@sanity/workflow-engine 0.15.0 → 0.17.0

package/dist/index.d.cts

@@ -1,5 +1,6 @@
 import { analyzeCondition } from "@sanity/groq-condition-describe";
 import { AtomInsight } from "@sanity/groq-condition-describe";
+import { atomReadsDataset } from "@sanity/groq-condition-describe";
 import { AtomRequirement } from "@sanity/groq-condition-describe";
 import { checklistLines as checklistLines_2 } from "@sanity/groq-condition-describe";
 import { ComparisonOp } from "@sanity/groq-condition-describe";
@@ -40,15 +41,16 @@ export declare function abortReason(
 
 /**
  * The structured half of applicability: does a required subject entry
- * (`doc.ref` / `doc.refs`, workflow scope) accept `documentType`? Name-blind
- * and EXISTENTIAL: ANY required ref entry counts — a multi-input definition
- * (say, contract + counterparty) surfaces from either document's picker, and
- * the start dialog collects the remaining required entries (their fail-hard
- * validation backstops). An entry without `types` accepts any type; a
- * definition with NO required ref entry takes no subject and never matches.
- * Cheap and indexable — no GROQ evaluation — so a consumer can pre-filter
- * before loading document content. (`required` is pinned to caller-filled
- * `input` entries by a deploy invariant, so it alone identifies the handoff.)
+ * ({@link isSubjectEntry} — `doc.ref` / `doc.refs`, workflow scope) accept
+ * `documentType`? Name-blind and EXISTENTIAL: ANY required ref entry counts —
+ * a multi-input definition (say, contract + counterparty) surfaces from
+ * either document's picker, and the start dialog collects the remaining
+ * required entries (their fail-hard validation backstops). An entry without
+ * `types` accepts any type; a definition with NO required ref entry takes no
+ * subject and never matches. Cheap and indexable — no GROQ evaluation — so a
+ * consumer can pre-filter before loading document content. (`required` is
+ * pinned to caller-filled `input` entries by a deploy invariant, so it alone
+ * identifies the handoff.)
  */
 export declare function acceptsDocumentType(
   definition: Pick<ApplicabilitySource, "fields">,
@@ -77,7 +79,9 @@ export declare function aclPathForResource(
   res: WorkflowResource,
 ): string | undefined;
 
-export declare type Action = ActionFields<Op, string[]>;
+export declare type Action = ActionFields<Op, string[]> & {
+  roles?: string[] | undefined;
+};
 
 /**
  * The engine's per-reason detail fragment — the same wording
@@ -121,11 +125,22 @@ export declare type ActionDisabledReason = Exclude<
 export declare interface ActionEvaluation {
   action: Action;
   allowed: boolean;
+  /**
+   * The action is cascade-fired (`when`): the engine fires it on truth, it
+   * is never fireAction-able, and a consumer must not render it as a
+   * button — narrate it ("will escalate when overdue") via `whenInsight`.
+   * Always set together with the `cascade-fired` `disabledReason` — either
+   * check suffices; the flag is the ergonomic spelling.
+   */
+  triggered?: true;
   /** Present iff `allowed === false`. The first failing gate wins. */
   disabledReason?: DisabledReason;
   /** Derived state of the action's `filter` gate — why it holds or fails,
    *  atom by atom. Present iff the action declares a filter. */
   insight?: ConditionInsight;
+  /** Derived state of a cascade-fired action's `when` trigger — what would
+   *  fire it. Present iff the action declares `when`. */
+  whenInsight?: ConditionInsight;
 }
 
 /** Type-mirror of {@link actionFields}, parameterised over the op and
@@ -135,10 +150,12 @@ declare type ActionFields<TOp, TGroup> = {
   title?: string | undefined;
   description?: string | undefined;
   group?: TGroup | undefined;
+  when?: string | undefined;
   filter?: string | undefined;
   params?: ActionParam[] | undefined;
   ops?: TOp[] | undefined;
   effects?: Effect[] | undefined;
+  spawn?: Subworkflows | undefined;
 };
 
 export declare type ActionName = string;
@@ -205,6 +222,26 @@ export declare class ActionParamsInvalidError extends WorkflowError<"action-para
   });
 }
 
+/**
+ * The three-way rendering verdict every surface applies to an action:
+ * `absent` — its `filter` failed, so it does not exist for this actor/visit
+ * (GROQ existence semantics; never even a disabled affordance). `automation` —
+ * cascade-fired, so the engine's cascade is its only firing path (narrate it,
+ * never render a fire affordance). `button` — fireable: enabled when
+ * `allowed`, otherwise disabled WITH its {@link DisabledReason} shown.
+ * Structural over the shared verdict fields so {@link ActionEvaluation} and
+ * `AvailableAction` both qualify; filter-existence dominates automation, the
+ * same order the engine's own verdicts apply.
+ */
+export declare function actionRendering(action: {
+  triggered?: true;
+  disabledReason?:
+    | {
+        kind: DisabledReason["kind"];
+      }
+    | undefined;
+}): "absent" | "automation" | "button";
+
 /** The fireable-action verdict for one action on an activity — its `allowed`
  *  state, structured `disabledReason`, and declared params, tagged with the
  *  owning activity. The per-action atom both projections share:
@@ -219,7 +256,6 @@ export declare function actionVerdict(
 export declare type Activity = ActivityFields<
   FieldEntry,
   Action,
-  Op,
   ManualTarget,
   string[]
 >;
@@ -271,19 +307,23 @@ export declare const ACTIVITY_KINDS: readonly [
  * `schema.ts → enums.ts` terminates here.
  */
 declare const ACTIVITY_STATUSES: readonly [
-  "pending",
   "active",
   "done",
   "skipped",
   "failed",
 ];
 
-/** An activity's four gates, each described — absent keys mirror undeclared gates. */
+/** The activity slice of a stage rollup — total by construction, like
+ *  {@link stageAutonomyOf}. */
+export declare function activityAutonomyOf(
+  stageAutonomy: StageAutonomy,
+  activityName: string,
+): AutonomyAnswer;
+
+/** An activity's gates, each described — absent keys mirror undeclared gates. */
 export declare interface ActivityDescription {
   requirements?: Record<string, ConditionDescription>;
   filter?: ConditionDescription;
-  completeWhen?: ConditionDescription;
-  failWhen?: ConditionDescription;
 }
 
 export declare interface ActivityEntry {
@@ -294,6 +334,14 @@ export declare interface ActivityEntry {
   startedAt?: string;
   completedAt?: string;
   completedBy?: string;
+  /**
+   * Names of this activity's cascade-fired actions that have fired during
+   * THIS stage visit — the once-per-visit ledger. Level-triggered: a name
+   * lands here on the first evaluation that finds its `when` true and never
+   * re-fires within the visit; stage re-entry rebuilds entries, so re-arming
+   * on a new visit is structural. Absent until the first trigger fires.
+   */
+  firedActions?: string[];
   filterEvaluation?: {
     at: string;
     truthy: boolean;
@@ -314,13 +362,35 @@ export declare interface ActivityEvaluation {
   activity: Activity;
   status: ActivityStatus;
   /**
-   * The activity's effective {@link ActivityKind} — the explicit {@link Activity.kind}, or
-   * the shape-derived default when omitted. Advisory: a label so a consumer can
-   * render each activity as what it is (`user` / `service` / `script` / `manual` / `receive`).
+   * The activity's shape-derived {@link ActivityKind}. Advisory: a label so a
+   * consumer can render each activity as what it is (`user` / `service` /
+   * `script` / `manual` / `receive`).
    */
   kind: ActivityKind;
+  /**
+   * Who, if anyone, fires the activity's actions — derived from its shape
+   * alone: `autonomous` (every action cascade-fired), `interactive` (only
+   * fireAction-fired actions), `off-system` (`target` present), or `hybrid`.
+   */
+  classification: ExecutorClassification;
+  /**
+   * The causal refinement of {@link ActivityEvaluation.classification}:
+   * whether this activity completes without a caller, derived by
+   * {@link deriveWorkflowAutonomy}'s dataflow over the definition — a
+   * mechanically `autonomous` activity whose triggers only read
+   * caller-written state still reports the caller it waits on.
+   */
+  autonomy: AutonomyAnswer;
   /** Whether this activity is the current actor's responsibility right now. */
   pendingOnActor: boolean;
+  /**
+   * The stage-entry `filter` scoped this activity out of the current visit:
+   * its entry is `skipped` and never started, so it does not exist for this
+   * visit — surfaces hide it entirely (an action-resolved `skipped` was real,
+   * started work and stays visible). Derived via {@link isFilterScopedOut},
+   * stamped here so consumers never re-join entry state to compute it.
+   */
+  scopedOut: boolean;
   /**
    * The activity's unmet {@link Activity.requirements}, by name — present iff at least
    * one is unmet. The activity's own readiness summary: a consumer can explain why
@@ -332,45 +402,28 @@ export declare interface ActivityEvaluation {
    *  Present iff the activity declares requirements; `unmetRequirements`
    *  is exactly the keys whose insight isn't satisfied. */
   requirementInsights?: Record<string, ConditionInsight>;
-  /** Derived state of the activity's `filter` skip-gate. Present iff declared.
-   *  Advisory read: the engine's cascade owns the gate itself. */
+  /** Derived state of the activity's `filter` existence gate. Present iff
+   *  declared. Advisory read: the engine's stage entry owns the gate itself. */
   filterInsight?: ConditionInsight;
-  /** Derived state of `completeWhen` — what would auto-complete this activity.
-   *  Present iff declared. */
-  completeWhenInsight?: ConditionInsight;
-  /** Derived state of `failWhen` — what would auto-fail this activity.
-   *  Present iff declared. */
-  failWhenInsight?: ConditionInsight;
   actions: ActionEvaluation[];
 }
 
-/** Type-mirror of {@link activityFields}, parameterised over field/action/op/target/group. */
-declare type ActivityFields<TField, TAction, TOp, TTarget, TGroup> = {
+/** Type-mirror of {@link activityFields}, parameterised over field/action/target/group. */
+declare type ActivityFields<TField, TAction, TTarget, TGroup> = {
   name: string;
   title?: string | undefined;
   description?: string | undefined;
   groups?: Group[] | undefined;
   group?: TGroup | undefined;
-  kind?: ActivityKind | undefined;
   target?: TTarget | undefined;
-  activation?: "auto" | "manual" | undefined;
   filter?: string | undefined;
   requirements?: Record<string, string> | undefined;
-  completeWhen?: string | undefined;
-  failWhen?: string | undefined;
-  ops?: TOp[] | undefined;
-  effects?: Effect[] | undefined;
   actions?: TAction[] | undefined;
-  subworkflows?: Subworkflows | undefined;
   fields?: TField[] | undefined;
 };
 
 export declare type ActivityKind = (typeof ACTIVITY_KINDS)[number];
 
-/** The effective kind of an activity: the explicitly declared {@link Activity.kind}, or
- *  the shape-derived default when omitted. */
-export declare function activityKind(activity: Activity): ActivityKind;
-
 export declare type ActivityName = string;
 
 export declare type ActivityStatus = (typeof ACTIVITY_STATUSES)[number];
@@ -408,14 +461,20 @@ export declare type ActorKind = (typeof ACTOR_KINDS)[number];
 
 export { analyzeCondition };
 
-/** The definition surface applicability reads — structural, so authored,
- *  stored, and deployed definition shapes all fit. `name` is error context
- *  only: a broken `applicableWhen` fails naming its definition. */
+/** The definition surface the start contexts read — structural, so authored,
+ *  stored, and deployed definition shapes all fit. `name` binds
+ *  `$definition` and names the definition in a broken-predicate error. */
 export declare interface ApplicabilitySource {
   name?: string | undefined;
   lifecycle?: WorkflowLifecycle | undefined;
   fields?: FieldEntry[] | undefined;
-  applicableWhen?: string | undefined;
+  start?:
+    | {
+        kind?: StartKind | undefined;
+        filter?: string | undefined;
+        allowed?: string | undefined;
+      }
+    | undefined;
 }
 
 /**
@@ -427,6 +486,8 @@ export declare function applicableDefinitions<
 >(args: {
   definitions: readonly T[];
   document: CandidateDocument;
+  /** Caller-side filter bindings, shared by every definition's evaluation. */
+  scope?: StartScope;
 }): Promise<T[]>;
 
 /**
@@ -467,6 +528,8 @@ export declare type Assignee =
 
 export { AtomInsight };
 
+export { atomReadsDataset };
+
 export { AtomRequirement };
 
 /**
@@ -496,7 +559,6 @@ export declare type AuthoringAction = AuthoringRawAction | ClaimAction;
 export declare type AuthoringActivity = ActivityFields<
   AuthoringFieldEntry,
   AuthoringAction,
-  AuthoringOp,
   AuthoringManualTarget,
   GroupMembership
 >;
@@ -564,6 +626,11 @@ export declare type AuthoringGuard = v.InferOutput<typeof AuthoringGuardSchema>;
 
 declare const AuthoringGuardSchema: v.StrictObjectSchema<
   {
+    /**
+     * Lake-id-segment grammar (`^[a-z0-9][a-z0-9-]*$`, deploy-enforced): the
+     * guard's lake `_id` derives from `(instanceId, name)` at stage entry.
+     * Unique per definition.
+     */
     name: v.SchemaWithPipe<
       readonly [
         v.StringSchema<undefined>,
@@ -725,8 +792,9 @@ declare const AuthoringGuardSchema: v.StrictObjectSchema<
     /**
      * Lake GROQ predicate — a distinct eval context: delta-mode GROQ
      * reading the `before()`/`after()` natives, `mutation`, `guard`, and
-     * `identity()`. Bare ids/fields only. Omitted or empty means
-     * UNCONDITIONAL DENY.
+     * `identity()`. Bare ids/fields only. Polarity: a result of strictly
+     * `true` ALLOWS the matched mutation; anything else (false, null, an
+     * evaluation error) DENIES. Omitted or empty means UNCONDITIONAL DENY.
      */
     predicate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
     /**
@@ -905,7 +973,7 @@ declare const AuthoringManualTargetSchema: v.VariantSchema<
   undefined
 >;
 
-declare type AuthoringOp = v.InferOutput<typeof AuthoringOpSchema>;
+export declare type AuthoringOp = v.InferOutput<typeof AuthoringOpSchema>;
 
 declare const AuthoringOpSchema: v.VariantSchema<
   "type",
@@ -1058,7 +1126,7 @@ declare const AuthoringOpSchema: v.VariantSchema<
           undefined
         >;
         readonly status: v.PicklistSchema<
-          readonly ["pending", "active", "done", "skipped", "failed"],
+          readonly ["active", "done", "skipped", "failed"],
           `Invalid option: expected one of ${string}`
         >;
       },
@@ -1123,15 +1191,21 @@ declare const AuthoringOpSchema: v.VariantSchema<
  * Authoring action — the stored fields plus two field sugars with one
  * defined expansion each:
  *
- *   - `roles` → a `count($actor.roles[@ in [...]]) > 0` membership condition
- *     ANDed with the authored `filter`. The definition's `roleAliases`
- *     ({@link RoleAliasesSchema}) widen that membership at desugar time.
+ *   - `roles` — on a fireAction-fired action (no `when`) it desugars to a
+ *     `count($actor.roles[@ in [...]]) > 0` membership condition ANDed with
+ *     the authored `filter` (for a caller, "not yours to fire" and "doesn't
+ *     exist for you" are the same advisory answer). On a CASCADE-FIRED
+ *     action it stores VERBATIM — the pin on which identities may execute
+ *     the trigger; folding it into `filter` would make the action's
+ *     existence depend on whose token happens to cascade. The definition's
+ *     `roleAliases` ({@link RoleAliasesSchema}) widen the membership either
+ *     way.
  *   - `status` → a `status.set` op on the firing activity, appended **after**
  *     the authored ops (deliberately never implied: a forgotten explicit
  *     `status` is a visible stall, an implied default silently completes
  *     claim-like actions). Status is the health axis: a decision action
  *     (decline, send back) resolves `done` and writes the decision into a
- *     field the transition filter reads — `failed` is for work that
+ *     field the transition trigger reads — `failed` is for work that
  *     genuinely could not complete.
  */
 declare type AuthoringRawAction = ActionFields<AuthoringOp, GroupMembership> & {
@@ -1152,219 +1226,105 @@ export declare type AuthoringStage = StageFields<
   AuthoringEditable
 >;
 
-export declare type AuthoringTransition =
-  TransitionFields<AuthoringTransitionOp> & {
-    filter?: string | undefined;
-  };
-
-declare type AuthoringTransitionOp = v.InferOutput<
-  typeof AuthoringTransitionOpSchema
->;
+export declare type AuthoringStartBlock = StartFields & {
+  kind?: StartKind | undefined;
+};
 
 /**
- * Authoring transitions may omit `filter`; desugar fills the safe,
- * overwhelmingly-common gate `"$allActivitiesDone"`. "Fire unconditionally"
- * stays spellable as an explicit `filter: "true"`.
+ * Authoring transitions may omit `when`; desugar fills the safe,
+ * overwhelmingly-common trigger `"$allActivitiesDone"`. "Fire unconditionally"
+ * stays spellable as an explicit `when: "true"`.
  */
-declare const AuthoringTransitionOpSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.set", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                `Invalid option: expected one of ${string}`
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.unset", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                `Invalid option: expected one of ${string}`
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.append", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                `Invalid option: expected one of ${string}`
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.updateWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                `Invalid option: expected one of ${string}`
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.removeWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                `Invalid option: expected one of ${string}`
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"audit", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                `Invalid option: expected one of ${string}`
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-        readonly stampFields: v.OptionalSchema<
-          v.StrictObjectSchema<
-            {
-              readonly actor: v.OptionalSchema<
-                v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >,
-                undefined
-              >;
-              readonly at: v.OptionalSchema<
-                v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >,
-                undefined
-              >;
-            },
-            undefined
-          >,
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
+export declare type AuthoringTransition = TransitionFields & {
+  when?: string | undefined;
+};
 
 /** The authoring surface: stored primitives plus the define-time sugar. */
 export declare type AuthoringWorkflow = WorkflowFields<
   AuthoringFieldEntry,
-  AuthoringStage
+  AuthoringStage,
+  AuthoringStartBlock
 >;
 
+/** The narratable answer at one rollup level: the verdict plus what it waits
+ *  on. `waitsOn` may be non-empty on a `yes` verdict (an effect settle is a
+ *  wait the engine resolves itself) — consumers choose what to surface. */
+export declare interface AutonomyAnswer {
+  completesWithoutCaller: AutonomyVerdict;
+  waitsOn: AutonomyWait[];
+}
+
+/** The workflow-level autonomy narrative: fully self-running, or the stages
+ *  where a run is held. */
+export declare function autonomySummary(
+  autonomy: WorkflowAutonomy,
+  ctx: DescribeContext,
+): InsightPhrase;
+
+/**
+ * Whether a node resolves without a caller: `yes` — engine machinery alone
+ * (the cascade plus the host's effect drain/ticker) gets it there; `no` —
+ * someone outside the engine must act (a caller fires an action, an editor
+ * writes a field or content); `conditional` — it may resolve either way
+ * depending on values the analysis can't see (start-time seeds, mixed
+ * alternative routes, unresolvable children, cyclic gates).
+ *
+ * `yes` still leans on the host: effects settle only if a drain runs, and
+ * time only passes for a ticker. A cascade-fired action's `roles` pin is a
+ * DEPENDENCY, not an assumption — the runtime leaves a pinned trigger armed
+ * until a capable token cascades, and whether the deployment's tokens fulfil
+ * the pin is configuration the analysis can't see, so a pinned trigger
+ * reports `conditional` with the pin as its wait.
+ */
+export declare type AutonomyVerdict = "yes" | "no" | "conditional";
+
+/** One narratable dependency a non-`yes` verdict rests on. */
+export declare type AutonomyWait =
+  | {
+      kind: "caller-action";
+      stage: string;
+      activity: string;
+      action: string;
+      roles?: string[];
+    }
+  | {
+      kind: "execute-pin";
+      stage: string;
+      activity: string;
+      action: string;
+      roles: string[];
+    }
+  | {
+      kind: "editor-field";
+      field: string;
+    }
+  | {
+      kind: "editor-content";
+      condition: Condition;
+    }
+  | {
+      kind: "effect";
+      effect: string;
+    }
+  | {
+      kind: "start-input";
+      field: string;
+    }
+  | {
+      kind: "context";
+      key?: string;
+    }
+  | {
+      kind: "subworkflow";
+      definition: string;
+      resolved: boolean;
+    }
+  | {
+      kind: "unwritten-field";
+      field: string;
+      handlerPossible: boolean;
+    };
+
 export declare interface AvailableAction {
   activity: string;
   activityStatus: ActivityStatus;
@@ -1376,7 +1336,10 @@ export declare interface AvailableAction {
 }
 
 /** Flatten an evaluation's current-stage activities into the actions the actor
- *  could fire, each carrying whether it's allowed (and why not). */
+ *  could fire, each carrying whether it's allowed (and why not). A
+ *  filter-scoped-out activity does not exist for this visit, so its actions
+ *  never list — the same {@link ActivityEvaluation.scopedOut} split every
+ *  other surface applies. */
 export declare function availableActions(
   activities: ActivityEvaluation[],
 ): AvailableAction[];
@@ -1389,6 +1352,22 @@ export declare interface AvailableActionsResult {
   actions: AvailableAction[];
 }
 
+/**
+ * Type each caller-supplied name→value against the workflow's declared field
+ * entries — the engine takes typed {@link InitialFieldValue}s, and a value's
+ * type IS its declared entry's kind. Only `input`-sourced entries read
+ * caller values (the engine silently ignores the rest), so anything else
+ * fails here, naming the fields that ARE settable; value validation stays
+ * in the engine.
+ */
+export declare function buildInitialFields({
+  declared,
+  values,
+}: {
+  declared: Pick<FieldEntry, "type" | "name" | "initialValue">[];
+  values: Record<string, unknown>;
+}): InitialFieldValue[];
+
 /**
  * Build a snapshot from a set of loaded docs. Pure transform.
  *
@@ -1410,7 +1389,7 @@ export declare function buildSnapshot(args: {
 /**
  * A LOADED candidate document. Applicability evaluates content, so a ref or
  * bare id is not enough: the doc must carry its schema `_type` plus whatever
- * attributes `applicableWhen` predicates read — under whatever perspective
+ * attributes `start.filter` predicates read — under whatever perspective
  * the caller loaded it with.
  */
 export declare interface CandidateDocument {
@@ -1419,12 +1398,12 @@ export declare interface CandidateDocument {
 }
 
 /**
- * Thrown when auto-transitions on an instance fail to stabilise within
- * {@link CascadeLimitError.limit} passes — the signature of a runaway
- * cascade. The classic trigger is two stages whose transition guards
+ * Thrown when hops on an instance fail to stabilise within
+ * {@link CascadeLimitError.limit} moves — the signature of a runaway
+ * cascade. The classic cause is two stages whose transition `when`s
  * stay simultaneously satisfied (e.g. an `op.field.set` lands a value
- * that trips the very guard that fired, and nothing ever clears it), so
- * the engine flip-flops and would otherwise write revisions forever.
+ * that trips the very trigger that fired, and nothing ever clears it),
+ * so the engine flip-flops and would otherwise write revisions forever.
  *
  * The cascade aborts at the limit rather than the engine hanging; the
  * instance is left at whatever stage the last completed pass reached.
@@ -1575,13 +1554,13 @@ export declare interface CompleteEffectArgs extends DedupableOperationArgs {
   effectKey: string;
   status: EffectCompletionStatus;
   /**
-   * Named values produced by the effect. If supplied, these are merged
-   * into `effectsContext` (replace-by-key) and become available to
-   * downstream effect bindings on the same instance. Each value may be any
-   * JSON — scalar, {@link GlobalDocumentReference}, or an arbitrary
-   * object/array (the whole record stores as one `effectsContext.json` entry).
+   * Named values produced by the effect — recorded on the run's
+   * `effectHistory` row and read downstream as
+   * `$effects['<effect name>'].<output>` (the latest completed run per
+   * effect name wins). Validated against the effect's declared `outputs`
+   * allowlist; each value may be any JSON.
    */
-  outputs?: EffectsContext;
+  outputs?: Record<string, unknown>;
   /**
    * The state half of the effect: `field.*` ops to apply in the completion
    * commit, computed from the effect's real result (e.g. a `field.set` of a
@@ -1616,6 +1595,26 @@ export declare function computeDiffEntries<
   target: DeployTarget;
 }): Promise<DiffEntry[]>;
 
+/**
+ * Completion twin of {@link ConcurrentFireActionError}: a `completeEffect`
+ * commit lost the optimistic-locking race on every attempt. Same contract —
+ * nothing committed on the final try, so the pending entry (and its claim)
+ * is untouched: the completion can be retried, and a claim whose lease
+ * lapses is recovered by a later drain. The handler's reported outcome is
+ * NOT applied — a caller that retries must not re-run the side effect,
+ * only re-report it.
+ */
+export declare class ConcurrentCompleteEffectError extends WorkflowError<"concurrent-complete-effect"> {
+  readonly instanceId: string;
+  readonly effectKey: string;
+  readonly attempts: number;
+  constructor(args: {
+    instanceId: string;
+    effectKey: string;
+    attempts: number;
+  });
+}
+
 /**
  * Edit-seam twin of {@link ConcurrentFireActionError}: an `editField` commit
  * lost the optimistic-locking race on every attempt. Same contract — re-read
@@ -1642,7 +1641,7 @@ export declare class ConcurrentEditFieldError extends WorkflowError<"concurrent-
 
 /**
  * Thrown when a `fireAction` commit loses the optimistic-locking race on
- * all {@link CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS} attempts — every reload +
+ * all {@link CONCURRENT_COMMIT_MAX_ATTEMPTS} attempts — every reload +
  * `ifRevisionId` retry was beaten by another writer committing first.
  * Surfacing it (rather than silently overwriting) lets the caller decide
  * whether to retry later or report a write storm; nothing was committed
@@ -1689,6 +1688,17 @@ export { ConditionClause };
 
 export { ConditionDescription };
 
+/**
+ * Every STATIC `$fields.<name>` (or `$fields['<name>']` — groq-js normalises
+ * both to `AccessAttribute`) read in a condition, from the AST. Dynamic access
+ * (`$fields[$var]`) carries no static name and is not collected. A malformed
+ * condition reads nothing here ({@link conditionSyntaxIssues} owns the parse
+ * error).
+ */
+export declare function conditionFieldReadNames(
+  groq: string,
+): ReadonlySet<string>;
+
 export { ConditionInsight };
 
 export { ConditionOutcome };
@@ -1697,8 +1707,8 @@ export { ConditionRead };
 
 /**
  * Every condition a definition declares, in stable order: author predicates,
- * then per stage — transitions, activities (filter, requirements,
- * completeWhen, failWhen, action filters), editable gates, tighten-overrides.
+ * then per stage — transitions, activities (filter, requirements, action
+ * filters and `when` triggers), editable gates, tighten-overrides.
  * Editable gates resolve through the same helper the runtime projection uses
  * ({@link editableFieldsInStage}: entry `editable` ANDed with the stage
  * tighten-override), so every live editable-field address exists here with
@@ -1724,25 +1734,33 @@ export declare interface ConditionVar {
  * The condition-variable inventory — the single source of truth for every
  * `$var` the engine binds when it evaluates a {@link Condition}.
  *
- * Three evaluation contexts read a definition's GROQ:
+ * Four evaluation contexts read a definition's GROQ:
  *
  * 1. **Rendered condition scope** — every condition site in a definition
- *    (transition filters, `completeWhen`/`failWhen`, action filters, effect
- *    bindings, `subworkflows` reads, where-op `where`s, editability
- *    predicates, author predicates). {@link CONDITION_VARS} is its inventory;
- *    each entry's `binding` says when the var actually holds a value. The
+ *    (transition `when`s, activity filters, action `when`s/filters, effect
+ *    bindings, `spawn` reads, where-op `where`s, editability predicates,
+ *    author predicates). {@link CONDITION_VARS} is its inventory; each
+ *    entry's `binding` says when the var actually holds a value. The
  *    where-op context is the one closed subset — its bound set is statically
  *    fixed and deploy-enforced (see the op-where scope's param-name list in
  *    the op applier).
- * 2. **Filter evaluation without a caller** — the engine's cascade evaluates
- *    transition filters and the activity gates (`filter`, `completeWhen`,
- *    `failWhen`) with no caller, so only the `'always'`-bound subset carries
- *    values there ({@link FILTER_SCOPE_VARS}). Caller-bound vars fail closed —
- *    `$assigned` binds its caller-free constant `false`, the rest evaluate to
- *    `undefined` — and deploy rejects them at these sites: routing and gate
- *    resolution must resolve identically no matter whose token triggers the
- *    evaluation.
- * 3. **Guard predicates** — NOT conditions. A lake mutation guard's
+ * 2. **Cascade gates** — transition `when`s, activity filters, and a
+ *    cascade-fired action's `when`/`filter` must resolve identically no
+ *    matter whose token drives the cascade, so only the `'always'`-bound
+ *    subset carries values there ({@link FILTER_SCOPE_VARS}). Caller-bound
+ *    vars fail closed — `$assigned` binds its caller-free constant `false`,
+ *    the rest evaluate to `undefined` — and deploy rejects them at these
+ *    sites; a cascade-fired action's per-token gate is `roles`, never its
+ *    conditions.
+ * 3. **The start contexts** — a definition's `start.filter` and
+ *    `start.allowed` evaluate against a CANDIDATE (no instance exists yet):
+ *    `*[...]` reads the WORKFLOW resource's dataset and none of the rendered
+ *    condition vars exist. The two split on what a surface can know:
+ *    `filter` is browse-time-pure (candidate document as root,
+ *    {@link START_FILTER_VARS} — no `$fields`, which cannot exist before
+ *    inputs do), `allowed` is the start-time permission predicate
+ *    ({@link START_ALLOWED_VARS} — `$fields` bound, never a root).
+ * 4. **Guard predicates** — NOT conditions. A lake mutation guard's
  *    `predicate` is groq-js **delta-mode** GROQ over a document mutation:
  *    `before()`/`after()`/`identity()` are dialect natives, and the wire
  *    format binds the identifiers in {@link GUARD_PREDICATE_VARS}. None of
@@ -1755,11 +1773,43 @@ export declare interface ConditionVar {
  *   instance and its snapshot.
  * - `'caller'` — rides the acting caller; without one the var is `undefined`
  *   (conditions referencing it fail closed). Author predicates may not read
- *   these — they pre-evaluate once per instance, caller-free.
- * - `'spawn'` — bound only at `subworkflows` sites (the per-row `$row`).
+ *   these — they pre-evaluate caller-free, per evaluation context.
+ * - `'spawn'` — bound only at spawn sites (the per-row `$row`).
  */
 export declare type ConditionVarBinding = "always" | "caller" | "spawn";
 
+/**
+ * The one-doc read a reactive adapter subscribes with to observe a content doc
+ * under a perspective stack — the same GROQ as the engine's own hydration read
+ * ({@link hydrateSnapshot}), so the adapter and the engine resolve identical
+ * content: draft/version content projected onto the published id, a doc that
+ * exists only as a draft (or only inside a release) still visible.
+ */
+export declare function contentDocQuery(documentId: string): CompiledQuery;
+
+/**
+ * Whether a watched content doc's reactive read may fall back to the DRAFT —
+ * the fallback half of the per-doc resolution rule {@link contentReleaseName}
+ * starts. Mirrors the engine's own hydration under the instance's effective
+ * perspective (`instance.perspective ?? DEFAULT_CONTENT_PERSPECTIVE`): a draft
+ * is visible only when that perspective names `'drafts'` — the drafts default,
+ * `'drafts'` itself, or a stack like `[release, 'drafts']`. Under `'published'`
+ * / `'raw'` and under a stack without a `'drafts'` entry (`[release]`,
+ * `['published']`) drafts are invisible, and an adapter feeding one would
+ * evaluate content the engine's read can never see.
+ *
+ * Raw refs ({@link readsRaw}) answer `true` by contract, and it is
+ * load-bearing: instance / ancestor / `system.release` docs have no draft
+ * form, and the `true` keeps them on the adapters' raw per-doc read path —
+ * never a perspective-scoped content read.
+ */
+export declare function contentDraftFallback(args: {
+  ref: {
+    type: string;
+  };
+  perspective: WorkflowPerspective | undefined;
+}): boolean;
+
 /**
  * The Content Release a watched doc resolves under, or `undefined` for a raw
  * read — how a reactive adapter turns the watch-set's perspective into the
@@ -1772,9 +1822,10 @@ export declare type ConditionVarBinding = "always" | "caller" | "spawn";
  *
  * Note: this resolves a **single** release — the documented `instance.perspective`
  * shapes (`[release]` / `[release, "drafts"]`). The stores' per-doc reads take
- * one release, so a multi-release stack can't be observed reactively here; the
- * engine's own fetch path ({@link hydrateSnapshot}) honours the full stack via
- * `client.fetch({perspective})`.
+ * one release, so a multi-release stack can't be observed through them; the
+ * engine's own fetch path ({@link hydrateSnapshot}) — and the SDK adapter's
+ * query-store route for stacks without a `'drafts'` entry — honour the full
+ * stack via `client.fetch({perspective})`.
  */
 export declare function contentReleaseName(args: {
   ref: {
@@ -1783,12 +1834,92 @@ export declare function contentReleaseName(args: {
   perspective: WorkflowPerspective | undefined;
 }): string | undefined;
 
+/**
+ * Context-bag entry kinds.
+ */
+export declare const CONTEXT_ENTRY_DISPLAY: {
+  "context.string": {
+    title: string;
+    description: string;
+  };
+  "context.number": {
+    title: string;
+    description: string;
+  };
+  "context.boolean": {
+    title: string;
+    description: string;
+  };
+  "context.ref": {
+    title: string;
+    description: string;
+  };
+  "context.json": {
+    title: string;
+    description: string;
+  };
+};
+
+/**
+ * One entry of the instance's `context` bag, rendered to conditions as
+ * `$context.<name>`. **Written exactly twice, both at start**: the
+ * `startInstance` seed and a parent's `spawn.context` handoff. Never
+ * mutated afterwards — completed effects' outputs live on
+ * `effectHistory[].outputs` and render as `$effects`, a separate bag.
+ *
+ * Critical: `context` is NOT a workflow field container. Transition
+ * triggers must NOT read it as fields. The workflow's fields live on
+ * `fields[]`; external state lives in the lake (queryable via conditions).
+ */
+export declare type ContextEntry =
+  | {
+      _key: string;
+      _type: "context.string";
+      name: string;
+      value: string;
+    }
+  | {
+      _key: string;
+      _type: "context.number";
+      name: string;
+      value: number;
+    }
+  | {
+      _key: string;
+      _type: "context.boolean";
+      name: string;
+      value: boolean;
+    }
+  | {
+      _key: string;
+      _type: "context.ref";
+      name: string;
+      /** GDR — see `../core/refs.ts` */
+      value: GlobalDocumentReference;
+    }
+  | {
+      _key: string;
+      _type: "context.json";
+      name: string;
+      value: string;
+    };
+
+/**
+ * Render the instance's `context` bag as the `$context` map — the
+ * start-time seed plus a parent's spawn handoff. `json` entries decode to
+ * their object form.
+ */
+export declare function contextMap(
+  instance: Pick<WorkflowInstance, "context">,
+): Record<string, unknown>;
+
 /**
  * A caller broke a public-API contract — a call the engine rejects
- * before touching the lake: an invalid `tag`, a `workflow.query` GROQ that
+ * without writing anything: an invalid `tag`, a `workflow.query` GROQ that
  * never binds `$tag`, a bare id where a GDR URI is required, an action,
- * activity, or field the definition never declared. Fix the call site;
- * retrying cannot succeed.
+ * activity, or field the definition never declared, or a `startInstance`
+ * `instanceId` reused for a different start (or a discarded one). Fix the
+ * call site; retrying cannot succeed.
  */
 export declare class ContractViolationError extends WorkflowError<"contract-violation"> {
   constructor(message: string);
@@ -1968,6 +2099,11 @@ export declare const DEFAULT_EFFECT_LEASE_MS: number;
  *  configured `idempotencyTtlMs`. */
 export declare const DEFAULT_IDEMPOTENCY_TTL_MS: number;
 
+/** The condition a transition gets when the author declares none — fire once
+ *  the stage's own work settles. Exported so consumers describing transition
+ *  conditions can recognize the default's spelling without copying it. */
+export declare const DEFAULT_TRANSITION_WHEN = "$allActivitiesDone";
+
 /**
  * Default LoggerFactory — writes through the global `console`. Exposed
  * so callers outside `createEngine` (drive scripts, the
@@ -2071,7 +2207,7 @@ export declare interface DefinitionsForDocumentArgs {
   /**
    * The LOADED candidate document — unlike {@link InstancesForDocumentArgs},
    * a ref won't do: applicability evaluates content (`_type` against subject
-   * entry `types`, `applicableWhen` against the attributes), under whatever
+   * entry `types`, `start.filter` against the attributes), under whatever
    * perspective the caller loaded the document with.
    */
   document: CandidateDocument;
@@ -2201,11 +2337,13 @@ export declare interface DeployDefinitionsArgs<
 > {
   /**
    * Resource-alias bindings for this deploy (alias name → physical resource).
-   * Every `@<alias>:` reference in a definition is expanded to its bound
-   * physical resource at deploy, so the deployed definition holds only physical
-   * references. Deploy fails closed when a definition references an alias this
-   * map doesn't bind. Omit for single-resource workflows (definitions that
-   * reference no aliases).
+   * A deploy-time abstraction ONLY: every `@<alias>:` reference in a
+   * definition is expanded to its bound physical resource before the
+   * deployed definition is fingerprinted and stored, and deploy fails closed
+   * on an unbound alias. Aliases never exist past deploy — no stored
+   * document carries one, the runtime never sees the map, and an
+   * alias-shaped ref reaching a runtime boundary is rejected as malformed.
+   * Omit for single-resource workflows (definitions referencing no aliases).
    */
   resourceAliases?: ResourceAliases;
   /** Authored definitions (the default — full compile-time checking) or
@@ -2272,16 +2410,45 @@ export declare interface DeployTarget {
 }
 
 /**
- * Classify an activity from its shape, in precedence order: an activity a person acts on
- * (`actions`) is `user`; otherwise an automated effect step is `service`;
- * otherwise an activity that waits on a condition (`completeWhen` or a `subworkflows`
- * fan-out) is `receive`; otherwise an inline machine step is `script`.
- *
- * Never returns `manual` — off-system work reads identically to a `user` or
- * `receive` activity by shape, so it is only ever an EXPLICIT {@link Activity.kind}.
+ * Classify an activity from its shape, BPMN-aligned: `target` marks off-system
+ * work (`manual`); otherwise any fireAction-fired action means a person (or
+ * robot caller) acts on it (`user`); otherwise cascade-fired effects make it a
+ * `service` step; otherwise cascade-fired status flips make it a `receive`
+ * wait; anything left is an inline `script` step.
  */
 export declare function deriveActivityKind(activity: Activity): ActivityKind;
 
+export declare interface DeriveAutonomyOptions {
+  /** Child definitions for `spawn` recursion, by definition `name` — the
+   *  deploy batch or previously deployed set. An unresolvable child reports
+   *  `conditional` with an unresolved wait. */
+  children?: ReadonlyMap<string, WorkflowDefinition>;
+}
+
+/**
+ * Who, if anyone, fires the activity's actions — derived ahead-of-time from
+ * the activity's shape alone: `off-system` when `target` is present; else
+ * `autonomous` (every action cascade-fired — no caller fires anything),
+ * `interactive` (only fireAction-fired actions), or `hybrid` (mixed). An
+ * actionless activity classifies `autonomous` vacuously (deploy's
+ * terminal-reachability invariant rejects it anyway). Shape-only: whether
+ * the activity actually RESOLVES without a caller is the causal question
+ * `deriveWorkflowAutonomy` answers.
+ */
+export declare function deriveExecutorClassification(
+  activity: Activity,
+): ExecutorClassification;
+
+/**
+ * Derive the causal autonomy of a stored definition. Pure and instance-free;
+ * conditions must parse (they did at define/deploy time — an unparseable one
+ * throws groq-js's syntax error rather than guessing).
+ */
+export declare function deriveWorkflowAutonomy(
+  definition: WorkflowDefinition,
+  options?: DeriveAutonomyOptions,
+): WorkflowAutonomy;
+
 export declare type Describable =
   | ConditionInsight
   | FieldInsight
@@ -2299,6 +2466,12 @@ export declare function describeAtom(
   fallback: boolean;
 };
 
+/** One {@link AutonomyWait} as a phrase in the workflow vocabulary. */
+export declare function describeAutonomyWait(
+  wait: AutonomyWait,
+  ctx: DescribeContext,
+): InsightPhrase;
+
 /** Render one condition's insight as a checklist + frontier summary, in the
  *  workflow vocabulary. */
 export declare function describeCondition(
@@ -2348,8 +2521,10 @@ export declare function describeFieldInsight(
 /**
  * The one front door: feed it any insight-bearing node off an evaluation and
  * get its description — a checklist for gate nodes (undefined when the node
- * declares no gate), all four gates for an activity, involvement + proposals
- * for a field. Dispatch is by each node's defining property, which is
+ * declares no gate), every declared gate for an activity, involvement +
+ * proposals for a field. For an action node the firing gate wins: a
+ * cascade-fired action describes its `when` trigger; a fireAction action
+ * its `filter`. Dispatch is by each node's defining property, which is
  * unambiguous across the union.
  */
 export declare function describeNode<T extends Describable>(
@@ -2379,7 +2554,7 @@ export declare function describeSiteHeading(
  *  so a hand-crafted stuck permutation doesn't have to fabricate insights. */
 export declare type DiagnosedTransition = Pick<
   TransitionEvaluation,
-  "transition" | "filterSatisfied" | "unevaluable"
+  "transition" | "whenSatisfied" | "unevaluable"
 >;
 
 /**
@@ -2513,12 +2688,19 @@ export declare type DisabledReason =
        * The action's condition evaluated falsy for this actor — the ONE
        * engine-side gate (advisory, like every engine check). Sugar like
        * `roles` desugared into this condition, so a role miss surfaces
-       * here too.
+       * here too. Under filter-existence semantics a consumer renders the
+       * action ABSENT, never disabled.
        */
       kind: "filter-failed";
       filter: string;
       detail?: string;
     }
+  | {
+      /** The action is cascade-fired (`when`) — the engine's cascade is its
+       *  only firing path; `fireAction` rejects it for every caller. */
+      kind: "cascade-fired";
+      when: string;
+    }
   | {
       kind: "activity-not-active";
       status: TerminalActivityStatus;
@@ -2657,6 +2839,20 @@ declare type DocumentEnvelopeKey =
   | "modelVersion"
   | "minReaderModel";
 
+/**
+ * The document-prefilter GROQ arm — matches instances that MAY reference any
+ * of `documents`. A deliberate lake-side SUPERSET (it also matches
+ * exited-stage refs); narrow fetched rows to the exact watch-set with
+ * {@link instanceWatchesDocument}. Binds `$documents` + `$bareIds` into
+ * `params`. Exposed for list builders that compose their own conditions
+ * (e.g. the CLI's cross-partition list); {@link instancesQuery} consumers get
+ * it via the `document`/`documents` filter fields instead.
+ */
+export declare function documentPrefilter(
+  documents: readonly GdrUri[],
+  params: Record<string, string | string[]>,
+): string;
+
 export declare type DocumentValuePermission =
   (typeof DOCUMENT_VALUE_PERMISSIONS)[number];
 
@@ -2859,6 +3055,15 @@ export declare type EditMode = "set" | "append" | "unset";
 
 export declare type Effect = v.InferOutput<typeof EffectSchema>;
 
+/**
+ * Every terminal state an effect run can record. `done` and `failed` are
+ * reported through completion ({@link EffectCompletionStatus}); `cancelled`
+ * is engine-stamped only — an abort cancelling the entry before dispatch.
+ * A cancellation is not a failure: anything counting failures (dashboards,
+ * retry tooling) must not count aborted-away effects among them.
+ */
+declare const EFFECT_RUN_STATUSES: readonly ["done", "failed", "cancelled"];
+
 /** The outcomes a completer may report through `completeEffect` — a run
  *  either succeeded or failed. `cancelled` is not reportable: only an abort
  *  stamps it, on entries that never dispatched. */
@@ -2869,8 +3074,9 @@ export declare type EffectCompletionStatus = Exclude<
 
 /**
  * External effect handler — invoked at drain time with the resolved
- * `params` and a context. Returning `outputs` upserts them into
- * `effectsContext` (replace-by-key) so downstream effects can bind.
+ * `params` and a context. Returning `outputs` records them on the run's
+ * `effectHistory` row, where downstream bindings and conditions read them
+ * as `$effects['<effect name>'].<output>`.
  * Returning `ops` applies the state half of the effect in the completion
  * commit — `field.*` computed from the real result, run through the same op
  * applier as an action's field ops (so a created doc's ref enters `$fields`, or
@@ -2924,7 +3130,7 @@ export declare type EffectHandler = (
     log: (message: string, extra?: Record<string, unknown>) => void;
   },
 ) => Promise<{
-  outputs?: EffectsContext;
+  outputs?: Record<string, unknown>;
   ops?: FieldOp[];
 } | void>;
 
@@ -2954,9 +3160,9 @@ export declare interface EffectHistoryEntry {
     stack?: string;
   };
   /**
-   * Outputs the runtime reported back. The engine merges these into
-   * `effectsContext` (replace-by-name) so downstream effect bindings and
-   * `$effects.<name>` reads can reference them. Recorded here for audit.
+   * Outputs the runtime reported back — the source the `$effects` read
+   * derives from (`$effects['<effect name>'].<output>` is the latest
+   * completed run's outputs, by name). Recorded here for audit.
    */
   outputs?: Record<string, unknown>;
 }
@@ -3004,14 +3210,16 @@ export declare interface EffectOrigin {
   name: string;
 }
 
-/** The lifecycle boundary that queued an effect — the node IS the moment. */
-export declare type EffectOriginKind = "activity" | "transition" | "action";
+/** The boundary that queued an effect — actions are the only effect
+ *  carriers, so the kind is structural (kept on the row for
+ *  self-description). */
+export declare type EffectOriginKind = "action";
 
 /**
  * Thrown when an effect completes with a returned output its declaration doesn't
  * allow — an undeclared key or a value that doesn't fit the declared shape. The
  * declared `outputs` are a strict allowlist bounding what an effect may persist
- * into `effectsContext`, so the completion does NOT commit rather than silently
+ * onto its `effectHistory` entry, so the completion does NOT commit rather than silently
  * storing off-contract data. An effect that declares no `outputs` has an EMPTY
  * allowlist (produces nothing), so any returned output fails here.
  */
@@ -3022,39 +3230,16 @@ export declare class EffectOutputsInvalidError extends WorkflowError<"effect-out
 }
 
 /**
- * Every terminal state an effect run can record. `done` and `failed` are
- * reported through completion ({@link EffectCompletionStatus}); `cancelled`
- * is engine-stamped only — an abort cancelling the entry before dispatch.
- * A cancellation is not a failure: anything counting failures (dashboards,
- * retry tooling) must not count aborted-away effects among them.
+ * Render completed effects' outputs as the `$effects` map — each effect's
+ * LATEST completed run with outputs wins, by name, across the whole
+ * history (outputs are workflow-scope handler results; the per-visit
+ * signal is `$effectStatus`).
  */
-export declare type EffectRunStatus = "done" | "failed" | "cancelled";
+export declare function effectOutputsMap(
+  instance: Pick<WorkflowInstance, "effectHistory">,
+): Record<string, unknown>;
 
-/**
- * EffectsContext entry kinds.
- */
-export declare const EFFECTS_CONTEXT_DISPLAY: {
-  "effectsContext.string": {
-    title: string;
-    description: string;
-  };
-  "effectsContext.number": {
-    title: string;
-    description: string;
-  };
-  "effectsContext.boolean": {
-    title: string;
-    description: string;
-  };
-  "effectsContext.ref": {
-    title: string;
-    description: string;
-  };
-  "effectsContext.json": {
-    title: string;
-    description: string;
-  };
-};
+export declare type EffectRunStatus = (typeof EFFECT_RUN_STATUSES)[number];
 
 declare const EffectSchema: v.StrictObjectSchema<
   {
@@ -3098,85 +3283,20 @@ declare const EffectSchema: v.StrictObjectSchema<
      * doesn't fit its shape — fails the completion (nothing is stored). Omitting
      * `outputs` is an EMPTY allowlist: the effect produces nothing, so any returned
      * output is rejected — the bound is universal, not opt-in.
-     * Why strict: `effectsContext` lives on the instance document, so the allowlist
-     * keeps it bounded — a handler can't accidentally spread a whole API response
-     * into the instance — and the declared shapes let tooling (e.g. the simulator's
-     * drain UI) suggest an effect's exact output keys. Declaring outputs also
-     * powers the advisory deploy-time producer/consumer lint.
-     */
-    readonly outputs: v.OptionalSchema<
-      v.ArraySchema<v.GenericSchema<FieldShape>, undefined>,
-      undefined
-    >;
-  },
-  undefined
->;
-
-/**
- * The named-params record effects bind against: what a caller supplies at
- * `startInstance` (stored as {@link WorkflowInstance.effectsContext} entries)
- * and what a handler's `outputs` merges back in (replace-by-key).
- *
- * Each value may be any JSON — a scalar, a {@link GlobalDocumentReference}, or
- * an arbitrary object/array. Scalars and GDRs store as their typed
- * `effectsContext` entries; anything else stores as one `effectsContext.json`
- * entry, so all forms read back the same under `$effects.<name>`.
- */
-export declare type EffectsContext = Record<string, unknown>;
-
-/**
- * Each entry is a named param the runtime hands to effect handlers via
- * binding resolution, rendered to conditions as `$effects.<name>`. **Set at
- * start (including a parent's `subworkflows.context` handoff); appended to
- * only by completed effects reporting `outputs`** — those land as one
- * `json` entry per effect, read as `$effects['<effect name>'].<output>`.
- * Never mutated by user-facing API.
- *
- * Critical: `effectsContext` is NOT a workflow field container.
- * Transition filters must NOT read it as fields. The workflow's fields live
- * on `fields[]`; external state lives in the lake (queryable via filters).
- */
-export declare type EffectsContextEntry =
-  | {
-      _key: string;
-      _type: "effectsContext.string";
-      name: string;
-      value: string;
-    }
-  | {
-      _key: string;
-      _type: "effectsContext.number";
-      name: string;
-      value: number;
-    }
-  | {
-      _key: string;
-      _type: "effectsContext.boolean";
-      name: string;
-      value: boolean;
-    }
-  | {
-      _key: string;
-      _type: "effectsContext.ref";
-      name: string;
-      /** GDR — see `../core/refs.ts` */
-      value: GlobalDocumentReference;
-    }
-  | {
-      _key: string;
-      _type: "effectsContext.json";
-      name: string;
-      value: string;
-    };
-
-/**
- * Render `effectsContext` as the `$effects` map. `json` entries decode to
- * their object form so a completed effect's outputs read namespaced:
- * `$effects['<effect name>'].<output>`.
- */
-export declare function effectsContextMap(
-  instance: Pick<WorkflowInstance, "effectsContext">,
-): Record<string, unknown>;
+     * Why strict: outputs land on the instance document's `effectHistory`, so
+     * the allowlist keeps it bounded — a handler can't accidentally spread a
+     * whole API response
+     * into the instance — and the declared shapes let tooling (e.g. the simulator's
+     * drain UI) suggest an effect's exact output keys. Declaring outputs also
+     * powers the advisory deploy-time producer/consumer lint.
+     */
+    readonly outputs: v.OptionalSchema<
+      v.ArraySchema<v.GenericSchema<FieldShape>, undefined>,
+      undefined
+    >;
+  },
+  undefined
+>;
 
 /** The `effectHistory` outcome {@link EffectNotFoundError} reports when the
  *  missing key belongs to a settled run. `detail` is the row's recorded
@@ -3274,18 +3394,30 @@ export declare interface Engine {
   /** The startable half of {@link Engine.instancesForDocument}: the latest
    *  deployed version of every definition that applies to the LOADED candidate
    *  document — startable, a required subject entry accepts its `_type`, and
-   *  `applicableWhen` passes. All matches, name ascending; advisory — a start
-   *  picker's filter, never enforcement. */
+   *  `start.filter` (browse-time-pure — `$fields` never binds) passes. All
+   *  matches, name ascending; advisory — a start picker's filter, never
+   *  enforcement. */
   definitionsForDocument: (
     args: DefinitionsForDocumentArgs,
   ) => Promise<DeployedDefinition[]>;
+  /** Pre-flight `startInstance`'s gates for a definition + the
+   *  `initialFields` gathered so far: the `start.allowed` verdict with its
+   *  insight (disable the start affordance on a definitive false AND say
+   *  why) plus the still-missing required inputs. Bindability-aware — a
+   *  predicate reading a not-yet-supplied entry reports `'unevaluable'`
+   *  with the entries named in `unboundReads`, never a collapsed verdict.
+   *  Pure read; the enforcement moment is `startInstance` itself. */
+  evaluateStart: (args: EvaluateStartArgs) => Promise<StartEvaluation>;
   /** GROQ query against the engine's workflow resource. `$tag`
    *  is bound for tag-scoped filtering. */
   query: <T = unknown>(args: QueryArgs) => Promise<T>;
   /** Snapshot-aware GROQ — runs against the same in-memory view the
-   *  engine's filters see for the supplied instance. The rendered scope's
-   *  instance-derived vars ({@link FILTER_SCOPE_VARS}) are bound, ids in
-   *  GDR URI form to match the snapshot's keying. */
+   *  engine's filters see for the supplied instance. The caller-free
+   *  rendered scope cascade gates evaluate in is bound — the
+   *  instance-derived vars ({@link FILTER_SCOPE_VARS}) with the open
+   *  stage's overlay merged into `$fields`, `$assigned` at its caller-free
+   *  `false`, plus the author's pre-evaluated `$<predicate>` booleans —
+   *  ids in GDR URI form to match the snapshot's keying. */
   queryInScope: <T = unknown>(args: QueryInScopeArgs) => Promise<T>;
   /** List every pending effect on an instance. */
   listPendingEffects: (args: InstanceRefArgs) => Promise<PendingEffect[]>;
@@ -3364,8 +3496,9 @@ export declare interface EngineScopeArgs {
    * docs that live in a different Sanity resource than the workflow). Called
    * with a parsed GDR; return a client for that resource, or undefined to let
    * the engine route it — `client` for the workflow resource itself, a
-   * sibling derived from `client`'s credentials for anything else. Engine-scope
-   * configuration — see `CreateEngineArgs`.
+   * sibling derived from `client`'s credentials for anything else. A served
+   * resource is also part of the declared surface for runtime-supplied refs.
+   * Engine-scope configuration — see `CreateEngineArgs`.
    */
   resourceClients?: ResourceClientResolver;
   /**
@@ -3385,6 +3518,16 @@ export declare interface EngineScopeArgs {
   idempotencyTtlMs?: number;
 }
 
+/**
+ * Pull the {@link GlobalDocumentReference} values out of `doc.ref` /
+ * `doc.refs` (content) field entries. Content only — release field entries come
+ * from {@link entryReleaseRefs}, so guard discovery (which reads this via
+ * `collectEntryDocUris`) stays scoped to content docs.
+ */
+export declare function entryDocRefs(
+  entries: unknown,
+): GlobalDocumentReference[];
+
 /**
  * Pure error helpers — no client, no I/O. The one home for the engine's
  * "coerce an unknown caught value" + "rethrow with context" idioms, so the
@@ -3482,6 +3625,46 @@ export declare function evaluateMutationGuard(args: {
   context: MutationContext;
 }): Promise<boolean>;
 
+/** Args for `evaluateStart` — the pre-flight read of `startInstance`'s gates
+ *  for a definition + the `initialFields` gathered so far (possibly none). */
+export declare interface EvaluateStartArgs {
+  /** The definition's `name` — which deployed workflow would be started. */
+  definition: string;
+  /** Optional explicit version. Defaults to the highest deployed version. */
+  version?: number;
+  /**
+   * The candidate seed, in `StartInstanceArgs.initialFields` shape. Partial
+   * mid-form input is expected and safe: the verdict is BINDABILITY-AWARE —
+   * when the predicate reads a declared entry these inputs don't supply,
+   * `outcome` reports `'unevaluable'` and {@link StartEvaluation.unboundReads}
+   * names the entries, instead of the collapsed answer GROQ equality would
+   * otherwise produce (`null == x` is false, not null — a definitive-looking
+   * verdict one more input could overturn, in either direction).
+   */
+  initialFields?: InitialFieldValue[];
+}
+
+/**
+ * Evaluate one `start.filter` in the start-filter context: `document` (may
+ * be absent — a root read is then GROQ null, fail-closed or vacuous-pass by
+ * shape) as the GROQ root, the {@link StartScope} bindings plus
+ * `$definition`, and — only when
+ * `analyzeCondition` says the filter reads the dataset — the scope's fetched
+ * slice as `*`. Cheap pure evaluation otherwise: no I/O rides a filter that
+ * never scans. GROQ null ("can't decide") is `false` — every consumer of
+ * this verdict fails closed; a parse/evaluation THROW is a malformed
+ * predicate, not an unevaluable one — rethrown loud, naming the definition
+ * (only writable by bypassing deploy validation), so every read surface that
+ * evaluates the filter reports the same context. A failed slice FETCH
+ * propagates as itself: transport trouble, never definition blame.
+ */
+export declare function evaluateStartFilter(args: {
+  filter: string;
+  definition: Pick<ApplicabilitySource, "name">;
+  document?: CandidateDocument | undefined;
+  scope?: StartScope | undefined;
+}): Promise<boolean>;
+
 /**
  * Well-known {@link ExecutionContext.kind} values. The field is a free
  * string — these are the shipped vocabulary, not a closed set.
@@ -3528,10 +3711,72 @@ export declare interface ExecutionContext {
   id?: string;
 }
 
+/**
+ * Executor classifications — who, if anyone, fires an activity's actions
+ * (shape-derived; see `./activity-kind.ts`).
+ */
+export declare const EXECUTOR_CLASSIFICATION_DISPLAY: {
+  autonomous: {
+    title: string;
+    description: string;
+  };
+  interactive: {
+    title: string;
+    description: string;
+  };
+  "off-system": {
+    title: string;
+    description: string;
+  };
+  hybrid: {
+    title: string;
+    description: string;
+  };
+};
+
+export declare const EXECUTOR_CLASSIFICATIONS: readonly [
+  "autonomous",
+  "interactive",
+  "off-system",
+  "hybrid",
+];
+
+export declare type ExecutorClassification =
+  (typeof EXECUTOR_CLASSIFICATIONS)[number];
+
 export { explainCondition };
 
 export { ExplainConditionArgs };
 
+/**
+ * Explain one `start.allowed` in the start-allowed context: no root (the
+ * subject rides `$fields.<entry>.id` — deploy rejects a root read), the
+ * {@link StartScope} bindings plus `$definition` and the caller's `$fields`
+ * map, and the scope's fetched slice as `*` when the predicate reads the
+ * dataset. Returns the full {@link ConditionInsight} — `outcome` is the
+ * verdict (`'satisfied'` allows; `'unsatisfied'`/`'unevaluable'` refuse,
+ * fail-closed) and the atom breakdown is what lets a surface disable its
+ * start affordance AND say why. One evaluator serves both moments:
+ * `startInstance` enforces the outcome, the `evaluateStart` verb pre-flights
+ * it.
+ *
+ * A dataset-reading predicate with no slice provider THROWS instead of
+ * failing closed: unlike a picker that merely hides a row, this verdict
+ * refuses starts — evaluating over an empty `*` would let a `count()`-style
+ * rule pass vacuously, and a silent "not allowed" would misreport a caller
+ * bug as an author verdict. Parse/evaluation throws rethrow naming the
+ * definition, like the filter's; a failed slice FETCH propagates as itself.
+ */
+export declare function explainStartAllowed(args: {
+  allowed: string;
+  definition: Pick<ApplicabilitySource, "name">;
+  /** The caller's input entries as a `$fields` map — the engine verbs build
+   *  it with `startFieldsParam` (field resolution's projection), so the
+   *  predicate can only see values the resolution would persist. */
+  fields: Record<string, unknown>;
+  scope?: StartScope | undefined;
+}): Promise<ConditionInsight>;
+
 /**
  * Extract the bare document `_id` from a GDR URI — what
  * `*[_id == $docId]` in GROQ needs.
@@ -3759,10 +4004,11 @@ declare type FieldSourceInternal =
 
 /**
  * The field tree of a persisted value — every leaf replaced by its type name
- * (`null` kept distinct from `object`), object keys sorted, arrays
- * element-wise so discriminated variants stay visible. The comparison form
- * the model-surface gates pin per model version, and the form ops tooling
- * can diff a live document against.
+ * (`null` kept distinct from `object`), object keys sorted by UTF-16 code
+ * unit (locale-independent, so the pinned ledgers canonicalise identically
+ * on every machine), arrays element-wise so discriminated variants stay
+ * visible. The comparison form the model-surface gates pin per model
+ * version, and the form ops tooling can diff a live document against.
  */
 export declare function fieldTreeShape(value: unknown): unknown;
 
@@ -3806,9 +4052,8 @@ export declare class FieldValueShapeError extends WorkflowError<"field-value-sha
 }
 
 /**
- * The subset that holds a value when the engine evaluates filters without a
- * caller (the cascade path: transition filters, activity `filter`/
- * `completeWhen`/`failWhen`).
+ * The subset that holds a value in the cascade gates (transition `when`s,
+ * activity filters, a cascade-fired action's `when`/`filter`).
  */
 export declare const FILTER_SCOPE_VARS: readonly string[];
 
@@ -3951,6 +4196,35 @@ export declare function gdrUri(
 ): GdrUri;
 
 /**
+ * The engine's reference value — deliberately NOT a lake reference, and
+ * spelled differently on purpose (`id`/`type`, never `_ref`/`_id`):
+ *
+ * - **`id` is a URI, not a bare doc id**, because workflow references cross
+ *   resources (another dataset, a media library) and a bare `_id` is only
+ *   meaningful inside one dataset. Everything resource-aware — client
+ *   routing, spawn discovery, guard target resolution — reads the resource
+ *   out of this URI. It is stripped to a bare lake id at exactly one
+ *   boundary: `paramsForLake` (core/params.ts), when a query actually runs
+ *   against a lake.
+ * - **`type` carries the target's schema type so consumers don't need a
+ *   fetch — as stamped by the ref's constructor, never verified against the
+ *   target.** Engine-built refs stamp it from real data (a projection row's
+ *   `_type`, the `releaseRef` constructor); a caller-supplied ref's `type`
+ *   is a trusted claim. Three advisory surfaces read it: the declared-subject-type
+ *   contract (an entry's `types: [...]` accepts/rejects incoming refs —
+ *   `refTypeIssues` at start `initialFields` and spawn `with`), start
+ *   applicability ("which definitions accept a doc of this `_type`" —
+ *   `acceptsDocumentType`), and guard `match.types` inference from resolved
+ *   targets (`resolveMatchTypes`). All must work when the target lives in a
+ *   resource the reader can't (or shouldn't) fetch from.
+ *
+ * In rendered GROQ this shape is what a reference-held value exposes
+ * (`$fields.<entry>.id` / `.type`) — whereas `_id`/`_type` belong to
+ * documents you hold (lake rows, `$row`, a dereferenced singular `doc.ref`).
+ * The spelling is not a namespace guarantee: a content document can carry
+ * its own `id`/`type` fields — what you're reading follows what the entry's
+ * declared kind puts in your hand, never the key's spelling.
+ *
  * `TType` preserves the `type` literal the constructors ({@link refDataset},
  * {@link gdrRef}, …) were called with, so a constructed ref satisfies
  * literal-typed targets (e.g. a `release.ref` value's `"system.release"`).
@@ -4207,6 +4481,11 @@ declare const GuardReadSchema: v.VariantSchema<
 /** Stored guards carry the printed string reads (the deploy resolver's input). */
 declare const GuardSchema: v.StrictObjectSchema<
   {
+    /**
+     * Lake-id-segment grammar (`^[a-z0-9][a-z0-9-]*$`, deploy-enforced): the
+     * guard's lake `_id` derives from `(instanceId, name)` at stage entry.
+     * Unique per definition.
+     */
     name: v.SchemaWithPipe<
       readonly [
         v.StringSchema<undefined>,
@@ -4278,8 +4557,9 @@ declare const GuardSchema: v.StrictObjectSchema<
     /**
      * Lake GROQ predicate — a distinct eval context: delta-mode GROQ
      * reading the `before()`/`after()` natives, `mutation`, `guard`, and
-     * `identity()`. Bare ids/fields only. Omitted or empty means
-     * UNCONDITIONAL DENY.
+     * `identity()`. Bare ids/fields only. Polarity: a result of strictly
+     * `true` ALLOWS the matched mutation; anything else (false, null, an
+     * evaluation error) DENIES. Omitted or empty means UNCONDITIONAL DENY.
      */
     predicate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
     /**
@@ -4380,10 +4660,6 @@ export declare const HISTORY_DISPLAY: {
     title: string;
     description: string;
   };
-  activityActivated: {
-    title: string;
-    description: string;
-  };
   activityStatusChanged: {
     title: string;
     description: string;
@@ -4475,14 +4751,6 @@ declare type HistoryEvent =
       reason?: string;
       actor?: Actor;
     }
-  | {
-      _key: string;
-      _type: "activityActivated";
-      at: string;
-      stage: StageName;
-      activity: ActivityName;
-      actor?: Actor;
-    }
   | {
       _key: string;
       _type: "activityStatusChanged";
@@ -4507,6 +4775,12 @@ declare type HistoryEvent =
        * person/agent/service/engine axis. Absent when no actor was supplied.
        */
       driverKind?: DriverKind;
+      /**
+       * The engine fired this action in a cascade (its `when` turned true) —
+       * {@link actor} is the cascading token that happened to execute it,
+       * not a caller who invoked `fireAction`.
+       */
+      triggered?: true;
     }
   | {
       _key: string;
@@ -4617,16 +4891,15 @@ declare type HistoryEvent =
       _type: "opApplied";
       at: string;
       stage: StageName;
-      /** The boundary that ran the op. For an action/transition/activation,
-       *  exactly one of activity/action/transition is set; for a direct edit
+      /** The boundary that ran the op. For an action fire (caller- or
+       *  cascade-fired), `activity` + `action` are set; for a direct edit
        *  (the edit seam), `edit` is set and `activity` carries the field's activity when
        *  the edited field is activity-scope; for an effect's completion ops,
        *  `effect` names the effect. */
       activity?: ActivityName;
       action?: ActionName;
-      transition?: string;
       /** Set when the op was a direct edit through the edit seam (`editField`),
-       *  not an action/transition/activation. */
+       *  not an action. */
       edit?: true;
       /** Set when the op came from an effect handler's completion (the state
        *  half of an effect); names the effect. */
@@ -4673,6 +4946,15 @@ export declare interface HydratedSnapshot {
   knownIds: Set<string>;
 }
 
+/**
+ * The in-flight arm — the one spelling of "not completed/aborted" every
+ * list surface's `includeCompleted` filter negates (the engine stamps
+ * `completedAt` on entry into any terminal stage, aborts included). A
+ * sibling of {@link tagScopeFilter} for list builders that compose their
+ * own conditions.
+ */
+export declare function inFlightFilter(): string;
+
 /**
  * Initial value for an `input`-sourced entry — what a caller supplies at
  * `startInstance` (or `setStage`). Same discriminator shape as
@@ -4706,15 +4988,12 @@ export declare type InsightSite =
       requirement: string;
     }
   | {
-      kind: "complete-when";
-      activity: string;
-    }
-  | {
-      kind: "fail-when";
+      kind: "action";
       activity: string;
+      action: string;
     }
   | {
-      kind: "action";
+      kind: "action-when";
       activity: string;
       action: string;
     }
@@ -4725,6 +5004,16 @@ export declare type InsightSite =
       activity?: string;
     };
 
+/**
+ * Mint the Sanity document `_id` for a workflow instance — a fresh
+ * {@link randomKey} suffix, so every instance (root or spawned child) gets a
+ * unique doc id under its tag. Lives in the shell, not `core/`, because it
+ * draws randomness; the deterministic {@link definitionDocId} is the pure-core
+ * counterpart. Bare form — Sanity rejects `:` in document IDs, so this is
+ * never a GDR URI.
+ */
+export declare function instanceDocId(tag: string): string;
+
 /**
  * The per-instance guard filter — the single definition of "this instance's
  * guards in one datasource". The engine's verdict load
@@ -4780,7 +5069,10 @@ export declare interface InstanceSession {
   /** Replace the held content with the current values the consumer observed
    *  (last-write-wins, scoped). A self-doc updates the held instance only when
    *  its `_updatedAt` is strictly newer — an older or timestamp-equal echo is
-   *  ignored. Buffered if a commit is in flight. */
+   *  ignored. Buffered if a commit is in flight; a BUFFERED push that fails
+   *  validation surfaces on the NEXT `update` call (after that call's own
+   *  docs are processed), never from the commit itself — the commit's
+   *  outcome is never masked by a store echo's failure. */
   update(docs: LoadedDoc[]): void;
   /** Replace the held live guards (the consumer's guard stream,
    *  last-write-wins). Guards are a separate stream from the watch-set:
@@ -4823,10 +5115,11 @@ export declare interface InstanceSession {
    *  replace the target's staged rows (last write wins); appends accumulate.
    *  Tolerant where commits are loud: a target that doesn't resolve in the
    *  current stage (it moved under a mounted editor), a closed edit window
-   *  (a pending activity's field before activation), or a value that doesn't
-   *  fit the field's shape yet (a half-typed date) stages an INERT preview —
-   *  no echo, no throw; the commit at the semantic boundary is the loud
-   *  surface. Never persisted — commit via {@link InstanceSession.editField}. */
+   *  (a skipped activity's field), a value that doesn't fit the field's
+   *  shape yet (a half-typed date), or a ref outside the declared resource
+   *  surface stages an INERT preview — no echo, no throw; the commit at the
+   *  semantic boundary is the loud surface. Never persisted — commit via
+   *  {@link InstanceSession.editField}. */
   previewField(args: {
     target: EditFieldTarget;
     mode?: EditMode;
@@ -4844,8 +5137,10 @@ export declare interface InstancesForDocumentArgs {
 
 /**
  * The instance-list GROQ for a {@link InstancesQueryFilter}, ordered by
- * `startedAt` ascending. Adapters subscribe to it; {@link workflow.query}
- * -style one-shot reads fetch it — both see the same rows.
+ * `startedAt` ascending (descending + sliced under
+ * {@link InstancesQueryFilter.limit}). Adapters subscribe to it;
+ * {@link workflow.query}-style one-shot reads fetch it — both see the same
+ * rows.
  */
 export declare function instancesQuery(args: {
   tag: string;
@@ -4889,6 +5184,14 @@ export declare interface InstancesQueryFilter {
   stage?: string;
   /** Include completed/aborted instances (default: in-flight only). */
   includeCompleted?: boolean;
+  /**
+   * Cap the read to the NEWEST `limit` instances — the query flips to
+   * `startedAt desc` and slices, so a bounded consumer (a dashboard over an
+   * unbounded dataset) reads the most recent rows instead of the oldest.
+   * Unlimited reads keep the ascending order adapters index by. Must be a
+   * positive integer.
+   */
+  limit?: number;
 }
 
 /**
@@ -4908,6 +5211,13 @@ export declare function instanceWatchesDocument(
   document: GdrUri,
 ): boolean;
 
+/** The trigger split: a `when` action is cascade-fired; without one it is
+ *  fireAction-fired. The single spelling of that test — structural over
+ *  `when` so authoring and stored shapes both qualify. */
+export declare function isCascadeFired(action: {
+  when?: string | undefined;
+}): boolean;
+
 /**
  * A claim whose lease has lapsed no longer protects the entry. A claim
  * without `leaseExpiresAt` (persisted before leases existed) counts as
@@ -4922,11 +5232,11 @@ export { isComparisonOp };
 
 /**
  * The full applicability derivation for one definition against one loaded
- * document: startable ∧ {@link acceptsDocumentType} ∧ `applicableWhen`.
+ * document: startable ∧ {@link acceptsDocumentType} ∧ `start.filter`.
  * "Deployed" is the caller's premise — feed it deployed definitions (the
  * engine verb `definitionsForDocument` does). Throws when `document` carries
- * no `_type` — that's a ref or a projection, not a loaded document. An
- * `applicableWhen` that doesn't PARSE also throws, naming the definition —
+ * no `_type` — that's a ref or a projection, not a loaded document. A
+ * `start.filter` that doesn't PARSE also throws, naming the definition —
  * that's a malformed definition (only writable by bypassing deploy
  * validation), and silently excluding it would make it vanish from every
  * picker with nothing screaming; only an evaluation result of GROQ null
@@ -4935,8 +5245,22 @@ export { isComparisonOp };
 export declare function isDefinitionApplicable(args: {
   definition: ApplicabilitySource;
   document: CandidateDocument;
+  /** Caller-side filter bindings — omit for the bare candidate-doc context. */
+  scope?: StartScope;
 }): Promise<boolean>;
 
+/**
+ * Whether an entry was scoped OUT at stage entry — the `filter` existence
+ * gate skipped it before it ever started. Distinct from an action-resolved
+ * `skipped` (real, started work whose entry carries `startedAt`): under
+ * filter-existence semantics render surfaces hide the former and keep the
+ * latter. The ONE spelling of that split.
+ */
+export declare function isFilterScopedOut(entry: {
+  status: ActivityStatus;
+  startedAt?: string | undefined;
+}): boolean;
+
 /** Type filter for GDR shape. */
 export declare function isGdr(value: unknown): value is GlobalDocumentReference;
 
@@ -4974,7 +5298,7 @@ export declare function isNotesEntry(
 /**
  * Whether a human may start this definition standalone (the default). A
  * `lifecycle: 'child'` definition is spawn-only — instantiated by a parent via
- * `activity.subworkflows`, so consumers exclude it from top-level start pickers.
+ * an action's `spawn`, so consumers exclude it from top-level start pickers.
  * Advisory: the engine does not enforce it (see the `required`-field backstop
  * for load-bearing input fields). Accepts any definition-shaped value (authored,
  * stored, deployed, or a projected list row).
@@ -4983,6 +5307,18 @@ export declare function isStartableDefinition(definition: {
   lifecycle?: WorkflowLifecycle | undefined;
 }): boolean;
 
+/**
+ * The SUBJECT-ENTRY RULE: a required `doc.ref` / `doc.refs` input entry is
+ * what makes a definition "about" a subject document. One predicate shared by
+ * applicability's type matching (`acceptsDocumentType`), the autonomous-start
+ * deploy invariant, and the root-read deploy check (a root-reading
+ * `start.filter` needs a subject entry to bind a candidate root) — so
+ * "counts as a subject" can't drift between them.
+ */
+export declare function isSubjectEntry(
+  entry: Pick<FieldEntry, "required" | "type">,
+): boolean;
+
 /**
  * The environment denial process shells (CLI, MCP server) feed
  * {@link createTelemetryIntake}: CI and `DO_NOT_TRACK` are trueish
@@ -5030,6 +5366,19 @@ export declare function isTodoListEntry(
  *  as null). The remaining columns stay loose (field validation owns them). */
 export declare function isTodoListItem(row: unknown): row is TodoListItem;
 
+/**
+ * True when the instance document exists but its start never finished: the
+ * `create` committed, yet priming (stage entry, activities, guard deploy)
+ * did not. The shape is legal and resumable — `startInstance` with the same
+ * `instanceId` completes the outstanding commits. Readers should present it
+ * as an incomplete start, never as a normal run sitting at its initial
+ * stage. Terminal instances are excluded: an aborted never-primed husk
+ * reads as aborted, not as still-resumable.
+ */
+export declare function isUnprimed(
+  instance: Pick<WorkflowInstance, "stages" | "completedAt" | "abortedAt">,
+): boolean;
+
 /**
  * Deterministic id so deploy/retract are query-free and idempotent. Derived
  * from the guard's authored `name` — an author-controlled handle that stays
@@ -5058,18 +5407,18 @@ export declare function latestDeployedDefinitions<
 
 /**
  * Advisory producer/consumer check for a deployed definition: every
- * `$effects['<name>'].<key>` read whose `<name>` is a declared effect that
- * declares its `outputs` but does not list `<key>`. Returns human-readable
- * warning strings (empty when clean) — deploy surfaces them, it never rejects.
- * (Runtime completion is where declared `outputs` are ENFORCED; this only warns
- * the author at deploy about a consumer read of a key no producer declares.)
+ * `$effects['<name>'].<key>` read whose `<name>` is not a declared effect,
+ * or is one whose declared `outputs` do not list `<key>`. Returns
+ * human-readable warning strings (empty when clean) — deploy surfaces them,
+ * it never rejects. (Runtime completion is where declared `outputs` are
+ * ENFORCED; this only warns the author at deploy about a consumer read no
+ * producer declares.)
  *
- * Advisory-strength by design: it flags reads against DECLARED effects only. A
- * name that is not a declared effect is left alone — it may be a `startInstance`
- * `effectsContext` seed key or a `subworkflows.context` handoff key, runtime
- * producers the static definition cannot see. An effect that declares no
- * `outputs` produces nothing (an empty allowlist), so a keyed read of it is
- * flagged like any undeclared key.
+ * `$effects` derives solely from completed effects' outputs — the start
+ * seed and spawn handoff live in `$context` — so every producer IS a
+ * declared effect and an unknown name is warnable, not tolerated. An
+ * effect that declares no `outputs` produces nothing (an empty allowlist),
+ * so a keyed read of it is flagged like any undeclared key.
  *
  * Reads are collected from the primary consumer sites: condition GROQ
  * ({@link conditionSitesOf}), effect binding GROQ, and guard reads (the
@@ -5171,8 +5520,8 @@ export declare type MissingHandlerPolicy =
  * read in {@link resolveInputValue}, but is stricter: a present-but-null/
  * undefined value counts as absent here (a required field needs a real
  * value), whereas {@link resolveInputValue} passes a null fill straight
- * through. Exported so pre-flight validators (e.g. a start gate) share the
- * engine's own rule instead of mirroring it.
+ * through. Exported so pre-flight validators (e.g. mapping validation) share
+ * the engine's own rule instead of mirroring it.
  */
 export declare function missingRequiredInputs(args: {
   entryDefs: readonly FieldEntry[];
@@ -5328,6 +5677,8 @@ export declare interface MutationGuardDoc extends MutationGuardBody {
   _updatedAt?: string;
 }
 
+export declare const MutationGuardDocSchema: v.GenericSchema<MutationGuardDoc>;
+
 export declare interface MutationGuardMatch {
   types?: string[];
   /** Bare document ids (resource-local; both published and `drafts.` forms). */
@@ -5336,6 +5687,14 @@ export declare interface MutationGuardMatch {
   actions: MutationGuardAction[];
 }
 
+/** Every wait narrated, de-duplicated by phrase: same-named actions on
+ *  sibling activities are distinct waits that tell one story — consumers
+ *  want one line per story, not one per site. */
+export declare function narrateAutonomyWaits(
+  waits: readonly AutonomyWait[],
+  ctx: DescribeContext,
+): string[];
+
 /** The default logger: emit nothing. The engine's twin of `@sanity/telemetry`'s `noopLogger`. */
 export declare const noopTelemetry: WorkflowTelemetryLogger;
 
@@ -5446,6 +5805,19 @@ export declare function parentRef(
   instance: Pick<WorkflowInstance, "ancestors">,
 ): GlobalDocumentReference | undefined;
 
+/**
+ * Parse one incoming definition at the deploy/diff boundary (`caller` prefixes
+ * the error). Accepts authored content or a fetched definition document — the
+ * document envelope is stripped (the inverse of the deploy serialisation, so a
+ * fetched document round-trips to `unchanged` instead of fingerprinting its
+ * envelope as content), then the remainder strict-parses against the stored
+ * schema: any unknown key anywhere in the tree fails loud.
+ */
+export declare function parseDefinitionInput(
+  def: Record<string, unknown>,
+  caller: string,
+): WorkflowDefinition;
+
 /**
  * The ONE way to read an instance's frozen {@link WorkflowInstance.definitionSnapshot}
  * back into a {@link WorkflowDefinition} — wraps the parse so a corrupt
@@ -5474,6 +5846,23 @@ export declare interface ParsedGdr {
  */
 export declare function parseGdr(uri: string): ParsedGdr;
 
+/**
+ * Parse a fetched guard document, failing hard with a
+ * {@link PersistedDocShapeError} naming the document and every offending
+ * field. No model-version gate: the guard doc carries no stamp by design —
+ * its `_type` cutover is its versioning event.
+ */
+export declare function parseGuardDocument(doc: unknown): MutationGuardDoc;
+
+/**
+ * Parse a fetched `sanity.workflow.instance` document, failing hard with a
+ * {@link PersistedDocShapeError} naming the document and every offending
+ * field. The caller's model-version gate (`assertReadableModel`) comes
+ * FIRST — a doc from beyond the reader floor is a governed
+ * `ModelVersionAheadError`, not a shape error.
+ */
+export declare function parseInstanceDocument(doc: unknown): WorkflowInstance;
+
 /**
  * Parse a resource-shaped GDR (`<type>:<id>`, no document part) into the
  * {@link WorkflowResource} it names. The one grammar for resource addresses —
@@ -5562,6 +5951,26 @@ export declare interface PendingEffectClaim {
   leaseExpiresAt?: string;
 }
 
+/**
+ * A persisted engine-owned document failed its shape parse — the stored
+ * field tree does not match what this engine's data model declares for the
+ * doc type. Distinct from {@link ModelVersionAheadError} (a declared,
+ * governed fence: upgrade the engine); this is UNGOVERNED corruption — a
+ * document no conforming engine wrote — and the read fails hard instead of
+ * letting the malformed value corrupt behavior downstream. The issues name
+ * every offending field path.
+ */
+export declare class PersistedDocShapeError extends WorkflowError<"persisted-doc-shape"> {
+  readonly documentId: string;
+  readonly documentType: string;
+  readonly issues: ValidationIssue[];
+  constructor(args: {
+    documentId: string;
+    documentType: string;
+    issues: ValidationIssue[];
+  });
+}
+
 /**
  * One row of the instance's idempotency ledger — a caller-supplied
  * `idempotencyKey` a state-changing verb already committed under. Recorded in
@@ -5601,6 +6010,26 @@ export declare function processShellUserProperties<
   runtimeVersion: string;
 };
 
+/**
+ * Project a store-resolved doc onto its watch ref's identity, the way the
+ * lake's perspective reads do: the published-form id becomes `_id` (the form
+ * the session keys its overlay and snapshot by), and a draft/version
+ * representation's stored id rides along as `_originalId` — session-side
+ * conditions (including the `_originalId in path("versions.**")` shape) then
+ * read exactly what the engine's own hydration ({@link contentDocQuery})
+ * returns. Strict by construction: only the ids in
+ * {@link watchRefRepresentations} are accepted — an id that merely *ends* in
+ * the watched id (another doc's dotted id under a version prefix), a release
+ * the perspective doesn't read, or a draft the perspective makes invisible is
+ * a store routing bug, and projecting it would make content the engine's read
+ * can never see impersonate the watched doc silently, so it throws instead.
+ */
+export declare function projectToWatchRef(args: {
+  doc: SanityDocument;
+  ref: SubscriptionDocument;
+  perspective: WorkflowPerspective | undefined;
+}): SanityDocument;
+
 export declare interface QueryArgs {
   groq: string;
   params?: Record<string, unknown>;
@@ -5610,6 +6039,14 @@ export declare interface QueryInScopeArgs extends InstanceRefArgs, QueryArgs {}
 
 export { quoted };
 
+/**
+ * The one spelling of the instance read discipline — model gate
+ * ({@link assertReadableModel}) first, shape parse
+ * ({@link parseInstanceDocument}) second — shared by the point-read funnel
+ * above and the list-read sites that fetch instance rows in bulk.
+ */
+export declare function readInstanceDoc(doc: SanityDocument): WorkflowInstance;
+
 /**
  * Whether a watched ref reads RAW — never perspective-scoped. The
  * instance, its ancestors, and its spawned children (all instance docs), and
@@ -5621,6 +6058,18 @@ export { quoted };
  */
 export declare function readsRaw(ref: { type: string }): boolean;
 
+/**
+ * Whether a GROQ expression reads its ROOT document — the candidate document
+ * a `start.filter` binds as root. A bare attribute access (`_type == 'task'`)
+ * or `@` in the OUTER scope reads the root; the same inside a construct that
+ * rebinds the implicit `this` per element (`*[...]` filters, projections,
+ * `map`/pipe traversals) addresses THOSE items, so it doesn't. `^` (Parent)
+ * climbs scopes — one that escapes past the outermost scope lands back on the
+ * root and counts, wherever it is nested. A malformed expression reads
+ * nothing here ({@link conditionSyntaxIssues} owns the parse error).
+ */
+export declare function readsRootDocument(groq: string): boolean;
+
 /** Make a GDR pointer to a Canvas-resource doc. */
 export declare function refCanvas<TType extends string = string>({
   resourceId,
@@ -5655,6 +6104,18 @@ export declare function refMediaLibrary<TType extends string = string>({
   type,
 }: ResourceRefArgs<TType>): GlobalDocumentReference<TType>;
 
+/**
+ * Thrown when a field write carries a ref to a resource outside the
+ * declared surface. The write does not commit; the engine has not mutated
+ * state.
+ */
+export declare class RefResourceUndeclaredError extends WorkflowError<"ref-resource-undeclared"> {
+  readonly entryType: string;
+  readonly entryName: string;
+  readonly issues: string[];
+  constructor(args: { entryName: string; entryType: string; issues: string[] });
+}
+
 /**
  * The GDR `type`s in a `doc.ref` / `doc.refs` value that the entry's declared
  * accepted `types` reject — empty when the value conforms, the entry declares
@@ -5720,8 +6181,8 @@ export declare function remediationsFor(
 /**
  * A verb that would unstick a {@link StuckCause} — the *what to do about it*
  * half of a diagnosis. Surface-neutral identifiers; a consumer maps each to
- * its own command or button. `retry-effect`, `drain-effects` and `reset-activity`
- * are not yet callable engine operations — see {@link SuggestedRemediation.available}.
+ * its own command or button. `retry-effect` and `reset-activity` are not yet
+ * callable engine operations — see {@link SuggestedRemediation.available}.
  */
 export declare type RemediationVerb =
   | "retry-effect"
@@ -5846,9 +6307,10 @@ export declare function resolveFieldEntry(
 export declare type ResourceAliases = Record<string, WorkflowResource>;
 
 /**
- * Collapse a deployment's `resourceAliases` bindings into the engine's
- * {@link ResourceAliases} map (handle name → physical resource) — the shape
- * {@link deployDefinitions} consumes.
+ * Collapse a deployment's `resourceAliases` bindings into the
+ * {@link ResourceAliases} map (handle name → physical resource) that
+ * `deployDefinitions` expands `@<handle>:` references against. Deploy-time
+ * only — the map never reaches any other verb.
  */
 export declare function resourceAliasesToMap(
   resourceAliases: WorkflowDeployment["resourceAliases"],
@@ -5861,6 +6323,10 @@ export declare function resourceAliasesToMap(
  * engine route it — its own client for the workflow resource, a derived
  * sibling ({@link WorkflowClient.withConfig}) for anything else.
  *
+ * Serving a resource also DECLARES it on the written-ref surface: the write
+ * boundaries probe this resolver per ref, so narrowing a resolver rejects
+ * refs to the resources it stops serving.
+ *
  * Resolved clients ride the engine's API version like every other engine
  * client: the verb scope rebinds them onto `ENGINE_API_VERSION` when they
  * carry {@link WorkflowClient.withConfig} (one without it is used as
@@ -5895,6 +6361,13 @@ declare interface ResourceRefArgs<TType extends string> {
   type: TType;
 }
 
+export declare interface ResourceSurface {
+  /** True when the parsed GDR targets a declared resource. */
+  allows: (parsed: ParsedGdr) => boolean;
+  /** Prose rendering of the declared surface, for rejection messages. */
+  description: string;
+}
+
 /**
  * Retract every guard for a stage being exited (lift predicate to allow), but
  * only once the instance has genuinely moved off that stage — or was aborted
@@ -5966,6 +6439,23 @@ declare const RoleAliasesSchema: v.RecordSchema<
   undefined
 >;
 
+/** Whether two workflow resources address the same place. */
+export declare function sameResource(
+  a: WorkflowResource,
+  b: WorkflowResource,
+): boolean;
+
+/**
+ * The DECLARED field tree of a runtime schema — every entry key (optional
+ * keys marked `key?`), every enum vocabulary, every variant arm — walked out
+ * of valibot's runtime shape. The declared twin of `fieldTreeShape` (which
+ * walks a CONCRETE document): the model-surface gate pins persisted doc
+ * types by what their schema declares, so an optional field no fixture
+ * reaches is still ledger-visible. Recursive grammars (a field shape nesting
+ * field shapes) close with a `'(circular)'` marker.
+ */
+export declare function schemaTreeShape(schema: v.GenericSchema): unknown;
+
 export { ScopeAssignment };
 
 export { sentenceCase };
@@ -6010,6 +6500,21 @@ export declare type Stage = StageFields<
   Editable
 >;
 
+/** A stage's rollup: progress through any exit transition, plus each
+ *  activity's own completion answer. */
+export declare interface StageAutonomy extends AutonomyAnswer {
+  stage: string;
+  activities: Record<string, AutonomyAnswer>;
+}
+
+/** The stage slice of a rollup. Total by construction — the rollup derives
+ *  from the same `definition.stages` consumers iterate, so a miss is an
+ *  engine bug worth failing loud on. */
+export declare function stageAutonomyOf(
+  autonomy: WorkflowAutonomy,
+  stageName: string,
+): StageAutonomy;
+
 export declare interface StageEntry {
   _key: string;
   name: StageName;
@@ -6025,6 +6530,9 @@ export declare interface StageEvaluation {
   stage: Stage;
   activities: ActivityEvaluation[];
   transitions: TransitionEvaluation[];
+  /** The stage's causal-autonomy rollup — will it progress without a caller,
+   *  and what does it wait on. Definition-derived, identical for every actor. */
+  autonomy: StageAutonomy;
 }
 
 /** Type-mirror of {@link stageFields}, parameterised over field/activity/transition/guard/editable. */
@@ -6057,6 +6565,118 @@ declare interface StageGuardArgs {
 
 export declare type StageName = string;
 
+/**
+ * The vars a definition's `start.allowed` reads — the start-time permission
+ * dialect: everything the filter context binds ({@link START_FILTER_VARS})
+ * plus `$fields`, which start time always has. No candidate root ever binds
+ * here (the subject rides `$fields.<entry>.id`; a root read is
+ * deploy-rejected), so a false/GROQ-null verdict is genuinely fail-closed —
+ * there is no unbound-binding ambiguity to caveat. Bound in one place:
+ * `startContextParams` in the applicability evaluator.
+ */
+export declare const START_ALLOWED_VARS: readonly {
+  name: string;
+  description: string;
+}[];
+
+/**
+ * The vars a definition's `start.filter` reads — the start-filter dialect,
+ * not the rendered condition scope (no {@link ConditionVarBinding}: these
+ * bind only while the filter is evaluated on the READ side — the
+ * `definitionsForDocument` derivation and the Studio start control).
+ * `startInstance` never evaluates the filter. BROWSE-TIME-PURE: every var is
+ * knowable before any inputs exist, so `$fields` is deliberately absent — a
+ * `$fields` read in a filter is deploy-rejected with a pointer to
+ * `start.allowed`, the context that binds it. An absent binding evaluates to
+ * GROQ null; the VERDICT-level coercion (null result ⇒ not applicable) is
+ * what fails closed — what a null read does inside the expression depends on
+ * its shape. Bound in one place: `startContextParams` in the applicability
+ * evaluator.
+ */
+export declare const START_FILTER_VARS: readonly {
+  name: string;
+  description: string;
+}[];
+
+declare const START_KINDS: readonly ["interactive", "autonomous"];
+
+export declare type StartBlock = StartFields & {
+  kind: StartKind;
+};
+
+/**
+ * The start-time seed a caller supplies at `startInstance`, stored as
+ * {@link WorkflowInstance.context} entries and read back as
+ * `$context.<name>`. Written only at start — a completed effect's
+ * `outputs` live on the run row and read as `$effects`, a separate bag.
+ *
+ * Each value may be any JSON — a scalar, a {@link GlobalDocumentReference}, or
+ * an arbitrary object/array. Scalars and GDRs store as their typed
+ * `context` entries; anything else stores as one `context.json` entry.
+ */
+export declare type StartContext = Record<string, unknown>;
+
+/**
+ * What `evaluateStart` projects — the same gates `startInstance` enforces,
+ * as renderable state. `allowed` and `missingRequired` are deliberately
+ * orthogonal: a missing required input is a caller mistake (the verb throws
+ * `RequiredFieldNotProvidedError` for it), never a `start.allowed` verdict.
+ */
+export declare interface StartEvaluation {
+  /** The `start.allowed` verdict — `outcome === 'satisfied'`. Vacuously true
+   *  when the definition declares no `allowed`, exactly like the verb. */
+  allowed: boolean;
+  /**
+   * Three-valued, BINDABILITY-AWARE verdict: `'unsatisfied'` is a definitive
+   * no for these inputs (disable and explain), `'unevaluable'` means the
+   * predicate can't be decided yet — either a null operand reached an
+   * ordered comparison, or the predicate reads an entry `initialFields`
+   * doesn't supply ({@link StartEvaluation.unboundReads} non-empty). Keep
+   * the affordance enabled on `'unevaluable'`; `startInstance` still
+   * enforces the final verdict, where absence is final rather than
+   * provisional.
+   */
+  outcome: ConditionOutcome;
+  /** The `start.allowed` atom breakdown over the SUPPLIED inputs — what to
+   *  render next to a disabled start affordance. Present iff the definition
+   *  declares `allowed`. With `unboundReads` non-empty its own `outcome` may
+   *  be a collapsed provisional answer — the top-level `outcome` is the
+   *  trustworthy one. */
+  insight?: ConditionInsight;
+  /** The `$fields` entries the predicate reads that `initialFields` doesn't
+   *  supply — "fill these to decide". Non-empty forces `outcome:
+   *  'unevaluable'`. Empty when the definition declares no `allowed`. */
+  unboundReads: string[];
+  /** Required input entries `initialFields` doesn't fill yet — the rows a
+   *  `startInstance` now would throw `RequiredFieldNotProvidedError` about. */
+  missingRequired: {
+    name: string;
+    type: FieldEntry["type"];
+  }[];
+}
+
+/** Type-mirror of {@link startFields}: how standalone runs of this workflow
+ *  begin. Stored requires `kind` (desugar fills the `'interactive'` default);
+ *  authoring may omit it — so each variant declares it. */
+declare type StartFields = {
+  filter?: string | undefined;
+  allowed?: string | undefined;
+};
+
+/**
+ * Project caller-supplied `initialFields` into the `$fields` map the
+ * start-allowed context binds: one key per declared `input`-sourced entry,
+ * resolved through {@link suppliedFieldFor} — the predicate can only ever see
+ * a value the input resolution would persist, and an undeclared supplied name
+ * never leaks in. Unsupplied (or null-supplied) entries stay unbound, so a
+ * read of one is GROQ null. Document references bind as their GDR envelopes
+ * (`$fields.<entry>.id` is the GDR URI).
+ */
+export declare function startFieldsParam(args: {
+  entryDefs: readonly FieldEntry[];
+  initialFields: readonly InitialFieldValue[];
+}): Record<string, unknown>;
+
 export declare interface StartInstanceArgs {
   /** The definition's `name` — which deployed workflow to instantiate. */
   definition: string;
@@ -6079,17 +6699,25 @@ export declare interface StartInstanceArgs {
   initialFields?: InitialFieldValue[];
   ancestors?: GlobalDocumentReference[];
   /**
-   * Stable named params for effect handlers, set at start time. The
-   * runtime resolves effect bindings against these to materialise
-   * handler params at queue time. **Not read by transition filters.**
+   * The instance's start seed — stable named values set once at start (or
+   * handed down by a parent's `spawn.context`) and never mutated after.
+   * Effect bindings and conditions read them as `$context.<name>`; the
+   * `$effects` bag is separate (completed effects' outputs only).
    *
    * Each value may be any JSON — a scalar, a {@link GlobalDocumentReference},
    * or an arbitrary object/array. Scalars and GDRs store as their typed
-   * `effectsContext` entries; anything else stores as one `effectsContext.json`
-   * entry, so all forms read back the same under `$effects.<name>`.
+   * `context` entries; anything else stores as one `context.json`
+   * entry, so all forms read back the same under `$context.<name>`.
+   */
+  context?: StartContext;
+  /**
+   * Caller-supplied id; auto-generated otherwise (mint one with
+   * `instanceDocId`). This is start's idempotency key: a retry carrying the
+   * same id resumes the earlier attempt's outstanding commits instead of
+   * creating a duplicate — the per-instance request ledger can't cover the
+   * create (it lives on the instance document), so id identity is the rail.
+   * Inputs bind on the create only; a resume never re-reads them.
    */
-  effectsContext?: EffectsContext;
-  /** Caller-supplied id; auto-generated otherwise. */
   instanceId?: string;
   /**
    * URL path on the supplied client where the engine fetches the
@@ -6118,6 +6746,122 @@ export declare interface StartInstanceArgs {
   perspective?: WorkflowPerspective;
 }
 
+/**
+ * Who initiates a standalone run of this workflow: a person picking it from a
+ * start surface (`'interactive'`, the default) or a system reacting to a
+ * document event (`'autonomous'`). PURE CLASSIFICATION — consumers use it to
+ * shape their surfaces (hide autonomous workflows from human pickers, list
+ * interactive ones for editors); `startInstance` is one verb and one code
+ * path for every kind, and an interactive start of an autonomous workflow is
+ * legal.
+ */
+export declare type StartKind = (typeof START_KINDS)[number];
+
+/**
+ * The declared {@link StartKind} of a definition, defaulting the absent
+ * `start` block to `'interactive'` — the one reading rule for every consumer,
+ * so definitions deployed before the block existed classify unchanged.
+ * Classification only: the engine never gates on it.
+ */
+export declare function startKindOf(definition: {
+  start?:
+    | {
+        kind?: StartKind | undefined;
+      }
+    | undefined;
+}): StartKind;
+
+/**
+ * Thrown by `startInstance` when the definition's `start.allowed` predicate
+ * is not satisfied for the supplied `initialFields` — evaluated false, or
+ * GROQ null ("can't decide"; fail-closed, `insight.outcome` tells the two
+ * apart). Carries the full {@link ConditionInsight} so a consumer renders
+ * the same explanation the `evaluateStart` pre-flight would have shown.
+ * There is no override arg — like `fireAction`, you don't bypass a verdict,
+ * you change what produces it. Advisory under races like every engine-side
+ * check.
+ */
+export declare class StartNotAllowedError extends WorkflowError<"start-not-allowed"> {
+  readonly definition: string;
+  readonly insight: ConditionInsight;
+  constructor(args: { definition: string; insight: ConditionInsight });
+}
+
+/**
+ * Thrown when a start fails AFTER its create committed but BEFORE priming:
+ * the instance document exists, unprimed (see {@link isUnprimed}) — a
+ * genuinely failed start, but a RESUMABLE one. The error names the id so
+ * every surface's failure message can point at the retry rail: retrying
+ * `startInstance` with this `instanceId` finishes the start instead of
+ * creating a duplicate; aborting the instance discards it.
+ */
+export declare class StartNotPrimedError extends WorkflowError<"start-not-primed"> {
+  readonly instanceId: string;
+  constructor(args: { instanceId: string; cause: unknown });
+}
+
+/**
+ * Thrown when a start's first cascade fails AFTER the instance was created
+ * and primed: the run exists — stage entered, activities active, guards
+ * deployed — it just hasn't auto-advanced to a stable stage yet. Callers
+ * must not present this as a failed start: the workflow IS running, and a
+ * `tick` (or retrying `startInstance` with the same `instanceId`) resumes
+ * the settling.
+ */
+export declare class StartNotSettledError extends WorkflowError<"start-not-settled"> {
+  readonly instanceId: string;
+  /** The primed instance re-read after the cascade failure — absent when
+   *  that best-effort read also failed. */
+  readonly instance?: WorkflowInstance;
+  constructor(args: {
+    instanceId: string;
+    instance?: WorkflowInstance;
+    cause: unknown;
+  });
+}
+
+/**
+ * Why a definition can't be started standalone, or `undefined` when it can.
+ * Advisory — the engine itself does not refuse ({@link isStartableDefinition})
+ * — but a start surface has no way to supply the parent context a spawn-only
+ * child expects, so it fails fast with this message instead.
+ */
+export declare function startRefusal(definition: {
+  lifecycle?: WorkflowLifecycle | undefined;
+}): string | undefined;
+
+/**
+ * The caller-side half of the start contexts — everything the evaluating
+ * surface knows that the definition doesn't. Every member is optional
+ * because the surfaces genuinely differ (a pure consumer may hold no clock):
+ * an absent binding evaluates each read of it to GROQ null, and where that
+ * null lands decides the verdict — a predicate that can't decide without
+ * the binding fails closed, while a count-of-matches clause over values
+ * every row stores passes vacuously (in GROQ null equals only null, so the
+ * unbound read matches no stored value). The vars themselves are
+ * inventoried in `START_FILTER_VARS` / `START_ALLOWED_VARS`; the caller's
+ * `$fields` map is NOT scope — `start.filter` never binds it, and
+ * `explainStartAllowed` takes it as its own argument.
+ */
+export declare interface StartScope {
+  /** The engine's tag partition — binds `$tag`. */
+  tag?: string | undefined;
+  /** ISO clock reading — binds `$now`. */
+  now?: string | undefined;
+  /**
+   * The WORKFLOW resource's dataset, for predicates that read it (`*[...]` or
+   * a deref) — invoked lazily, only when `analyzeCondition` says the
+   * predicate needs it. A slice is fine as long as it covers what predicates
+   * scan; the engine verbs supply EVERY instance of the tag, completed
+   * included — `*` carries no hidden predicate, so authors qualify in-flight
+   * themselves (`!defined(completedAt)`). Absent ⇒ a dataset-reading filter
+   * fails closed (this surface cannot see the dataset, so it cannot decide),
+   * while a dataset-reading `allowed` THROWS — see
+   * {@link explainStartAllowed}.
+   */
+  fetchDataset?: (() => Promise<unknown[]>) | undefined;
+}
+
 /**
  * Declared editability of a field — the generic edit seam's gate. Default
  * (absent) is NOT editable: a field is op-only engine working memory unless the
@@ -6468,7 +7212,7 @@ declare const StoredOpSchema: v.VariantSchema<
           ]
         >;
         readonly status: v.PicklistSchema<
-          readonly ["pending", "active", "done", "skipped", "failed"],
+          readonly ["active", "done", "skipped", "failed"],
           `Invalid option: expected one of ${string}`
         >;
       },
@@ -6507,7 +7251,7 @@ export declare type StuckCause =
       kind: "no-transition-fires";
     }
   /**
-   * Every activity resolved, but an exit transition's filter is *unevaluable*
+   * Every activity resolved, but an exit transition's `when` is *unevaluable*
    * (GROQ `null` — a referenced operand is missing/unreadable), so selection
    * halts. Unlike {@link StuckCause} `no-transition-fires` this is recoverable:
    * the cascade re-fires once the operand resolves (e.g. the subject is
@@ -6582,6 +7326,12 @@ export declare interface SubworkflowEntry {
   _key: string;
   /** The spawning activity's name. */
   activity: ActivityName;
+  /**
+   * The spawning ACTION's name — rows key per (activity entry, spawning
+   * action), so two spawn actions on one activity can never cross-adopt
+   * each other's children.
+   */
+  action: string;
   /** The child definition's `name` — adoption never crosses definitions. */
   definition: string;
   /**
@@ -6705,8 +7455,8 @@ declare const SubworkflowsSchema: v.StrictObjectSchema<
     >;
     /**
      * Extra values evaluated in the parent's rendered scope at spawn time and
-     * delivered into each subworkflow's `$effects` bag — the parent→child
-     * handoff, read exactly like an effect output.
+     * delivered into each subworkflow's `$context` bag — the parent→child
+     * handoff.
      */
     readonly context: v.OptionalSchema<
       v.RecordSchema<
@@ -6728,13 +7478,13 @@ declare const SubworkflowsSchema: v.StrictObjectSchema<
     >;
     /**
      * What happens to still-live children when their cohort's scope stops
-     * applying — the spawning stage exits, or a re-entry's `forEach` no longer
+     * applying — the spawning stage exits, or a re-fire's `forEach` no longer
      * discovers their row. `'detach'` (the default) lets them run to
      * completion outside the gate; `'abort'` kills them (recursively). The
      * engine never destroys in-flight work implicitly — `'abort'` is always
      * an authored choice. Note this governs only the CHILDREN's fate; whether
-     * the parent may move at all is what gates (`completeWhen`, transition
-     * filters over `$subworkflows`) decide.
+     * the parent may move at all is what gates (conditions over
+     * `$subworkflows`) decide.
      */
     readonly onExit: v.OptionalSchema<
       v.PicklistSchema<
@@ -6910,46 +7660,42 @@ export declare interface TodoListItem {
   dueDate?: string | null;
 }
 
-export declare type Transition = TransitionFields<TransitionOp> & {
-  filter: string;
+export declare type Transition = TransitionFields & {
+  when: string;
 };
 
 export declare interface TransitionEvaluation {
   transition: Transition;
   /**
-   * Whether the transition's filter is definitively satisfied at read time.
-   * Projected caller-free, exactly as the engine's cascade evaluates it — the
-   * evaluation's actor and grants never participate.
+   * Whether the transition's `when` trigger is definitively satisfied at read
+   * time. Projected caller-free, exactly as the engine's cascade evaluates
+   * it — the evaluation's actor and grants never participate.
    */
-  filterSatisfied: boolean;
+  whenSatisfied: boolean;
   /**
-   * The filter evaluated to GROQ `null` — a referenced operand was missing or
-   * incomparable, so it couldn't be decided. `filterSatisfied` is `false`, but
+   * The trigger evaluated to GROQ `null` — a referenced operand was missing or
+   * incomparable, so it couldn't be decided. `whenSatisfied` is `false`, but
    * this is a *recoverable hold*, not a deliberate `false`: the engine halts
    * selection (it won't fall through to a later transition) and the cascade
    * re-fires once the operand resolves. Lets a diagnosis tell an undecidable
    * hold apart from a genuine routing dead-end.
    */
   unevaluable: boolean;
-  /** Derived state of the transition's filter — the atoms standing between
-   *  here and the next stage. `filterSatisfied`/`unevaluable` are projections
+  /** Derived state of the transition's `when` trigger — the atoms standing between
+   *  here and the next stage. `whenSatisfied`/`unevaluable` are projections
    *  of `insight.outcome`; one evaluation feeds all three. */
   insight: ConditionInsight;
 }
 
-/** Type-mirror of {@link transitionFields} minus `filter` — stored requires it,
+/** Type-mirror of {@link transitionFields} minus `when` — stored requires it,
  *  authoring omits it (desugar fills the default), so each variant declares it. */
-declare type TransitionFields<TOp> = {
+declare type TransitionFields = {
   name: string;
   title?: string | undefined;
   description?: string | undefined;
   to: string;
-  ops?: TOp[] | undefined;
-  effects?: Effect[] | undefined;
 };
 
-export declare type TransitionOp = FieldOp;
-
 /**
  * Parse a GDR URI, returning `undefined` instead of throwing when the string
  * is not a GDR (or is malformed). The "is this a GDR, and if so its parts"
@@ -6958,6 +7704,29 @@ export declare type TransitionOp = FieldOp;
  */
 export declare function tryParseGdr(uri: string): ParsedGdr | undefined;
 
+/**
+ * The `$fields` entries a `start.allowed` predicate reads that `fields` does
+ * not bind — the BINDABILITY rule every pre-flight surface applies before
+ * trusting a verdict over possibly-incomplete inputs. GROQ equality against
+ * a missing operand collapses to a definitive-looking answer (`null == x` is
+ * false, not null), so a verdict that read an unbound entry is PROVISIONAL in
+ * both directions: supplying the entry could overturn a refusal AND an
+ * approval. Non-empty ⇒ report "can't decide yet" instead of the collapsed
+ * verdict (the `evaluateStart` verb does; the Studio start control does).
+ *
+ * The GATE never consults this: at `startInstance` the supplied inputs are
+ * final, so evaluating over genuine absence — including rules that WANT it,
+ * like `!defined($fields.rush)` — is the correct semantics there.
+ *
+ * `fields` is a produced `$fields` map (`startFieldsParam`, or a surface's
+ * seed map) — producers bind only own keys with real values, so key presence
+ * IS the supplied-ness rule.
+ */
+export declare function unboundAllowedReads(
+  allowed: string,
+  fields: Record<string, unknown>,
+): string[];
+
 /**
  * The diagnose idiom shared by every consumer: each unsatisfied exit
  * transition with its insight summary. Consumers shape the result (the CLI
@@ -6973,8 +7742,8 @@ export declare function unsatisfiedTransitionSummaries(
 
 /**
  * Validate a (stored, desugared) definition before deploy: parse-check every
- * GROQ string (malformed predicates, conditions, bindings, `completeWhen`/
- * `failWhen`) and re-run the cross-field invariants. `defineWorkflow` already
+ * GROQ string (malformed predicates, conditions, bindings, triggers) and
+ * re-run the cross-field invariants. `defineWorkflow` already
  * ran the invariants at authoring time, but deploy must reject what authoring
  * rejects — a stored-shape definition handed straight to the verb (raw JSON,
  * a foreign tool) would otherwise bypass every invariant.
@@ -6998,27 +7767,13 @@ export declare function validateDefinition(
   definition: WorkflowDefinition,
 ): void;
 
-/**
- * Engine-scope tag — the environment partition primitive.
- *
- * Every engine operates against exactly one `tag` ("test", "prod", …).
- * The tag partitions definitions and instances within a single workflow
- * resource: `deploy(def, tag: "test")` and `deploy(def, tag: "prod")` are
- * separate deployed workflows with independent lifecycles, and every read
- * is scoped to one tag so test runs never surface in prod.
- *
- * The tag must be Sanity-ID-compatible since it's joined into IDs with
- * `.` — ASCII lowercase + digits + dashes, no leading dash, no dots. It
- * is also the ID prefix for every definition/instance the engine writes.
- *
- * There is no default. The tag selects which environment the engine reads
- * and writes, and the engine enforces nothing — so the partition is the
- * only thing keeping test runs out of prod. Every entry point
- * (`createEngine`, the CLI, the MCP server) requires it explicitly and
- * fails when it's absent rather than guessing an environment.
- */
 export declare function validateTag(tag: string): void;
 
+declare interface ValidationIssue {
+  path: ReadonlyArray<PropertyKey>;
+  message: string;
+}
+
 export declare type ValueExpr = ValueExprInternal;
 
 declare type ValueExprInternal =
@@ -7096,16 +7851,18 @@ export declare interface WatchSet {
   /**
    * The instance's effective read perspective (a release stack like
    * `[releaseName]` or `[releaseName, "drafts"]`), already resolved at
-   * `startInstance`. `undefined` means raw/published.
+   * `startInstance`. `undefined` means content reads use the
+   * drafts-preferring {@link DEFAULT_CONTENT_PERSPECTIVE}.
    *
    * The engine does not form `versions.<release>.<id>` ids — it has no
    * such concept (it reads content through `client.fetch({perspective})`
    * for queries). A reactive consumer applies this perspective when it
-   * subscribes: a **content** doc must be resolved to its version /
-   * draft / published form (e.g. Studio `editState`'s version param, or
-   * the SDK's `getVersionId`), while instance / ancestor / `system.release`
-   * docs are always raw. The `type` on each {@link SubscriptionDocument}
-   * tells the consumer which is which.
+   * subscribes: a **content** doc resolves under the release
+   * {@link contentReleaseName} names (e.g. Studio `editState`'s version
+   * param, or the SDK's `getVersionId`), falling back to the draft only
+   * when {@link contentDraftFallback} allows it, then published — while
+   * instance / ancestor / `system.release` docs are always raw. The `type`
+   * on each {@link SubscriptionDocument} tells the consumer which is which.
    */
   perspective?: WorkflowPerspective;
 }
@@ -7131,7 +7888,7 @@ export declare const workflow: {
    * never patches a deployed version, so a definition can't change out from
    * under the instances pinned to it. `startInstance` picks the highest
    * version by default. The engine figures out the dependency order itself
-   * (children before parents that spawn them via `subworkflows.definition`)
+   * (children before parents that spawn them via `action.spawn.definition`)
    * and reports a per-definition outcome (`created` / `unchanged`).
    *
    * Refs may point inside the batch OR at already-deployed definitions
@@ -7161,20 +7918,44 @@ export declare const workflow: {
   /**
    * Spawn a new workflow instance from a deployed definition.
    *
-   * Pins the snapshot at start-time, seeds `effectsContext`, enters
-   * the initial stage (which builds activityStatus, queues onEnter
-   * effects, auto-activates activities). Then cascades auto-transitions
-   * until stable. Starting always changes state (`changed: true`) —
-   * `cascaded` reports how far the new instance auto-advanced.
+   * Two gates run before anything is written, in order: the required-input
+   * check — a missing `required` input is a CALLER mistake
+   * ({@link RequiredFieldNotProvidedError}) — then the definition's
+   * `start.allowed` permission predicate, whose false/GROQ-null VERDICT
+   * throws {@link StartNotAllowedError} (declaring the expression is the
+   * opt-in; there is no override arg — pre-flight with `evaluateStart`).
+   * Per-value SHAPE validation fires during field resolution, after the
+   * verdict but still before any write. It does NOT evaluate `start.filter`:
+   * that is a read-side visibility rule (see `definitionsForDocument`).
+   *
+   * Pins the snapshot at start-time, seeds the `context` bag, and enters
+   * the initial stage — fields resolve and every in-scope activity is
+   * born active. Then cascades until stable, so the initial stage's
+   * `when: 'true'` triggers have fired by the time this returns.
+   *
+   * Start is three commits — create, prime, first cascade — and a supplied
+   * `instanceId` is its idempotency key across them. When that id already
+   * exists under this tag for the same start, the call RESUMES: input gates
+   * and field resolution are skipped (those values were pinned at create)
+   * and the outstanding commits run — the retry path for a start that
+   * failed after its create landed (see `isUnprimed`). Reusing an id for a
+   * DIFFERENT start (definition or explicit version mismatch) — or for an
+   * unfinished start that was aborted (a discarded start) — throws
+   * {@link ContractViolationError}. The mid-sequence failures are typed and
+   * carry the retry id: a prime failure after the create committed throws
+   * `StartNotPrimedError` (failed but resumable), and a cascade failure
+   * after a successful prime throws `StartNotSettledError` — the run exists
+   * by then and must not be reported as a failed start. `changed` is `true`
+   * on a fresh start and rev-derived on a resume; `cascaded` reports how far
+   * the instance auto-advanced.
    */
   startInstance: (
     rawArgs: Clocked<Telemetered<StartInstanceArgs & EngineScopeArgs>>,
   ) => Promise<OperationResult>;
   /**
-   * Fire an action against an activity. If the activity is pending, it is
-   * auto-invoked first (pending → active) so callers don't have to know
-   * the lifecycle. Cascades auto-transitions and propagates to ancestors
-   * after the action commits.
+   * Fire an action against an active activity. Cascades and propagates to
+   * ancestors after the action commits. A cascade-fired (`when`) action is
+   * rejected — the cascade is its only firing path.
    *
    * This is the universal "something happened" call. Editors fire it.
    * Runtimes fire it in response to webhooks, effect completions, and
@@ -7202,11 +7983,11 @@ export declare const workflow: {
     rawArgs: Clocked<Telemetered<EditFieldArgs & EngineScopeArgs>>,
   ) => Promise<OperationResult>;
   /**
-   * Report a queued effect's outcome. Drains it from `pendingEffects`,
-   * appends an `effectHistory` entry, and (if `outputs` are supplied
-   * and the effect succeeded) upserts those values into
-   * `effectsContext` by key — so downstream effect bindings can
-   * reference them. Any `ops` the handler returned (`field.*`) are
+   * Report a queued effect's outcome. Drains it from `pendingEffects` and
+   * appends an `effectHistory` entry whose `outputs` (when supplied on a
+   * successful run) are what downstream effect bindings and conditions
+   * read as `$effects['<name>'].<output>` — the start-only `context` bag
+   * is never touched. Any `ops` the handler returned (`field.*`) are
    * validated and applied to the instance in the same commit, through the
    * same op applier an action's field ops use. Cascades after. A completion
    * that applies always changes state (the effect drains + history is
@@ -7222,17 +8003,16 @@ export declare const workflow: {
     rawArgs: Clocked<Telemetered<CompleteEffectArgs & EngineScopeArgs>>,
   ) => Promise<OperationResult>;
   /**
-   * Re-evaluate auto-transitions and resolve due waits until stable.
+   * Run the cascade until stable — triggered actions fire, transitions move.
    *
    * Used by the runtime after any event that might affect the workflow
-   * but isn't itself an activity action: a subject doc was patched, a sibling
-   * workflow completed, the clock crossed a `completeWhen` deadline, etc.
+   * but isn't itself an action fire: a subject doc was patched, a sibling
+   * workflow completed, the clock crossed a deadline a `when` reads, etc.
    * The runtime doesn't need to know what changed — it just nudges
    * affected instances and the engine re-evaluates. `changed` reports
    * whether the nudge wrote anything: a fired transition, but also a
-   * persisted activity-gate flip (`completeWhen`/`failWhen`) that didn't
-   * unlock a transition yet — so it's derived from the instance's `_rev`,
-   * not from `cascaded` alone.
+   * hop that fired triggered actions without unlocking a transition yet —
+   * so it's derived from the instance's `_rev`, not from `cascaded` alone.
    */
   tick: (
     rawArgs: Clocked<Telemetered<OperationArgs & EngineScopeArgs>>,
@@ -7289,8 +8069,11 @@ export declare const workflow: {
    * Hydrates the instance's snapshot (instance + ancestors + every doc
    * declared by a `doc.ref` / `doc.refs` entry in scope), then
    * evaluates the supplied GROQ in groq-js against that dataset. The
-   * rendered scope's instance-derived vars ({@link FILTER_SCOPE_VARS}) are
-   * auto-bound — ids in GDR URI form to match the snapshot's keying.
+   * caller-free rendered scope cascade gates evaluate in is auto-bound —
+   * the instance-derived vars ({@link FILTER_SCOPE_VARS}) with the open
+   * stage's overlay merged into `$fields`, `$assigned` at its caller-free
+   * `false`, plus the author's pre-evaluated `$<predicate>` booleans —
+   * ids in GDR URI form to match the snapshot's keying.
    *
    * Use when an external consumer (a UI, a debug pane, a test) wants
    * to ask "what does the engine see for this workflow right now?"
@@ -7398,9 +8181,13 @@ export declare const workflow: {
    * The startable half of {@link workflow.instancesForDocument}: every
    * deployed definition that APPLIES to `document` — what a start picker for
    * it should offer. Loads the latest deployed version of each definition
-   * visible to the engine's tag and filters it through the pure derivation
+   * visible to the engine's tag and filters it through the derivation
    * ({@link applicableDefinitions}): startable ∧ a required subject entry
-   * accepts the doc's `_type` ∧ `applicableWhen` passes.
+   * accepts the doc's `_type` ∧ `start.filter` passes — evaluated in the
+   * browse-time-pure start-filter context with `$tag`/`$definition`/`$now`
+   * bound and the tag's instance slice (completed included) backing dataset
+   * reads. `start.allowed` never participates — permission is a start-time
+   * question; pre-flight it with {@link workflow.evaluateStart}.
    *
    * Takes the LOADED candidate document, not a ref — applicability evaluates
    * its content, under whatever perspective the caller read it with. Surfaces
@@ -7408,8 +8195,28 @@ export declare const workflow: {
    * auto-picking is consumer policy. Advisory like every engine-side check.
    */
   definitionsForDocument: (
-    rawArgs: DefinitionsForDocumentArgs & EngineScopeArgs,
+    rawArgs: Clocked<DefinitionsForDocumentArgs & EngineScopeArgs>,
   ) => Promise<DeployedDefinition[]>;
+  /**
+   * Pre-flight the start gates for a definition + candidate `initialFields` —
+   * the read `startInstance` enforces, as a {@link StartEvaluation} a surface
+   * can render: `missingRequired` mirrors the input contract
+   * ({@link RequiredFieldNotProvidedError}'s rows), and `allowed` /
+   * `outcome` / `insight` carry the `start.allowed` verdict with its atom
+   * breakdown — disable the start affordance on a definitive `false` and say
+   * why. BINDABILITY-AWARE for partial mid-form inputs: when the predicate
+   * reads an entry `initialFields` doesn't supply, `outcome` is
+   * `'unevaluable'` and `unboundReads` names the entries ("fill these to
+   * decide") instead of the collapsed answer GROQ equality would give —
+   * this is the ONE deliberate divergence from the gate, where absence is
+   * final, not provisional (a rule like `!defined($fields.rush)` genuinely
+   * passes there when `rush` is absent). A definition with no
+   * `start.allowed` is vacuously allowed, exactly like the verb. Pure read;
+   * advisory under races — the enforcement moment is `startInstance` itself.
+   */
+  evaluateStart: (
+    rawArgs: Clocked<EvaluateStartArgs & EngineScopeArgs>,
+  ) => Promise<StartEvaluation>;
   /**
    * Permission helpers — Sanity ACL grants evaluated against documents
    * via GROQ. Used by `workflow.evaluate` to soft-gate actions when the
@@ -7471,6 +8278,12 @@ export declare interface WorkflowAdminOverrideData extends InstanceScopedEventDa
   changed: boolean;
 }
 
+/** The whole-definition rollup: every stage must progress, so the workflow
+ *  verdict conjoins the stage verdicts. */
+export declare interface WorkflowAutonomy extends AutonomyAnswer {
+  stages: StageAutonomy[];
+}
+
 export declare interface WorkflowClient {
   fetch: <T = unknown>(
     query: string,
@@ -7858,7 +8671,7 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                         description?: string | undefined;
                         groups?: Group[] | undefined;
                         lifecycle?: WorkflowLifecycle | undefined;
-                        applicableWhen?: string | undefined;
+                        start?: StartBlock | undefined;
                         initialStage: string;
                         fields?: FieldEntry[] | undefined;
                         stages: Stage[];
@@ -7876,7 +8689,7 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                       description?: string | undefined;
                       groups?: Group[] | undefined;
                       lifecycle?: WorkflowLifecycle | undefined;
-                      applicableWhen?: string | undefined;
+                      start?: StartBlock | undefined;
                       initialStage: string;
                       fields?: FieldEntry[] | undefined;
                       stages: Stage[];
@@ -7942,7 +8755,7 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
               description?: string | undefined;
               groups?: Group[] | undefined;
               lifecycle?: WorkflowLifecycle | undefined;
-              applicableWhen?: string | undefined;
+              start?: StartBlock | undefined;
               initialStage: string;
               fields?: FieldEntry[] | undefined;
               stages: Stage[];
@@ -8002,7 +8815,7 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
               description?: string | undefined;
               groups?: Group[] | undefined;
               lifecycle?: WorkflowLifecycle | undefined;
-              applicableWhen?: string | undefined;
+              start?: StartBlock | undefined;
               initialStage: string;
               fields?: FieldEntry[] | undefined;
               stages: Stage[];
@@ -8073,9 +8886,9 @@ export declare interface WorkflowDefinitionDeployedData {
    *  scopes, sorted. */
   fieldKinds: FieldKind[];
   guardCount: number;
-  /** Effects declared across activities, actions, and transitions. */
+  /** Effects declared across the definition's actions. */
   effectCount: number;
-  /** Activities carrying a `subworkflows` block. */
+  /** Actions carrying a `spawn` block. */
   subworkflowCount: number;
   lifecycle: WorkflowLifecycle;
 }
@@ -8114,7 +8927,7 @@ export declare type WorkflowDefinitionInput<T> = string extends keyof T
  * mints the next version.
  */
 declare const WorkflowDefinitionSchema: v.GenericSchema<
-  WorkflowFields<FieldEntry, Stage>
+  WorkflowFields<FieldEntry, Stage, StartBlock>
 >;
 
 export declare type WorkflowDeployment = WorkflowConfig["deployments"][number];
@@ -8165,6 +8978,7 @@ export declare abstract class WorkflowError<
 
 export declare type WorkflowErrorKind =
   | "action-disabled"
+  | "start-not-allowed"
   | "edit-field-denied"
   | "mutation-guard-denied"
   | "action-params-invalid"
@@ -8173,11 +8987,16 @@ export declare type WorkflowErrorKind =
   | "required-field-not-provided"
   | "workflow-state-diverged"
   | "partial-guard-deploy"
+  | "start-not-primed"
+  | "start-not-settled"
   | "concurrent-fire-action"
   | "concurrent-edit-field"
+  | "concurrent-complete-effect"
   | "cascade-limit"
   | "field-value-shape"
+  | "ref-resource-undeclared"
   | "model-version-ahead"
+  | "persisted-doc-shape"
   | "instance-not-found"
   | "definition-not-found"
   | "definition-in-use"
@@ -8208,6 +9027,14 @@ export declare interface WorkflowEvaluation {
    * Empty when no condition reads a field.
    */
   fieldInsights: FieldInsight[];
+  /**
+   * The whole definition's causal-autonomy rollup: per activity, per stage,
+   * and workflow-wide — will each level resolve without a caller, and what
+   * does it wait on. Static (no instance state), stamped here so every
+   * consumer reads one derivation. Spawn children are not resolved at
+   * evaluation time, so their legs report `conditional`.
+   */
+  autonomy: WorkflowAutonomy;
 }
 
 export declare interface WorkflowFetchOptions {
@@ -8235,14 +9062,20 @@ export declare interface WorkflowFieldEditedData extends InstanceScopedEventData
   mode: EditMode;
 }
 
-/** Type-mirror of {@link workflowFields}, parameterised over field/stage. */
-declare type WorkflowFields<TField, TStage> = {
+/** Type-mirror of {@link workflowFields}, parameterised over field/stage/start. */
+declare type WorkflowFields<TField, TStage, TStart> = {
+  /**
+   * Lake-id-segment grammar (`^[a-z0-9][a-z0-9-]*$`, deploy-enforced): the
+   * name interpolates into every deployed document id
+   * (`<tag>.<name>.v<version>`). Stable identity — instances pin to it,
+   * subworkflows resolve by it.
+   */
   name: string;
   title: string;
   description?: string | undefined;
   groups?: Group[] | undefined;
   lifecycle?: WorkflowLifecycle | undefined;
-  applicableWhen?: string | undefined;
+  start?: TStart | undefined;
   initialStage: string;
   fields?: TField[] | undefined;
   stages: TStage[];
@@ -8307,10 +9140,11 @@ export declare interface WorkflowInstance extends SanityDocument {
    */
   fields: ResolvedFieldEntry[];
   /**
-   * Stable named params the runtime hands to effect handlers via binding
-   * resolution. Set at `startInstance`. **Not read by transition filters.**
+   * The start seed: named values set once at `startInstance` (or by a
+   * parent's `spawn.context`) and never mutated after. Conditions and
+   * effect bindings read them as `$context.<name>`.
    */
-  effectsContext: EffectsContextEntry[];
+  context: ContextEntry[];
   /**
    * Chain of ancestor workflow instances, root-first. Each entry is a
    * GDR pointing at a {@link WORKFLOW_INSTANCE_TYPE} document in the
@@ -8370,6 +9204,13 @@ export declare interface WorkflowInstance extends SanityDocument {
 
 export declare const WorkflowInstanceAborted: WorkflowTelemetryEvent<WorkflowAdminOverrideData>;
 
+/**
+ * The persisted instance document, root to leaf. Reused verbatim by every
+ * engine read boundary through {@link parseInstanceDocument}; the
+ * model-surface gate derives its shape ledger from this schema.
+ */
+export declare const WorkflowInstanceSchema: v.GenericSchema<WorkflowInstance>;
+
 export declare const WorkflowInstanceStarted: WorkflowTelemetryEvent<WorkflowInstanceStartedData>;
 
 export declare interface WorkflowInstanceStartedData extends InstanceScopedEventData {
@@ -8564,10 +9405,11 @@ export declare interface WorkflowTransaction {
   /**
    * Queue a document delete. Deliberately a transaction-only capability —
    * the top-level client surface stays delete-free so no engine code path
-   * can casually remove documents; the sole consumer is `deleteDefinition`
-   * housekeeping (definition docs + orphaned guard docs). Both the real
-   * `@sanity/client` Transaction and the test fake's TransactionHandle
-   * carry this shape.
+   * can casually remove documents; engine-side the sole consumer is
+   * `deleteDefinition` housekeeping (definition docs + orphaned guard docs),
+   * and outside the engine the CLI's `nuke` reset deletes raw engine-owned
+   * docs through it. Both the real `@sanity/client` Transaction and the test
+   * fake's TransactionHandle carry this shape.
    */
   delete: (id: string) => WorkflowTransaction;
   /**