Invalid onError: expected a function, received ${typeof config.onError}.`);
+  }
+  ambientHook = config ? config.onError : undefined;
+}
+/** The nearest root's hook above `owner` (parked under `ROOT_ERROR_HOOK`), else the ambient one. */
+function hookFor(owner) {
+  for (let o = owner; o; o = o._parent) {
+    const hook = o[ROOT_ERROR_HOOK];
+    if (hook !== undefined) return hook;
+  }
+  return ambientHook;
+}
+/** Component labels up the owner chain, root first — `_name` where the runtime keeps it. */
+function labels(owner) {
+  const path = [];
+  for (let o = owner; o; o = o._parent) {
+    const name = o._name;
+    if (typeof name === "string" && name.length) path.push(name);
+  }
+  return path.length ? path.reverse() : undefined;
+}
+/**
+ * Tells the client error hook about `error`, caught by the boundary whose
+ * owner is `owner`, thrown by `thrower` (the computation the engine's status
+ * wrapper named; unknown for a value that never crossed one) — once per
+ * error object. A throwing hook is reported on the console and otherwise
+ * ignored — a monitor must never take the app down.
+ * @internal
+ */
+function reportClientError(error, owner, thrower) {
+  const isObject = error !== null && (typeof error === "object" || typeof error === "function");
+  if (isObject) {
+    if (reported.has(error)) return;
+    reported.add(error);
+  }
+  const hook = hookFor(owner);
+  if (hook === undefined) return;
+  const context = {};
+  const boundary = labels(owner);
+  const path = labels(thrower) ?? boundary;
+  if (path !== undefined) context.ownerPath = path;
+  if (boundary !== undefined) context.boundaryPath = boundary;
+  try {
+    hook(error, context);
+  } catch (hookError) {
+    console.error(hookError);
+  }
+}
+
 /**
  * Low-level reactive-cleanup primitive. Registers a callback that runs when
  * the surrounding owner is disposed.
@@ -2290,12 +2691,20 @@ function refresh(target) {
  *
  * Must be called *outside* a tracking scope.
  *
+ * Inside an action, call it from a step: after an `await`, put a bare `yield`
+ * before `yield until(...)`. The runtime cannot hook an async generator's
+ * `await` continuation, so the `until(...)` expression — which CREATES the
+ * predicate's reader — would otherwise run outside the transaction; created
+ * there it is born held (A29) and replays only at the commit its own promise
+ * holds open (#3482). See {@link action}.
+ *
  * @example
  * ```ts
  * const send = action(async function* (text: string) {
  *   const clientId = crypto.randomUUID();
  *   setMessages(m => { m.push({ clientId, text, pending: true }); }); // optimistic
  *   await socket.send({ clientId, text }); // fire-and-forget transport
+ *   yield; // re-enter the transaction after the await
  *   // Hold until the live source echoes the write (authoritative view —
  *   // the optimistic row above cannot satisfy this):
  *   yield until(() => messages.some(m => m.clientId === clientId), { timeout: 10_000 });
@@ -2486,7 +2895,15 @@ function onSettled(callback) {
   const owner = getOwner();
   owner && !(owner._config & CONFIG_CHILDREN_FORBIDDEN)
     ? trackedEffect(() => untrack(callback), { name: "onSettled" })
-    : globalQueue.enqueue(EFFECT_USER, () => {
+    : globalQueue.enqueue(EFFECT_USER, function fire() {
+        // Settled means derived. A settle that reverts optimism (or replays
+        // gated reads) only enqueues the affected subscribers; the pass after
+        // the commit re-derives them. Fired in the commit pass, the callback
+        // read the optimistic source already reverted beside a sync memo of it
+        // still holding the optimistic value — reads do not pull (#3411). Fall
+        // to the next pass while the heap has work; `run` swapped the queue,
+        // so this lands there, and `enqueue` keeps the drain alive.
+        if (dirtyQueue._max >= dirtyQueue._min) return globalQueue.enqueue(EFFECT_USER, fire);
         // Unowned, out-of-band fire (no owner, or a children-forbidden one this
         // one-shot must not bind to): a returned cleanup has no lifecycle to
         // attach to. Reject it in dev; in production the return is simply
@@ -3011,44 +3428,825 @@ function affects(target, key) {
 function trueFn() {
   return true;
 }
-const propTraps = {
-  get(_, property, receiver) {
+/** @internal What a source ENTRY is, decided once when the view is built
+ * (`merge()` learns it while flattening; `omit()` from its argument) and
+ * carried beside the entry — `MergeView.kinds[i]`, `OmitView.kind` — so no
+ * read has to ask. Asking is the cost: any brand check on a Proxy is a trap
+ * (`instanceof` is a `getPrototypeOf` trap, ~20 ns on a store — as much as
+ * the read itself), and a merge over a store did two per read. */
+const SOURCE_PLAIN = 0; // a plain object: own keys fixed, data is data
+const SOURCE_OMIT = 1; // an `OmitView` record (only as a merge entry)
+const SOURCE_PROXY = 2; // a store or foreign proxy: everything is a trap
+const SOURCE_MEMO = 3; // a function source (merge's memo): swaps objects
+const SOURCE_MERGE = 4; // a `MergeView` record (only as an omit's source)
+const EMPTY = Object.freeze({});
+// The object behind a LEAF entry (any kind but OMIT): a memo is read
+// (tracked, as merge's own reads are) and a nullish result has no keys.
+function leafOf(s, kind) {
+  return kind === SOURCE_MEMO ? ((s = s()) == null ? EMPTY : s) : s;
+}
+const $SOURCES = Symbol("MERGE_SOURCE");
+const $OMIT = Symbol("OMIT_VIEW");
+// The MergeView behind a merge proxy. `$SOURCES` answers the array; the
+// record itself is reached through this symbol so the table can live on it.
+const $VIEW = Symbol("MERGE_VIEW");
+/** @internal The record behind an `omit()` proxy: `source` with `hidden`
+ * keys removed. It is the proxy's TARGET, so the shared handler reads it as
+ * plain fields — no per-instance closures — and it is what props consumers
+ * walk directly (`merge`, `spread`, `ssrElement`): a view never materializes
+ * a copy, and a consumer that knows the record never goes through its traps
+ * (a `getOwnPropertyDescriptor` trap per key allocates a descriptor and a
+ * getter, so enumerating a proxy costs more than the copy it was avoiding).
+ * `hidden` is a key list or a predicate (`omit(props, k => k[0] === "$")`).
+ *
+ * An omit over a `merge()` holds the merge's RECORD (`MergeView`, kind
+ * `SOURCE_MERGE`) — never its proxy, so no read hops through a trap — and is
+ * one record however many leaves the merge has. A consumer walks it as ONE
+ * filtered entry (`sourceKeys` / `sourceGet` recurse into the merge's
+ * sources by function call), and a later `merge()` over it carries the
+ * record as one entry instead of copying its leaves: on a component chain of
+ * defaults + omit + spread (`merge(omit(merge(omit(props))))`) the layers
+ * nest as records, each a few fields, where a flatten to leaf views built a
+ * view and a combined key list per leaf per layer — the largest allocation
+ * of a Kobalte-shaped render. A merge leaf may be merge's memo for a
+ * function source; it is resolved on access. */
+class OmitView {
+  source;
+  kind;
+  hidden;
+  /** see `MergeView.table` */
+  table = 0;
+  /** see `tableOwnKeys` / `tableDescriptor` */
+  keys = undefined;
+  descs = undefined;
+  constructor(
+    source,
+    /** of `source` — PLAIN, PROXY (a store or a foreign proxy), MEMO, or
+     * MERGE (a `MergeView` record); never OMIT, a view over a view folds
+     * into one. */
+    kind,
+    hidden
+  ) {
+    this.source = source;
+    this.kind = kind;
+    this.hidden = hidden;
+  }
+}
+function isHidden(view, key) {
+  const h = view.hidden;
+  return typeof h === "function" ? h(key) : h.includes(key);
+}
+// Both filters as one. Two key lists stay a key list (one `includes`, no
+// closure); a predicate on either side needs a closure. An omit over a
+// merge builds one combined list per leaf, per component layer, so the
+// copy's form matters in every tier: `concat` runs the species/spreadable
+// protocol (2–3× the cost of a copy once optimized), a hand loop is 2–4×
+// `concat` in the interpreter and baseline tiers (a bytecode per element
+// against one builtin), and a presized `new Array(n)` is holey, which takes
+// `includes` off its fast path. `slice` + `push` of the (short) second list
+// is within a third of the best form in every tier, and packed.
+function combineHidden(a, b) {
+  if (typeof a !== "function" && typeof b !== "function") {
+    const out = a.slice();
+    for (let i = 0; i < b.length; i++) out.push(b[i]);
+    return out;
+  }
+  return key =>
+    (typeof a === "function" ? a(key) : a.includes(key)) ||
+    (typeof b === "function" ? b(key) : b.includes(key));
+}
+// The object a view filters (see `leafOf`).
+function viewSource(view) {
+  return leafOf(view.source, view.kind);
+}
+// Whether a `$PROXY`-marked object is one of OUR views rather than a store
+// (or a foreign proxy). Asked through `$TARGET`, which a store's `get` trap
+// answers on its symbol fast path and the view traps answer first thing —
+// so the question never reaches a store's generic read path (firewall gate,
+// tracked key read), which is what any unknown symbol (`$SOURCES`, `$OMIT`)
+// would take. Call only after `$PROXY in o` is known true.
+function isView(o) {
+  return o[$TARGET] === undefined && (o[$OMIT] !== undefined || o[$VIEW] !== undefined);
+}
+/** @internal The `OmitView` behind an `omit()` proxy, or undefined. */
+function omitView(o) {
+  return o != null && $PROXY in o && o[$TARGET] === undefined ? o[$OMIT] : undefined;
+}
+// A props SOURCE ENTRY is a plain object, a proxy (store, merge, omit — the
+// last two are normally unwrapped first: `mergeView` / `omitView`), a memo,
+// or an `OmitView` record, and travels with its kind. These three answer for
+// an entry what `Object.keys` / `in` / `[]` answer for an object, so every
+// consumer walks entries with one code path, an `OmitView` is filtered
+// rather than materialized, and nothing is asked of a proxy but the read.
+// Own keys of a leaf: a proxy answers through ONE `ownKeys` trap (a store's
+// keeps the key set tracked; `Object.keys` on a proxy would add a descriptor
+// trap per key); a plain object its enumerable string keys. What a memo
+// holds is only known once read.
+function leafKeys(leaf, kind) {
+  if (kind === SOURCE_PLAIN) return Object.keys(leaf);
+  if (kind === SOURCE_PROXY || leaf[$PROXY] === leaf) return Reflect.ownKeys(leaf);
+  return Object.keys(leaf);
+}
+/** @internal Own string keys of a source entry — every consumer skips
+ * symbols itself. */
+function sourceKeys(s, kind) {
+  if (kind === SOURCE_OMIT) {
+    if (s.kind === SOURCE_MERGE) return mergeKeysOf(s.source, false, s);
+    const keys = leafKeys(viewSource(s), s.kind);
+    const out = [];
+    for (let i = 0; i < keys.length; i++) if (!isHidden(s, keys[i])) out.push(keys[i]);
+    return out;
+  }
+  return leafKeys(leafOf(s, kind), kind);
+}
+/** @internal `key in entry`. */
+function sourceHas(s, kind, key) {
+  if (kind === SOURCE_OMIT) {
+    if (isHidden(s, key)) return false;
+    return s.kind === SOURCE_MERGE ? mergeHas(s.source, key) : key in viewSource(s);
+  }
+  return key in leafOf(s, kind);
+}
+/** @internal `entry[key]` — the source's getter runs once, here. */
+function sourceGet(s, kind, key) {
+  if (kind === SOURCE_OMIT) {
+    if (isHidden(s, key)) return undefined;
+    return s.kind === SOURCE_MERGE ? mergeGet(s.source, key) : viewSource(s)[key];
+  }
+  return leafOf(s, kind)[key];
+}
+// An entry whose own key set is fixed: a plain object, or a view over one —
+// an omit of a plain object, or of a merge whose entries all are. Not a
+// store (its key set is a tracked signal), not a merge memo source (it
+// swaps whole objects), and not any proxy that declares itself with
+// `$PROXY in s` — a frames slot proxy answers `has` for every key and lists
+// none, so only the `in` walk is right for it.
+function entryHasStaticKeys(s, kind) {
+  if (kind === SOURCE_PLAIN) return true;
+  if (kind !== SOURCE_OMIT) return false;
+  if (s.kind === SOURCE_PLAIN) return true;
+  return s.kind === SOURCE_MERGE && mergeHasStaticKeys(s.source);
+}
+function mergeHasStaticKeys(view) {
+  const f = view.sources,
+    k = view.kinds;
+  for (let i = 0; i < f.length; i++) if (!entryHasStaticKeys(f[i], k[i])) return false;
+  return true;
+}
+/** @internal Whether the own key set of a props object cannot change
+ * reactively: a plain object, or a merge/omit view over plain objects only.
+ * A consumer may then decide from `Object.getOwnPropertyDescriptor` once —
+ * "no `children` key" or "a data `children`" holds for the object's lifetime,
+ * so no tracking scope is needed for it (#3388). For a store, or a view with
+ * a store or memo leaf, keys can appear later and the reactive path is the
+ * only correct one. */
+function hasStaticKeys(o) {
+  if (!($PROXY in o)) return true;
+  if (o[$TARGET] !== undefined) return false;
+  const merged = o[$VIEW];
+  if (merged !== undefined) return mergeHasStaticKeys(merged);
+  const view = o[$OMIT];
+  return view !== undefined && entryHasStaticKeys(view, SOURCE_OMIT);
+}
+/**
+ * Whether `o[key]` can never change for the lifetime of `o`: the key is a
+ * data property of a plain object, or is absent from an object whose key set
+ * is fixed. A getter, a key on a store, a memo-backed `merge()` source, or
+ * any key of an object whose keys can appear later (a store) is not static.
+ *
+ * Looks through `merge()`/`omit()` views to the leaf that owns the key. Any
+ * object will do, but props are the case it exists for: the compiler encodes
+ * a literal at the call site (`as="button"`) as a data property and an
+ * expression (`as={isLink() ? "a" : "button"}`) as a getter, so a component
+ * library reads the caller's own static/dynamic classification of a prop at
+ * runtime — identically on server and client, the compiled shape being the
+ * same on both — and can take a no-computation path for the literal:
+ *
+ * ```tsx
+ * const Tag = dynamic(() => props.as, { static: isStatic(props, "as") });
+ * ```
+ *
+ * One descriptor lookup; no read of the value, nothing tracked.
+ */
+function isStatic(o, key) {
+  if ($PROXY in o) {
+    // A store answers its descriptor trap with a value; through a view the
+    // descriptor is truthful (see `sourceDescriptor`). A foreign proxy is
+    // opaque: nothing about it is known to be fixed.
+    if (viewOf(o) === undefined) return false;
+    const desc = Reflect.getOwnPropertyDescriptor(o, key);
+    return desc === undefined ? hasStaticKeys(o) : desc.get === undefined;
+  }
+  const desc = Reflect.getOwnPropertyDescriptor(o, key);
+  return desc === undefined || (desc.get === undefined && desc.set === undefined);
+}
+function accessorDescriptor(get, enumerable = true) {
+  return { configurable: true, enumerable, get, set: trueFn };
+}
+/** The descriptor a consumer should see for `key` on an entry —
+ * the view proxies answer `getOwnPropertyDescriptor` with it, so it tells the
+ * truth through any depth of merge/omit layers.
+ *
+ * A DATA descriptor means "nothing reactive can hide behind this value": the
+ * key is a data property of a plain-object leaf — the compiler's own
+ * encoding of a static attribute. Everything else is an accessor: a getter
+ * on a leaf, a key on a store proxy (its "data" is a signal), or a key on a
+ * merge memo source (the whole object is reactive). That is what lets a
+ * consumer skip a reactive node for a static prop at the bottom of a
+ * component chain, and it is why the store case must NOT forward the store's
+ * own descriptor, which reports a value.
+ *
+ * `configurable: true` always — the target has no such property, and the
+ * Proxy invariants forbid reporting a non-configurable one. */
+// `present` says the caller has already established `key in s` (a trap's
+// shadowing walk did), so a store is not asked a second time.
+function sourceDescriptor(s, kind, key, present = false) {
+  if (kind === SOURCE_OMIT) {
+    if (isHidden(s, key)) return undefined;
+    return sourceDescriptor(s.source, s.kind, key, present);
+  }
+  // An omit's merge record: the descriptor of the last entry that has the
+  // key, as the merge proxy's own trap answers (see `mergeDescriptor`).
+  if (kind === SOURCE_MERGE) return mergeDescriptor(s, key);
+  // A memo source (`merge(() => …)`) is reactive wholesale: whatever shape
+  // the memo's current object has, the key is an accessor here.
+  if (kind === SOURCE_MEMO) {
+    return present || key in leafOf(s, kind)
+      ? accessorDescriptor(() => leafOf(s, kind)[key])
+      : undefined;
+  }
+  if (kind === SOURCE_PROXY) {
+    // Another view (an omit's source may be a merge proxy) already answers
+    // truthfully. A store's reported "data" is a signal, and a foreign proxy
+    // (frames slot props) has no own descriptors: for both, existence is
+    // `in` and the kind is accessor — one trap, and never the store's
+    // descriptor path.
+    if (isView(s)) return Reflect.getOwnPropertyDescriptor(s, key);
+    return present || key in s ? accessorDescriptor(() => s[key]) : undefined;
+  }
+  const desc = Reflect.getOwnPropertyDescriptor(s, key);
+  if (desc === undefined) return undefined;
+  if (desc.get !== undefined || desc.set !== undefined)
+    return accessorDescriptor(() => s[key], desc.enumerable);
+  // The proxy target has no such key, so the descriptor must be configurable;
+  // Reflect's is a fresh object, so a configurable one is handed out as is.
+  if (desc.configurable) return desc;
+  return { configurable: true, enumerable: desc.enumerable, writable: true, value: desc.value };
+}
+// Own ENUMERABLE keys, symbols included, of an entry — the user-facing key
+// set (`Object.keys(merged)`), where enumerability matters (#2769).
+function sourceEnumerableKeys(s, kind) {
+  {
+    if (s.kind === SOURCE_MERGE) return mergeEnumerableKeys(s.source, s);
+    const keys = ownEnumerableKeys(viewSource(s));
+    const out = [];
+    for (let i = 0; i < keys.length; i++) if (!isHidden(s, keys[i])) out.push(keys[i]);
+    return out;
+  }
+}
+// The target of a merge() proxy: the flattened sources, read by one shared
+// handler — like OmitView, no per-instance closures. `sources` is what
+// `$SOURCES` answers.
+/** @internal */
+class MergeView {
+  sources;
+  kinds;
+  /** key → the plain leaf that owns it (later sources win), built by an
+   * enumeration or once the reads have paid for it (see `resolvedTable`)
+   * when every leaf has static keys; `null` when one doesn't. Until then
+   * the slot counts the per-key trap reads so far. One slot rather than a
+   * counter field of its own: a view is built per source per component
+   * layer, and each field initializer is a measurable share of a
+   * constructor that small in the lower JIT tiers. */
+  table = 0;
+  /** see `tableOwnKeys` / `tableDescriptor` */
+  keys = undefined;
+  descs = undefined;
+  constructor(
+    sources,
+    /** `kinds[i]` is what `sources[i]` is (see `SourceKind`). */
+    kinds
+  ) {
+    this.sources = sources;
+    this.kinds = kinds;
+  }
+}
+/** @internal The `MergeView` behind a `merge()` proxy — its flattened
+ * `sources` with their `kinds` — or undefined. */
+function mergeView(o) {
+  return o != null && $PROXY in o && o[$TARGET] === undefined ? o[$VIEW] : undefined;
+}
+/** @internal The record behind a merge() or omit() proxy — a `MergeView`
+ * (flattened `sources` with their `kinds`) or an `OmitView` — or undefined
+ * for anything else (a plain object, a store, a foreign proxy). Two fast
+ * traps on a store, none on a plain object. */
+function viewOf(o) {
+  if (o == null || !($PROXY in o) || o[$TARGET] !== undefined) return undefined;
+  const merged = o[$VIEW];
+  return merged !== undefined ? merged : o[$OMIT];
+}
+/** @internal The resolved key table of a merge/omit view — every own key of
+ * the view mapped to the plain object that owns it, in merged order (a key
+ * at the position of the last source that carries it, see `tableSet`) — or
+ * undefined when it has none: a leaf is a store or a memo source, whose
+ * keys can change, or the object is not a view at all.
+ *
+ * This is the flat object the eager copy used to build, made lazily and
+ * without copying: one pass over the leaves' own keys, then every
+ * `get`/`has`/descriptor is one lookup plus one read of the owning leaf, and
+ * a consumer (`spread` rerunning its effect) walks the table instead of
+ * re-deriving shadowing from the leaves each time. Own keys only, as the
+ * copy's were: a plain source's key set is fixed once merged (keys added to
+ * it later are not seen — the copy didn't see them either).
+ *
+ * It is built by an ENUMERATION — the `ownKeys` trap, or a consumer asking
+ * for it here — or once per-key reads have paid for it (`READS_FOR_TABLE`),
+ * not on the first read. A per-key read has a direct answer (a walk of the
+ * sources, last to first, one `in` each) whose cost is the source count,
+ * while the table's is every key of every leaf, so the walk wins until a
+ * view has been read about as many times as it has keys. On the server it
+ * never is: a component reads its props a few times, the element enumerates
+ * them once through its own source walk, and the view is gone — building on
+ * first read there cost a component chain a table per layer (profiled on
+ * the Kobalte-shaped chain: a third of SSR time in the table code and its
+ * garbage). On the
+ * client a view read on every reactive rerun crosses the threshold in its
+ * first few updates and is one lookup per read from then on, as before.
+ * Once built — by a `spread`, `Object.keys`, `{...props}`, or the count —
+ * every trap uses it. */
+function resolvedTable(o) {
+  if (o == null || !($PROXY in o) || o[$TARGET] !== undefined) return undefined;
+  const view = o[$OMIT];
+  if (view !== undefined) return omitTable(view);
+  const merged = o[$VIEW];
+  return merged === undefined ? undefined : mergeTable(merged);
+}
+function mergeTable(view) {
+  let table = view.table;
+  if (typeof table !== "object") {
+    // a read count: not decided yet
+    const f = view.sources,
+      k = view.kinds;
+    for (let i = 0; i < f.length; i++) {
+      if (!entryHasStaticKeys(f[i], k[i])) {
+        view.table = null;
+        return undefined;
+      }
+    }
+    table = new Map();
+    collectTable(table, view, undefined);
+    view.table = table;
+  }
+  return table === null ? undefined : table;
+}
+// One pass over a merge record's leaves into `table`, through the nested
+// omit-over-merge entries — the filters enclosing the current leaf are the
+// `filters` stack — so a component chain builds ONE table at the view that
+// asked, not one per layer. A key an entry hides that an EARLIER entry owned
+// must stay: a filter applies to its own entry's contribution, not to the
+// merge, which is exactly what the stack expresses. Every entry has static
+// keys (the caller checked), so a leaf's own keys are the truth.
+function collectTable(table, view, filters) {
+  const f = view.sources,
+    k = view.kinds;
+  for (let i = 0; i < f.length; i++) {
+    const leaf = f[i];
+    if (k[i] === SOURCE_OMIT) {
+      if (leaf.kind === SOURCE_MERGE) {
+        if (filters === undefined) filters = [leaf];
+        else filters.push(leaf);
+        collectTable(table, leaf.source, filters);
+        filters.pop();
+        continue;
+      }
+      const src = leaf.source;
+      const keys = Reflect.ownKeys(src);
+      for (let j = 0; j < keys.length; j++) {
+        const key = keys[j];
+        if (!isHidden(leaf, key) && !hiddenByAny(filters, key)) tableSet(table, key, src);
+      }
+    } else {
+      const keys = Reflect.ownKeys(leaf);
+      for (let j = 0; j < keys.length; j++) {
+        const key = keys[j];
+        if (!hiddenByAny(filters, key)) tableSet(table, key, leaf);
+      }
+    }
+  }
+}
+function hiddenByAny(filters, key) {
+  if (filters !== undefined)
+    for (let i = filters.length - 1; i >= 0; i--) if (isHidden(filters[i], key)) return true;
+  return false;
+}
+// Key order is the merged one — every key at the position of the LAST source
+// that carries it — the order `ssrElement`'s array form serializes in and the
+// eager copy enumerated in, so a spread through a view and a spread over the
+// sources emit the same attribute order.
+function tableSet(table, key, leaf) {
+  if (table.has(key)) table.delete(key);
+  table.set(key, leaf);
+}
+// An omit view's table: its source's (a merge's table, or a plain object's
+// own keys) minus the hidden keys. Cached on the record.
+function omitTable(view) {
+  let table = view.table;
+  if (typeof table !== "object") {
+    const src = view.source;
+    if (view.kind === SOURCE_MERGE) {
+      // One pass over the merge's leaves with this filter on the stack —
+      // the merge record builds no table of its own for it.
+      if (!mergeHasStaticKeys(src)) {
+        view.table = null;
+        return undefined;
+      }
+      table = new Map();
+      collectTable(table, src, [view]);
+    } else if (view.kind === SOURCE_PLAIN) {
+      table = new Map();
+      const keys = Reflect.ownKeys(src);
+      for (let j = 0; j < keys.length; j++) {
+        const key = keys[j];
+        if (!isHidden(view, key)) table.set(key, src);
+      }
+    } else {
+      // a store or a memo: keys can change, no table
+      view.table = null;
+      return undefined;
+    }
+    view.table = table;
+  }
+  return table === null ? undefined : table;
+}
+// The user-facing key set of a resolved table: its keys that are enumerable
+// on the leaf that owns them (`Object.keys(merged)`, #2769). Fixed, like the
+// table, so it is built once per view: an `ownKeys` trap may hand back the
+// same array every time (the engine copies it).
+const propertyIsEnumerable$1 = Object.prototype.propertyIsEnumerable;
+function tableOwnKeys(view, table) {
+  let keys = view.keys;
+  if (keys === undefined) {
+    keys = view.keys = [];
+    for (const [key, leaf] of table) if (propertyIsEnumerable$1.call(leaf, key)) keys.push(key);
+  }
+  return keys;
+}
+// The descriptor for a table key — its owning leaf's, truthful (see
+// `sourceDescriptor`) — with the shape cached per key so an enumeration
+// (`for…in`, `Object.keys`, `{...props}`: a descriptor trap per key, on
+// every pass) does not re-read the leaf's descriptor and re-allocate a
+// getter each time. An accessor reads live, so its descriptor is reused as
+// is; a data descriptor is rebuilt with the current value.
+function tableDescriptor(view, table, key) {
+  const leaf = table.get(key);
+  if (leaf === undefined) return undefined;
+  let descs = view.descs;
+  if (descs === undefined) descs = view.descs = new Map();
+  let cached = descs.get(key);
+  if (cached === undefined) {
+    cached = sourceDescriptor(leaf, SOURCE_PLAIN, key);
+    if (cached === undefined) return undefined;
+    descs.set(key, cached);
+    return cached;
+  }
+  if (cached.get !== undefined) return cached;
+  return {
+    configurable: true,
+    enumerable: cached.enumerable,
+    writable: cached.writable,
+    value: leaf[key]
+  };
+}
+// Per-key trap reads a view takes before building its table, from the
+// break-even: a build is ~60 ns per key (an `ownKeys` share, a `has`, a
+// `set`), a walk ~20 ns per source (an `in`, a hidden-list check), and a
+// leaf carries about five keys — so the table has paid for itself after
+// ~15 reads. Measured on the Kobalte-shaped chain: a walk is 2× a lookup at
+// depth 1 and up to 10× for a first-source key at depth 7 (a walk through
+// seven nested layers, a hidden-list check at each), so a view read on
+// every update wants the table; a view read a handful of times (every
+// server-side view) never wants it.
+const READS_FOR_TABLE = 16;
+// The table for a per-key trap: the one a view HAS (built by an enumeration
+// or an earlier read, see `resolvedTable`), or the one this read pays for,
+// or none — a walk answers. One per view type, so a trap pays no type check.
+// A settled slot is an object (the Map, or `null`); a number is the count.
+function mergeReadTable(view) {
+  const table = view.table;
+  if (typeof table === "object") return table === null ? undefined : table;
+  if (table + 1 < READS_FOR_TABLE) {
+    view.table = table + 1;
+    return undefined;
+  }
+  return mergeTable(view);
+}
+// Only for an omit over a merge (`kind === SOURCE_MERGE`; the caller checks,
+// inline — a call is not free in every tier): an omit over one object reads
+// it directly — a list check and a property read, nothing a table would
+// shorten.
+function omitReadTable(view) {
+  const table = view.table;
+  if (typeof table === "object") return table === null ? undefined : table;
+  if (table + 1 < READS_FOR_TABLE) {
+    view.table = table + 1;
+    return undefined;
+  }
+  return omitTable(view);
+}
+// The table a record HAS — built already by an enumeration or a trap's read
+// count — or undefined. What a nested walk asks: a record reached through an
+// outer view's entry counts no reads of its own (the outer view decides for
+// the whole tree, and its table build then builds the inner ones), so the
+// inner merges of a component chain build nothing on the server where the
+// leaves are read a few times each.
+function tableOf(view) {
+  const table = view.table;
+  return typeof table === "object" && table !== null ? table : undefined;
+}
+// "no entry has the key" — distinct from an entry that holds `undefined`.
+const MISSING = Symbol();
+// The read: the value of the last entry that has the key, or MISSING. ONE
+// walk — a nested omit-over-merge entry answers presence and value together,
+// so a chain of layers is walked once per read, not once per layer per
+// level.
+function mergeLookup(view, property) {
+  const table = tableOf(view);
+  if (table !== undefined) {
+    const leaf = table.get(property);
+    return leaf === undefined ? MISSING : leaf[property];
+  }
+  const f = view.sources,
+    k = view.kinds;
+  for (let i = f.length - 1; i >= 0; i--) {
+    const kind = k[i];
+    if (kind === SOURCE_OMIT) {
+      const v = f[i];
+      if (isHidden(v, property)) continue;
+      if (v.kind === SOURCE_MERGE) {
+        const value = mergeLookup(v.source, property);
+        if (value !== MISSING) return value;
+        continue;
+      }
+      const s = viewSource(v);
+      if (property in s) return s[property];
+    } else {
+      const s = leafOf(f[i], kind);
+      if (property in s) return s[property];
+    }
+  }
+  return MISSING;
+}
+function mergeGet(view, property) {
+  const value = mergeLookup(view, property);
+  return value === MISSING ? undefined : value;
+}
+// `key in merge`, on the record.
+function mergeHas(view, property) {
+  const table = tableOf(view);
+  if (table !== undefined) return table.has(property);
+  const f = view.sources,
+    k = view.kinds;
+  for (let i = f.length - 1; i >= 0; i--) if (sourceHas(f[i], k[i], property)) return true;
+  return false;
+}
+// The proxy's `getOwnPropertyDescriptor`, on the record.
+function mergeDescriptor(view, property) {
+  const table = tableOf(view);
+  if (table !== undefined) return tableDescriptor(view, table, property);
+  const f = view.sources,
+    k = view.kinds;
+  for (let i = f.length - 1; i >= 0; i--) {
+    if (!sourceHas(f[i], k[i], property)) continue;
+    // `in` also answers for inherited keys, which have no own descriptor.
+    return (
+      sourceDescriptor(f[i], k[i], property, true) ??
+      accessorDescriptor(() => mergeGet(view, property))
+    );
+  }
+  return undefined;
+}
+// Own keys of a merge record in merged order — every key at the position
+// of the LAST entry that carries it, the order the table keeps and
+// `ssrElement` serializes in. `enumerable` selects the user-facing set
+// (`Object.keys`, #2769) over every own string key (a consumer's walk);
+// `filter` is the omit this record is read through, applied as the keys
+// are gathered so an omit over a merge builds ONE list per layer. A list
+// with `indexOf` rather than a Set: a props object has a dozen keys, and a
+// Set's hash store was 2 KB per row on the Kobalte-shaped chain.
+function mergeKeysOf(view, enumerable, filter) {
+  const out = [];
+  collectKeys(view, filter === undefined ? undefined : [filter], enumerable, out, null);
+  return out;
+}
+// One pass over a merge record's leaves — through its nested omit-over-merge
+// entries, `filters` the omits enclosing the current leaf (see
+// `collectTable`) — appending each leaf's keys to `keys` in merged order
+// (a key already listed moves to the end: later wins) and, when `owners` is
+// given, the object that owns the key at the same index. A consumer that
+// reads every key once (`ssrElement`) then reads `owners[i][keys[i]]`: no
+// `in` walk per key, no table. A memo leaf is resolved once here.
+function collectKeys(view, filters, enumerable, keys, owners) {
+  const f = view.sources,
+    k = view.kinds;
+  for (let i = 0; i < f.length; i++) {
+    let leaf = f[i],
+      kind = k[i];
+    let filter;
+    if (kind === SOURCE_OMIT) {
+      if (leaf.kind === SOURCE_MERGE) {
+        if (filters === undefined) filters = [leaf];
+        else filters.push(leaf);
+        collectKeys(leaf.source, filters, enumerable, keys, owners);
+        filters.pop();
+        continue;
+      }
+      filter = leaf;
+      kind = leaf.kind;
+      leaf = leaf.source;
+    }
+    leaf = leafOf(leaf, kind);
+    const ks = enumerable ? ownEnumerableKeys(leaf) : leafKeys(leaf, kind);
+    for (let j = 0; j < ks.length; j++) {
+      const key = ks[j];
+      if (filter !== undefined && isHidden(filter, key)) continue;
+      if (hiddenByAny(filters, key)) continue;
+      addKey(keys, owners, key, leaf);
+    }
+  }
+}
+// Append `key` owned by `owner`, moving an earlier listing to the end: later
+// wins, and the position is the last owner's (the merged order).
+function addKey(keys, owners, key, owner) {
+  const at = keys.indexOf(key);
+  if (at !== -1) {
+    keys.splice(at, 1);
+    if (owners !== null) owners.splice(at, 1);
+  }
+  keys.push(key);
+  if (owners !== null) owners.push(owner);
+}
+/** @internal Every own string key of a props SOURCE — a plain object, a
+ * store or foreign proxy, or a merge/omit view — appended to `keys` in
+ * merged order with the object that owns each at the same index of
+ * `owners`: a key already listed (by this source or an earlier one) moves
+ * to the end, so several sources collected in turn give the order and the
+ * winners a merge of them would. A consumer that reads each key once
+ * (`ssrElement`) then reads `owners[i][keys[i]]` — the owner's getter runs
+ * there, once — and asks nothing else of a view: no table, no `in` walk per
+ * key through the merge/omit layers, no key list per leaf. One pass,
+ * however deep the layers nest. Symbols are listed; the consumer skips
+ * them. */
+function sourceOwners(s, keys, owners) {
+  if ($PROXY in s) {
+    const view = viewOf(s);
+    if (view === undefined) {
+      // a store: one `ownKeys` trap, reads through `[]`
+      const ks = Reflect.ownKeys(s);
+      for (let i = 0; i < ks.length; i++) addKey(keys, owners, ks[i], s);
+      return;
+    }
+    if (view instanceof OmitView) {
+      if (view.kind === SOURCE_MERGE) return collectKeys(view.source, [view], false, keys, owners);
+      const leaf = viewSource(view);
+      const ks = leafKeys(leaf, view.kind);
+      for (let i = 0; i < ks.length; i++)
+        if (!isHidden(view, ks[i])) addKey(keys, owners, ks[i], leaf);
+      return;
+    }
+    return collectKeys(view, undefined, false, keys, owners);
+  }
+  const ks = Object.keys(s);
+  for (let i = 0; i < ks.length; i++) addKey(keys, owners, ks[i], s);
+}
+// The user-facing key set of a merge record, read through `filter` if given.
+function mergeEnumerableKeys(view, filter) {
+  const table = mergeTable(view);
+  if (table === undefined) return mergeKeysOf(view, true, filter);
+  const keys = tableOwnKeys(view, table);
+  if (filter === undefined) return keys;
+  const out = [];
+  for (let i = 0; i < keys.length; i++) if (!isHidden(filter, keys[i])) out.push(keys[i]);
+  return out;
+}
+const mergeTraps = {
+  get(view, property, receiver) {
     if (property === $PROXY) return receiver;
-    return _.get(property);
+    if (property === $TARGET || property === $OMIT) return undefined;
+    if (property === $SOURCES) return view.sources;
+    if (property === $VIEW) return view;
+    // A trap read counts toward the table (see `mergeReadTable`); the walk
+    // itself is the record's.
+    const table = mergeReadTable(view);
+    if (table !== undefined) {
+      const leaf = table.get(property);
+      return leaf === undefined ? undefined : leaf[property];
+    }
+    return mergeGet(view, property);
   },
-  has(_, property) {
+  has(view, property) {
     if (property === $PROXY) return true;
-    return _.has(property);
+    if (property === $TARGET || property === $OMIT || property === $SOURCES || property === $VIEW)
+      return false;
+    const table = mergeReadTable(view);
+    if (table !== undefined) return table.has(property);
+    return mergeHas(view, property);
   },
   set: trueFn,
   deleteProperty: trueFn,
-  getOwnPropertyDescriptor(_, property) {
-    return {
-      configurable: true,
-      enumerable: true,
-      get() {
-        return _.get(property);
-      },
-      set: trueFn,
-      deleteProperty: trueFn
-    };
+  getOwnPropertyDescriptor(view, property) {
+    if (
+      property === $PROXY ||
+      property === $TARGET ||
+      property === $OMIT ||
+      property === $SOURCES ||
+      property === $VIEW
+    )
+      return undefined;
+    const table = mergeReadTable(view);
+    if (table !== undefined) return tableDescriptor(view, table, property);
+    return mergeDescriptor(view, property);
   },
-  ownKeys(_) {
-    return _.keys();
+  ownKeys(view) {
+    return mergeEnumerableKeys(view);
   }
 };
-function resolveSource(s) {
-  return !(s = typeof s === "function" ? s() : s) ? {} : s;
-}
-const $SOURCES = Symbol("MERGE_SOURCE");
-/** @internal The flattened sources behind a `merge()` PROXY, or undefined.
- * Only the proxy form: its writes are no-ops, so the sources are the whole
- * truth. merge()'s plain-object form also records `$SOURCES` (so nested
- * merges flatten), but it is a real object callers may mutate afterwards
- * (html's tagged templates assign props after spreading) — those own writes
- * live on the object, not in the sources, so it must be read directly. */
+// An omit view reads its source directly — a hidden-key check and one
+// property read; over a merge record, the merge's own walk by function call,
+// never a trap. Once an enumeration or the read count has built its table
+// (over a merge with plain leaves only: the merge's, filtered) every trap
+// answers from that instead.
+const omitTraps = {
+  get(view, property, receiver) {
+    if (property === $PROXY) return receiver;
+    // $VIEW is the underlying merge's record, UNFILTERED: never forwarded,
+    // and $SOURCES never answers the merge's own sources, which would hand
+    // a re-merge the unfiltered objects and leak the omitted keys (#3014).
+    // A consumer reaches the record through $OMIT and walks it as ONE
+    // filtered entry.
+    if (property === $TARGET || property === $VIEW || property === $SOURCES) return undefined;
+    if (property === $OMIT) return view;
+    if (view.kind === SOURCE_MERGE) {
+      const table = omitReadTable(view);
+      if (table !== undefined) {
+        const leaf = table.get(property);
+        return leaf === undefined ? undefined : leaf[property];
+      }
+      if (isHidden(view, property)) return undefined;
+      return mergeGet(view.source, property);
+    }
+    if (isHidden(view, property)) return undefined;
+    return viewSource(view)[property];
+  },
+  has(view, property) {
+    if (property === $PROXY) return true;
+    if (property === $TARGET || property === $VIEW || property === $SOURCES || property === $OMIT)
+      return false;
+    if (view.kind === SOURCE_MERGE) {
+      const table = omitReadTable(view);
+      if (table !== undefined) return table.has(property);
+      if (isHidden(view, property)) return false;
+      return mergeHas(view.source, property);
+    }
+    if (isHidden(view, property)) return false;
+    return property in viewSource(view);
+  },
+  set: trueFn,
+  deleteProperty: trueFn,
+  getOwnPropertyDescriptor(view, property) {
+    if (
+      property === $PROXY ||
+      property === $TARGET ||
+      property === $VIEW ||
+      property === $OMIT ||
+      property === $SOURCES
+    )
+      return undefined;
+    if (view.kind === SOURCE_MERGE) {
+      const table = omitReadTable(view);
+      if (table !== undefined) return tableDescriptor(view, table, property);
+    }
+    return sourceDescriptor(view, SOURCE_OMIT, property);
+  },
+  ownKeys(view) {
+    if (view.kind === SOURCE_MERGE) {
+      const table = omitTable(view);
+      if (table !== undefined) return tableOwnKeys(view, table);
+      // No table (a store or memo leaf): the merge's own key set, filtered.
+      return sourceEnumerableKeys(view);
+    }
+    const keys = Reflect.ownKeys(viewSource(view));
+    const out = [];
+    for (let i = 0; i < keys.length; i++) if (!isHidden(view, keys[i])) out.push(keys[i]);
+    return out;
+  }
+};
+/** @internal The flattened sources behind a `merge()` proxy, or undefined.
+ * A merge's writes are no-ops, so its sources are the whole truth. A COPY of
+ * a merge (`{...merged}`, a descriptor copy) is a plain object that carries
+ * no sources — `ownKeys` never answers $SOURCES — so what is on the copy is
+ * the truth there and every consumer reads it directly (#3384). */
 function mergeSources(o) {
-  return o != null && o[$PROXY] === o ? o[$SOURCES] : undefined;
+  return o != null && $PROXY in o && o[$TARGET] === undefined ? o[$SOURCES] : undefined;
 }
 /**
  * Merges multiple props-like objects into a single proxy that *preserves
@@ -3058,6 +4256,12 @@ function mergeSources(o) {
  * Function arguments are treated as memo-backed sources — useful for passing
  * derived defaults whose computation should track reactively.
  *
+ * The result is a live VIEW of its sources, never a copy: creating it costs
+ * nothing per key, every read goes to the source that owns the key (a getter
+ * runs there, a data property is read live), and writing to it is a no-op.
+ * A single non-function source is returned as is. To own a mutable object,
+ * copy it: `{ ...merged }` snapshots the current values.
+ *
  * Use this in component bodies to merge defaults / overrides without losing
  * Solid's per-property tracking.
  *
@@ -3072,44 +4276,69 @@ function mergeSources(o) {
  */
 function merge(...sources) {
   if (sources.length === 1 && typeof sources[0] !== "function") return sources[0];
-  let proxy = false;
   const flattened = [];
+  const kinds = [];
+  // The one non-falsy source, if there is exactly one: it IS the merge.
+  let only = undefined;
+  let count = 0;
   for (let i = 0; i < sources.length; i++) {
     const s = sources[i];
-    proxy = proxy || (!!s && $PROXY in s);
-    const childSources = !!s && s[$SOURCES];
-    if (childSources) {
-      for (let i = 0; i < childSources.length; i++) flattened.push(childSources[i]);
-    } else flattened.push(typeof s === "function" ? ((proxy = true), createMemo(s)) : s);
-  }
-  if (SUPPORTS_PROXY && proxy) {
-    return new Proxy(
-      {
-        get(property) {
-          if (property === $SOURCES) return flattened;
-          for (let i = flattened.length - 1; i >= 0; i--) {
-            const s = resolveSource(flattened[i]);
-            if (property in s) return s[property];
-          }
-        },
-        has(property) {
-          for (let i = flattened.length - 1; i >= 0; i--) {
-            if (property in resolveSource(flattened[i])) return true;
-          }
-          return false;
-        },
-        keys() {
-          const keys = new Set();
-          for (let i = 0; i < flattened.length; i++) {
-            const sourceKeys = ownEnumerableKeys(resolveSource(flattened[i]));
-            for (let j = 0; j < sourceKeys.length; j++) keys.add(sourceKeys[j]);
+    if (!s) continue;
+    count++;
+    only = s;
+    if (typeof s === "function") {
+      flattened.push(createMemo(s));
+      kinds.push(SOURCE_MEMO);
+      continue;
+    }
+    if ($PROXY in s) {
+      // A store (`$TARGET`) is a leaf as it is. A merge() proxy is flattened
+      // through: its writes are no-ops, so its sources are exactly what it
+      // reads. An omit() proxy joins as its view record — ONE entry, its
+      // filter travelling with it, whether it is over a plain object or a
+      // whole merge (never the merge's own sources, which would leak the
+      // omitted keys, #3014). A consumer's walk recurses into the record.
+      if (s[$TARGET] === undefined) {
+        const child = s[$VIEW];
+        if (child !== undefined) {
+          for (let j = 0; j < child.sources.length; j++) {
+            flattened.push(child.sources[j]);
+            kinds.push(child.kinds[j]);
           }
-          return [...keys];
+          continue;
         }
-      },
-      propTraps
-    );
-  }
+        const view = s[$OMIT];
+        if (view !== undefined) {
+          flattened.push(view);
+          kinds.push(SOURCE_OMIT);
+          continue;
+        }
+      }
+      flattened.push(s);
+      kinds.push(SOURCE_PROXY);
+      continue;
+    }
+    flattened.push(s);
+    kinds.push(SOURCE_PLAIN);
+  }
+  if (SUPPORTS_PROXY) {
+    if (count === 1 && typeof only !== "function") return only;
+    // Always a view, never a copy. Building a plain object here costs a
+    // descriptor read, a bound getter and a defineProperty per key per
+    // layer, and component libraries stack several layers per element
+    // (defaults → omit → call-site statics → …), so the copies dominated
+    // their render cost while every consumer that matters — `spread`,
+    // `ssrElement`, a nested merge — reads the flattened sources directly
+    // anyway (#3448). The view is O(1) to create and reads through to the
+    // sources, so a data property on a source is read live, like a getter.
+    // Writes to the result are no-ops (a consumer that needs its own object
+    // copies: `{...merged}`, which the traps answer truthfully). Copies of
+    // the result never carry $SOURCES (#3384): `ownKeys` answers only the
+    // sources' keys.
+    return new Proxy(new MergeView(flattened, kinds), mergeTraps);
+  }
+  // No Proxy: an eager descriptor copy, semantics as close to the view as a
+  // plain object allows (getters stay live; data properties are snapshots).
   const defined = Object.create(null);
   let nonTargetKey = false;
   let lastIndex = flattened.length - 1;
@@ -3145,62 +4374,50 @@ function merge(...sources) {
     if (desc.get) Object.defineProperty(target, key, desc);
     else target[key] = desc.value;
   }
-  target[$SOURCES] = flattened;
   return target;
 }
-/**
- * Returns a reactive proxy of `props` with the listed keys hidden. Tracking
- * on the remaining keys is preserved.
- *
- * Use it to forward "rest" props to a child element while pulling out the
- * keys your component handles itself — the equivalent of `splitProps(p, ["a","b"])[1]`.
- *
- * @example
- * ```tsx
- * function Input(props: { label: string; value: string; onInput: (v: string) => void } & JSX.HTMLAttributes<HTMLInputElement>) {
- *   const rest = omit(props, "label", "value", "onInput");
- *
- *   return (
- *     <label>
- *       {props.label}
- *       <input
- *         {...rest}
- *         value={props.value}
- *         onInput={e => props.onInput(e.currentTarget.value)}
- *       />
- *     </label>
- *   );
- * }
- * ```
- */
 function omit(props, ...keys) {
-  if (SUPPORTS_PROXY && $PROXY in props) {
-    return new Proxy(
-      {
-        get(property) {
-          // $SOURCES must not tunnel through the filter: merge() flattens
-          // whatever answers it, so forwarding would hand a re-merge the
-          // UNFILTERED sources of an underlying merge proxy and the omitted
-          // keys leak back in (#3014 — the SSR element-spread path re-merges
-          // static attributes with the rest object). Opaque here: merge
-          // composes omit proxies through their traps instead.
-          return property === $SOURCES || keys.includes(property) ? undefined : props[property];
-        },
-        has(property) {
-          return property !== $SOURCES && !keys.includes(property) && property in props;
-        },
-        keys() {
-          return ownEnumerableKeys(props).filter(k => !keys.includes(k));
+  let hidden = keys.length === 1 && typeof keys[0] === "function" ? keys[0] : keys;
+  if (SUPPORTS_PROXY) {
+    // A view over a view folds: one record, both filters, the original
+    // source — so a consumer walks the real object however deep the omits go.
+    // Over a merge() proxy the source is the merge's RECORD (see OmitView):
+    // one record whatever the leaf count, read by function call.
+    let source = props;
+    let kind = SOURCE_PLAIN;
+    if (typeof props === "function") kind = SOURCE_MEMO;
+    else if ($PROXY in props) {
+      kind = SOURCE_PROXY;
+      if (props[$TARGET] === undefined) {
+        const inner = props[$OMIT];
+        if (inner !== undefined) {
+          source = inner.source;
+          kind = inner.kind;
+          hidden = combineHidden(inner.hidden, hidden);
+        } else {
+          const merged = props[$VIEW];
+          if (merged !== undefined) {
+            source = merged;
+            kind = SOURCE_MERGE;
+          }
         }
-      },
-      propTraps
-    );
+      }
+    }
+    return new Proxy(new OmitView(source, kind, hidden), omitTraps);
   }
   const result = {};
   const propNames = Object.getOwnPropertyNames(props);
-  const blocked = keys.length > 4 && propNames.length > keys.length ? new Set(keys) : undefined;
+  const isHiddenKey =
+    typeof hidden === "function"
+      ? hidden
+      : hidden.length > 4 && propNames.length > hidden.length
+        ? (
+            blocked => key =>
+              blocked.has(key)
+          )(new Set(hidden))
+        : key => hidden.includes(key);
   for (const propName of propNames) {
-    if (blocked ? !blocked.has(propName) : !keys.includes(propName)) {
+    if (!isHiddenKey(propName)) {
       const desc = Object.getOwnPropertyDescriptor(props, propName);
       !desc.get && !desc.set && desc.enumerable && desc.writable && desc.configurable
         ? (result[propName] = desc.value)
@@ -3355,6 +4572,11 @@ const slotNodeEquals = function (a, b) {
 setSlotUnobserved(node => {
   // A live affects() mark keeps the node addressable (sweep parity).
   if (node._x?._affectsCount) return;
+  // An active override or a staged write is state only the node holds (an
+  // optimistic signal keeps its override whether or not anything reads it —
+  // store parity, posture-store-parity S7): defer the release to the flush
+  // that resolves it (the scheduler's transient-node sweep).
+  if (hasActiveOverride(node) || node._pendingValue !== NOT_PENDING) return deferSlotRelease(node);
   const t = node._host;
   const key = node._key;
   if (t.n && t.n[key] === node) {
@@ -3387,11 +4609,16 @@ function getNode(
     // (stageHeldKey). Its held-adoption notification (stageHeldAdoptions)
     // ran before the node existed and the drain has nothing left to say.
     // Without this the node was born from whichever view its first reader
-    // saw and never learned the other. (The held-FOLD twin — a setter's
-    // write to an unobserved key landing only in the pending backing — is
-    // #3336's, and lands with #3337.)
-    const held = heldAdoptionTransition(target);
+    // saw and never learned the other. Two kinds of hold, one rule (#3336):
+    //  - a held FOLD (pb): a setter's write to an unobserved key landed only
+    //    in the pending backing; committed is `v[key]`, staged is `pb[key]`
+    //    (undefined for a deleted key);
+    //  - a held ADOPTION (ht): the adopted value already swapped into `v`;
+    //    committed is the held view `hv[key]`, staged is `v[key]`.
+    const fold = heldFoldTransition(target);
+    let held = heldAdoptionTransition(target);
     if (held !== null) current = target.hv[key];
+    else if ((held = fold) !== null) current = target.v[key];
     // Create-floor diet: slotSignal bakes the whole node into one literal —
     // no options object, no equals/unobserved closures, no NodeExtension,
     // no post-construction expandos (acc + the wrap cache px/pxv are
@@ -3418,7 +4645,10 @@ function getNode(
     // "signal". Gated on the engine being installed — node creation is
     // the hottest store path, and the disabled cost must stay one null
     // check (nodes created before enable() stay generically named).
-    if (attrHooks !== null) created._name = "store." + String(key);
+    if (attrHooks !== null) {
+      created._name = "store." + String(key);
+      stampNodeOwner(created, target);
+    }
     // Optimistic families: arm the override slot — setSignal routes armed
     // nodes through the core engine (lanes, ownership, reverts all native).
     if (target.fam?.opt) {
@@ -3428,7 +4658,16 @@ function getNode(
     // A node born inside a live mark's identity scope inherits the mark
     // (the declaration walk could only cover nodes existing then).
     if (key !== $AFFECTS && affectsScopesLive()) inheritAffectsMarks(created, target.v, key);
-    if (held !== null) stageHeldKey(created, target.v[key], held);
+    if (held !== null)
+      stageHeldKey(
+        created,
+        fold !== null
+          ? target.del !== null && target.del.has(key)
+            ? undefined
+            : target.pb[key]
+          : target.v[key],
+        held
+      );
     nodes[key] = node;
     target.nc++;
     markDescendants(target);
@@ -3456,6 +4695,48 @@ function heldAdoptionTransition(target) {
  * it walks no subscriber (the node has none yet). Transition-stamped now, as
  * `runFolded` does — no parked-flush pass will stamp it.
  */
+/** The live transaction holding `target`'s pending backing (the #3089
+ * write-time stamp, resolved through merges), else null. */
+function liveFoldTransition(target) {
+  if (target.pb === null) return null;
+  const fb = foldBatches.get(target);
+  if (fb === undefined) return null;
+  const txn = currentTransition(fb);
+  return txn._done === false ? txn : null;
+}
+/** liveFoldTransition for node materialization (stageHeldKey). Inside the
+ * draft the backing is the setter's working copy, not a flushed hold — its
+ * nodes take their writes at setter exit (notifyWrites). Optimistic families
+ * hold at the backing: tentative writes are node overrides over a discarded
+ * clone, and a truth-staged landing is masked from ordinary readers by
+ * heldTruthMasked — neither is a plain staged write to mirror. Chained
+ * backings serve the inner store's live value, never a node value. */
+function heldFoldTransition(target) {
+  if (target.ch || target.fam?.opt === true || inDraft(target)) return null;
+  return liveFoldTransition(target);
+}
+/**
+ * Rule 1 at the backing, the hold half (core serve()'s stale-of-foreign and
+ * A29 arms, for a container instead of a node): given the transaction
+ * holding what a reader `c` (a pass; callers serve context-free readers the
+ * committed container themselves) is about to be served, is the STAGED
+ * container its to see? Its own hold, or none — yes. A foreign hold — a
+ * stale pass (render effect) keeps the committed frame and is recorded for
+ * replay at the hold's commit (recordStaleReplay, A15 / A26); a deriving
+ * pass takes the staged world and enters the transaction (enterStagedRead,
+ * A29). Shared by both hold kinds: a setter's fold (committed `v`, staged
+ * `pb`, the write-time stamp) and an adoption under a transaction
+ * (committed = the held view `hv`, staged = the adopted `v`, #3074).
+ */
+function holdVisible(txn, c) {
+  if (txn === null || ownsHold(txn)) return true;
+  if (stale) {
+    recordStaleReplay(txn, c);
+    return false;
+  }
+  enterStagedRead(null, txn);
+  return true;
+}
 function stageHeldKey(node, nv, txn) {
   if (slotNodeEquals.call(node, node._value, nv)) return;
   node._pendingValue = nv;
@@ -3467,6 +4748,27 @@ function sameLogicalSlot(target, a, b) {
   const at = lookupTarget$1(a, target.fam);
   return at !== undefined && at === lookupTarget$1(b, target.fam);
 }
+/**
+ * Observe-tier: the owner each store root was created under. The proxy
+ * cannot carry `_owner` itself (`registerGraph`'s stamp is swallowed by the
+ * set trap outside a draft), so the root target keys it here and the store's
+ * nodes copy it into `_owner` as they are created — an `OBSERVE.exclude`d
+ * panel's store nodes are then excluded subjects, exactly like its signals.
+ * Both ends are gated with the naming on the engine being installed: node
+ * creation is the hottest store path, store creation is next, and the
+ * disabled cost of each stays one null check. A store created before
+ * `enable()` therefore has no recorded owner and its nodes are never excluded
+ * subjects — the same boundary the naming draws; a panel enables first.
+ */
+const storeOwners = new WeakMap();
+function storeRootOwner(target) {
+  let root = target;
+  while (root.u !== null) root = root.u;
+  return storeOwners.get(root);
+}
+function stampNodeOwner(created, target) {
+  created._owner = storeRootOwner(target) ?? null;
+}
 function getHasNode(target, key, present) {
   const nodes = (target.h ??= Object.create(null));
   let node = nodes[key];
@@ -3477,6 +4779,13 @@ function getHasNode(target, key, present) {
         equals: isEqual,
         unobserved() {
           if (created._x?._affectsCount) return;
+          // The structural twin of the value slot's rule (setSlotUnobserved,
+          // S7): an optimistic add/delete lives on this presence node as its
+          // override — releasing it with the override on would let `in`,
+          // `Object.keys` and descriptors fall back to committed structure
+          // while the action is live. Defer to the flush that resolves it.
+          if (hasActiveOverride(created) || created._pendingValue !== NOT_PENDING)
+            return deferSlotRelease(created);
           if (target.h && target.h[key] === created) {
             delete target.h[key];
             unlinkFirewallChild(created);
@@ -3486,6 +4795,7 @@ function getHasNode(target, key, present) {
       target.fam?.node ?? undefined
     ));
     created._config |= CONFIG_OWNED_WRITE;
+    if (attrHooks !== null) stampNodeOwner(created, target);
     if (target.fam?.opt) {
       ext(created)._overrideValue = NOT_PENDING;
       created._config |= CONFIG_OPTIMISTIC;
@@ -3513,6 +4823,7 @@ function getKeySetNode(target) {
       target.fam?.node ?? undefined
     ));
     created._config |= CONFIG_OWNED_WRITE;
+    if (attrHooks !== null) stampNodeOwner(created, target);
     if (target.fam?.opt) {
       ext(created)._overrideValue = NOT_PENDING;
       created._config |= CONFIG_OPTIMISTIC;
@@ -3539,6 +4850,7 @@ function getDeepNode(target) {
       target.fam?.node ?? undefined
     ));
     created._config |= CONFIG_OWNED_WRITE;
+    if (attrHooks !== null) stampNodeOwner(created, target);
     if (target.fam?.opt) {
       ext(created)._overrideValue = NOT_PENDING;
       created._config |= CONFIG_OPTIMISTIC;
@@ -4078,6 +5390,7 @@ function storePath$1(t) {
 function reportReplacedContainers(t, old, pb, writtenKeys) {
   const keys = writtenKeys ?? Reflect.ownKeys(pb);
   const isArray = Array.isArray(pb);
+  const owner = storeRootOwner(t);
   for (const key of keys) {
     if ((isArray && key === "length") || key === $OWNER) continue;
     if (t.del !== null && t.del.has(key)) continue;
@@ -4115,7 +5428,8 @@ function reportReplacedContainers(t, old, pb, writtenKeys) {
       isArr,
       total,
       unchanged,
-      isArr ? ov.length : Object.keys(ov).length
+      isArr ? ov.length : Object.keys(ov).length,
+      owner
     );
   }
 }
@@ -4528,22 +5842,12 @@ const UNSAFE_KEYS = new Set(["__proto__", "prototype", "constructor"]);
  * computed (#2687 — untracked reads inside mapArray Roots see in-flight
  * values mid-flush). CHILDREN_FORBIDDEN execution scopes (createTrackedEffect
  * / onSettled callbacks) get COMMITTED visibility (#3006), same as core. */
-function inOwnerContext() {
+/** Core read()'s reader: the current computation, a root reading as its
+ * parent computed (`context` persists under untrack — an untracked read
+ * inside an effect is still that effect's read). */
+function readerContext() {
   const c = getOwner();
-  if (c === null) return false;
-  const eff = c._root ? c._parentComputed : c;
-  return eff != null && !(eff._config & CONFIG_CHILDREN_FORBIDDEN);
-}
-/** CHILDREN_FORBIDDEN execution scope (createTrackedEffect / onSettled
- * callbacks). Distinct from context-free: these scopes get committed
- * visibility even against a projection's authoritative-elect pending
- * backing (#3082) — parity with signals, where core read() serves
- * committed to them regardless of staged writes. */
-function inForbiddenScope() {
-  const c = getOwner();
-  if (c === null) return false;
-  const eff = c._root ? c._parentComputed : c;
-  return eff != null && !!(eff._config & CONFIG_CHILDREN_FORBIDDEN);
+  return c === null ? null : c._root ? (c._parentComputed ?? null) : c;
 }
 /** A pending fold is transition-held when any written node's parked value is
  * stamped by a live transition (a plain batch parking — the lazy-recompute
@@ -4563,19 +5867,23 @@ function foldHeld(target) {
   return false;
 }
 function readSource(target) {
-  // Held view first (#3074): an adoption staged under a live hold serves the
-  // pre-hold committed backing to committed-visibility readers. Speculative
-  // readers — drafts, write-override, owner-context computeds recomputing
-  // inside the transaction, and latest() reads — see the adopted backing.
-  if (
-    target.ht !== null &&
-    !latestReadActive &&
-    !inDraft(target) &&
-    !getWriteOverride() &&
-    !inOwnerContext()
-  ) {
+  // Adoption hold first (#3074): an adoption staged under a live transaction
+  // (or a latest()-pull, PLAIN_HOLD) serves the pre-hold committed view to
+  // committed-visibility readers — context-free and children-forbidden ones,
+  // and stale passes off a foreign hold. Drafts, write-override and latest()
+  // see the adopted backing.
+  const ht = target.ht;
+  if (ht !== null && !latestReadActive && !inDraft(target) && !getWriteOverride()) {
     const hv = heldMaskView(target);
-    if (hv !== null) return hv;
+    if (hv !== null) {
+      const c = readerContext();
+      if (
+        c === null ||
+        c._config & CONFIG_CHILDREN_FORBIDDEN ||
+        !holdVisible(ht === PLAIN_HOLD ? null : currentTransition(ht), c)
+      )
+        return hv;
+    }
   }
   return pendingBackingVisible(target, false) ? target.pb : target.v;
 }
@@ -4595,25 +5903,28 @@ function readSource(target) {
  * divergence from context-free per-key reads) — but never through a hold:
  * held truth stays masked exactly as it is for per-key readers. */
 function pendingBackingVisible(target, speculative) {
-  return (
-    target.pb !== null &&
-    (inDraft(target) ||
-      getWriteOverride() ||
-      // Owner-context (and speculative-peek) readers see the pending
-      // backing — EXCEPT held truth on an optimistic family (#3164 fold):
-      // a live pb on an opt family outside the draft/write-override windows
-      // is a staged landing (tentative drafts never outlive their setter),
-      // and only the authoritative postures and latest() see it (the
-      // backing-level twin of core read()'s A17-for-held-truth arm;
-      // ordinary readers keep committed until the transaction's reveal).
-      ((speculative || inOwnerContext()) && !heldTruthMasked(target)) ||
-      // A projection's pending backing is authoritative-elect: serve it to
-      // context-free readers too UNLESS a transition is holding the node
-      // commits (downstream async hold — stale committed is the contract)
-      // or the reader is a CHILDREN_FORBIDDEN scope, which never observes
-      // its own unsettled write (#3082, signal parity per #3006).
-      (target.fam !== null && !heldTruthMasked(target) && !foldHeld(target) && !inForbiddenScope()))
-  );
+  if (target.pb === null) return false;
+  // The writer's own channels compose on the pending backing regardless.
+  if (inDraft(target) || getWriteOverride()) return true;
+  // HELD truth on an optimistic family (#3164 fold) is masked from ordinary
+  // readers until the transaction's reveal (the backing-level twin of core
+  // serve()'s CONFIG_HELD_TRUTH arm; authoritative postures and latest()
+  // tunnel through inside heldTruthMasked).
+  if (heldTruthMasked(target)) return false;
+  const c = readerContext();
+  if (c === null || c._config & CONFIG_CHILDREN_FORBIDDEN) {
+    // No pass, or a children-forbidden one: the committed frame (A32) —
+    // except the speculative peek (deep()/snapshot()), which sees ordinary
+    // pending staging but never through a live foreign hold, and a
+    // projection's pending backing, authoritative-elect for context-free
+    // readers UNLESS a transition holds the node commits (downstream async
+    // hold — stale committed is the contract; the write-time stamp covers
+    // keys with no node, #3336) or the scope is children-forbidden (#3082).
+    const txn = liveFoldTransition(target);
+    if (speculative) return txn === null || ownsHold(txn);
+    return target.fam !== null && c === null && !foldHeld(target) && txn === null;
+  }
+  return holdVisible(liveFoldTransition(target), c);
 }
 /** #3164 fold: HELD truth on an optimistic family — a pending backing
  * stamped by a live transition that retains optimism — is masked from
@@ -4655,11 +5966,6 @@ function runAuthoritative(fn) {
     setProjectionWriteActive(was);
   }
 }
-/** Active optimistic override on an armed node (armed slot idles at
- * NOT_PENDING; undefined = unarmed plain node). */
-function hasActiveOverride(node) {
-  return node._x?._overrideValue !== undefined && node._x?._overrideValue !== NOT_PENDING;
-}
 /** The reading computation is until()'s authoritative-view predicate — same
  * source of truth as core read()'s A17 carve-out (`context`, which persists
  * under untrack). optimisticView()'s composition gate consults exactly this:
@@ -4688,26 +5994,23 @@ function authoritativeServe() {
  * FORCE sentinels never surface (they only bump subscribers of accessor
  * keys, which are served by the trap, not the node). */
 function nodeValue(node, backing) {
-  // latest() sees the in-flight parked value like an owner-context reader
-  // does (#3075) — signal/memo parity for store-node-backed keys.
-  // Authoritative-view reads (until()'s predicate) skip the override arm
-  // only: staged pending values are authoritative, overrides are the
-  // caller's optimism.
-  const v =
-    !authoritativeServe() && hasActiveOverride(node)
+  // Store-only tunnels, ahead of Rule 1: truth authors (authoritativeServe —
+  // the projection derive's draft, the write-override continuation) see
+  // staged truth and never an override; latest() reaching this untracked
+  // path for a store key sees the in-flight parked value like an
+  // owner-context reader does (#3075), the visible override first.
+  let v;
+  if (authoritativeServe()) v = node._pendingValue !== NOT_PENDING ? node._pendingValue : backing;
+  else if (latestReadActive)
+    v = visibleOverride(node)
       ? unwrapOverride(node._x?._overrideValue)
-      : node._pendingValue !== NOT_PENDING &&
-          (latestReadActive ||
-            // Owner-context pending visibility — except HELD truth (#3164,
-            // see CONFIG_HELD_TRUTH: fold-staged or entangle-stolen
-            // confirming truth), which only authoritative/latest readers
-            // see (core read()'s A17-for-held-truth twin; ordinary readers
-            // keep committed until the transaction's reveal — latest() is
-            // exempted by the leading arm above).
-            ((inOwnerContext() || authoritativeServe()) &&
-              !(node._config & CONFIG_HELD_TRUTH && !authoritativeServe())))
+      : node._pendingValue !== NOT_PENDING
         ? node._pendingValue
         : backing;
+  // Otherwise the one slow selection core read() uses (serve): override,
+  // lane gate, A28, readerSeesCommitted / A29 — with the BACKING as the
+  // committed value (single-home rule, O6).
+  else v = serve(node, readerContext(), node._firewall || node, backing);
   return v === FORCE ? backing : v;
 }
 /** §7b: a chained target's child found as a RAW — from its pending backing
@@ -4759,7 +6062,8 @@ function serveDataKey(target, key, backingValue, src, node, accKnown = -1) {
     // Truth authors read the backing's own length — an optimistic row from
     // the caller's transaction must not shift where the author's next write
     // lands (#3108).
-    return (authoritativeServe() ? src : optHooks.optimisticView(target, src)).length;
+    return (authoritativeServe() ? src : optHooks.optimisticView(target, src, inDraft(target)))
+      .length;
   }
   if (inDraft(target)) {
     // Optimistic drafts before their first write have no pending backing yet;
@@ -4773,23 +6077,23 @@ function serveDataKey(target, key, backingValue, src, node, accKnown = -1) {
         v = unwrapOverride(node._x?._overrideValue);
     }
   } else {
-    if (node !== undefined) {
-      // §7b: a lane value on the outer node SHADOWS read-through — an active
-      // override pierces the chained gate; otherwise chained backings always
-      // serve the live inner value.
-      if (getObserver() !== null) {
-        // read()'s plain-signal fast path hoisted over the call (legacy trap
-        // parity): READ_SLOW = a global read window or non-plain node.
-        let nv = readNodeFast(node);
-        if (nv === READ_SLOW) nv = read(node);
-        if (!chained || hasActiveOverride(node)) v = nv === FORCE ? backingValue : nv;
-      } else if (!chained || hasActiveOverride(node)) {
-        v = nodeValue(node, backingValue);
-      }
-    } else if (getObserver() !== null) {
-      // First tracked read: create + link, and let the wrap-cache branch
-      // below populate px/pxv so read #2 skips wrapNext (slice 2).
-      read((node = getNode(target, key, backingValue, accKnown)));
+    // §7b: a lane value on the outer node SHADOWS read-through — an active
+    // override pierces the chained gate; otherwise chained backings always
+    // serve the live inner value.
+    if (getObserver() !== null) {
+      // First tracked read: create + link (the wrap-cache branch below
+      // populates px/pxv so read #2 skips wrapNext, slice 2). The value is
+      // served THROUGH the node from this read on — a node born under a held
+      // fold carries the hold (getNode, #3336), and the backing it was read
+      // from does not.
+      if (node === undefined) node = getNode(target, key, backingValue, accKnown);
+      // read()'s plain-signal fast path hoisted over the call (legacy trap
+      // parity): READ_SLOW = a global read window or non-plain node.
+      let nv = readNodeFast(node);
+      if (nv === READ_SLOW) nv = read(node);
+      if (!chained || hasActiveOverride(node)) v = nv === FORCE ? backingValue : nv;
+    } else if (node !== undefined && (!chained || hasActiveOverride(node))) {
+      v = nodeValue(node, backingValue);
     }
   }
   // Shallow stores serve data raw; store-proxy slots get boundary wrappers.
@@ -5012,7 +6316,7 @@ const traps = {
         !authoritativeServe()
       ) {
         const node = target.n?.[key];
-        if (node !== undefined && hasActiveOverride(node))
+        if (node !== undefined && visibleOverride(node))
           v = unwrapOverride(node._x?._overrideValue);
       }
       if (target.s) return serveShallow(target, key, v);
@@ -5044,7 +6348,7 @@ const traps = {
         if (hasActiveOverride(node)) present = !!nv;
       } else if (!authoritativeServe()) {
         const node = target.h?.[key];
-        if (node !== undefined && hasActiveOverride(node))
+        if (node !== undefined && visibleOverride(node))
           present = !!unwrapOverride(node._x?._overrideValue);
       }
     } else if (target.fam?.opt && draftSeesOverrides(target) && !authoritativeServe()) {
@@ -5062,7 +6366,25 @@ const traps = {
   },
   getOwnPropertyDescriptor(target, key) {
     if (key === $OWNER) return undefined;
-    const desc = visibleDescriptor(target, readSource(target), key);
+    // A descriptor read is a PRESENCE read: it subscribes to the key's
+    // presence node and witnesses affects()/isPending() exactly as `in` does
+    // (structural oracle, 2026-09-17 — the trap read no node before, so a
+    // render effect inspecting a key through getOwnPropertyDescriptor never
+    // re-ran for an optimistic add or delete, and an isPending() probe over
+    // it witnessed nothing). The value it reports rides the value node's
+    // view through visibleDescriptor.
+    if (pendingCheckActive) witnessAffectsMark(target, key);
+    if (target.fam !== null && getObserver() === null && !inDraft(target)) firewallGate(target);
+    const src = readSource(target);
+    const desc = visibleDescriptor(target, src, key);
+    if (!inDraft(target) && getObserver() !== null) {
+      // The node is born from the source's presence (as `has` births it),
+      // not the override-adjusted answer.
+      let present = key in src;
+      if (present && target.del !== null && src === target.pb && target.del.has(key))
+        present = false;
+      read(getHasNode(target, key, present));
+    }
     if (desc === undefined) return undefined;
     // Array targets carry a real non-configurable `length` the proxy
     // invariant forces us to report faithfully; everything else reports
@@ -5176,8 +6498,10 @@ const traps = {
 };
 /** Low-level setter primitive: opens write mode on a next proxy, runs `fn`,
  * emits write-time notifications at outermost exit, applies returned
- * replacements as adoptions. `guard=false` skips the owned-scope dev guard —
- * projection recomputes legitimately write from inside their computed. */
+ * replacements as adoptions. `guard=false` skips the dev guards (owned-scope
+ * write, thenable result) — projection recomputes legitimately write from
+ * inside their computed, and their async derive is handled by the recompute,
+ * not returned through here. */
 function storeSetterNext(proxy, fn, guard = true) {
   if (guard) devGuardStoreSetterWrite();
   const target = proxy[$TARGET];
@@ -5203,6 +6527,9 @@ function storeSetterNext(proxy, fn, guard = true) {
       for (const t of touched) notifyWrites(t);
     }
   }
+  // After the sync writes have notified (they were real, like an effect's
+  // side effects before its invalid-cleanup throw) and before adoption.
+  if (guard) devGuardStoreSetterResult(result);
   if (result !== undefined && result !== proxy && isWrappable(result)) {
     // Returned replacement: on an optimistic family (outside authoritative
     // writes) the replacement is itself an optimistic edit — diff it against
@@ -5236,7 +6563,18 @@ function createStoreNext(initialValue, shallow = false) {
     proxy[$TARGET].s = true;
     markRawIngest(initialValue);
   }
-  registerGraph(proxy, getOwner());
+  {
+    const owner = getOwner();
+    // Dev-tier graph registration (owner signal lists, onGraph); the
+    // `_owner` write itself never reaches the proxy, see storeOwners.
+    registerGraph(proxy, owner);
+    // Only once the engine is installed, like the node stamping it feeds: a
+    // WeakMap.set per fresh store is a growing ephemeron table (~+35% on the
+    // 2000-store create+commit shape, CodSpeed −11.7% on #3380's first cut)
+    // and, disabled, buys nothing — a store created before enable() has no
+    // excluded owner to inherit either way.
+    if (attrHooks !== null) storeOwners.set(proxy[$TARGET], owner);
+  }
   const setter = fn => storeSetterNext(proxy, fn);
   return [proxy, setter];
 }
@@ -5313,9 +6651,10 @@ function visibleKeys(target, src) {
     (!inDraft(target) || draftSeesOverrides(target))
   ) {
     let set = null;
+    const draft = inDraft(target);
     for (const key of Reflect.ownKeys(target.h)) {
       const node = target.h[key];
-      if (!hasActiveOverride(node)) continue;
+      if (!(draft ? hasActiveOverride(node) : visibleOverride(node))) continue;
       set ??= new Set(keys);
       if (unwrapOverride(node._x?._overrideValue)) set.add(key);
       else set.delete(key);
@@ -5337,7 +6676,7 @@ function visibleDescriptor(target, src, key) {
   }
   if (!authoritativeServe() && target.fam?.opt && !inDraft(target)) {
     const node = target.h?.[key];
-    if (node !== undefined && hasActiveOverride(node)) {
+    if (node !== undefined && visibleOverride(node)) {
       if (!unwrapOverride(node._x?._overrideValue)) return undefined; // opt delete
       if (desc === undefined) {
         const vn = target.n?.[key];
@@ -5978,7 +7317,7 @@ function descend(pv, nv, keyFn, fam, proj = false) {
  * driven from inside an enclosing authoritative-write scope (next-store
  * optimistic derives), and a hard `false` would clobber it mid-derive.
  */
-function wrapDraft(inner, isActive, aroundWrite) {
+function wrapDraft(inner, isActive, aroundWrite, shallow) {
   const write = op => (aroundWrite ? aroundWrite(op) : op());
   const traps = {
     get(_, prop) {
@@ -5992,8 +7331,9 @@ function wrapDraft(inner, isActive, aroundWrite) {
         setWriteOverride(false);
         setProjectionWriteActive(was);
       }
-      if (prop === $TARGET) return value;
-      return typeof value === "object" && value !== null
+      // A shallow store's leaves are raw by contract (#3498): no draft proxy
+      // over them, so identity holds and a frozen leaf is never trapped.
+      return !shallow && typeof value === "object" && value !== null && prop !== $TARGET
         ? wrapDraft(value, isActive, aroundWrite)
         : value;
     },
@@ -6128,21 +7468,27 @@ function createStoreDerivedNext(fn, seed, options) {
     }
   ];
 }
+// A detached copy of projection state: the root container alone for a shallow
+// store — its leaves are raw references by contract and stay so (#3498) — the
+// whole tree otherwise.
+function cloneState(v, shallow) {
+  return shallow ? (Array.isArray(v) ? v.slice() : { ...v }) : JSON.parse(JSON.stringify(v));
+}
 function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, aroundDraftWrite) {
   const owner = getOwner();
+  const target = wrappedStore[$TARGET];
   let settled = false;
   let result;
   // Open loading window (seedLoadingValue): the observable store IS commit #0
   // for the whole first flight — the derive works a detached shadow of the
   // seed so draft writes cannot tear through to readers (#2988). Every commit
   // point reconciles the shadow through the normal commit path.
-  const shadow = owner._loading
-    ? JSON.parse(JSON.stringify(wrappedStore[$TARGET][STORE_VALUE]))
-    : null;
+  const shadow = owner._loading ? cloneState(target[STORE_VALUE], target.s) : null;
   const draft = wrapDraft(
     wrappedStore,
     () => !settled || owner._x?._inFlight === result,
-    aroundDraftWrite
+    aroundDraftWrite,
+    target.s
   );
   storeSetterNext(
     draft,
@@ -6153,7 +7499,7 @@ function runProjectionComputedNext(wrappedStore, fn, key, wrapCommit, aroundDraf
         // Shadow run: commit a detached snapshot, never the shadow itself
         // (adoption takes the value by identity — handing it the live shadow
         // would fuse the draft to the observable store).
-        if (shadow && (v === undefined || v === shadow)) v = JSON.parse(JSON.stringify(shadow));
+        if (shadow && (v === undefined || v === shadow)) v = cloneState(shadow, target.s);
         if (v === s || v === undefined) return;
         const write = () =>
           storeSetterNext(wrappedStore, st => reconcileNextState(v, st, key, true), false);
@@ -6214,7 +7560,10 @@ function installNextBlockedHalf() {
     applyTentative,
     retainsOptimism: transitionHoldsOptimism
   });
-  setNextOptimisticViewResolver((t, raw) => optimisticView(t, raw));
+  // The affects() declaration walk is a WRITER channel (A28 (5)): tagging a
+  // parent covers the record as the writer sees it, this tick's optimistic
+  // writes included — the draft view, not the reader view.
+  setNextOptimisticViewResolver((t, raw) => optimisticView(t, raw, true));
   // Scheduler flush tails call _clearOptimisticStores whenever tracked
   // stores exist; next has no layer to clear — reverts are engine-native —
   // so the hook only empties the batch set.
@@ -6707,7 +8056,7 @@ function notifyOptimisticWrites(t, pb) {
  * Authoritative-view reads (until()'s predicate) skip composition entirely:
  * the predicate observes authoritative truth, never the caller's tentative
  * overlay. (Write-side emission callers never run under such a compute.) */
-function optimisticView(t, src) {
+function optimisticView(t, src, draft = false) {
   if (t.fam?.opt !== true || authoritativeRead()) return src;
   let out = null;
   const ensure = () => (out ??= Array.isArray(src) ? [...src] : { ...src });
@@ -6715,7 +8064,9 @@ function optimisticView(t, src) {
   if (nodes !== null) {
     for (const key of Reflect.ownKeys(nodes)) {
       const node = nodes[key];
-      if (!hasActiveOverride(node)) continue;
+      // A28 (5): readers see an optimistic write once a flush carried it;
+      // the draft (writer channel) composes on it now.
+      if (!(draft ? hasActiveOverride(node) : visibleOverride(node))) continue;
       const ov = unwrapOverride(node._x?._overrideValue);
       if (key === "length" && Array.isArray(src)) {
         if (src.length !== ov) ensure().length = ov;
@@ -6726,7 +8077,9 @@ function optimisticView(t, src) {
   if (has !== null) {
     for (const key of Reflect.ownKeys(has)) {
       const node = has[key];
-      if (!hasActiveOverride(node)) continue;
+      // A28 (5): readers see an optimistic write once a flush carried it;
+      // the draft (writer channel) composes on it now.
+      if (!(draft ? hasActiveOverride(node) : visibleOverride(node))) continue;
       const present = !!unwrapOverride(node._x?._overrideValue);
       if (!present && key in (out ?? src)) delete ensure()[key];
     }
@@ -7680,6 +9033,8 @@ class CollectionQueue extends Queue {
   _initialized = false;
   _onFn;
   _prevOn = ON_INIT;
+  /** The boundary's owner — where a `caught` report locates itself, set before the children are built (a creation-time throw arrives before `_tree`). */
+  _owner;
   constructor(type) {
     super();
     this._collectionType = type;
@@ -7688,20 +9043,47 @@ class CollectionQueue extends Queue {
     if (!type || (read(this._disabled) && (!_revealUsed || read(this._collapsed)))) return;
     return super.run(type);
   }
+  /** The `on` key, or ON_INIT when it throws. Evaluated mid-propagation,
+   * inside the pending node's own pass: read as a spectator so the key's
+   * sources never become that node's dependencies (#3528). */
+  _readOn() {
+    return spectate(() => {
+      try {
+        return this._onFn();
+      } catch {
+        return ON_INIT;
+      }
+    });
+  }
   notify(node, type, flags, error) {
     if (!(type & this._collectionType)) return super.notify(node, type, flags, error);
     if (this._initialized && this._onFn) {
-      const currentOn = untrack(() => {
-        try {
-          return this._onFn();
-        } catch {
-          return ON_INIT;
-        }
-      });
+      const currentOn = this._readOn();
       if (currentOn !== this._prevOn) {
         this._prevOn = currentOn;
         this._initialized = false;
         this._sources.clear();
+        // Readers forwarded while this boundary showed content are behind the
+        // fallback now: they stop blocking (`reporterBlocksSource`), and the
+        // transactions they were holding must be re-judged for it (A33, #3375).
+        // What those readers still wait on is this boundary's to wait on now:
+        // they never re-notify (status propagation dedupes on the reader's
+        // `_pendingSources`), so the reset collects it from their registrations
+        // — the one place a forwarded reader is recorded (INV-3) — or a sibling
+        // reader's flight that lands first reveals them stale (A33, #3459).
+        for (const t of transitions)
+          for (const [source, reporters] of t._asyncReporters)
+            for (const reporter of reporters)
+              if (this._holds(reporter)) {
+                this._sources.add(source);
+                reporter._x?._pendingSources?.forEach(s => this._sources.add(s));
+              }
+        if (this._sources.size) {
+          setSignal(this._disabled, true);
+          if (attrHooks !== null && this._collectionType & STATUS_PENDING)
+            attrHooks.boundaryFallback(this, this._tree, true);
+        }
+        wakeParked();
       }
     }
     // Routing is dimension-independent: each boundary consumes only its own
@@ -7722,19 +9104,47 @@ class CollectionQueue extends Queue {
       if (source) {
         const wasEmpty = this._sources.size === 0;
         this._sources.add(source);
+        // A collecting boundary waits on everything the effect is pending on,
+        // not only the source this notification carries. Status propagation
+        // dedupes on the effect's `_pendingSources`: a source it already
+        // carries (a flight that started before an `on` reset cleared the
+        // set) is never re-reported, and that source's later re-flight
+        // stays invisible — the boundary revealed when its one collected
+        // source settled while the effect was still pending (#3375).
+        if (this._collectionType & STATUS_PENDING)
+          node._x?._pendingSources?.forEach(s => this._sources.add(s));
         if (wasEmpty) {
           setSignal(this._disabled, true);
           if (attrHooks !== null && this._collectionType & STATUS_PENDING)
             attrHooks.boundaryFallback(this, this._tree, true);
         }
         if (this._collectionType & STATUS_ERROR) {
-          setSignal(this._error, unwrapStatusError(source._x?._error));
+          const caught = unwrapStatusError(source._x?._error);
+          setSignal(this._error, caught);
+          // The client error hook: this boundary renders its fallback for
+          // it — the one road a rendered failure took that no global handler
+          // ever saw. `source` is the computation that threw (the status
+          // wrapper's, made at the first landing and kept downstream), so the
+          // hook hears where it broke as well as where it was met. Once per
+          // error object; a `reset()` re-collecting the same failure says
+          // nothing new.
+          reportClientError(caught, this._owner, source);
         }
       }
     }
     type &= ~this._collectionType;
     return type ? super.notify(node, type, flags, error) : true;
   }
+  /** Is `reporter` live and routed to this boundary — under it, with no
+   * collecting pending-type boundary in between (`reporterBlocksSource`'s test)? */
+  _holds(reporter) {
+    if (reporter._flags & (REACTIVE_ZOMBIE | REACTIVE_DISPOSED)) return false;
+    for (let q = reporter._queue; q; q = q._parent) {
+      if (q === this) return true;
+      if (q._collectionType & STATUS_PENDING && !q._initialized) return false;
+    }
+    return false;
+  }
   _checkSources() {
     for (const source of this._sources) {
       // A source with a live affects() mark holds display state for the
@@ -7765,11 +9175,10 @@ class CollectionQueue extends Queue {
         if (attrHooks !== null && this._collectionType & STATUS_PENDING)
           attrHooks.boundaryFallback(this, this._tree, false);
         if (this._onFn) {
-          try {
-            this._prevOn = untrack(() => this._onFn());
-          } catch {
-            /* value not yet committed — _prevOn stays stale, next notify will reset */
-          }
+          // A throw (value not yet committed) leaves _prevOn stale; the next
+          // notify then resets.
+          const on = this._readOn();
+          if (on !== ON_INIT) this._prevOn = on;
         }
       }
     }
@@ -7793,6 +9202,7 @@ function createCollectionBoundary(type, fn, fallback, onFn) {
   const owner = createOwner();
   if (_revealUsed) setContext(RevealControllerContext, null, owner);
   const queue = new CollectionQueue(type);
+  queue._owner = owner;
   if (type === STATUS_ERROR)
     queue._error = signal(undefined, { ownedWrite: true, _noSnapshot: true });
   if (onFn) queue._onFn = onFn;
@@ -8063,13 +9473,22 @@ export {
   $TRACK,
   ContextNotFoundError,
   DEV,
+  MergeView,
   NoOwnerError,
   NotReadyError,
   OBSERVE,
+  OmitView,
+  ROOT_ERROR_HOOK,
+  SOURCE_MEMO,
+  SOURCE_MERGE,
+  SOURCE_OMIT,
+  SOURCE_PLAIN,
+  SOURCE_PROXY,
   SUPPORTS_PROXY,
   TimeoutError,
   action,
   affects,
+  configureClientErrors,
   createContext,
   createEffect,
   createErrorBoundary,
@@ -8093,27 +9512,37 @@ export {
   getContext,
   getObserver,
   getOwner,
+  hasStaticKeys,
   isEqual,
   isPending,
+  isStatic,
   isWrappable,
   latest,
   mapArray,
   merge,
   mergeSources,
+  mergeView,
   omit,
+  omitView,
   onCleanup,
   onSettled,
   reconcile,
   refresh,
   repeat,
   resolve,
+  resolvedTable,
   runWithOwner,
   setContext,
   snapshot,
+  sourceGet,
+  sourceHas,
+  sourceKeys,
+  sourceOwners,
   storeHasFamily,
   storeHasOptimisticFamily,
   storeIsShallow,
   storePath,
   until,
-  untrack
+  untrack,
+  viewOf
 };