diff --git a/.changeset/pre.json b/.changeset/pre.json
index 394de44e8..92df1791e 100644
--- a/.changeset/pre.json
+++ b/.changeset/pre.json
@@ -60,6 +60,7 @@
     "async-waterfall-attribution",
     "attribution-feedback-facts",
     "attribution-feedback-tables",
+    "attribution-navigation-origin",
     "attribution-unstable-memo-output",
     "attribution-wide-write",
     "attribution-write-provenance",
@@ -138,6 +139,7 @@
     "document-action-mutation-navigation-framing",
     "document-control-flow-callback-shapes",
     "document-entry-only-handler-wrap",
+    "document-event-request-contract",
     "document-face-live-holes-client",
     "document-live-slot-args-client",
     "document-shell-hydration-docs",
@@ -193,10 +195,12 @@
     "fix-composed-header-bounds",
     "fix-conditional-async-reveal-pending",
     "fix-content-length-guard-bypass",
+    "fix-contested-effect-rederive",
     "fix-cookie-bounds-and-validity",
     "fix-create-projection-seed-inference",
     "fix-dead-transition-stamp-revival",
     "fix-decoder-collision-orphaned-promise",
+    "fix-deep-chained-view-subscription",
     "fix-deep-optimistic-store-pending",
     "fix-deep-snapshot-held-landing-visibility",
     "fix-derived-event-locals-sharing",
@@ -219,6 +223,7 @@
     "fix-error-carrier-hidden-data-slots",
     "fix-errored-derive-memo-parity",
     "fix-errored-loading-hydration-ids",
+    "fix-finalize-reentry-effect-ownership",
     "fix-flash-url-unbound-base",
     "fix-flatten-needsunwrap-or",
     "fix-flight-owned-transaction",
@@ -364,6 +369,7 @@
     "fix-ssr-async-error-handling",
     "fix-ssr-bench-shape",
     "fix-ssr-errored-async-retry-loop",
+    "fix-ssr-escape-function-results",
     "fix-ssr-loading-errored-hydration",
     "fix-ssr-memo-promise-notready",
     "fix-ssr-owner-id-parity",
@@ -373,6 +379,7 @@
     "fix-ssr-retry-child-reset",
     "fix-ssr-retry-convergence-oom",
     "fix-ssr-server-projection-pending-store",
+    "fix-ssr-spread-children-read-once",
     "fix-ssr-stream-rejected-fragment-hang",
     "fix-ssr-sync-memo-child-id-leak",
     "fix-ssr-textarea-spread-value",
@@ -433,6 +440,7 @@
     "gate-child-companion-walk",
     "gate-invariants-to-test-builds",
     "get-read-contract",
+    "golf-effect-ownership-flag",
     "graph-size-diagnostics",
     "guard-error-carried-failure-channels",
     "guard-failures-iterative-walk",
@@ -503,6 +511,8 @@
     "nohydration-lazy-maparray-deps",
     "notready-skip-stack-capture",
     "npm-descriptions",
+    "observe-node-shapes",
+    "observe-tier",
     "optimistic-draft-reads-compose-over-staged-truth",
     "optimistic-landing-fold",
     "optimistic-lists-drivable",
@@ -560,6 +570,7 @@
     "rc-api-freeze-pass",
     "reaction-rearm-replaces",
     "read-every-body-the-transport-tees",
+    "rebuild-buffered-request-from-parts",
     "reconcile-array-object-shape-guard",
     "reconcile-default-id-positional-null",
     "reconcile-symbol-keyed-nodes",
@@ -581,12 +592,14 @@
     "refresh-lifts-stale-manual-write-mask",
     "refreshable-type-alias",
     "refusals-commit-event-stub",
+    "refuse-flush-in-action-body",
     "refuse-invalid-wrap-invocation-values",
     "refuse-unknown-body-format-tags-as-version-skew",
     "refuse-unstorable-flash-cookies",
     "register-settle-walk-diagnostic-code",
     "relocate-uninit-lane-check",
     "remove-capturing-event-listeners",
+    "remove-cjs",
     "remove-create-effect-single-argument-overload",
     "remove-derived-initial-values",
     "remove-dist-exports-and-fix-dual-types",
@@ -605,6 +618,7 @@
     "republish-fresh-signals-build",
     "require-client-source-commit-zero",
     "require-seroval-1-5-4",
+    "require-seroval-1-6",
     "response-head-lifecycle",
     "responsive-preload-links",
     "reveal-order-prop",
@@ -718,6 +732,7 @@
     "tighten-show-match-jsx-types",
     "tiny-lions-jam",
     "track-applied-classes",
+    "tracked-style-class-objects",
     "transform-result-sees-thrown-errors",
     "transparent-devcomponent",
     "transparent-effect-option-typed",
diff --git a/packages/babel-plugin/CHANGELOG.md b/packages/babel-plugin/CHANGELOG.md
index 024295b9f..fc60057ea 100644
--- a/packages/babel-plugin/CHANGELOG.md
+++ b/packages/babel-plugin/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @solidjs/babel-plugin
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+  `<Show when={s}>{s}</Show>`, `<For>{v => v}</For>`, `<Dynamic component={() => s} />`,
+  `<Switch>/<Match>`, boundary fallbacks and any component that returns a string through a
+  memo rendered that string raw on the server. The server flow controls return memos for
+  hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+  appended whatever they later produced without escaping.
+
+  One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+  items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+  Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+  escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+  `_$escape` (they are values; escaping them too double-escaped through
+  `<Comp>{props.children}</Comp>`), and a single-expression fragment at a hole keeps the
+  hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+  frames behave as before.
+
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+  `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/babel-plugin/package.json b/packages/babel-plugin/package.json
index fdf651f29..8b5c5ed8c 100644
--- a/packages/babel-plugin/package.json
+++ b/packages/babel-plugin/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/babel-plugin",
   "description": "Babel compiler plugin for Solid templates",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "repository": {
diff --git a/packages/compiler/CHANGELOG.md b/packages/compiler/CHANGELOG.md
index 16f32d77c..d058d7712 100644
--- a/packages/compiler/CHANGELOG.md
+++ b/packages/compiler/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @solidjs/compiler
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+  `<Show when={s}>{s}</Show>`, `<For>{v => v}</For>`, `<Dynamic component={() => s} />`,
+  `<Switch>/<Match>`, boundary fallbacks and any component that returns a string through a
+  memo rendered that string raw on the server. The server flow controls return memos for
+  hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+  appended whatever they later produced without escaping.
+
+  One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+  items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+  Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+  escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+  `_$escape` (they are values; escaping them too double-escaped through
+  `<Comp>{props.children}</Comp>`), and a single-expression fragment at a hole keeps the
+  hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+  frames behave as before.
+
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+  `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/compiler/npm/darwin-arm64/package.json b/packages/compiler/npm/darwin-arm64/package.json
index 9cb4a2476..d427695d2 100644
--- a/packages/compiler/npm/darwin-arm64/package.json
+++ b/packages/compiler/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-darwin-arm64",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "arm64"
   ],
diff --git a/packages/compiler/npm/darwin-x64/package.json b/packages/compiler/npm/darwin-x64/package.json
index bb9173c0b..8e046f74f 100644
--- a/packages/compiler/npm/darwin-x64/package.json
+++ b/packages/compiler/npm/darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-darwin-x64",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "x64"
   ],
diff --git a/packages/compiler/npm/linux-arm64-gnu/package.json b/packages/compiler/npm/linux-arm64-gnu/package.json
index cf6cd0c6c..2b5207267 100644
--- a/packages/compiler/npm/linux-arm64-gnu/package.json
+++ b/packages/compiler/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-linux-arm64-gnu",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "arm64"
   ],
diff --git a/packages/compiler/npm/linux-x64-gnu/package.json b/packages/compiler/npm/linux-x64-gnu/package.json
index af9123905..af8dd9847 100644
--- a/packages/compiler/npm/linux-x64-gnu/package.json
+++ b/packages/compiler/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-linux-x64-gnu",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "x64"
   ],
diff --git a/packages/compiler/npm/wasm32-wasi/package.json b/packages/compiler/npm/wasm32-wasi/package.json
index a83cb3398..2749a8050 100644
--- a/packages/compiler/npm/wasm32-wasi/package.json
+++ b/packages/compiler/npm/wasm32-wasi/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-wasm32-wasi",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "main": "compiler.wasi.cjs",
   "files": [
     "compiler.wasm32-wasi.wasm",
diff --git a/packages/compiler/npm/win32-x64-msvc/package.json b/packages/compiler/npm/win32-x64-msvc/package.json
index 4daaeaa0f..270f4c33e 100644
--- a/packages/compiler/npm/win32-x64-msvc/package.json
+++ b/packages/compiler/npm/win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-win32-x64-msvc",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "x64"
   ],
diff --git a/packages/compiler/package.json b/packages/compiler/package.json
index 00d83514d..6ffbd670d 100644
--- a/packages/compiler/package.json
+++ b/packages/compiler/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/compiler",
   "description": "Solid's native Oxc JSX compiler",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "repository": {
@@ -62,11 +62,11 @@
     "emnapi": "^1.11.3"
   },
   "optionalDependencies": {
-    "@solidjs/compiler-darwin-x64": "2.0.0-rc.7",
-    "@solidjs/compiler-darwin-arm64": "2.0.0-rc.7",
-    "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.7",
-    "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.7",
-    "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.7",
-    "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.7"
+    "@solidjs/compiler-darwin-x64": "2.0.0-rc.8",
+    "@solidjs/compiler-darwin-arm64": "2.0.0-rc.8",
+    "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.8",
+    "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.8",
+    "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.8",
+    "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.8"
   }
 }
diff --git a/packages/diagnostics/CHANGELOG.md b/packages/diagnostics/CHANGELOG.md
index 743343367..9145d3612 100644
--- a/packages/diagnostics/CHANGELOG.md
+++ b/packages/diagnostics/CHANGELOG.md
@@ -1,5 +1,66 @@
 # @solidjs/diagnostics
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+  **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+  — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+  `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+  `getParent`/`getSources`/`getObservers`) and gains the console face
+  (`DEV.report`, `DEV.setConsoleFooter` — formerly
+  `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+  and `solid-js` (client and server).
+
+  **Breaking (pre-release):** the attribution engine is its own entry.
+  `DEV.attribution.enable()` and friends are now
+  `import { attribution } from "solid-js/attribution"` (or
+  `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+  plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+  `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+  core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+  slot an engine — built-in or a devtools' own — installs into) and
+  `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+  dispatch; `fn()` when no engine is installed). A build that never imports the
+  engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+  CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+  every tier — prod resolves an inert engine with the same surface.
+  `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+  works against observe builds.
+
+  **New build tier.** Every package with wiring ships `<entry>.observe.{js,cjs}`
+  beside its prod and dev artifacts, selected by a new `observe` export condition
+  (listed after `development`, so dev still wins when both are set): signals
+  `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+  beside `index`; the flat dev/CJS builds are code-split so both entries share
+  one module instance), solid-js `solid.observe.*` and
+  `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+  Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+  memo names, component roots), graph edge counters and the diagnostics channel;
+  they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+  brands and all console output. Entries without wiring (frames, server-functions,
+  storage, h, html, element) fall through to prod under `observe`. Signals gates
+  on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+  on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+  from the new `OBSERVE = undefined` export; `_name` is reserved from property
+  mangling so the cross-package label survives in the observe tree.
+  `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+  owners are not signals' owners (the SSR runtime).
+
+- Updated dependencies [21c5460]
+- Updated dependencies [1354a53]
+- Updated dependencies [ae0ec3f]
+- Updated dependencies [1c9e9e7]
+- Updated dependencies [05725e8]
+- Updated dependencies [2fa7539]
+- Updated dependencies [1807f7f]
+- Updated dependencies [3a5fe8c]
+- Updated dependencies [a39415c]
+  - @solidjs/signals@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/diagnostics/package.json b/packages/diagnostics/package.json
index 7998722e8..5050b9b0d 100644
--- a/packages/diagnostics/package.json
+++ b/packages/diagnostics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/diagnostics",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "description": "Agent-consumable diagnostics harness for Solid: capture the dev-mode diagnostic and attribution channels as structured artifacts, with assertion helpers for tests and agent loops.",
   "author": "Ryan Carniato",
   "license": "MIT",
@@ -52,7 +52,7 @@
     "test:watch": "vitest watch tests"
   },
   "dependencies": {
-    "@solidjs/signals": "^2.0.0-rc.7"
+    "@solidjs/signals": "^2.0.0-rc.8"
   },
   "peerDependencies": {
     "vitest": ">=2.0.0"
diff --git a/packages/element/CHANGELOG.md b/packages/element/CHANGELOG.md
index 4d379ee49..96beee8d8 100644
--- a/packages/element/CHANGELOG.md
+++ b/packages/element/CHANGELOG.md
@@ -1,5 +1,20 @@
 # solid-element
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- Updated dependencies [9e6c867]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [ab4c40c]
+  - @solidjs/web@2.0.0-rc.8
+  - solid-js@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/element/package.json b/packages/element/package.json
index db10fb65a..f0f953103 100644
--- a/packages/element/package.json
+++ b/packages/element/package.json
@@ -3,7 +3,7 @@
   "description": "Webcomponents wrapper for Solid",
   "author": "Ryan Carniato",
   "license": "MIT",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "homepage": "https://github.com/solidjs/solid/blob/main/packages/element#readme",
   "repository": {
     "type": "git",
@@ -30,8 +30,8 @@
     "component-register": "^0.8.7"
   },
   "peerDependencies": {
-    "solid-js": "^2.0.0-rc.7",
-    "@solidjs/web": "^2.0.0-rc.7"
+    "solid-js": "^2.0.0-rc.8",
+    "@solidjs/web": "^2.0.0-rc.8"
   },
   "devDependencies": {
     "solid-js": "workspace:*",
diff --git a/packages/h/CHANGELOG.md b/packages/h/CHANGELOG.md
index b8b6d26cd..85a824760 100644
--- a/packages/h/CHANGELOG.md
+++ b/packages/h/CHANGELOG.md
@@ -1,5 +1,31 @@
 # @solidjs/h
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+  Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+  For consumers:
+  - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+  - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+  - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+  - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+  `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- Updated dependencies [9e6c867]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [ab4c40c]
+  - @solidjs/web@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/h/package.json b/packages/h/package.json
index 649b15228..e58637b55 100644
--- a/packages/h/package.json
+++ b/packages/h/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/h",
   "description": "Hyperscript / h() factory for Solid — write components without compiled JSX.",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "homepage": "https://solidjs.com",
@@ -58,7 +58,7 @@
     "test": "vitest run"
   },
   "peerDependencies": {
-    "@solidjs/web": "^2.0.0-rc.7"
+    "@solidjs/web": "^2.0.0-rc.8"
   },
   "devDependencies": {
     "@solidjs/web": "workspace:*",
diff --git a/packages/html/CHANGELOG.md b/packages/html/CHANGELOG.md
index 9c78f6656..69169c162 100644
--- a/packages/html/CHANGELOG.md
+++ b/packages/html/CHANGELOG.md
@@ -1,5 +1,31 @@
 # @solidjs/html
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+  Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+  For consumers:
+  - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+  - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+  - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+  - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+  `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- Updated dependencies [9e6c867]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [ab4c40c]
+  - @solidjs/web@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/html/package.json b/packages/html/package.json
index 964d2004d..1e2e5f253 100644
--- a/packages/html/package.json
+++ b/packages/html/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/html",
   "description": "Tagged-template-literal templating for Solid — write components with no build step.",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "homepage": "https://solidjs.com",
@@ -42,7 +42,7 @@
     "test": "vitest run"
   },
   "peerDependencies": {
-    "@solidjs/web": "^2.0.0-rc.7"
+    "@solidjs/web": "^2.0.0-rc.8"
   },
   "devDependencies": {
     "@solidjs/web": "workspace:*",
diff --git a/packages/signals/CHANGELOG.md b/packages/signals/CHANGELOG.md
index 695431257..40b3fa8b4 100644
--- a/packages/signals/CHANGELOG.md
+++ b/packages/signals/CHANGELOG.md
@@ -1,5 +1,117 @@
 # @solidjs/signals
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 21c5460: Router-agnostic navigation attribution: `OBSERVE.attribution.withOrigin({ kind: "navigation", name, to, from, params }, fn)`
+
+  A navigation in Solid 2 is a plain write to the location; the runtime already sees everything it costs (the hold behind route data, the re-runs, the silence) but not that the writes were a navigation, or to which route. `withOrigin` is the seam where a router says so, around its write — the one router-specific line, living in the router. From it the attribution engine:
+  - stamps the writes with a `navigation` origin (new `ChangeOrigin.kind`, with `name`/`to`/`from`/`params`), nested under the enclosing interaction — including through an action step — so cause chains read `— navigation to /users/:id (under click on a.nav "Alice")`;
+  - names holds by route: `HoldEvent.origin`, `SILENT_HOLD`/`LONG_HOLD` messages that start from the navigation, and `data.navigation` on the event;
+  - keeps one `NavigationEvent` per frame (`attribution.navigations()`), settled exactly once as `committed` (a plain drain took the writes), `held` (with the `HoldEvent` attached), or `superseded` (a later write replaced them before they landed);
+  - folds settled navigations per route into `feedback().navigations`.
+
+  The ref is read late on purpose. `name`/`to`/`params` are re-read from the object when the navigation settles, so a router whose match is coarse at write time (a lazy route subtree resolving inside the hold) assigns the exact pattern onto the same object and every consumer reads it — no second API. A redirect is declared with `redirect: n` (the hop depth routers already track) and folds onto the pending navigation instead of opening one: one record, timed from the user's request, the abandoned destination kept in `NavigationEvent.redirects`, `feedback().navigations[].redirected` counting them, and `formatOrigin` reading `navigation to /login (redirected from /users/42)`.
+
+  Hold census fix: a `latest()`/`isPending()` companion now counts as acknowledgement only when an effect reads it, through however many memos. Memos compute eagerly, so a router's internal `createMemo(() => isPending(location))` used to clear `SILENT_HOLD` for every navigation whether or not anything rendered it.
+
+  One new core hook, `flushEnd`, fires once per `flush()` drain so the engine has the "committed and effects ran" instant for writes no transition held. Prod builds are unchanged (the hook site folds out; only the inert attribution twin gained the new empty queries).
+
+- 1354a53: Fix a render effect that reads sources written by two concurrent, non-entangled transactions committing the wrong value and then never updating (#3322). Effects have one value slot and do not entangle transactions, so the second transaction's recompute overwrote the value the first still owed a run for; the first's silent commit then published it, and the second found nothing left to run. Such effects are now re-derived against the committed world at each owed commit, ahead of the effect phase. The same mechanism covers a mainline recompute of an effect a live transaction had computed (the transaction's commit re-derives it), and render effects recomputing with no transaction active no longer see a foreign transaction's staged signal through the read fast path — the mask the slow path already applied.
+- ae0ec3f: Fix `deep()` over optimistic and derived stores missing writes it should hear, and derived views churning row identities under an optimistic overlay (#3323).
+  - `deep(view)` / `deep(view[i])` over a derived view — `createOptimisticStore(base)` or a projection whose backing is another store — never re-ran when the base store was written, while per-key reads on the same view did. A view's targets chain to the inner store's proxies and base writes bump the inner record's witness nodes; the walk never subscribed them, and it resolved children to fresh non-chained wrappers of the base raw instead of the chained row targets the view serves. The walk now reads through the whole chain and resolves children to the targets the get trap would serve.
+  - `deep()` over any optimistic store was deaf to every write on a row added under a held action: the row lives in presence/value overrides, not the committed backing, and the walk enumerated the raw backing. The `ownKeys` / `getOwnPropertyDescriptor` trap bodies are now shared helpers the walk uses, so the walk sees exactly what readers see.
+  - A derived view's untouched rows came back as fresh proxies for the life of an optimistic action (`view.map(r => r)` was O(n) new identities per action) and snapped back at settle. The optimistic diff compared the inner store's child proxies to the draft's raws and marked every row changed; it now compares unwrapped values. Chained targets serving from a pending backing resolve inner-owned raws to the inner proxy before wrapping, and `snapshot()` composes outer overrides below the root.
+
+  Only `deep()`, the chained-view read path, and the optimistic diff changed; plain-store reads and writes are unaffected.
+
+- 1c9e9e7: Fix a held transaction being re-entered while an unrelated flush finalizes — through a store commit hook (`deep()` readers of a projection), a boundary check, or a recompute — and that flush then committing the transaction's state and running its effects as if it still owned the batch, leaving the UI permanently stale once the transaction settled (#3319). Finalization now captures the batch it started with and settles nothing an entered transaction adopted (a completing transaction still settles its own separate containers). Effects follow ownership: a run is applied by the commit of the transaction that computed its value, so the entering flush still applies everything it computed mainline — the write that caused it reads and renders together — while runs owned by the still-held transaction park with it and release when it completes. Optimistic lanes are unaffected; they apply their own effects ahead of their transaction by design.
+- 05725e8: Trim the #3319/#3322 fixes: `runEffect` reads `activeTransition` directly instead of a `parkHeldOwners` flag toggled around the ordinary effect phase (lane runners and the creation-time immediate run mark themselves exempt with `LANE_RUN`), and `contestEffect` is inlined into its single call site in `recompute`. Behavior-identical; -41 B minified on the core floor.
+- 2fa7539: Observe tier: no post-construction fields on reactive nodes.
+
+  The observe build stamped `_name` on every node, `_owner` on `createSignal`
+  nodes and live `_subCount`/`_depCount` edge counters on linked nodes after the
+  node literal — exactly the hidden-class transitions the prod literals are
+  shaped to avoid. Measured against prod on the reactivity benchmark the tier
+  cost +15% overall with creation tests 2–3× under polymorphic load.
+  - Node factories (`computed`, `createEffectNode`, `signal`, `slotSignal`,
+    `createOwner`) now have two literals selected at build time: prod, and
+    observe = prod plus its `_name` slot (`_owner` too on signals). Default
+    labels (`signal`, `computed`, `effect`, `trackedEffect`) come from the
+    literal, so the `createEffect`/`createRenderEffect`/`createTrackedEffect`
+    wrappers no longer spread a fresh options object per effect to inject one.
+    A dist test pins observe's key set to prod's plus the slots.
+  - Edge counters are gone. `HUGE_FAN_OUT` is counted by the notify walk a
+    committed change already makes over its subscribers, `HUGE_FAN_IN` by one
+    walk of the recompute's trimmed dep list at the end of the pass.
+    Both therefore fire on the work — the change / the recompute — rather than
+    on the link, once per node and again after +500 growth (a WeakMap, not a
+    node field). `WIDE_WRITE` (engine) counts the subscriber list on the write
+    and hands over to `HUGE_FAN_OUT` at 2000, so a change never carries both.
+    Messages: "changed with N subscribers" / "tracked N sources".
+  - Prod artifacts are unchanged apart from removing a leftover
+    `...(false ? {...} : options)` spread in `createEffect`.
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+  **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+  — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+  `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+  `getParent`/`getSources`/`getObservers`) and gains the console face
+  (`DEV.report`, `DEV.setConsoleFooter` — formerly
+  `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+  and `solid-js` (client and server).
+
+  **Breaking (pre-release):** the attribution engine is its own entry.
+  `DEV.attribution.enable()` and friends are now
+  `import { attribution } from "solid-js/attribution"` (or
+  `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+  plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+  `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+  core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+  slot an engine — built-in or a devtools' own — installs into) and
+  `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+  dispatch; `fn()` when no engine is installed). A build that never imports the
+  engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+  CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+  every tier — prod resolves an inert engine with the same surface.
+  `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+  works against observe builds.
+
+  **New build tier.** Every package with wiring ships `<entry>.observe.{js,cjs}`
+  beside its prod and dev artifacts, selected by a new `observe` export condition
+  (listed after `development`, so dev still wins when both are set): signals
+  `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+  beside `index`; the flat dev/CJS builds are code-split so both entries share
+  one module instance), solid-js `solid.observe.*` and
+  `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+  Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+  memo names, component roots), graph edge counters and the diagnostics channel;
+  they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+  brands and all console output. Entries without wiring (frames, server-functions,
+  storage, h, html, element) fall through to prod under `observe`. Signals gates
+  on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+  on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+  from the new `OBSERVE = undefined` export; `_name` is reserved from property
+  mangling so the cross-package label survives in the observe tree.
+  `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+  owners are not signals' owners (the SSR runtime).
+
+- 3a5fe8c: Refuse `flush()` inside an action body. An action's writes are held by its transaction until it settles, so a flush can't reveal them — and the drain loop only exits once the ambient transition is cleared, so it parked the transaction mid-slice and every write that followed in the body landed as a plain, committed write, visible before the action finished. DEV now throws `FLUSH_IN_ACTION`; prod skips the drain (the `flush(fn)` form still runs `fn`). The same drain inside `restoreTransition` is skipped when a nested action resumes synchronously inside an outer body, which had the same leak.
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+  Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+  For consumers:
+  - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+  - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+  - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+  - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+  `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/signals/package.json b/packages/signals/package.json
index 6dcd7e30c..410c17506 100644
--- a/packages/signals/package.json
+++ b/packages/signals/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/signals",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "description": "Solid's reactive primitives: signals, memos, effects, stores, and async-aware computations.",
   "author": "Ryan Carniato",
   "license": "MIT",
diff --git a/packages/solid/CHANGELOG.md b/packages/solid/CHANGELOG.md
index c8ebbb600..da467e016 100644
--- a/packages/solid/CHANGELOG.md
+++ b/packages/solid/CHANGELOG.md
@@ -1,5 +1,96 @@
 # solid-js
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+  `<Show when={s}>{s}</Show>`, `<For>{v => v}</For>`, `<Dynamic component={() => s} />`,
+  `<Switch>/<Match>`, boundary fallbacks and any component that returns a string through a
+  memo rendered that string raw on the server. The server flow controls return memos for
+  hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+  appended whatever they later produced without escaping.
+
+  One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+  items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+  Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+  escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+  `_$escape` (they are values; escaping them too double-escaped through
+  `<Comp>{props.children}</Comp>`), and a single-expression fragment at a hole keeps the
+  hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+  frames behave as before.
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+  **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+  — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+  `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+  `getParent`/`getSources`/`getObservers`) and gains the console face
+  (`DEV.report`, `DEV.setConsoleFooter` — formerly
+  `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+  and `solid-js` (client and server).
+
+  **Breaking (pre-release):** the attribution engine is its own entry.
+  `DEV.attribution.enable()` and friends are now
+  `import { attribution } from "solid-js/attribution"` (or
+  `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+  plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+  `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+  core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+  slot an engine — built-in or a devtools' own — installs into) and
+  `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+  dispatch; `fn()` when no engine is installed). A build that never imports the
+  engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+  CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+  every tier — prod resolves an inert engine with the same surface.
+  `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+  works against observe builds.
+
+  **New build tier.** Every package with wiring ships `<entry>.observe.{js,cjs}`
+  beside its prod and dev artifacts, selected by a new `observe` export condition
+  (listed after `development`, so dev still wins when both are set): signals
+  `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+  beside `index`; the flat dev/CJS builds are code-split so both entries share
+  one module instance), solid-js `solid.observe.*` and
+  `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+  Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+  memo names, component roots), graph edge counters and the diagnostics channel;
+  they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+  brands and all console output. Entries without wiring (frames, server-functions,
+  storage, h, html, element) fall through to prod under `observe`. Signals gates
+  on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+  on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+  from the new `OBSERVE = undefined` export; `_name` is reserved from property
+  mangling so the cross-package label survives in the observe tree.
+  `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+  owners are not signals' owners (the SSR runtime).
+
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+  Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+  For consumers:
+  - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+  - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+  - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+  - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+  `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- 8cfa272: Require `seroval` and `seroval-plugins` `~1.6.7` (minor-locked, as before). Seroval 1.6 ships bundled declarations with no extensionless relative imports, so the `@solidjs/web` `server-functions`, `serialization` and `frames` type surfaces now type-check under `module: NodeNext` from a CommonJS project without `skipLibCheck` — the packaged-types check covers every public `@solidjs/web` specifier.
+- Updated dependencies [21c5460]
+- Updated dependencies [1354a53]
+- Updated dependencies [ae0ec3f]
+- Updated dependencies [1c9e9e7]
+- Updated dependencies [05725e8]
+- Updated dependencies [2fa7539]
+- Updated dependencies [1807f7f]
+- Updated dependencies [3a5fe8c]
+- Updated dependencies [a39415c]
+  - @solidjs/signals@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/solid/package.json b/packages/solid/package.json
index 0aec08869..dfbde2a2d 100644
--- a/packages/solid/package.json
+++ b/packages/solid/package.json
@@ -1,7 +1,7 @@
 {
   "name": "solid-js",
   "description": "Reactive JavaScript library for building user interfaces. Compiles JSX to real DOM with fine-grained signal-based updates — no virtual DOM.",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "homepage": "https://solidjs.com",
@@ -123,7 +123,7 @@
     "performance"
   ],
   "dependencies": {
-    "@solidjs/signals": "^2.0.0-rc.7",
+    "@solidjs/signals": "^2.0.0-rc.8",
     "csstype": "^3.1.0",
     "seroval": "~1.6.7",
     "seroval-plugins": "~1.6.7"
diff --git a/packages/test-integration/CHANGELOG.md b/packages/test-integration/CHANGELOG.md
index b5b6aad81..62888c94e 100644
--- a/packages/test-integration/CHANGELOG.md
+++ b/packages/test-integration/CHANGELOG.md
@@ -1,5 +1,32 @@
 # test-integration
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- Updated dependencies [21c5460]
+- Updated dependencies [9e6c867]
+- Updated dependencies [1354a53]
+- Updated dependencies [ae0ec3f]
+- Updated dependencies [1c9e9e7]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [05725e8]
+- Updated dependencies [2fa7539]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [3a5fe8c]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [ab4c40c]
+  - @solidjs/signals@2.0.0-rc.8
+  - @solidjs/web@2.0.0-rc.8
+  - solid-js@2.0.0-rc.8
+  - @solidjs/babel-plugin@2.0.0-rc.8
+  - @solidjs/universal@2.0.0-rc.8
+  - @solidjs/h@2.0.0-rc.8
+  - @solidjs/html@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/test-integration/package.json b/packages/test-integration/package.json
index 4a76ad58f..6b07ae503 100644
--- a/packages/test-integration/package.json
+++ b/packages/test-integration/package.json
@@ -21,5 +21,5 @@
     "gitly": "^2.2.1",
     "shelljs": "^0.8.5"
   },
-  "version": "2.0.0-rc.7"
+  "version": "2.0.0-rc.8"
 }
diff --git a/packages/universal/CHANGELOG.md b/packages/universal/CHANGELOG.md
index d17cd54ac..d8b100e72 100644
--- a/packages/universal/CHANGELOG.md
+++ b/packages/universal/CHANGELOG.md
@@ -1,5 +1,73 @@
 # @solidjs/universal
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+  **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+  — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+  `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+  `getParent`/`getSources`/`getObservers`) and gains the console face
+  (`DEV.report`, `DEV.setConsoleFooter` — formerly
+  `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+  and `solid-js` (client and server).
+
+  **Breaking (pre-release):** the attribution engine is its own entry.
+  `DEV.attribution.enable()` and friends are now
+  `import { attribution } from "solid-js/attribution"` (or
+  `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+  plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+  `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+  core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+  slot an engine — built-in or a devtools' own — installs into) and
+  `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+  dispatch; `fn()` when no engine is installed). A build that never imports the
+  engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+  CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+  every tier — prod resolves an inert engine with the same surface.
+  `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+  works against observe builds.
+
+  **New build tier.** Every package with wiring ships `<entry>.observe.{js,cjs}`
+  beside its prod and dev artifacts, selected by a new `observe` export condition
+  (listed after `development`, so dev still wins when both are set): signals
+  `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+  beside `index`; the flat dev/CJS builds are code-split so both entries share
+  one module instance), solid-js `solid.observe.*` and
+  `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+  Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+  memo names, component roots), graph edge counters and the diagnostics channel;
+  they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+  brands and all console output. Entries without wiring (frames, server-functions,
+  storage, h, html, element) fall through to prod under `observe`. Signals gates
+  on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+  on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+  from the new `OBSERVE = undefined` export; `_name` is reserved from property
+  mangling so the cross-package label survives in the observe tree.
+  `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+  owners are not signals' owners (the SSR runtime).
+
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+  Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+  For consumers:
+  - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+  - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+  - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+  - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+  `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- Updated dependencies [7d985b6]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+  - solid-js@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/universal/package.json b/packages/universal/package.json
index c5dd6d3a0..025361629 100644
--- a/packages/universal/package.json
+++ b/packages/universal/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/universal",
   "description": "Solid's universal runtime for creating custom renderers",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "homepage": "https://solidjs.com",
@@ -51,7 +51,7 @@
     "test": "vitest run"
   },
   "peerDependencies": {
-    "solid-js": "^2.0.0-rc.7"
+    "solid-js": "^2.0.0-rc.8"
   },
   "devDependencies": {
     "solid-js": "workspace:*"
diff --git a/packages/web/CHANGELOG.md b/packages/web/CHANGELOG.md
index 99ff4c5e4..75ab303bd 100644
--- a/packages/web/CHANGELOG.md
+++ b/packages/web/CHANGELOG.md
@@ -1,5 +1,98 @@
 # @solidjs/web
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 9e6c867: Document the `createEvent(request)` contract: the request is a standards-shaped `Request` and nothing more. Body-size enforcement may hand a rebuilt `Request`, so host-specific fields on the inbound object are not carried; hosts surface platform handles on the event from their own request.
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+  `<Show when={s}>{s}</Show>`, `<For>{v => v}</For>`, `<Dynamic component={() => s} />`,
+  `<Switch>/<Match>`, boundary fallbacks and any component that returns a string through a
+  memo rendered that string raw on the server. The server flow controls return memos for
+  hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+  appended whatever they later produced without escaping.
+
+  One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+  items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+  Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+  escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+  `_$escape` (they are values; escaping them too double-escaped through
+  `<Comp>{props.children}</Comp>`), and a single-expression fragment at a hole keeps the
+  hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+  frames behave as before.
+
+- 3b4db21: Fix an rc.7 SSR hydration regression: a self-closing element that spreads props containing `children` (`<a {...props} />` in a wrapper component) read the compiled `children` getter twice on the server, building the child element twice and consuming a hydration id the client never allocates. Every element after the first such spread then hydrated against the wrong node and the client halted. `ssrElement` again reads each spread key at most once and never reads `children` when JSX children are present; the textarea `value`/`defaultValue`-as-content behaviour from #3286 is preserved.
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+  **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+  — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+  `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+  `getParent`/`getSources`/`getObservers`) and gains the console face
+  (`DEV.report`, `DEV.setConsoleFooter` — formerly
+  `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+  and `solid-js` (client and server).
+
+  **Breaking (pre-release):** the attribution engine is its own entry.
+  `DEV.attribution.enable()` and friends are now
+  `import { attribution } from "solid-js/attribution"` (or
+  `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+  plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+  `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+  core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+  slot an engine — built-in or a devtools' own — installs into) and
+  `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+  dispatch; `fn()` when no engine is installed). A build that never imports the
+  engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+  CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+  every tier — prod resolves an inert engine with the same surface.
+  `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+  works against observe builds.
+
+  **New build tier.** Every package with wiring ships `<entry>.observe.{js,cjs}`
+  beside its prod and dev artifacts, selected by a new `observe` export condition
+  (listed after `development`, so dev still wins when both are set): signals
+  `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+  beside `index`; the flat dev/CJS builds are code-split so both entries share
+  one module instance), solid-js `solid.observe.*` and
+  `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+  Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+  memo names, component roots), graph edge counters and the diagnostics channel;
+  they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+  brands and all console output. Entries without wiring (frames, server-functions,
+  storage, h, html, element) fall through to prod under `observe`. Signals gates
+  on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+  on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+  from the new `OBSERVE = undefined` export; `_name` is reserved from property
+  mangling so the cross-package label survives in the observe tree.
+  `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+  owners are not signals' owners (the SSR runtime).
+
+- a71e42e: Rebuild the buffered server-function request from its url, method, headers and signal instead of through the `Request` copy constructor, so a host adapter's lazy request (Nitro via srvx) no longer fails every POST with 400 "Malformed server function arguments"; only a failed upload read answers 400 now, a failure to put the bytes back surfaces as its own error.
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+  Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+  For consumers:
+  - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+  - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+  - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+  - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+  `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- 8cfa272: Require `seroval` and `seroval-plugins` `~1.6.7` (minor-locked, as before). Seroval 1.6 ships bundled declarations with no extensionless relative imports, so the `@solidjs/web` `server-functions`, `serialization` and `frames` type surfaces now type-check under `module: NodeNext` from a CommonJS project without `skipLibCheck` — the packaged-types check covers every public `@solidjs/web` specifier.
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+  `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
+- Updated dependencies [7d985b6]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+  - solid-js@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes
diff --git a/packages/web/package.json b/packages/web/package.json
index 83b811a53..f5321fcef 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/web",
   "description": "Solid's web runtime: client rendering, hydration, SSR, and DOM-specific control flow (Portal, Dynamic).",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "homepage": "https://solidjs.com",
@@ -235,7 +235,7 @@
     "seroval-plugins": "~1.6.7"
   },
   "peerDependencies": {
-    "solid-js": "^2.0.0-rc.7"
+    "solid-js": "^2.0.0-rc.8"
   },
   "devDependencies": {
     "@codspeed/vitest-plugin": "^5.4.0",