@sanity/workflow-engine 0.18.0 → 0.19.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { terminalState, andConditions, deriveActivityKind, parseDefinitionSnapshot, CALLER_BOUND_VARS, START_ALLOWED_VARS, CONDITION_VARS, SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, rethrowWithContext, conditionParameterNames, isGdr, WORKFLOW_INSTANCE_TYPE, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, parentRef, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, errorMessage, validateFieldValue, validateFieldAppendItem, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, runGroq, parseGdr, isGdrUri, gdrRef, isInputSourced, checkFieldValue, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, assertReadableModel, InstanceNotFoundError, modelStampFor, evaluateConditionOutcome, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, minReaderModelOf, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, deriveExecutorClassification, validateTag, driverKind, EffectNotFoundError, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, isUnprimed, DefinitionInUseError, assertReaderModelAcknowledgement, FieldValueShapeError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
+import { terminalState, andConditions, deriveActivityKind, parseDefinitionSnapshot, CALLER_BOUND_VARS, START_ALLOWED_VARS, CONDITION_VARS, SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, rethrowWithContext, conditionParameterNames, isGdr, WORKFLOW_INSTANCE_TYPE, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, parentRef, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, errorMessage, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, parseGdr, isGdrUri, gdrRef, isInputSourced, checkFieldValue, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, assertReadableModel, InstanceNotFoundError, modelStampFor, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, minReaderModelOf, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, driverKind, EffectNotFoundError, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, isUnprimed, DefinitionInUseError, assertReaderModelAcknowledgement, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
 
 import { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTOR_KINDS, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, ModelVersionAheadError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, clientConfigFromResource, fieldTreeShape, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, modelVersionOf, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, requiredModelFeatures, requiredReaderModel, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
 
@@ -248,6 +248,11 @@ const HIGH_FREQUENCY_SAMPLE_MS = 6e4, WorkflowDefinitionDeployed = defineWorkflo
     name: "Editorial Workflows Effects Drained",
     version: 1,
     description: "A drain pass ran — drainedCount/drainedEffects report the successful dispatches. Unsampled when non-empty (outcome counts must be complete; volume is bounded by real effect work); empty polls are machine-cadence noise, throttled engine-side to at most one per minute"
+}), WorkflowEffectStateReported = defineWorkflowEvent({
+    name: "Editorial Workflows Effect State Reported",
+    version: 1,
+    description: "A running effect handler committed mid-dispatch field state through commitEffectOps. Sampled (high-frequency by design — a dispatch may report many times): an adoption and usage signal, not an exact per-run report count",
+    maxSampleRate: HIGH_FREQUENCY_SAMPLE_MS
 }), WorkflowEffectCompleted = defineWorkflowEvent({
     name: "Editorial Workflows Effect Completed",
     version: 1,
@@ -2219,6 +2224,21 @@ class StartNotSettledError extends WorkflowError {
     }
 }
 
+class StaleEffectClaimError extends WorkflowError {
+    instanceId;
+    effectKey;
+    reason;
+    constructor(args) {
+        super("stale-effect-claim", `Mid-dispatch report for effect entry "${args.effectKey}" on ${args.instanceId} rejected: ${staleClaimDetail(args.reason)}. Nothing was written. Stop reporting from this dispatch — a newer dispatch (or none) owns the entry now.`), 
+        this.name = "StaleEffectClaimError", this.instanceId = args.instanceId, this.effectKey = args.effectKey, 
+        this.reason = args.reason;
+    }
+}
+
+function staleClaimDetail(reason) {
+    return reason === "unclaimed" ? "the entry holds no claim" : reason === "claim-superseded" ? "the claim was taken over by another dispatch" : "the claim's lease has expired";
+}
+
 const CONCURRENT_COMMIT_MAX_ATTEMPTS = 3;
 
 function lostRaceMessage(args) {
@@ -2275,6 +2295,20 @@ class ConcurrentCompleteEffectError extends WorkflowError {
     }
 }
 
+class ConcurrentCommitEffectOpsError extends WorkflowError {
+    instanceId;
+    effectKey;
+    attempts;
+    constructor(args) {
+        super("concurrent-commit-effect-ops", lostRaceMessage({
+            what: `Mid-dispatch report for effect entry "${args.effectKey}"`,
+            instanceId: args.instanceId,
+            attempts: args.attempts
+        })), this.name = "ConcurrentCommitEffectOpsError", this.instanceId = args.instanceId, 
+        this.effectKey = args.effectKey, this.attempts = args.attempts;
+    }
+}
+
 class CascadeLimitError extends WorkflowError {
     instanceId;
     limit;
@@ -2609,8 +2643,17 @@ async function applyFieldUpdateWhere(op, ctx) {
             fields: entry.of
         }
     });
-    if (merge === null || typeof merge != "object" || Array.isArray(merge)) throw new Error(`field.updateWhere value must resolve to an object of fields to merge (target "${op.target.field}")`);
-    requireNoReservedMergeKeys(merge, op);
+    if (merge === null || typeof merge != "object" || Array.isArray(merge)) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `field.updateWhere value must resolve to an object of fields to merge (target "${op.target.field}")` ]
+    });
+    requireNoReservedMergeKeys({
+        merge: merge,
+        entry: entry,
+        op: op
+    });
     const matches = await rowMatches({
         where: op.where,
         rows: rows,
@@ -2656,9 +2699,14 @@ function requireMergeableRows(entry, op) {
     if (entry._type !== "array") throw new Error(`${op.type} target ${op.target.scope}:"${op.target.field}" is a ${entry._type} entry — updateWhere merges declared row sub-fields, so it targets \`array\` entries only`);
 }
 
-function requireNoReservedMergeKeys(merge, op) {
-    const reserved = [ "_key", "_type" ].filter(key => key in merge);
-    if (reserved.length !== 0) throw new Error(`field.updateWhere merge writes the reserved row key${reserved.length === 1 ? "" : "s"} ${reserved.map(k => `"${k}"`).join(", ")} (target "${op.target.field}") — row identity and bookkeeping are engine-stamped, never merged`);
+function requireNoReservedMergeKeys(args) {
+    const {merge: merge, entry: entry, op: op} = args, reserved = [ "_key", "_type" ].filter(key => key in merge);
+    if (reserved.length !== 0) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `field.updateWhere merge writes the reserved row key${reserved.length === 1 ? "" : "s"} ${reserved.map(k => `"${k}"`).join(", ")} (target "${op.target.field}") — row identity and bookkeeping are engine-stamped, never merged` ]
+    });
 }
 
 function requireArrayValue(entry, op) {
@@ -3426,20 +3474,11 @@ function remediationsFor(diagnosis) {
     }));
 }
 
-async function resolveBindings(args) {
-    const resolved = {};
-    for (const [key, groq] of Object.entries(args.bindings ?? {})) resolved[key] = await runGroq({
-        groq: groq,
-        params: args.params,
-        snapshot: args.snapshot
-    });
-    return {
-        ...resolved,
-        ...args.staticInput
-    };
+function isClaimExpired(claim, now) {
+    return claim.leaseExpiresAt === void 0 || hasPassed(claim.leaseExpiresAt, now);
 }
 
-const EXECUTION_KINDS = {
+const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ], EXECUTION_KINDS = {
     interactive: "interactive",
     server: "server",
     cli: "cli",
@@ -3998,7 +4037,7 @@ function coerceToGdr(raw, workflowResource) {
     } : null;
 }
 
-const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ], NonEmpty = NonEmptyString, UnknownRecord = v.record(v.string(), v.unknown()), PersistedChoiceOptionsSchema = v.looseObject({
+const NonEmpty = NonEmptyString, UnknownRecord = v.record(v.string(), v.unknown()), PersistedChoiceOptionsSchema = v.looseObject({
     list: v.array(v.looseObject({
         title: v.string(),
         value: v.union([ v.string(), v.number() ])
@@ -4058,7 +4097,7 @@ const OptionalRefTypes = v.exactOptional(v.array(v.string())), ResolvedFieldEntr
 })), v.looseObject(tolerantEntries()({
     ...fieldArm("subject", fieldValueSchemas.subject),
     types: OptionalRefTypes
-})), v.looseObject(tolerantEntries()(fieldArm("release.ref", fieldValueSchemas["release.ref"]))), v.looseObject(tolerantEntries()(fieldArm("string", fieldValueSchemas.string))), v.looseObject(tolerantEntries()(fieldArm("text", fieldValueSchemas.text))), v.looseObject(tolerantEntries()(fieldArm("number", fieldValueSchemas.number))), v.looseObject(tolerantEntries()(fieldArm("boolean", fieldValueSchemas.boolean))), v.looseObject(tolerantEntries()(fieldArm("date", fieldValueSchemas.date))), v.looseObject(tolerantEntries()(fieldArm("datetime", fieldValueSchemas.datetime))), v.looseObject(tolerantEntries()(fieldArm("url", fieldValueSchemas.url))), v.looseObject(tolerantEntries()(fieldArm("actor", fieldValueSchemas.actor))), v.looseObject(tolerantEntries()(fieldArm("assignee", fieldValueSchemas.assignee))), v.looseObject(tolerantEntries()(fieldArm("assignees", fieldValueSchemas.assignees))), v.looseObject(tolerantEntries()({
+})), v.looseObject(tolerantEntries()(fieldArm("release.ref", fieldValueSchemas["release.ref"]))), v.looseObject(tolerantEntries()(fieldArm("string", fieldValueSchemas.string))), v.looseObject(tolerantEntries()(fieldArm("text", fieldValueSchemas.text))), v.looseObject(tolerantEntries()(fieldArm("number", fieldValueSchemas.number))), v.looseObject(tolerantEntries()(fieldArm("progress", fieldValueSchemas.progress))), v.looseObject(tolerantEntries()(fieldArm("boolean", fieldValueSchemas.boolean))), v.looseObject(tolerantEntries()(fieldArm("date", fieldValueSchemas.date))), v.looseObject(tolerantEntries()(fieldArm("datetime", fieldValueSchemas.datetime))), v.looseObject(tolerantEntries()(fieldArm("url", fieldValueSchemas.url))), v.looseObject(tolerantEntries()(fieldArm("actor", fieldValueSchemas.actor))), v.looseObject(tolerantEntries()(fieldArm("assignee", fieldValueSchemas.assignee))), v.looseObject(tolerantEntries()(fieldArm("assignees", fieldValueSchemas.assignees))), v.looseObject(tolerantEntries()({
     ...fieldArm("object", v.union([ v.null(), UnknownRecord ])),
     fields: v.array(PersistedFieldShapeSchema)
 })), v.looseObject(tolerantEntries()({
@@ -4071,7 +4110,8 @@ const OptionalRefTypes = v.exactOptional(v.array(v.string())), ResolvedFieldEntr
     _type: v.literal("pendingEffect.claim"),
     claimedAt: IsoTimestamp,
     claimedBy: ActorShape,
-    leaseExpiresAt: v.exactOptional(IsoTimestamp)
+    leaseExpiresAt: v.exactOptional(IsoTimestamp),
+    claimToken: v.exactOptional(NonEmpty)
 }), PendingEffectSchema = tolerantObject()({
     _key: NonEmpty,
     _type: v.exactOptional(v.literal("pendingEffect")),
@@ -4487,6 +4527,10 @@ function collectEntryDocUris(resolvedFieldEntries) {
     return entryDocRefs(resolvedFieldEntries).map(ref => ref.id);
 }
 
+function isEngineContext(ctx) {
+    return "client" in ctx;
+}
+
 function loadCallContext({client: client, instanceId: instanceId, options: options}) {
     return loadContext({
         client: client,
@@ -4662,6 +4706,19 @@ async function resolveActivityFieldEntries(args) {
     });
 }
 
+async function resolveBindings(args) {
+    const resolved = {};
+    for (const [key, groq] of Object.entries(args.bindings ?? {})) resolved[key] = await runGroq({
+        groq: groq,
+        params: args.params,
+        snapshot: args.snapshot
+    });
+    return {
+        ...resolved,
+        ...args.staticInput
+    };
+}
+
 const DEFAULT_IDEMPOTENCY_TTL_MS = 1440 * 60 * 1e3;
 
 class RequestAlreadyProcessedError extends Error {
@@ -4836,6 +4893,7 @@ const REQUEST_TAG = {
     fireAction: "workflow.fire-action",
     editField: "workflow.edit-field",
     completeEffect: "workflow.complete-effect",
+    commitEffectOps: "workflow.commit-effect-ops",
     tick: "workflow.tick",
     evaluate: "workflow.evaluate",
     evaluateStart: "workflow.evaluate-start",
@@ -6104,1965 +6162,2134 @@ async function fetchGrants(args) {
     });
 }
 
-const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
-
-async function resolveAccess(taggedClient, args = {}) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
-    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: args.grantsFromPath
-    }) : Promise.resolve(void 0), [actor, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
-    if (actor === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
-    return {
-        actor: actor,
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
-    };
-}
-
-function cachedActor(client, requestFn) {
-    const cached = actorCache.get(client);
-    if (cached !== void 0) return cached;
-    const pending = fetchActor(requestFn).catch(err => {
-        throw actorCache.get(client) === pending && actorCache.delete(client), err;
-    });
-    return actorCache.set(client, pending), pending;
-}
-
-function grantsForClientPath(taggedClient, resourcePath) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: resourcePath
+async function advisoryCan({instance: instance, actor: actor, grants: grants}) {
+    if (grants === void 0) return;
+    const can = {};
+    for (const permission of DOCUMENT_VALUE_PERMISSIONS) can[permission] = await grantsPermissionOn({
+        document: instance,
+        grants: grants,
+        permission: permission,
+        userId: actor.id
     });
+    return can;
 }
 
-function lazyRequest(client) {
-    return client.request === void 0 ? void 0 : opts => client.request(opts);
-}
-
-function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
-    let byPath = grantsCache.get(client);
-    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
-    let cached = byPath.get(resourcePath);
-    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
-    byPath.set(resourcePath, cached)), cached;
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
 }
 
-async function fetchActor(requestFn) {
-    let user;
-    try {
-        user = await requestFn({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        });
-    } catch (err) {
-        throw new Error('workflow: /users/me request failed. The engine resolves the actor from the client\'s token via `client.request({ uri: "/users/me" })`. Check the token/connectivity.', {
-            cause: err
-        });
+class ActionDisabledError extends WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
     }
-    if (!user || typeof user.id != "string" || user.id.length === 0) return;
-    const roleNames = user.roles?.map(r => r.name).filter(n => !!n) ?? [];
-    return {
-        kind: "person",
-        id: user.id,
-        ...roleNames.length > 0 ? {
-            roles: roleNames
-        } : {}
-    };
 }
 
-async function fetchGrantsCached(requestFn, resourcePath) {
-    try {
-        return await fetchGrants({
-            client: {
-                request: requestFn
-            },
-            resourcePath: resourcePath
-        });
-    } catch (err) {
-        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
-        return;
+class StartNotAllowedError extends WorkflowError {
+    definition;
+    insight;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused: start.allowed on definition "${args.definition}" evaluated ` + (args.insight.outcome === "unevaluable" ? `GROQ null ("can't decide" — fail-closed)` : "false") + " for the supplied initialFields. Pre-flight the verdict with evaluateStart."), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.insight = args.insight;
     }
 }
 
-async function buildFieldInsights({sites: sites, snapshot: snapshot}) {
-    const insights = [];
-    for (const field of fieldsReadAcross(sites)) {
-        const involved = sites.filter(entry => readsField(entry.insight, field));
-        insights.push({
-            field: field,
-            reads: dedupeReads(involved.flatMap(entry => fieldReads(entry.insight, field))),
-            involvedIn: involved.map(entry => entry.site),
-            proposals: await verifyProposals({
-                field: field,
-                involved: involved,
-                snapshot: snapshot
-            })
-        });
-    }
-    return insights;
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
 }
 
-function fieldsReadAcross(sites) {
-    const names = sites.flatMap(entry => entry.insight.analysis.reads).filter(read => read.variable === "fields").map(read => read.path[0]).filter(head => typeof head == "string");
-    return [ ...new Set(names) ];
-}
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+    "activity-not-active": r => `activity status is "${r.status}"`,
+    "stage-terminal": r => `stage "${r.stage}" is terminal`,
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.join(", ")}`,
+    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
+};
 
-function fieldReads(insight, field) {
-    return insight.analysis.reads.filter(read => read.variable === "fields" && read.path[0] === field);
+function actionDisabledDetail(reason) {
+    return disabledReasonDetail[reason.kind](reason);
 }
 
-function readsField(insight, field) {
-    return fieldReads(insight, field).length > 0;
+function formatDisabledReason({activity: activity, action: action, reason: reason}) {
+    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
 }
 
-async function verifyProposals({field: field, involved: involved, snapshot: snapshot}) {
-    const proposals = [];
-    for (const assign of candidateAssignments(involved, field)) {
-        const consequences = [];
-        for (const entry of involved) {
-            const result = await whatIfCondition({
-                condition: entry.condition,
-                dataset: snapshot.docs,
-                params: entry.params,
-                assign: assign
-            });
-            result.changed && consequences.push({
-                site: entry.site,
-                before: result.before,
-                after: result.after
-            });
-        }
-        consequences.length > 0 && proposals.push({
-            assign: assign,
-            consequences: consequences
-        });
+class EditFieldDeniedError extends WorkflowError {
+    reason;
+    target;
+    constructor(args) {
+        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
+        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
     }
-    return proposals;
 }
 
-function candidateAssignments(involved, field) {
-    const candidates = involved.flatMap(entry => entry.insight.blockedBy).flatMap(atom => atom.requirement !== void 0 ? [ atom.requirement ] : []).filter(requirement => requirement.target.variable === "fields").filter(requirement => requirement.target.path[0] === field).flatMap(assignmentFor).filter(fabricatable);
-    return dedupeBy(candidates, assignment => JSON.stringify([ assignment.target.path, assignment.value ]));
-}
+const editDisabledReasonDetail = {
+    "not-editable": () => "field is not declared editable",
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "edit-window-closed": r => `edit window closed (${r.detail})`,
+    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
+};
 
-function assignmentFor(requirement) {
-    switch (requirement.kind) {
-      case "equals":
-        return [ {
-            target: requirement.target,
-            value: requirement.value
-        } ];
+function formatEditDisabledReason(target, reason) {
+    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
+    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+}
 
-      case "truthy":
-        return [ {
-            target: requirement.target,
-            value: !0
-        } ];
-
-      case "falsy":
-        return [ {
-            target: requirement.target,
-            value: !1
-        } ];
-
-      case "differs":
-      case "defined":
-      case "undefined":
-      case "compares":
-        return [];
-    }
-}
-
-function fabricatable(assignment) {
-    return assignment.target.path.every(segment => typeof segment != "number" || segment <= MAX_COUNTERFACTUAL_INDEX);
+async function fireAction(args) {
+    const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
+    return retryOnRevisionConflict({
+        client: client,
+        instanceId: instanceId,
+        options: options,
+        commit: ctx => commitAction({
+            ctx: ctx,
+            activityName: activity,
+            actionName: action,
+            callerParams: params,
+            requestRecord: requestRecord,
+            options: options
+        }),
+        onExhausted: () => new ConcurrentFireActionError({
+            instanceId: instanceId,
+            activity: activity,
+            action: action,
+            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
+        })
+    });
 }
 
-async function subjectResourceGrants(args) {
-    const {clientForGdr: clientForGdr, instance: instance} = args, clients = /* @__PURE__ */ new Map;
-    for (const {parsed: parsed, resource: resource} of foreignSubjectRefs(instance)) {
-        const key = resourceGdr(resource);
-        clients.has(key) || clients.set(key, {
-            resource: resource,
-            client: clientForGdr(parsed)
+async function resolveActionCommit({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, options: options}) {
+    const actor = options?.actor, {stage: stage, activity: activity} = findActivityInCurrentStage(ctx, activityName), action = (activity.actions ?? []).find(a => a.name === actionName);
+    if (action === void 0) throw new ContractViolationError(`Action "${actionName}" not declared on activity "${activityName}"`);
+    if (action.when !== void 0) throw new ActionDisabledError({
+        activity: activityName,
+        action: actionName,
+        reason: {
+            kind: "cascade-fired",
+            when: action.when
+        }
+    });
+    if (action.filter !== void 0) {
+        const can = options?.grants !== void 0 && actor !== void 0 ? await advisoryCan({
+            instance: ctx.instance,
+            actor: actor,
+            grants: options.grants
+        }) : void 0;
+        if (!await ctxEvaluateCondition({
+            ctx: ctx,
+            condition: action.filter,
+            opts: {
+                activityName: activityName,
+                ...actor !== void 0 ? {
+                    actor: actor
+                } : {},
+                ...can !== void 0 ? {
+                    vars: {
+                        can: can
+                    }
+                } : {}
+            }
+        })) throw new ActionDisabledError({
+            activity: activityName,
+            action: actionName,
+            reason: {
+                kind: "filter-failed",
+                filter: action.filter,
+                detail: "commit re-check"
+            }
         });
     }
-    const resolved = await Promise.all([ ...clients.entries() ].map(async ([key, entry]) => {
-        const path = aclPathForResource(entry.resource);
-        if (path === void 0) return;
-        const grants = await grantsForClientPath(entry.client, path);
-        return grants === void 0 ? void 0 : [ key, grants ];
-    }));
-    return new Map(resolved.filter(entry => entry !== void 0));
-}
-
-async function evaluateInstance(args) {
-    const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
-    validateTag(tag);
-    const {actor: actor, grants: grants} = await resolveAccess(client, {
-        ...args.grantsFromPath !== void 0 ? {
-            grantsFromPath: args.grantsFromPath
-        } : {}
-    }), instance = await reload({
-        client: client,
-        instanceId: instanceId,
-        tag: tag
-    }), definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
-        client: client,
-        workflowResource: workflowResource,
-        resourceClients: resourceClients
-    }), snapshot = await hydrateSnapshot({
-        client: client,
-        clientForGdr: clientForGdr,
-        instance: instance
-    }), guards = await verdictGuardsForInstance(client, instance._id), resourceGrants = await subjectResourceGrants({
-        clientForGdr: clientForGdr,
-        instance: instance
+    const entry = findCurrentActivities(ctx.instance).find(t => t.name === activityName);
+    if (entry === void 0 || entry.status !== "active") throw notActiveAtCommit({
+        activityName: activityName,
+        actionName: actionName,
+        status: entry?.status
     });
-    return evaluateFromSnapshot({
-        instance: instance,
-        definition: definition,
-        actor: actor,
-        snapshot: snapshot,
-        guards: guards,
-        now: now,
-        resourceGrants: resourceGrants,
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
+    const params = validateActionParams({
+        action: action,
+        activityName: activityName,
+        callerParams: callerParams
     });
-}
-
-function memoizedByName(render) {
-    const rendered = /* @__PURE__ */ new Map;
-    return activityName => {
-        const hit = rendered.get(activityName);
-        if (hit !== void 0) return hit;
-        const scope = render(activityName);
-        return rendered.set(activityName, scope), scope;
+    return {
+        stage: stage,
+        activity: activity,
+        action: action,
+        params: params
     };
 }
 
-function currentStageOf(instance, definition) {
-    try {
-        return findStage(definition, instance.currentStage);
-    } catch (err) {
-        throw new Error(`Instance "${instance._id}" currentStage "${instance.currentStage}" not in definition`, {
-            cause: err
-        });
-    }
+function notActiveAtCommit(args) {
+    const {activityName: activityName, actionName: actionName, status: status} = args;
+    return status !== void 0 && isTerminalActivityStatus(status) ? new ActionDisabledError({
+        activity: activityName,
+        action: actionName,
+        reason: {
+            kind: "activity-not-active",
+            status: status
+        }
+    }) : new Error(`Activity "${activityName}" must be active to fire action "${actionName}"; status is ${status ?? "missing"}`);
 }
 
-async function explainSite(args) {
-    const {site: site, condition: condition, params: params, snapshot: snapshot, sites: sites} = args, insight = await explainCondition({
-        condition: condition,
-        dataset: snapshot.docs,
-        params: params
+async function applyActionFire({ctx: ctx, mutation: mutation, activity: activity, action: action, params: params, actor: actor, triggered: triggered}) {
+    mutation.history.push({
+        _key: randomKey(),
+        _type: "actionFired",
+        at: ctx.now,
+        stage: mutation.currentStage,
+        activity: activity.name,
+        action: action.name,
+        ...actor !== void 0 ? {
+            actor: actor,
+            driverKind: driverKind(actor)
+        } : {},
+        ...triggered ? {
+            triggered: !0
+        } : {}
     });
-    return sites.push({
-        site: site,
-        condition: condition,
+    const ranOps = await runOps({
+        ops: action.ops,
+        mutation: mutation,
+        stage: mutation.currentStage,
+        origin: {
+            activity: activity.name,
+            action: action.name
+        },
         params: params,
-        insight: insight
-    }), insight;
-}
-
-async function evaluateFromSnapshot(args) {
-    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), scopeSource = {
-        instance: instance,
-        definition: definition,
-        snapshot: snapshot,
-        now: now
-    }, can = await advisoryCan({
-        instance: instance,
         actor: actor,
-        grants: grants
-    }), scope = await renderConditionScope(scopeSource, {
+        self: selfGdr(ctx.instance),
+        now: ctx.now,
+        snapshot: ctx.snapshot,
+        refSurface: ctx.refSurface
+    });
+    if (await queueEffects({
+        ctx: ctx,
+        mutation: mutation,
+        effects: action.effects,
+        origin: {
+            kind: "action",
+            name: action.name
+        },
         actor: actor,
-        vars: {
-            can: can
+        opts: {
+            callerParams: params,
+            activityName: activity.name
         }
-    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+    }), action.spawn !== void 0) {
+        if (!isEngineContext(ctx)) throw new ContractViolationError(`Action "${action.name}" declares spawn, which requires a lake-capable engine context`);
+        await spawnSubworkflows({
+            ctx: ctx,
+            mutation: mutation,
+            activity: activity,
+            action: action,
+            sub: action.spawn,
+            actor: actor
+        });
+    }
+    return {
+        ranOps: ranOps
+    };
+}
+
+async function commitAction({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, requestRecord: requestRecord, options: options}) {
+    assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
+    });
+    const actor = options?.actor, {stage: stage, activity: activity, action: action, params: params} = await resolveActionCommit({
+        ctx: ctx,
         activityName: activityName,
-        actor: actor,
-        vars: {
-            can: can
-        }
-    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
-        activityName: activityName
-    })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
-        instance: instance,
-        actor: actor,
-        guards: args.guards
-    }), subjectDenials = await forecastSubjectDenials({
-        instance: instance,
-        actor: actor,
-        snapshot: snapshot,
-        resourceGrants: args.resourceGrants
-    }), subjectPermissionReason = subjectDenials.length > 0 ? {
-        kind: "subject-permission-denied",
-        denied: subjectDenials
-    } : void 0, sites = [], activityEvaluations = [];
-    for (const activity of stage.activities ?? []) activityEvaluations.push(await evaluateActivity({
-        activity: activity,
-        statusEntry: currentActivityEntries.find(t => t.name === activity.name),
-        instance: instance,
-        snapshot: snapshot,
-        activityScope: await scopeForActivity(activity.name),
-        cascadeActivityScope: () => cascadeScopeForActivity(activity.name),
-        stageHasExits: !isTerminalStage(stage),
-        guardDenial: guardDenial,
-        subjectPermissionReason: subjectPermissionReason,
-        sites: sites,
-        autonomy: activityAutonomyOf(stageAutonomy2, activity.name)
-    }));
-    const cascadeParams = await renderConditionScope(scopeSource), transitionEvaluations = [];
-    for (const transition of stage.transitions ?? []) {
-        const insight = await explainSite({
-            site: {
-                kind: "transition",
-                transition: transition.name
-            },
-            condition: transition.when,
-            params: cascadeParams,
-            snapshot: snapshot,
-            sites: sites
-        });
-        transitionEvaluations.push({
-            transition: transition,
-            whenSatisfied: insight.outcome === "satisfied",
-            unevaluable: insight.outcome === "unevaluable",
-            insight: insight
-        });
-    }
-    const currentStage = {
-        stage: stage,
-        activities: activityEvaluations,
-        transitions: transitionEvaluations,
-        autonomy: stageAutonomy2
-    }, pendingOnYou = activityEvaluations.filter(t => t.pendingOnActor), canInteract = activityEvaluations.some(t => t.actions.some(a => a.allowed)), editGuardDenial = guardDenial?.kind === "mutation-guard-denied" ? guardDenial : void 0, editableFields = await evaluateEditableFields({
-        instance: instance,
-        definition: definition,
-        stage: stage,
-        snapshot: snapshot,
-        scope: scope,
-        scopeForActivity: scopeForActivity,
-        guardDenial: editGuardDenial,
-        sites: sites
+        actionName: actionName,
+        callerParams: callerParams,
+        options: options
+    }), mutation = startMutation(ctx.instance);
+    recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
     });
-    return {
-        instance: instance,
-        definition: definition,
+    const mutEntry = requireMutationActivityEntry(mutation, activityName), statusBefore = mutEntry.status, {ranOps: ranOps} = await applyActionFire({
+        ctx: ctx,
+        mutation: mutation,
+        activity: activity,
+        action: action,
+        params: params,
         actor: actor,
-        currentStage: currentStage,
-        pendingOnYou: pendingOnYou,
-        canInteract: canInteract,
-        editableFields: editableFields,
-        fieldInsights: await buildFieldInsights({
-            sites: sites,
-            snapshot: snapshot
-        }),
-        autonomy: autonomy
+        triggered: !1
+    }), newStatus = mutEntry.status !== statusBefore ? mutEntry.status : void 0;
+    return await persistThenMaybeRefresh({
+        ctx: ctx,
+        mutation: mutation,
+        stageName: stage.name,
+        didChangeState: ranOps.some(isFieldOp)
+    }), {
+        fired: !0,
+        activity: activityName,
+        action: actionName,
+        ...newStatus !== void 0 ? {
+            newStatus: newStatus
+        } : {},
+        ...ranOps.length > 0 ? {
+            ranOps: ranOps
+        } : {}
     };
 }
 
-const AUTONOMY_CACHE = /* @__PURE__ */ new WeakMap;
-
-function autonomyOf(definition) {
-    const hit = AUTONOMY_CACHE.get(definition);
-    if (hit !== void 0) return hit;
-    const derived = deriveWorkflowAutonomy(definition);
-    return AUTONOMY_CACHE.set(definition, derived), derived;
+async function runTriggeredActions({ctx: ctx, mutation: mutation, stage: stage}) {
+    let fires = 0, ranFieldOps = !1;
+    const liveCtx = liveViewContext(ctx, mutation);
+    let firedThisPass = !0;
+    for (;firedThisPass; ) {
+        firedThisPass = !1;
+        for (const activity of stage.activities ?? []) {
+            const fired = await runActivityTriggers({
+                ctx: liveCtx,
+                mutation: mutation,
+                activity: activity
+            });
+            fires += fired.fires, ranFieldOps = ranFieldOps || fired.ranFieldOps, fired.fires > 0 && (firedThisPass = !0);
+        }
+    }
+    return {
+        fires: fires,
+        ranFieldOps: ranFieldOps
+    };
 }
 
-async function evaluateEditableFields(args) {
-    const {instance: instance, definition: definition, stage: stage, snapshot: snapshot, scope: scope, scopeForActivity: scopeForActivity, guardDenial: guardDenial, sites: sites} = args, fields = [];
-    for (const site of editableFieldsInStage(definition, stage)) {
-        const window = fieldWindowOpen(instance, site), insight = await editPredicateInsight({
-            site: site,
-            snapshot: snapshot,
-            scope: scope,
-            scopeForActivity: scopeForActivity,
-            sites: sites
-        }), predicateSatisfied = insight === void 0 || insight.outcome === "satisfied", reason = editDisabledReason({
-            effective: site.effective,
-            instance: instance,
-            window: window,
-            guardDenial: guardDenial,
-            predicateSatisfied: predicateSatisfied
-        }), value = readFieldValue(instance, site);
-        fields.push({
-            scope: site.scope,
-            ...site.activity !== void 0 ? {
-                activity: site.activity
-            } : {},
-            name: site.name,
-            type: site.type,
-            ...site.title !== void 0 ? {
-                title: site.title
-            } : {},
-            ...site.validation !== void 0 ? {
-                validation: site.validation
-            } : {},
-            value: value,
-            editable: reason === void 0,
-            ...reason !== void 0 ? {
-                disabledReason: reason
-            } : {},
-            ...fieldProvenance(instance, site.ref),
-            ...insight !== void 0 ? {
-                insight: insight
-            } : {}
+async function runActivityTriggers({ctx: ctx, mutation: mutation, activity: activity}) {
+    let fires = 0, ranFieldOps = !1;
+    for (const action of activity.actions ?? []) {
+        if (!isCascadeFired(action)) continue;
+        const entry = currentActivities(mutation).find(e => e.name === activity.name);
+        if (entry === void 0 || entry.status !== "active") break;
+        if ((entry.firedActions ?? []).includes(action.name) || !await triggerIsLive({
+            ctx: ctx,
+            activity: activity,
+            action: action
+        })) continue;
+        const result = await fireTriggeredAction({
+            ctx: ctx,
+            mutation: mutation,
+            activity: activity,
+            action: action,
+            entry: entry
         });
+        if (fires++, ranFieldOps = ranFieldOps || result.ranFieldOps, isTerminalActivityStatus(entry.status)) break;
     }
-    return fields;
+    return {
+        fires: fires,
+        ranFieldOps: ranFieldOps
+    };
 }
 
-async function editPredicateInsight(args) {
-    const {site: site, snapshot: snapshot, scope: scope, scopeForActivity: scopeForActivity, sites: sites} = args;
-    if (typeof site.effective != "string") return;
-    const params = site.scope === "activity" && site.activity !== void 0 ? await scopeForActivity(site.activity) : scope;
-    return explainSite({
-        site: {
-            kind: "editable-field",
-            scope: site.scope,
-            name: site.name,
-            ...site.activity !== void 0 ? {
-                activity: site.activity
-            } : {}
-        },
-        condition: site.effective,
-        params: params,
-        snapshot: snapshot,
-        sites: sites
-    });
+async function triggerIsLive({ctx: ctx, activity: activity, action: action}) {
+    if (!tokenMayExecute({
+        actor: ctx.actor,
+        action: action,
+        ctx: ctx
+    })) return !1;
+    const scope = {
+        activityName: activity.name
+    };
+    return action.filter !== void 0 && await ctxEvaluateConditionOutcome({
+        ctx: ctx,
+        condition: action.filter,
+        opts: scope
+    }) !== "satisfied" ? !1 : await ctxEvaluateConditionOutcome({
+        ctx: ctx,
+        condition: action.when,
+        opts: scope
+    }) === "satisfied";
 }
 
-async function advisoryCan({instance: instance, actor: actor, grants: grants}) {
-    if (grants === void 0) return;
-    const can = {};
-    for (const permission of DOCUMENT_VALUE_PERMISSIONS) can[permission] = await grantsPermissionOn({
-        document: instance,
-        grants: grants,
-        permission: permission,
-        userId: actor.id
+function tokenMayExecute({actor: actor, action: action, ctx: ctx}) {
+    const roles = action.roles;
+    return roles === void 0 || roles.length === 0 ? !0 : actor === void 0 ? !1 : roles.some(required => actorFulfillsRole({
+        actorRoles: actor.roles,
+        required: required,
+        aliases: ctx.definition.roleAliases
+    }));
+}
+
+async function fireTriggeredAction({ctx: ctx, mutation: mutation, activity: activity, action: action, entry: entry}) {
+    entry.firedActions = [ ...entry.firedActions ?? [], action.name ];
+    const {ranOps: ranOps} = await applyActionFire({
+        ctx: ctx,
+        mutation: mutation,
+        activity: activity,
+        action: action,
+        params: {},
+        actor: ctx.actor,
+        triggered: !0
     });
-    return can;
+    return {
+        ranFieldOps: ranOps.some(isFieldOp)
+    };
 }
 
-async function forecastSubjectDenials(args) {
-    const {instance: instance, actor: actor, snapshot: snapshot, resourceGrants: resourceGrants} = args;
-    if (resourceGrants === void 0 || resourceGrants.size === 0) return [];
-    const denials = [], seen = /* @__PURE__ */ new Set;
-    for (const {ref: ref, parsed: parsed, resource: resource} of foreignSubjectRefs(instance)) {
-        if (seen.has(ref.id)) continue;
-        seen.add(ref.id);
-        const grants = resourceGrants.get(resourceGdr(resource));
-        if (grants === void 0) continue;
-        const doc = snapshot.docs.find(d => d._id === ref.id);
-        doc !== void 0 && await subjectUpdateAllowed({
-            doc: doc,
-            parsed: parsed,
-            grants: grants,
-            actorId: actor.id
-        }) === !1 && denials.push({
-            subject: ref.id,
-            resource: resourceGdr(resource),
-            permission: "update"
+async function primeInitialStage({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry}) {
+    const instance = await getInstanceDocument(client, instanceId);
+    if (!instance || instance.stages.length > 0) return;
+    const definition = parseDefinitionSnapshot(instance), stage = definition.stages.find(s => s.name === instance.currentStage);
+    if (stage === void 0) return;
+    const ctx = await buildEngineContext({
+        client: client,
+        clientForGdr: clientForGdr,
+        refSurface: refSurface,
+        instance: instance,
+        definition: definition,
+        ...clock ? {
+            clock: clock
+        } : {},
+        ...actor ? {
+            actor: actor
+        } : {},
+        ...executionContext ? {
+            executionContext: executionContext
+        } : {},
+        ...telemetry ? {
+            telemetry: telemetry
+        } : {}
+    }), now = ctx.now, discards = [], initialStageEntry = {
+        _key: randomKey(),
+        name: stage.name,
+        enteredAt: now,
+        fields: await resolveStageFieldEntries({
+            client: client,
+            instance: instance,
+            stage: stage,
+            now: now,
+            refSurface: refSurface,
+            recordDiscard: recordFieldDiscards({
+                target: discards,
+                scope: "stage",
+                at: now
+            })
+        }),
+        activities: []
+    }, primedCtx = {
+        ...ctx,
+        instance: {
+            ...instance,
+            stages: [ initialStageEntry ]
+        }
+    };
+    initialStageEntry.activities = await buildStageActivities({
+        ctx: primedCtx,
+        stage: stage,
+        recordDiscard: recordFieldDiscards({
+            target: discards,
+            scope: "activity",
+            at: now
+        })
+    });
+    const terminal = isTerminalStage(stage), committed = await client.patch(instance._id).set({
+        stages: [ initialStageEntry ],
+        lastChangedAt: now,
+        ...terminal ? {
+            completedAt: now
+        } : {},
+        ...discards.length > 0 ? {
+            history: [ ...instance.history, ...stampHistoryEntries(discards, ctx.executionContext) ]
+        } : {}
+    }).ifRevisionId(instance._rev).commit(SYNC_COMMIT);
+    await deployOrRollback({
+        client: client,
+        instanceId: instance._id,
+        committedRev: committed._rev,
+        restore: {
+            stages: instance.stages,
+            history: instance.history
+        },
+        ...terminal ? {
+            unset: [ "completedAt" ]
+        } : {},
+        reversible: !0,
+        deploy: () => deployStageGuards({
+            client: client,
+            clientForGdr: clientForGdr,
+            instance: instance,
+            definition: definition,
+            stageName: stage.name,
+            now: now,
+            snapshot: ctx.snapshot
+        })
+    });
+}
+
+const CASCADE_LIMIT = 100;
+
+async function runCascadeHop({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
+    const ctx = await loadContext({
+        client: client,
+        instanceId: instanceId,
+        options: {
+            clientForGdr: clientForGdr,
+            refSurface: refSurface,
+            ...actor ? {
+                actor: actor
+            } : {},
+            ...clock ? {
+                clock: clock
+            } : {},
+            ...executionContext ? {
+                executionContext: executionContext
+            } : {},
+            ...telemetry ? {
+                telemetry: telemetry
+            } : {},
+            ...overlay ? {
+                overlay: overlay
+            } : {}
+        }
+    });
+    if (isTerminal(ctx)) return {
+        moved: !1
+    };
+    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), fired = await runTriggeredActions({
+        ctx: ctx,
+        mutation: mutation,
+        stage: stage
+    }), hopCtx = liveViewContext(ctx, mutation), transition = await pickTransition(hopCtx, stage);
+    return transition === void 0 ? (fired.fires > 0 && await persistThenMaybeRefresh({
+        ctx: ctx,
+        mutation: mutation,
+        stageName: stage.name,
+        didChangeState: fired.ranFieldOps
+    }), {
+        moved: !1
+    }) : (await commitStageMove({
+        ctx: ctx,
+        mutation: mutation,
+        fromStage: stage,
+        toStage: findStage(ctx.definition, transition.to),
+        transition: transition.name,
+        via: "transition",
+        actor: actor
+    }), {
+        moved: !0
+    });
+}
+
+async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
+    let count = 0;
+    for (;;) {
+        if (await drainCondemnedChildren({
+            client: client,
+            instanceId: instanceId,
+            actor: actor,
+            clientForGdr: clientForGdr,
+            refSurface: refSurface,
+            clock: clock,
+            executionContext: executionContext,
+            telemetry: telemetry
+        }), !(await runCascadeHop({
+            client: client,
+            instanceId: instanceId,
+            actor: actor,
+            clientForGdr: clientForGdr,
+            refSurface: refSurface,
+            clock: clock,
+            executionContext: executionContext,
+            telemetry: telemetry,
+            overlay: overlay
+        })).moved) return count;
+        if (count++, count >= CASCADE_LIMIT) throw new CascadeLimitError({
+            instanceId: instanceId,
+            limit: CASCADE_LIMIT
         });
     }
-    return denials;
 }
 
-async function subjectUpdateAllowed(args) {
-    const {doc: doc, parsed: parsed, grants: grants, actorId: actorId} = args;
+async function drainCondemnedChildren({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining = /* @__PURE__ */ new Set}) {
+    if (draining.has(instanceId)) return;
+    draining.add(instanceId);
+    const instance = await getInstanceDocument(client, instanceId);
+    if (!instance) return;
+    const condemned = condemnedSubworkflows(instance);
+    if (condemned.length !== 0) {
+        for (const row of condemned) await settleCondemnedRow({
+            client: client,
+            ownerId: instanceId,
+            row: row,
+            actor: actor,
+            clientForGdr: clientForGdr,
+            refSurface: refSurface,
+            clock: clock,
+            executionContext: executionContext,
+            telemetry: telemetry,
+            draining: draining
+        });
+        await stampDrainedRows({
+            client: client,
+            instance: instance,
+            condemned: condemned,
+            clock: clock,
+            executionContext: executionContext
+        });
+    }
+}
+
+async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining}) {
+    const childId = toBareId(row.ref.id);
     try {
-        return await grantsPermissionOn({
-            document: {
-                ...doc,
-                _id: parsed.documentId
-            },
-            grants: grants,
-            permission: "update",
-            userId: actorId
+        await abortInstance({
+            client: client,
+            instanceId: childId,
+            reason: row.abortPending?.reason ?? "condemned by parent",
+            options: {
+                ...actor ? {
+                    actor: actor
+                } : {},
+                clientForGdr: clientForGdr,
+                refSurface: refSurface,
+                ...clock ? {
+                    clock: clock
+                } : {},
+                ...executionContext ? {
+                    executionContext: executionContext
+                } : {},
+                ...telemetry ? {
+                    telemetry: telemetry
+                } : {}
+            }
+        }), await drainCondemnedChildren({
+            client: client,
+            instanceId: childId,
+            actor: actor,
+            clientForGdr: clientForGdr,
+            refSurface: refSurface,
+            clock: clock,
+            executionContext: executionContext,
+            telemetry: telemetry,
+            draining: draining
+        });
+    } catch (cause) {
+        if (cause instanceof InstanceNotFoundError) return;
+        throw cause instanceof WorkflowStateDivergedError ? cause : new WorkflowStateDivergedError({
+            instanceId: ownerId,
+            guardError: cause,
+            reason: `owed child abort of "${childId}" failed while draining condemned rows`
         });
-    } catch (err) {
-        console.warn(`workflow: subject-write forecast skipped for "${doc._id}" — evaluating that resource's grants failed (the lake still enforces the write). Original error: ${errorMessage(err)}`);
-        return;
     }
 }
 
-async function evaluateActivity(args) {
-    const {activity: activity, statusEntry: statusEntry, instance: instance, snapshot: snapshot, activityScope: activityScope, cascadeActivityScope: cascadeActivityScope, stageHasExits: stageHasExits, guardDenial: guardDenial, subjectPermissionReason: subjectPermissionReason, sites: sites, autonomy: autonomy} = args, status = statusEntry?.status ?? "skipped", assigned = activityScope.assigned === !0, {unmetRequirements: unmetRequirements, ...conditionInsights} = await explainActivityConditions({
-        activity: activity,
-        activityScope: activityScope,
-        cascadeActivityScope: cascadeActivityScope,
-        snapshot: snapshot,
-        sites: sites
-    }), requirementsReason = unmetRequirements.length > 0 ? {
-        kind: "requirements-unmet",
-        unmetRequirements: unmetRequirements
-    } : void 0, actions = [];
-    for (const action of activity.actions ?? []) actions.push(await evaluateAction({
-        action: action,
-        activityName: activity.name,
-        status: status,
-        instance: instance,
-        snapshot: snapshot,
-        activityScope: activityScope,
-        cascadeActivityScope: cascadeActivityScope,
-        stageHasExits: stageHasExits,
-        guardDenial: guardDenial,
-        subjectPermissionReason: subjectPermissionReason,
-        requirementsReason: requirementsReason,
-        sites: sites
-    }));
-    return {
-        activity: activity,
-        status: status,
-        kind: deriveActivityKind(activity),
-        classification: deriveExecutorClassification(activity),
-        autonomy: autonomy,
-        pendingOnActor: status === "active" && assigned,
-        scopedOut: isFilterScopedOut({
-            status: status,
-            startedAt: statusEntry?.startedAt
-        }),
-        ...unmetRequirements.length > 0 ? {
-            unmetRequirements: unmetRequirements
-        } : {},
-        ...conditionInsights,
-        actions: actions
-    };
+async function stampDrainedRows({client: client, instance: instance, condemned: condemned, clock: clock, executionContext: executionContext}) {
+    const now = (clock ?? wallClock)(), stamp = resolveExecutionContext(executionContext), ids = condemned.map(row => toBareId(row.ref.id)), children = await client.fetch("*[_id in $ids]{_id, currentStage, completedAt, abortedAt, modelVersion, minReaderModel}", {
+        ids: ids
+    }), byId = new Map(children.map(c => [ assertReadableModel(c)._id, c ])), condemnedKeys = new Set(condemned.map(row => row._key)), history = [ ...instance.history ], subworkflows = (instance.subworkflows ?? []).map(row => {
+        if (row.resolved !== void 0 || !condemnedKeys.has(row._key)) return row;
+        const child = byId.get(toBareId(row.ref.id)), resolved = child !== void 0 ? terminalResolution(child) : {
+            at: now,
+            aborted: !0
+        };
+        return resolved === void 0 ? row : (history.push(...stampHistoryEntries([ subworkflowResolvedEntry({
+            row: row,
+            at: now,
+            status: resolved.aborted === !0 ? "aborted" : "done"
+        }) ], stamp)), {
+            ...row,
+            resolved: resolved
+        });
+    });
+    await client.patch(instance._id).set({
+        subworkflows: subworkflows,
+        history: history,
+        lastChangedAt: now
+    }).ifRevisionId(instance._rev).commit(SYNC_COMMIT);
 }
 
-async function explainActivityConditions({activity: activity, activityScope: activityScope, cascadeActivityScope: cascadeActivityScope, snapshot: snapshot, sites: sites}) {
-    const explainAt = (site, condition) => explainSite({
-        site: site,
-        condition: condition,
-        params: activityScope,
-        snapshot: snapshot,
-        sites: sites
-    }), requirementEntries = [];
-    for (const [name, condition] of Object.entries(activity.requirements ?? {})) requirementEntries.push([ name, await explainAt({
-        kind: "requirement",
-        activity: activity.name,
-        requirement: name
-    }, condition) ]);
-    const requirementInsights = Object.fromEntries(requirementEntries), unmetRequirements = requirementEntries.filter(([, insight]) => insight.outcome !== "satisfied").map(([name]) => name), filterInsight = activity.filter !== void 0 ? await explainSite({
-        site: {
-            kind: "activity-filter",
-            activity: activity.name
-        },
-        condition: activity.filter,
-        params: await cascadeActivityScope(),
-        snapshot: snapshot,
-        sites: sites
-    }) : void 0;
-    return {
-        unmetRequirements: unmetRequirements,
-        ...activity.requirements !== void 0 ? {
-            requirementInsights: requirementInsights
-        } : {},
-        ...filterInsight !== void 0 ? {
-            filterInsight: filterInsight
+function terminalResolution(child) {
+    const status = resolvedChildStatus(child);
+    if (!(status === void 0 || child.completedAt === void 0 || child.completedAt === null)) return {
+        at: child.completedAt,
+        stage: child.currentStage,
+        ...status === "aborted" ? {
+            aborted: !0
         } : {}
     };
 }
 
-async function evaluateAction(args) {
-    const {action: action, activityName: activityName, snapshot: snapshot, activityScope: activityScope, sites: sites} = args, conditionScope = isCascadeFired(action) ? await args.cascadeActivityScope() : activityScope, insights = await explainActionGates({
-        action: action,
-        activityName: activityName,
-        conditionScope: conditionScope,
-        snapshot: snapshot,
-        sites: sites
-    });
-    return action.when !== void 0 ? triggeredActionVerdict({
-        action: action,
-        when: action.when,
-        insights: insights
-    }) : fireableActionVerdict({
-        args: args,
-        insights: insights
-    });
+function subworkflowResolvedEntry({row: row, at: at, status: status}) {
+    return {
+        _key: randomKey(),
+        _type: "subworkflowResolved",
+        at: at,
+        activity: row.activity,
+        instanceRef: row.ref,
+        status: status
+    };
 }
 
-async function explainActionGates({action: action, activityName: activityName, conditionScope: conditionScope, snapshot: snapshot, sites: sites}) {
-    const insight = action.filter !== void 0 ? await explainSite({
-        site: {
-            kind: "action",
-            activity: activityName,
-            action: action.name
-        },
-        condition: action.filter,
-        params: conditionScope,
-        snapshot: snapshot,
-        sites: sites
-    }) : void 0, whenInsight = action.when !== void 0 ? await explainSite({
-        site: {
-            kind: "action-when",
-            activity: activityName,
-            action: action.name
-        },
-        condition: action.when,
-        params: conditionScope,
-        snapshot: snapshot,
-        sites: sites
-    }) : void 0;
-    return {
-        ...insight !== void 0 ? {
-            insight: insight
+async function propagateToAncestors({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry}) {
+    const loaded = await loadPropagationPair(client, instanceId);
+    if (loaded === void 0) return;
+    const {child: child, parent: parent} = loaded, definition = parseDefinitionSnapshot(parent), ctx = await buildEngineContext({
+        client: client,
+        clientForGdr: clientForGdr,
+        refSurface: refSurface,
+        instance: parent,
+        definition: definition,
+        ...clock ? {
+            clock: clock
         } : {},
-        ...whenInsight !== void 0 ? {
-            whenInsight: whenInsight
+        ...actor ? {
+            actor: actor
+        } : {},
+        ...executionContext ? {
+            executionContext: executionContext
+        } : {},
+        ...telemetry ? {
+            telemetry: telemetry
         } : {}
-    };
+    }), mutation = startMutation(parent), row = mutation.subworkflows.find(r => toBareId(r.ref.id) === child._id);
+    if (row === void 0) {
+        await recordOrphanedPropagation({
+            ctx: ctx,
+            mutation: mutation,
+            child: child
+        });
+        return;
+    }
+    const changed = stampResolvedChild({
+        mutation: mutation,
+        row: row,
+        child: child,
+        now: ctx.now
+    }), parentTerminal = parent.completedAt !== void 0;
+    changed && await persist(ctx, mutation), !parentTerminal && (await cascadeAutoTransitions({
+        client: client,
+        instanceId: parent._id,
+        actor: actor,
+        clientForGdr: clientForGdr,
+        refSurface: refSurface,
+        clock: clock,
+        executionContext: executionContext,
+        telemetry: telemetry
+    }), await propagateToAncestors({
+        client: client,
+        instanceId: parent._id,
+        actor: actor,
+        clientForGdr: clientForGdr,
+        refSurface: refSurface,
+        clock: clock,
+        executionContext: executionContext,
+        telemetry: telemetry
+    }));
 }
 
-function triggeredActionVerdict({action: action, when: when, insights: insights}) {
-    return insights.insight !== void 0 && insights.insight.outcome === "unsatisfied" ? disabled({
-        action: action,
-        reason: {
-            kind: "filter-failed",
-            filter: action.filter ?? ""
-        },
-        ...insights
-    }) : {
-        ...actionEvaluationIdentity(action),
-        allowed: !1,
-        triggered: !0,
-        disabledReason: {
-            kind: "cascade-fired",
-            when: when
-        },
-        ...insights
+async function loadPropagationPair(client, instanceId) {
+    const child = await getInstanceDocument(client, instanceId);
+    if (!child) return;
+    const parentGdr = parentRef(child);
+    if (parentGdr === void 0) return;
+    const parentDoc = await client.getDocument(toBareId(parentGdr.id));
+    if (!(!parentDoc || parentDoc._type !== WORKFLOW_INSTANCE_TYPE)) return {
+        child: child,
+        parent: readInstanceDoc(parentDoc)
     };
 }
 
-function fireableActionVerdict({args: args, insights: insights}) {
-    const {action: action, status: status, instance: instance, stageHasExits: stageHasExits, guardDenial: guardDenial} = args, lifecycle = lifecycleReason({
-        instance: instance,
-        status: status,
-        stageHasExits: stageHasExits
-    });
-    if (lifecycle !== void 0) return disabled({
-        action: action,
-        reason: lifecycle,
-        ...insights
-    });
-    if (guardDenial !== void 0) return disabled({
-        action: action,
-        reason: guardDenial,
-        ...insights
-    });
-    if (args.subjectPermissionReason !== void 0 && (action.effects?.length ?? 0) > 0) return disabled({
-        action: action,
-        reason: args.subjectPermissionReason,
-        ...insights
-    });
-    if (args.requirementsReason !== void 0) return disabled({
-        action: action,
-        reason: args.requirementsReason,
-        ...insights
-    });
-    const {insight: insight} = insights;
-    return action.filter !== void 0 && insight !== void 0 && insight.outcome !== "satisfied" ? disabled({
-        action: action,
-        reason: {
-            kind: "filter-failed",
-            filter: action.filter
+function stampResolvedChild({mutation: mutation, row: row, child: child, now: now}) {
+    if (row.resolved !== void 0) return !1;
+    const resolved = terminalResolution(child);
+    return resolved === void 0 ? !1 : (row.resolved = resolved, mutation.history.push(subworkflowResolvedEntry({
+        row: row,
+        at: now,
+        status: resolved.aborted === !0 ? "aborted" : "done"
+    })), !0);
+}
+
+async function recordOrphanedPropagation({ctx: ctx, mutation: mutation, child: child}) {
+    const childUri = selfGdr(child);
+    mutation.history.some(h => h._type === "subworkflowOrphaned" && h.instanceRef.id === childUri) || (mutation.history.push({
+        _key: randomKey(),
+        _type: "subworkflowOrphaned",
+        at: ctx.now,
+        instanceRef: {
+            id: childUri,
+            type: WORKFLOW_INSTANCE_TYPE
         },
-        ...insights
-    }) : {
-        ...actionEvaluationIdentity(action),
-        allowed: !0,
-        ...insights
-    };
+        detail: `Instance "${child._id}" names this instance as its parent but no subworkflow-registry row matches it, so its state cannot drive any gate here.`
+    }), await persist(ctx, mutation));
 }
 
-function actionEvaluationIdentity(action) {
+function startMutation(instance) {
     return {
-        action: action,
-        ...action.semantics !== void 0 ? {
-            semantics: action.semantics
-        } : {}
+        minReaderModel: minReaderModelOf(instance),
+        currentStage: instance.currentStage,
+        fields: (instance.fields ?? []).map(s => ({
+            ...s
+        })),
+        stages: instance.stages.map(s => ({
+            ...s,
+            fields: (s.fields ?? []).map(entry => ({
+                ...entry
+            })),
+            activities: s.activities.map(t => ({
+                ...t,
+                ...t.fields !== void 0 ? {
+                    fields: t.fields.map(entry => ({
+                        ...entry
+                    }))
+                } : {}
+            }))
+        })),
+        subworkflows: (instance.subworkflows ?? []).map(row => ({
+            ...row,
+            ...row.abortPending !== void 0 ? {
+                abortPending: {
+                    ...row.abortPending
+                }
+            } : {},
+            ...row.resolved !== void 0 ? {
+                resolved: {
+                    ...row.resolved
+                }
+            } : {}
+        })),
+        pendingEffects: [ ...instance.pendingEffects ],
+        effectHistory: [ ...instance.effectHistory ],
+        context: [ ...instance.context ],
+        history: [ ...instance.history ],
+        processedRequests: [ ...instance.processedRequests ?? [] ],
+        lastChangedAt: instance.lastChangedAt,
+        ...instance.completedAt !== void 0 ? {
+            completedAt: instance.completedAt
+        } : {},
+        ...instance.abortedAt !== void 0 ? {
+            abortedAt: instance.abortedAt
+        } : {},
+        pendingCreates: []
     };
 }
 
-async function instanceGuardReason({instance: instance, actor: actor, guards: guards}) {
-    if (guards === void 0 || guards.length === 0) return;
-    const denied = await instanceWriteDenials({
-        instance: instance,
-        guards: guards,
-        identity: actor.id
-    });
-    if (denied.length !== 0) return {
-        kind: "mutation-guard-denied",
-        denied: deniedGuardRefs(denied)
+function instanceStateFields(src) {
+    const state = {
+        currentStage: src.currentStage,
+        fields: src.fields,
+        stages: src.stages,
+        subworkflows: src.subworkflows ?? [],
+        pendingEffects: src.pendingEffects,
+        effectHistory: src.effectHistory,
+        context: src.context,
+        history: src.history,
+        processedRequests: src.processedRequests ?? [],
+        ...src.completedAt !== void 0 ? {
+            completedAt: src.completedAt
+        } : {},
+        ...src.abortedAt !== void 0 ? {
+            abortedAt: src.abortedAt
+        } : {}
+    };
+    return {
+        ...modelStampFor({
+            documentType: "instance",
+            document: state,
+            storedMinReaderModel: src.minReaderModel
+        }),
+        ...state
     };
 }
 
-function lifecycleReason({instance: instance, status: status, stageHasExits: stageHasExits}) {
-    const terminalReason = instanceTerminalReason(instance);
-    if (terminalReason !== void 0) return terminalReason;
-    if (!stageHasExits) return {
-        kind: "stage-terminal",
-        stage: instance.currentStage
-    };
-    if (isTerminalActivityStatus(status)) return {
-        kind: "activity-not-active",
-        status: status
+function liveViewContext(ctx, mutation) {
+    const materialized = materializeInstance(ctx.instance, mutation);
+    return {
+        ...ctx,
+        instance: materialized,
+        snapshot: overlayInstanceInSnapshot(ctx.snapshot, materialized)
     };
 }
 
-function disabled(args) {
+function materializeInstance(base, mutation) {
     return {
-        ...actionEvaluationIdentity(args.action),
-        allowed: !1,
-        disabledReason: args.reason,
-        ...args.insight !== void 0 ? {
-            insight: args.insight
-        } : {},
-        ...args.whenInsight !== void 0 ? {
-            whenInsight: args.whenInsight
-        } : {}
+        ...base,
+        currentStage: mutation.currentStage,
+        fields: mutation.fields,
+        stages: mutation.stages,
+        subworkflows: mutation.subworkflows,
+        context: mutation.context,
+        pendingEffects: mutation.pendingEffects,
+        effectHistory: mutation.effectHistory
     };
 }
 
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+async function persist(ctx, mutation) {
+    stampExecutionContext(ctx, mutation);
+    const set = {
+        ...instanceStateFields(mutation),
+        lastChangedAt: ctx.now
+    }, pendingCreates = mutation.pendingCreates;
+    if (pendingCreates.length === 0) return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT);
+    const tx = ctx.client.transaction();
+    for (const {body: body} of pendingCreates) tx.create(body);
+    tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), 
+    await tx.commit(), mutation.pendingCreates = [];
+    const actorForPriming = ctx.actor;
+    for (const {body: body, started: started} of pendingCreates) try {
+        await primeInitialStage({
+            client: ctx.client,
+            instanceId: body._id,
+            actor: actorForPriming,
+            clientForGdr: ctx.clientForGdr,
+            refSurface: ctx.refSurface,
+            clock: ctx.clock,
+            executionContext: ctx.executionContext,
+            telemetry: ctx.telemetry
+        }), await cascadeAutoTransitions({
+            client: ctx.client,
+            instanceId: body._id,
+            actor: actorForPriming,
+            clientForGdr: ctx.clientForGdr,
+            refSurface: ctx.refSurface,
+            clock: ctx.clock,
+            executionContext: ctx.executionContext,
+            telemetry: ctx.telemetry
+        }), await propagateToAncestors({
+            client: ctx.client,
+            instanceId: body._id,
+            actor: actorForPriming,
+            clientForGdr: ctx.clientForGdr,
+            refSurface: ctx.refSurface,
+            clock: ctx.clock,
+            executionContext: ctx.executionContext,
+            telemetry: ctx.telemetry
+        }), ctx.telemetry.log(WorkflowInstanceStarted, started);
+    } catch (cause) {
+        throw cause instanceof WorkflowStateDivergedError ? cause : new WorkflowStateDivergedError({
+            instanceId: ctx.instance._id,
+            guardError: cause,
+            reason: `spawned child "${body._id}" failed to settle after the spawn transaction committed`
+        });
+    }
+    const reloaded = await getInstanceDocument(ctx.client, ctx.instance._id);
+    if (!reloaded) throw new Error(`Instance ${ctx.instance._id} disappeared after transaction commit`);
+    return reloaded;
 }
 
-class ActionDisabledError extends WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
-    }
+function stampExecutionContext(ctx, mutation) {
+    const stamp = ctx.executionContext, appended = mutation.history.slice(ctx.instance.history.length);
+    mutation.history = [ ...mutation.history.slice(0, ctx.instance.history.length), ...stampHistoryEntries(appended, stamp) ];
+    for (const {body: body} of mutation.pendingCreates) body.history = stampHistoryEntries(body.history, stamp);
 }
 
-class StartNotAllowedError extends WorkflowError {
-    definition;
-    insight;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused: start.allowed on definition "${args.definition}" evaluated ` + (args.insight.outcome === "unevaluable" ? `GROQ null ("can't decide" — fail-closed)` : "false") + " for the supplied initialFields. Pre-flight the verdict with evaluateStart."), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.insight = args.insight;
-    }
+function currentStageEntry(mutation) {
+    const entry = findOpenStageEntry(mutation);
+    if (entry === void 0) throw new Error(`Mutation invariant broken: no current (un-exited) StageEntry for currentStage "${mutation.currentStage}"`);
+    return entry;
 }
 
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+function currentActivities(mutation) {
+    return currentStageEntry(mutation).activities;
 }
 
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
-    "activity-not-active": r => `activity status is "${r.status}"`,
-    "stage-terminal": r => `stage "${r.stage}" is terminal`,
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.join(", ")}`,
-    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
-};
-
-function actionDisabledDetail(reason) {
-    return disabledReasonDetail[reason.kind](reason);
+function findActivityInCurrentStage(ctx, activityName) {
+    const stage = findStage(ctx.definition, ctx.instance.currentStage), activity = (stage.activities ?? []).find(t => t.name === activityName);
+    if (activity === void 0) throw new ContractViolationError(`Activity "${activityName}" not found in current stage "${stage.name}" of ${ctx.definition.name}`);
+    return {
+        stage: stage,
+        activity: activity
+    };
 }
 
-function formatDisabledReason({activity: activity, action: action, reason: reason}) {
-    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+function requireMutationActivityEntry(mutation, activity) {
+    const mutEntry = currentActivities(mutation).find(t => t.name === activity);
+    if (mutEntry === void 0) throw new Error(`Activity "${activity}" disappeared from mutation copy — invariant broken`);
+    return mutEntry;
 }
 
-class EditFieldDeniedError extends WorkflowError {
-    reason;
-    target;
-    constructor(args) {
-        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
-        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
-    }
+function findCurrentStageEntry(instance) {
+    return findOpenStageEntry(instance);
 }
 
-const editDisabledReasonDetail = {
-    "not-editable": () => "field is not declared editable",
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "edit-window-closed": r => `edit window closed (${r.detail})`,
-    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
-};
-
-function formatEditDisabledReason(target, reason) {
-    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
-    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+function findCurrentActivities(instance) {
+    return findCurrentStageEntry(instance)?.activities ?? [];
 }
 
-async function fireAction(args) {
-    const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
+async function completeEffect(args) {
+    const {client: client, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, requestRecord: requestRecord, options: options} = args;
+    if (status !== "done" && status !== "failed") throw new ContractViolationError(`completeEffect: status must be "done" or "failed", got ${JSON.stringify(status)} — "cancelled" is engine-stamped by abort, never reportable`);
     return retryOnRevisionConflict({
         client: client,
         instanceId: instanceId,
         options: options,
-        commit: ctx => commitAction({
+        commit: ctx => commitCompleteEffect({
             ctx: ctx,
-            activityName: activity,
-            actionName: action,
-            callerParams: params,
+            effectKey: effectKey,
+            status: status,
+            outputs: outputs,
+            ops: ops,
+            detail: detail,
+            error: error,
+            durationMs: durationMs,
             requestRecord: requestRecord,
-            options: options
+            actor: options.actor
         }),
-        onExhausted: () => new ConcurrentFireActionError({
+        onExhausted: () => new ConcurrentCompleteEffectError({
             instanceId: instanceId,
-            activity: activity,
-            action: action,
+            effectKey: effectKey,
             attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
         })
     });
 }
 
-async function resolveActionCommit({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, options: options}) {
-    const actor = options?.actor, {stage: stage, activity: activity} = findActivityInCurrentStage(ctx, activityName), action = (activity.actions ?? []).find(a => a.name === actionName);
-    if (action === void 0) throw new ContractViolationError(`Action "${actionName}" not declared on activity "${activityName}"`);
-    if (action.when !== void 0) throw new ActionDisabledError({
-        activity: activityName,
-        action: actionName,
-        reason: {
-            kind: "cascade-fired",
-            when: action.when
-        }
-    });
-    if (action.filter !== void 0) {
-        const can = options?.grants !== void 0 && actor !== void 0 ? await advisoryCan({
-            instance: ctx.instance,
-            actor: actor,
-            grants: options.grants
-        }) : void 0;
-        if (!await ctxEvaluateCondition({
-            ctx: ctx,
-            condition: action.filter,
-            opts: {
-                activityName: activityName,
-                ...actor !== void 0 ? {
-                    actor: actor
-                } : {},
-                ...can !== void 0 ? {
-                    vars: {
-                        can: can
-                    }
-                } : {}
-            }
-        })) throw new ActionDisabledError({
-            activity: activityName,
-            action: actionName,
-            reason: {
-                kind: "filter-failed",
-                filter: action.filter,
-                detail: "commit re-check"
-            }
-        });
-    }
-    const entry = findCurrentActivities(ctx.instance).find(t => t.name === activityName);
-    if (entry === void 0 || entry.status !== "active") throw notActiveAtCommit({
-        activityName: activityName,
-        actionName: actionName,
-        status: entry?.status
-    });
-    const params = validateActionParams({
-        action: action,
-        activityName: activityName,
-        callerParams: callerParams
-    });
+function buildEffectHistoryEntry(pending, outcome) {
+    const {status: status, ranAt: ranAt, actor: actor, detail: detail, error: error, durationMs: durationMs, outputs: outputs} = outcome, resolvedActor = actor ?? pending.actor;
     return {
-        stage: stage,
-        activity: activity,
-        action: action,
-        params: params
+        _key: pending._key,
+        name: pending.name,
+        ...pending.title !== void 0 ? {
+            title: pending.title
+        } : {},
+        ...pending.description !== void 0 ? {
+            description: pending.description
+        } : {},
+        params: pending.params,
+        origin: pending.origin,
+        ...resolvedActor !== void 0 ? {
+            actor: resolvedActor
+        } : {},
+        ...pending.stageEntryKey !== void 0 ? {
+            stageEntryKey: pending.stageEntryKey
+        } : {},
+        ranAt: ranAt,
+        ...durationMs !== void 0 ? {
+            durationMs: durationMs
+        } : {},
+        status: status,
+        ...detail !== void 0 ? {
+            detail: detail
+        } : {},
+        ...error !== void 0 ? {
+            error: error
+        } : {},
+        ...outputs !== void 0 ? {
+            outputs: outputs
+        } : {}
     };
 }
 
-function notActiveAtCommit(args) {
-    const {activityName: activityName, actionName: actionName, status: status} = args;
-    return status !== void 0 && isTerminalActivityStatus(status) ? new ActionDisabledError({
-        activity: activityName,
-        action: actionName,
-        reason: {
-            kind: "activity-not-active",
-            status: status
+function buildEffectSettlement(pending, outcome) {
+    const {status: status, ranAt: ranAt, actor: actor, detail: detail, outputs: outputs} = outcome;
+    return {
+        run: buildEffectHistoryEntry(pending, outcome),
+        event: {
+            _key: randomKey(),
+            _type: "effectCompleted",
+            at: ranAt,
+            effectKey: pending._key,
+            effect: pending.name,
+            status: status,
+            ...outputs !== void 0 ? {
+                outputs: outputs
+            } : {},
+            ...detail !== void 0 ? {
+                detail: detail
+            } : {},
+            ...actor !== void 0 ? {
+                actor: actor
+            } : {}
         }
-    }) : new Error(`Activity "${activityName}" must be active to fire action "${actionName}"; status is ${status ?? "missing"}`);
+    };
 }
 
-async function applyActionFire({ctx: ctx, mutation: mutation, activity: activity, action: action, params: params, actor: actor, triggered: triggered}) {
-    mutation.history.push({
-        _key: randomKey(),
-        _type: "actionFired",
-        at: ctx.now,
-        stage: mutation.currentStage,
-        activity: activity.name,
-        action: action.name,
-        ...actor !== void 0 ? {
-            actor: actor,
-            driverKind: driverKind(actor)
+function validateEffectOutputs(args) {
+    const {outputs: outputs, declared: declared, effectName: effectName} = args, byName = new Map(declared.map(shape => [ shape.name, shape ])), issues = [];
+    for (const [key, value] of Object.entries(outputs)) {
+        const shape = byName.get(key);
+        if (shape === void 0) {
+            issues.push(`"${key}" is not a declared output`);
+            continue;
+        }
+        const shapeIssues = effectOutputIssues(shape, value);
+        shapeIssues !== void 0 && issues.push(...shapeIssues.map(i => `"${key}": ${i}`));
+    }
+    if (issues.length > 0) throw new EffectOutputsInvalidError({
+        effect: effectName,
+        issues: issues
+    });
+}
+
+function effectOutputIssues(shape, value) {
+    return checkFieldValue({
+        entryType: shape.type,
+        value: value,
+        ...shape.fields !== void 0 ? {
+            fields: shape.fields
         } : {},
-        ...triggered ? {
-            triggered: !0
+        ...shape.of !== void 0 ? {
+            of: shape.of
+        } : {},
+        ...shape.options !== void 0 ? {
+            options: shape.options
+        } : {},
+        ...shape.validation !== void 0 ? {
+            validation: shape.validation
+        } : {}
+    });
+}
+
+function requirePendingEffect(instance, effectKey) {
+    const pending = instance.pendingEffects.find(e => e._key === effectKey);
+    if (pending !== void 0) return pending;
+    const run = instance.effectHistory.find(e => e._key === effectKey), settled = run !== void 0 ? {
+        status: run.status,
+        ranAt: run.ranAt,
+        ...run.detail !== void 0 ? {
+            detail: run.detail
+        } : {}
+    } : void 0;
+    throw new EffectNotFoundError({
+        instanceId: instance._id,
+        effectKey: effectKey,
+        ...settled !== void 0 ? {
+            settled: settled
         } : {}
     });
-    const ranOps = await runOps({
-        ops: action.ops,
-        mutation: mutation,
-        stage: mutation.currentStage,
-        origin: {
-            activity: activity.name,
-            action: action.name
-        },
-        params: params,
-        actor: actor,
-        self: selfGdr(ctx.instance),
-        now: ctx.now,
-        snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+}
+
+function validateCompletionInput({pending: pending, definition: definition, status: status, ops: ops, outputs: outputs}) {
+    if (status === "failed" && ops !== void 0 && ops.length > 0) throw new EffectOpsInvalidError({
+        effect: pending.name,
+        issues: [ "ops cannot accompany a failed completion — field.set the outcome on a done completion instead" ]
     });
-    return await queueEffects({
-        ctx: ctx,
-        mutation: mutation,
-        effects: action.effects,
-        origin: {
-            kind: "action",
-            name: action.name
-        },
-        actor: actor,
-        opts: {
-            callerParams: params,
-            activityName: activity.name
-        }
-    }), action.spawn !== void 0 && await spawnSubworkflows({
-        ctx: ctx,
-        mutation: mutation,
-        activity: activity,
-        action: action,
-        sub: action.spawn,
-        actor: actor
-    }), {
-        ranOps: ranOps
-    };
+    if (status === "failed" && outputs !== void 0) throw new EffectOutputsInvalidError({
+        effect: pending.name,
+        issues: [ "outputs cannot accompany a failed completion — report outputs on a done completion instead" ]
+    });
+    if (outputs !== void 0) {
+        const declared = findEffect(definition, pending.name)?.outputs ?? [];
+        validateEffectOutputs({
+            outputs: outputs,
+            declared: declared,
+            effectName: pending.name
+        });
+    }
+    return ops !== void 0 ? validateEffectOps(ops, pending.name) : [];
 }
 
-async function commitAction({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, requestRecord: requestRecord, options: options}) {
+async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, requestRecord: requestRecord, actor: actor}) {
     assertRequestUnprocessed({
         instance: ctx.instance,
         record: requestRecord,
         now: ctx.now
     });
-    const actor = options?.actor, {stage: stage, activity: activity, action: action, params: params} = await resolveActionCommit({
-        ctx: ctx,
-        activityName: activityName,
-        actionName: actionName,
-        callerParams: callerParams,
-        options: options
+    const pending = requirePendingEffect(ctx.instance, effectKey), validatedOps = validateCompletionInput({
+        pending: pending,
+        definition: ctx.definition,
+        status: status,
+        ops: ops,
+        outputs: outputs
     }), mutation = startMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
         now: ctx.now
+    }), mutation.pendingEffects = mutation.pendingEffects.filter(e => e._key !== effectKey);
+    const ranAt = ctx.now, settlement = buildEffectSettlement(pending, {
+        status: status,
+        ranAt: ranAt,
+        actor: actor,
+        detail: detail,
+        error: error,
+        durationMs: durationMs,
+        outputs: outputs
     });
-    const mutEntry = requireMutationActivityEntry(mutation, activityName), statusBefore = mutEntry.status, {ranOps: ranOps} = await applyActionFire({
-        ctx: ctx,
+    mutation.effectHistory.push(settlement.run);
+    const wroteEffectOutputs = status === "done" && outputs !== void 0;
+    mutation.history.push(settlement.event);
+    const ranOps = await runOps({
+        ops: validatedOps,
         mutation: mutation,
-        activity: activity,
-        action: action,
-        params: params,
+        stage: ctx.instance.currentStage,
+        origin: {
+            effect: pending.name
+        },
+        params: pending.params,
         actor: actor,
-        triggered: !1
-    }), newStatus = mutEntry.status !== statusBefore ? mutEntry.status : void 0;
+        self: selfGdr(ctx.instance),
+        now: ranAt,
+        snapshot: ctx.snapshot,
+        refSurface: ctx.refSurface
+    }), needsGuardRefresh = wroteEffectOutputs || ranOps.some(isFieldOp);
     return await persistThenMaybeRefresh({
         ctx: ctx,
         mutation: mutation,
-        stageName: stage.name,
-        didChangeState: ranOps.some(isFieldOp)
+        stageName: ctx.instance.currentStage,
+        didChangeState: needsGuardRefresh
     }), {
-        fired: !0,
-        activity: activityName,
-        action: actionName,
-        ...newStatus !== void 0 ? {
-            newStatus: newStatus
-        } : {},
-        ...ranOps.length > 0 ? {
-            ranOps: ranOps
-        } : {}
-    };
-}
-
-async function runTriggeredActions({ctx: ctx, mutation: mutation, stage: stage}) {
-    let fires = 0, ranFieldOps = !1;
-    const liveCtx = liveViewContext(ctx, mutation);
-    let firedThisPass = !0;
-    for (;firedThisPass; ) {
-        firedThisPass = !1;
-        for (const activity of stage.activities ?? []) {
-            const fired = await runActivityTriggers({
-                ctx: liveCtx,
-                mutation: mutation,
-                activity: activity
-            });
-            fires += fired.fires, ranFieldOps = ranFieldOps || fired.ranFieldOps, fired.fires > 0 && (firedThisPass = !0);
-        }
-    }
-    return {
-        fires: fires,
-        ranFieldOps: ranFieldOps
-    };
-}
-
-async function runActivityTriggers({ctx: ctx, mutation: mutation, activity: activity}) {
-    let fires = 0, ranFieldOps = !1;
-    for (const action of activity.actions ?? []) {
-        if (!isCascadeFired(action)) continue;
-        const entry = currentActivities(mutation).find(e => e.name === activity.name);
-        if (entry === void 0 || entry.status !== "active") break;
-        if ((entry.firedActions ?? []).includes(action.name) || !await triggerIsLive({
-            ctx: ctx,
-            activity: activity,
-            action: action
-        })) continue;
-        const result = await fireTriggeredAction({
-            ctx: ctx,
-            mutation: mutation,
-            activity: activity,
-            action: action,
-            entry: entry
-        });
-        if (fires++, ranFieldOps = ranFieldOps || result.ranFieldOps, isTerminalActivityStatus(entry.status)) break;
-    }
-    return {
-        fires: fires,
-        ranFieldOps: ranFieldOps
+        effectKey: effectKey,
+        effect: pending.name,
+        status: status,
+        origin: pending.origin.kind
     };
 }
 
-async function triggerIsLive({ctx: ctx, activity: activity, action: action}) {
-    if (!tokenMayExecute({
-        actor: ctx.actor,
-        action: action,
-        ctx: ctx
-    })) return !1;
-    const scope = {
-        activityName: activity.name
+function buildQueuedEffect({effect: effect, origin: origin, params: params, actor: actor, now: now, stageEntryKey: stageEntryKey}) {
+    const key = randomKey(), pending = {
+        _key: key,
+        _type: "pendingEffect",
+        name: effect.name,
+        ...effect.title !== void 0 ? {
+            title: effect.title
+        } : {},
+        ...effect.description !== void 0 ? {
+            description: effect.description
+        } : {},
+        ...effect.bindings !== void 0 ? {
+            bindings: effect.bindings
+        } : {},
+        params: params,
+        origin: origin,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {},
+        queuedAt: now,
+        ...stageEntryKey !== void 0 ? {
+            stageEntryKey: stageEntryKey
+        } : {}
+    }, history = {
+        _key: randomKey(),
+        _type: "effectQueued",
+        at: now,
+        effectKey: key,
+        effect: effect.name,
+        origin: origin
     };
-    return action.filter !== void 0 && await ctxEvaluateConditionOutcome({
-        ctx: ctx,
-        condition: action.filter,
-        opts: scope
-    }) !== "satisfied" ? !1 : await ctxEvaluateConditionOutcome({
-        ctx: ctx,
-        condition: action.when,
-        opts: scope
-    }) === "satisfied";
-}
-
-function tokenMayExecute({actor: actor, action: action, ctx: ctx}) {
-    const roles = action.roles;
-    return roles === void 0 || roles.length === 0 ? !0 : actor === void 0 ? !1 : roles.some(required => actorFulfillsRole({
-        actorRoles: actor.roles,
-        required: required,
-        aliases: ctx.definition.roleAliases
-    }));
-}
-
-async function fireTriggeredAction({ctx: ctx, mutation: mutation, activity: activity, action: action, entry: entry}) {
-    entry.firedActions = [ ...entry.firedActions ?? [], action.name ];
-    const {ranOps: ranOps} = await applyActionFire({
-        ctx: ctx,
-        mutation: mutation,
-        activity: activity,
-        action: action,
-        params: {},
-        actor: ctx.actor,
-        triggered: !0
-    });
     return {
-        ranFieldOps: ranOps.some(isFieldOp)
+        pending: pending,
+        history: history
     };
 }
 
-async function primeInitialStage({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry}) {
-    const instance = await getInstanceDocument(client, instanceId);
-    if (!instance || instance.stages.length > 0) return;
-    const definition = parseDefinitionSnapshot(instance), stage = definition.stages.find(s => s.name === instance.currentStage);
-    if (stage === void 0) return;
-    const ctx = await buildEngineContext({
-        client: client,
-        clientForGdr: clientForGdr,
-        refSurface: refSurface,
-        instance: instance,
-        definition: definition,
-        ...clock ? {
-            clock: clock
+async function queueEffects({ctx: ctx, mutation: mutation, effects: effects, origin: origin, actor: actor, opts: opts}) {
+    if (!effects || effects.length === 0) return;
+    const now = ctx.now, liveCtx = {
+        ...ctx,
+        instance: materializeInstance(ctx.instance, mutation)
+    }, stageEntryKey = opts?.stageEntryKey ?? findOpenStageEntry(liveCtx.instance)?._key, params = await ctxConditionParams(liveCtx, {
+        ...opts?.activityName !== void 0 ? {
+            activityName: opts.activityName
         } : {},
-        ...actor ? {
+        ...actor !== void 0 ? {
             actor: actor
         } : {},
-        ...executionContext ? {
-            executionContext: executionContext
-        } : {},
-        ...telemetry ? {
-            telemetry: telemetry
-        } : {}
-    }), now = ctx.now, discards = [], initialStageEntry = {
-        _key: randomKey(),
-        name: stage.name,
-        enteredAt: now,
-        fields: await resolveStageFieldEntries({
-            client: client,
-            instance: instance,
-            stage: stage,
-            now: now,
-            refSurface: refSurface,
-            recordDiscard: recordFieldDiscards({
-                target: discards,
-                scope: "stage",
-                at: now
-            })
-        }),
-        activities: []
-    }, primedCtx = {
-        ...ctx,
-        instance: {
-            ...instance,
-            stages: [ initialStageEntry ]
+        vars: {
+            params: opts?.callerParams ?? {}
         }
-    };
-    initialStageEntry.activities = await buildStageActivities({
-        ctx: primedCtx,
-        stage: stage,
-        recordDiscard: recordFieldDiscards({
-            target: discards,
-            scope: "activity",
-            at: now
-        })
     });
-    const terminal = isTerminalStage(stage), committed = await client.patch(instance._id).set({
-        stages: [ initialStageEntry ],
-        lastChangedAt: now,
-        ...terminal ? {
-            completedAt: now
-        } : {},
-        ...discards.length > 0 ? {
-            history: [ ...instance.history, ...stampHistoryEntries(discards, ctx.executionContext) ]
-        } : {}
-    }).ifRevisionId(instance._rev).commit(SYNC_COMMIT);
-    await deployOrRollback({
-        client: client,
-        instanceId: instance._id,
-        committedRev: committed._rev,
-        restore: {
-            stages: instance.stages,
-            history: instance.history
-        },
-        ...terminal ? {
-            unset: [ "completedAt" ]
-        } : {},
-        reversible: !0,
-        deploy: () => deployStageGuards({
-            client: client,
-            clientForGdr: clientForGdr,
-            instance: instance,
-            definition: definition,
-            stageName: stage.name,
+    for (const effect of effects) {
+        const resolved = await resolveBindings({
+            bindings: effect.bindings,
+            staticInput: effect.input,
+            snapshot: ctx.snapshot,
+            params: params
+        }), {pending: pending, history: history} = buildQueuedEffect({
+            effect: effect,
+            origin: origin,
+            params: resolved,
+            actor: actor,
             now: now,
-            snapshot: ctx.snapshot
+            stageEntryKey: stageEntryKey
+        });
+        mutation.pendingEffects.push(pending), mutation.history.push(history);
+    }
+}
+
+async function commitEffectOps(args) {
+    const {client: client, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, requestRecord: requestRecord, leaseMs: leaseMs, options: options} = args;
+    return retryOnRevisionConflict({
+        client: client,
+        instanceId: instanceId,
+        options: options,
+        commit: ctx => commitReport({
+            ctx: ctx,
+            effectKey: effectKey,
+            claimToken: claimToken,
+            ops: ops,
+            requestRecord: requestRecord,
+            leaseMs: leaseMs
+        }),
+        onExhausted: () => new ConcurrentCommitEffectOpsError({
+            instanceId: instanceId,
+            effectKey: effectKey,
+            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
         })
     });
 }
 
-const CASCADE_LIMIT = 100;
+function staleClaimReason(args) {
+    const claim = args.pending.claim;
+    if (claim === void 0) return "unclaimed";
+    if (claim.claimToken !== args.claimToken) return "claim-superseded";
+    if (isClaimExpired(claim, args.now)) return "lease-expired";
+}
 
-async function runCascadeHop({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
-    const ctx = await loadContext({
-        client: client,
-        instanceId: instanceId,
-        options: {
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
-            ...actor ? {
-                actor: actor
-            } : {},
-            ...clock ? {
-                clock: clock
-            } : {},
-            ...executionContext ? {
-                executionContext: executionContext
-            } : {},
-            ...telemetry ? {
-                telemetry: telemetry
-            } : {},
-            ...overlay ? {
-                overlay: overlay
-            } : {}
+function renewClaimLease(args) {
+    const {mutation: mutation, effectKey: effectKey, now: now, leaseMs: leaseMs} = args;
+    mutation.pendingEffects = mutation.pendingEffects.map(entry => entry._key === effectKey && entry.claim !== void 0 ? {
+        ...entry,
+        claim: {
+            ...entry.claim,
+            leaseExpiresAt: addMs(now, leaseMs)
         }
+    } : entry);
+}
+
+async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimToken, ops: ops, requestRecord: requestRecord, leaseMs: leaseMs}) {
+    assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
     });
-    if (isTerminal(ctx)) return {
-        moved: !1
-    };
-    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), fired = await runTriggeredActions({
-        ctx: ctx,
+    const pending = requirePendingEffect(ctx.instance, effectKey), reason = staleClaimReason({
+        pending: pending,
+        claimToken: claimToken,
+        now: ctx.now
+    });
+    if (reason !== void 0) throw new StaleEffectClaimError({
+        instanceId: ctx.instance._id,
+        effectKey: effectKey,
+        reason: reason
+    });
+    const validatedOps = validateEffectOps(ops, pending.name);
+    if (validatedOps.length === 0) throw new EffectOpsInvalidError({
+        effect: pending.name,
+        issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
+    });
+    const mutation = startMutation(ctx.instance);
+    return recordProcessedRequest({
         mutation: mutation,
-        stage: stage
-    }), hopCtx = liveViewContext(ctx, mutation), transition = await pickTransition(hopCtx, stage);
-    return transition === void 0 ? (fired.fires > 0 && await persistThenMaybeRefresh({
-        ctx: ctx,
+        record: requestRecord,
+        now: ctx.now
+    }), renewClaimLease({
         mutation: mutation,
-        stageName: stage.name,
-        didChangeState: fired.ranFieldOps
-    }), {
-        moved: !1
-    }) : (await commitStageMove({
+        effectKey: effectKey,
+        now: ctx.now,
+        leaseMs: leaseMs
+    }), await runOps({
+        ops: validatedOps,
+        mutation: mutation,
+        stage: ctx.instance.currentStage,
+        origin: {
+            effect: pending.name
+        },
+        params: pending.params,
+        actor: ctx.actor,
+        self: selfGdr(ctx.instance),
+        now: ctx.now,
+        snapshot: ctx.snapshot,
+        refSurface: ctx.refSurface
+    }), await persistThenMaybeRefresh({
         ctx: ctx,
         mutation: mutation,
-        fromStage: stage,
-        toStage: findStage(ctx.definition, transition.to),
-        transition: transition.name,
-        via: "transition",
-        actor: actor
+        stageName: ctx.instance.currentStage,
+        didChangeState: !0
     }), {
-        moved: !0
+        effectKey: effectKey,
+        effect: pending.name
+    };
+}
+
+const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
+
+async function resolveAccess(taggedClient, args = {}) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: args.grantsFromPath
+    }) : Promise.resolve(void 0), [actor, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
+    if (actor === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
+    return {
+        actor: actor,
+        ...grants !== void 0 ? {
+            grants: grants
+        } : {}
+    };
+}
+
+function cachedActor(client, requestFn) {
+    const cached = actorCache.get(client);
+    if (cached !== void 0) return cached;
+    const pending = fetchActor(requestFn).catch(err => {
+        throw actorCache.get(client) === pending && actorCache.delete(client), err;
     });
+    return actorCache.set(client, pending), pending;
 }
 
-async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
-    let count = 0;
-    for (;;) {
-        if (await drainCondemnedChildren({
-            client: client,
-            instanceId: instanceId,
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
-            clock: clock,
-            executionContext: executionContext,
-            telemetry: telemetry
-        }), !(await runCascadeHop({
-            client: client,
-            instanceId: instanceId,
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
-            clock: clock,
-            executionContext: executionContext,
-            telemetry: telemetry,
-            overlay: overlay
-        })).moved) return count;
-        if (count++, count >= CASCADE_LIMIT) throw new CascadeLimitError({
-            instanceId: instanceId,
-            limit: CASCADE_LIMIT
+function grantsForClientPath(taggedClient, resourcePath) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: resourcePath
+    });
+}
+
+function lazyRequest(client) {
+    return client.request === void 0 ? void 0 : opts => client.request(opts);
+}
+
+function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
+    let byPath = grantsCache.get(client);
+    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
+    let cached = byPath.get(resourcePath);
+    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
+    byPath.set(resourcePath, cached)), cached;
+}
+
+async function fetchActor(requestFn) {
+    let user;
+    try {
+        user = await requestFn({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        });
+    } catch (err) {
+        throw new Error('workflow: /users/me request failed. The engine resolves the actor from the client\'s token via `client.request({ uri: "/users/me" })`. Check the token/connectivity.', {
+            cause: err
         });
     }
+    if (!user || typeof user.id != "string" || user.id.length === 0) return;
+    const roleNames = user.roles?.map(r => r.name).filter(n => !!n) ?? [];
+    return {
+        kind: "person",
+        id: user.id,
+        ...roleNames.length > 0 ? {
+            roles: roleNames
+        } : {}
+    };
 }
 
-async function drainCondemnedChildren({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining = /* @__PURE__ */ new Set}) {
-    if (draining.has(instanceId)) return;
-    draining.add(instanceId);
-    const instance = await getInstanceDocument(client, instanceId);
-    if (!instance) return;
-    const condemned = condemnedSubworkflows(instance);
-    if (condemned.length !== 0) {
-        for (const row of condemned) await settleCondemnedRow({
-            client: client,
-            ownerId: instanceId,
-            row: row,
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
-            clock: clock,
-            executionContext: executionContext,
-            telemetry: telemetry,
-            draining: draining
-        });
-        await stampDrainedRows({
-            client: client,
-            instance: instance,
-            condemned: condemned,
-            clock: clock,
-            executionContext: executionContext
+async function fetchGrantsCached(requestFn, resourcePath) {
+    try {
+        return await fetchGrants({
+            client: {
+                request: requestFn
+            },
+            resourcePath: resourcePath
         });
+    } catch (err) {
+        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
+        return;
     }
 }
 
-async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining}) {
-    const childId = toBareId(row.ref.id);
+const REPLAY_SURFACE = {
+    allows: () => !0,
+    description: "any resource (in-memory replay; the committing surface enforces)"
+};
+
+async function whatIfFireAction(args) {
+    const {instance: instance, definition: definition, snapshot: snapshot, now: now, actor: actor, stage: stage, activity: activity, action: action} = args;
+    if (!replayable({
+        instance: instance,
+        stage: stage,
+        action: action
+    })) return;
+    const ctx = {
+        now: now,
+        instance: instance,
+        definition: definition,
+        snapshot: snapshot,
+        refSurface: REPLAY_SURFACE,
+        actor: actor
+    }, mutation = startMutation(instance);
     try {
-        await abortInstance({
-            client: client,
-            instanceId: childId,
-            reason: row.abortPending?.reason ?? "condemned by parent",
-            options: {
-                ...actor ? {
-                    actor: actor
-                } : {},
-                clientForGdr: clientForGdr,
-                refSurface: refSurface,
-                ...clock ? {
-                    clock: clock
-                } : {},
-                ...executionContext ? {
-                    executionContext: executionContext
-                } : {},
-                ...telemetry ? {
-                    telemetry: telemetry
-                } : {}
-            }
-        }), await drainCondemnedChildren({
-            client: client,
-            instanceId: childId,
+        await applyActionFire({
+            ctx: ctx,
+            mutation: mutation,
+            activity: activity,
+            action: action,
+            params: {},
             actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
-            clock: clock,
-            executionContext: executionContext,
-            telemetry: telemetry,
-            draining: draining
-        });
-    } catch (cause) {
-        if (cause instanceof InstanceNotFoundError) return;
-        throw cause instanceof WorkflowStateDivergedError ? cause : new WorkflowStateDivergedError({
-            instanceId: ownerId,
-            guardError: cause,
-            reason: `owed child abort of "${childId}" failed while draining condemned rows`
+            triggered: !1
+        }), await runTriggeredActions({
+            ctx: ctx,
+            mutation: mutation,
+            stage: stage
         });
+    } catch (err) {
+        if (err instanceof FieldValueShapeError) return;
+        throw err;
     }
+    const transition = await pickTransition(liveViewContext(ctx, mutation), stage);
+    return transition === void 0 ? {
+        exitsStage: !1
+    } : {
+        exitsStage: !0,
+        transition: transition.name
+    };
 }
 
-async function stampDrainedRows({client: client, instance: instance, condemned: condemned, clock: clock, executionContext: executionContext}) {
-    const now = (clock ?? wallClock)(), stamp = resolveExecutionContext(executionContext), ids = condemned.map(row => toBareId(row.ref.id)), children = await client.fetch("*[_id in $ids]{_id, currentStage, completedAt, abortedAt, modelVersion, minReaderModel}", {
-        ids: ids
-    }), byId = new Map(children.map(c => [ assertReadableModel(c)._id, c ])), condemnedKeys = new Set(condemned.map(row => row._key)), history = [ ...instance.history ], subworkflows = (instance.subworkflows ?? []).map(row => {
-        if (row.resolved !== void 0 || !condemnedKeys.has(row._key)) return row;
-        const child = byId.get(toBareId(row.ref.id)), resolved = child !== void 0 ? terminalResolution(child) : {
-            at: now,
-            aborted: !0
-        };
-        return resolved === void 0 ? row : (history.push(...stampHistoryEntries([ subworkflowResolvedEntry({
-            row: row,
-            at: now,
-            status: resolved.aborted === !0 ? "aborted" : "done"
-        }) ], stamp)), {
-            ...row,
-            resolved: resolved
+function replayable(args) {
+    const {instance: instance, stage: stage, action: action} = args;
+    if (terminalState(instance) !== "in-flight" || (action.params ?? []).length > 0 || action.spawn !== void 0) return !1;
+    const primed = new Set((findOpenStageEntry(instance)?.activities ?? []).map(e => e.name));
+    return (stage.activities ?? []).every(declared => primed.has(declared.name)) ? !(stage.activities ?? []).flatMap(declared => declared.actions ?? []).some(sibling => isCascadeFired(sibling) && sibling.spawn !== void 0) : !1;
+}
+
+async function buildFieldInsights({sites: sites, snapshot: snapshot}) {
+    const insights = [];
+    for (const field of fieldsReadAcross(sites)) {
+        const involved = sites.filter(entry => readsField(entry.insight, field));
+        insights.push({
+            field: field,
+            reads: dedupeReads(involved.flatMap(entry => fieldReads(entry.insight, field))),
+            involvedIn: involved.map(entry => entry.site),
+            proposals: await verifyProposals({
+                field: field,
+                involved: involved,
+                snapshot: snapshot
+            })
         });
-    });
-    await client.patch(instance._id).set({
-        subworkflows: subworkflows,
-        history: history,
-        lastChangedAt: now
-    }).ifRevisionId(instance._rev).commit(SYNC_COMMIT);
+    }
+    return insights;
 }
 
-function terminalResolution(child) {
-    const status = resolvedChildStatus(child);
-    if (!(status === void 0 || child.completedAt === void 0 || child.completedAt === null)) return {
-        at: child.completedAt,
-        stage: child.currentStage,
-        ...status === "aborted" ? {
-            aborted: !0
-        } : {}
-    };
+function fieldsReadAcross(sites) {
+    const names = sites.flatMap(entry => entry.insight.analysis.reads).filter(read => read.variable === "fields").map(read => read.path[0]).filter(head => typeof head == "string");
+    return [ ...new Set(names) ];
 }
 
-function subworkflowResolvedEntry({row: row, at: at, status: status}) {
-    return {
-        _key: randomKey(),
-        _type: "subworkflowResolved",
-        at: at,
-        activity: row.activity,
-        instanceRef: row.ref,
-        status: status
-    };
+function fieldReads(insight, field) {
+    return insight.analysis.reads.filter(read => read.variable === "fields" && read.path[0] === field);
 }
 
-async function propagateToAncestors({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry}) {
-    const loaded = await loadPropagationPair(client, instanceId);
-    if (loaded === void 0) return;
-    const {child: child, parent: parent} = loaded, definition = parseDefinitionSnapshot(parent), ctx = await buildEngineContext({
-        client: client,
-        clientForGdr: clientForGdr,
-        refSurface: refSurface,
-        instance: parent,
-        definition: definition,
-        ...clock ? {
-            clock: clock
-        } : {},
-        ...actor ? {
-            actor: actor
-        } : {},
-        ...executionContext ? {
-            executionContext: executionContext
-        } : {},
-        ...telemetry ? {
-            telemetry: telemetry
-        } : {}
-    }), mutation = startMutation(parent), row = mutation.subworkflows.find(r => toBareId(r.ref.id) === child._id);
-    if (row === void 0) {
-        await recordOrphanedPropagation({
-            ctx: ctx,
-            mutation: mutation,
-            child: child
-        });
-        return;
-    }
-    const changed = stampResolvedChild({
-        mutation: mutation,
-        row: row,
-        child: child,
-        now: ctx.now
-    }), parentTerminal = parent.completedAt !== void 0;
-    changed && await persist(ctx, mutation), !parentTerminal && (await cascadeAutoTransitions({
-        client: client,
-        instanceId: parent._id,
-        actor: actor,
-        clientForGdr: clientForGdr,
-        refSurface: refSurface,
-        clock: clock,
-        executionContext: executionContext,
-        telemetry: telemetry
-    }), await propagateToAncestors({
-        client: client,
-        instanceId: parent._id,
-        actor: actor,
-        clientForGdr: clientForGdr,
-        refSurface: refSurface,
-        clock: clock,
-        executionContext: executionContext,
-        telemetry: telemetry
-    }));
+function readsField(insight, field) {
+    return fieldReads(insight, field).length > 0;
 }
 
-async function loadPropagationPair(client, instanceId) {
-    const child = await getInstanceDocument(client, instanceId);
-    if (!child) return;
-    const parentGdr = parentRef(child);
-    if (parentGdr === void 0) return;
-    const parentDoc = await client.getDocument(toBareId(parentGdr.id));
-    if (!(!parentDoc || parentDoc._type !== WORKFLOW_INSTANCE_TYPE)) return {
-        child: child,
-        parent: readInstanceDoc(parentDoc)
-    };
+async function verifyProposals({field: field, involved: involved, snapshot: snapshot}) {
+    const proposals = [];
+    for (const assign of candidateAssignments(involved, field)) {
+        const consequences = [];
+        for (const entry of involved) {
+            const result = await whatIfCondition({
+                condition: entry.condition,
+                dataset: snapshot.docs,
+                params: entry.params,
+                assign: assign
+            });
+            result.changed && consequences.push({
+                site: entry.site,
+                before: result.before,
+                after: result.after
+            });
+        }
+        consequences.length > 0 && proposals.push({
+            assign: assign,
+            consequences: consequences
+        });
+    }
+    return proposals;
 }
 
-function stampResolvedChild({mutation: mutation, row: row, child: child, now: now}) {
-    if (row.resolved !== void 0) return !1;
-    const resolved = terminalResolution(child);
-    return resolved === void 0 ? !1 : (row.resolved = resolved, mutation.history.push(subworkflowResolvedEntry({
-        row: row,
-        at: now,
-        status: resolved.aborted === !0 ? "aborted" : "done"
-    })), !0);
+function candidateAssignments(involved, field) {
+    const candidates = involved.flatMap(entry => entry.insight.blockedBy).flatMap(atom => atom.requirement !== void 0 ? [ atom.requirement ] : []).filter(requirement => requirement.target.variable === "fields").filter(requirement => requirement.target.path[0] === field).flatMap(assignmentFor).filter(fabricatable);
+    return dedupeBy(candidates, assignment => JSON.stringify([ assignment.target.path, assignment.value ]));
 }
 
-async function recordOrphanedPropagation({ctx: ctx, mutation: mutation, child: child}) {
-    const childUri = selfGdr(child);
-    mutation.history.some(h => h._type === "subworkflowOrphaned" && h.instanceRef.id === childUri) || (mutation.history.push({
-        _key: randomKey(),
-        _type: "subworkflowOrphaned",
-        at: ctx.now,
-        instanceRef: {
-            id: childUri,
-            type: WORKFLOW_INSTANCE_TYPE
-        },
-        detail: `Instance "${child._id}" names this instance as its parent but no subworkflow-registry row matches it, so its state cannot drive any gate here.`
-    }), await persist(ctx, mutation));
-}
+function assignmentFor(requirement) {
+    switch (requirement.kind) {
+      case "equals":
+        return [ {
+            target: requirement.target,
+            value: requirement.value
+        } ];
 
-function startMutation(instance) {
-    return {
-        minReaderModel: minReaderModelOf(instance),
-        currentStage: instance.currentStage,
-        fields: (instance.fields ?? []).map(s => ({
-            ...s
-        })),
-        stages: instance.stages.map(s => ({
-            ...s,
-            fields: (s.fields ?? []).map(entry => ({
-                ...entry
-            })),
-            activities: s.activities.map(t => ({
-                ...t,
-                ...t.fields !== void 0 ? {
-                    fields: t.fields.map(entry => ({
-                        ...entry
-                    }))
-                } : {}
-            }))
-        })),
-        subworkflows: (instance.subworkflows ?? []).map(row => ({
-            ...row,
-            ...row.abortPending !== void 0 ? {
-                abortPending: {
-                    ...row.abortPending
-                }
-            } : {},
-            ...row.resolved !== void 0 ? {
-                resolved: {
-                    ...row.resolved
-                }
-            } : {}
-        })),
-        pendingEffects: [ ...instance.pendingEffects ],
-        effectHistory: [ ...instance.effectHistory ],
-        context: [ ...instance.context ],
-        history: [ ...instance.history ],
-        processedRequests: [ ...instance.processedRequests ?? [] ],
-        lastChangedAt: instance.lastChangedAt,
-        ...instance.completedAt !== void 0 ? {
-            completedAt: instance.completedAt
-        } : {},
-        ...instance.abortedAt !== void 0 ? {
-            abortedAt: instance.abortedAt
-        } : {},
-        pendingCreates: []
-    };
-}
+      case "truthy":
+        return [ {
+            target: requirement.target,
+            value: !0
+        } ];
 
-function instanceStateFields(src) {
-    const state = {
-        currentStage: src.currentStage,
-        fields: src.fields,
-        stages: src.stages,
-        subworkflows: src.subworkflows ?? [],
-        pendingEffects: src.pendingEffects,
-        effectHistory: src.effectHistory,
-        context: src.context,
-        history: src.history,
-        processedRequests: src.processedRequests ?? [],
-        ...src.completedAt !== void 0 ? {
-            completedAt: src.completedAt
-        } : {},
-        ...src.abortedAt !== void 0 ? {
-            abortedAt: src.abortedAt
-        } : {}
-    };
-    return {
-        ...modelStampFor({
-            documentType: "instance",
-            document: state,
-            storedMinReaderModel: src.minReaderModel
-        }),
-        ...state
-    };
-}
+      case "falsy":
+        return [ {
+            target: requirement.target,
+            value: !1
+        } ];
 
-function liveViewContext(ctx, mutation) {
-    const materialized = materializeInstance(ctx.instance, mutation);
-    return {
-        ...ctx,
-        instance: materialized,
-        snapshot: overlayInstanceInSnapshot(ctx.snapshot, materialized)
-    };
+      case "differs":
+      case "defined":
+      case "undefined":
+      case "compares":
+        return [];
+    }
 }
 
-function materializeInstance(base, mutation) {
-    return {
-        ...base,
-        currentStage: mutation.currentStage,
-        fields: mutation.fields,
-        stages: mutation.stages,
-        subworkflows: mutation.subworkflows,
-        context: mutation.context,
-        pendingEffects: mutation.pendingEffects,
-        effectHistory: mutation.effectHistory
-    };
+function fabricatable(assignment) {
+    return assignment.target.path.every(segment => typeof segment != "number" || segment <= MAX_COUNTERFACTUAL_INDEX);
 }
 
-async function persist(ctx, mutation) {
-    stampExecutionContext(ctx, mutation);
-    const set = {
-        ...instanceStateFields(mutation),
-        lastChangedAt: ctx.now
-    }, pendingCreates = mutation.pendingCreates;
-    if (pendingCreates.length === 0) return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT);
-    const tx = ctx.client.transaction();
-    for (const {body: body} of pendingCreates) tx.create(body);
-    tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), 
-    await tx.commit(), mutation.pendingCreates = [];
-    const actorForPriming = ctx.actor;
-    for (const {body: body, started: started} of pendingCreates) try {
-        await primeInitialStage({
-            client: ctx.client,
-            instanceId: body._id,
-            actor: actorForPriming,
-            clientForGdr: ctx.clientForGdr,
-            refSurface: ctx.refSurface,
-            clock: ctx.clock,
-            executionContext: ctx.executionContext,
-            telemetry: ctx.telemetry
-        }), await cascadeAutoTransitions({
-            client: ctx.client,
-            instanceId: body._id,
-            actor: actorForPriming,
-            clientForGdr: ctx.clientForGdr,
-            refSurface: ctx.refSurface,
-            clock: ctx.clock,
-            executionContext: ctx.executionContext,
-            telemetry: ctx.telemetry
-        }), await propagateToAncestors({
-            client: ctx.client,
-            instanceId: body._id,
-            actor: actorForPriming,
-            clientForGdr: ctx.clientForGdr,
-            refSurface: ctx.refSurface,
-            clock: ctx.clock,
-            executionContext: ctx.executionContext,
-            telemetry: ctx.telemetry
-        }), ctx.telemetry.log(WorkflowInstanceStarted, started);
-    } catch (cause) {
-        throw cause instanceof WorkflowStateDivergedError ? cause : new WorkflowStateDivergedError({
-            instanceId: ctx.instance._id,
-            guardError: cause,
-            reason: `spawned child "${body._id}" failed to settle after the spawn transaction committed`
+async function subjectResourceGrants(args) {
+    const {clientForGdr: clientForGdr, instance: instance} = args, clients = /* @__PURE__ */ new Map;
+    for (const {parsed: parsed, resource: resource} of foreignSubjectRefs(instance)) {
+        const key = resourceGdr(resource);
+        clients.has(key) || clients.set(key, {
+            resource: resource,
+            client: clientForGdr(parsed)
         });
     }
-    const reloaded = await getInstanceDocument(ctx.client, ctx.instance._id);
-    if (!reloaded) throw new Error(`Instance ${ctx.instance._id} disappeared after transaction commit`);
-    return reloaded;
+    const resolved = await Promise.all([ ...clients.entries() ].map(async ([key, entry]) => {
+        const path = aclPathForResource(entry.resource);
+        if (path === void 0) return;
+        const grants = await grantsForClientPath(entry.client, path);
+        return grants === void 0 ? void 0 : [ key, grants ];
+    }));
+    return new Map(resolved.filter(entry => entry !== void 0));
 }
 
-function stampExecutionContext(ctx, mutation) {
-    const stamp = ctx.executionContext, appended = mutation.history.slice(ctx.instance.history.length);
-    mutation.history = [ ...mutation.history.slice(0, ctx.instance.history.length), ...stampHistoryEntries(appended, stamp) ];
-    for (const {body: body} of mutation.pendingCreates) body.history = stampHistoryEntries(body.history, stamp);
+async function evaluateInstance(args) {
+    const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
+    validateTag(tag);
+    const {actor: actor, grants: grants} = await resolveAccess(client, {
+        ...args.grantsFromPath !== void 0 ? {
+            grantsFromPath: args.grantsFromPath
+        } : {}
+    }), instance = await reload({
+        client: client,
+        instanceId: instanceId,
+        tag: tag
+    }), definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
+        client: client,
+        workflowResource: workflowResource,
+        resourceClients: resourceClients
+    }), snapshot = await hydrateSnapshot({
+        client: client,
+        clientForGdr: clientForGdr,
+        instance: instance
+    }), guards = await verdictGuardsForInstance(client, instance._id), resourceGrants = await subjectResourceGrants({
+        clientForGdr: clientForGdr,
+        instance: instance
+    });
+    return evaluateFromSnapshot({
+        instance: instance,
+        definition: definition,
+        actor: actor,
+        snapshot: snapshot,
+        guards: guards,
+        now: now,
+        resourceGrants: resourceGrants,
+        ...grants !== void 0 ? {
+            grants: grants
+        } : {}
+    });
+}
+
+function memoizedByName(render) {
+    const rendered = /* @__PURE__ */ new Map;
+    return activityName => {
+        const hit = rendered.get(activityName);
+        if (hit !== void 0) return hit;
+        const scope = render(activityName);
+        return rendered.set(activityName, scope), scope;
+    };
 }
 
-function currentStageEntry(mutation) {
-    const entry = findOpenStageEntry(mutation);
-    if (entry === void 0) throw new Error(`Mutation invariant broken: no current (un-exited) StageEntry for currentStage "${mutation.currentStage}"`);
-    return entry;
+function currentStageOf(instance, definition) {
+    try {
+        return findStage(definition, instance.currentStage);
+    } catch (err) {
+        throw new Error(`Instance "${instance._id}" currentStage "${instance.currentStage}" not in definition`, {
+            cause: err
+        });
+    }
 }
 
-function currentActivities(mutation) {
-    return currentStageEntry(mutation).activities;
+async function explainSite(args) {
+    const {site: site, condition: condition, params: params, snapshot: snapshot, sites: sites} = args, insight = await explainCondition({
+        condition: condition,
+        dataset: snapshot.docs,
+        params: params
+    });
+    return sites.push({
+        site: site,
+        condition: condition,
+        params: params,
+        insight: insight
+    }), insight;
 }
 
-function findActivityInCurrentStage(ctx, activityName) {
-    const stage = findStage(ctx.definition, ctx.instance.currentStage), activity = (stage.activities ?? []).find(t => t.name === activityName);
-    if (activity === void 0) throw new ContractViolationError(`Activity "${activityName}" not found in current stage "${stage.name}" of ${ctx.definition.name}`);
-    return {
+async function evaluateFromSnapshot(args) {
+    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
+        instance: instance,
+        definition: definition,
+        snapshot: snapshot,
+        now: now,
+        actor: actor,
         stage: stage,
-        activity: activity
+        activity: activity,
+        action: action
+    }), scopeSource = {
+        instance: instance,
+        definition: definition,
+        snapshot: snapshot,
+        now: now
+    }, can = await advisoryCan({
+        instance: instance,
+        actor: actor,
+        grants: grants
+    }), scope = await renderConditionScope(scopeSource, {
+        actor: actor,
+        vars: {
+            can: can
+        }
+    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        activityName: activityName,
+        actor: actor,
+        vars: {
+            can: can
+        }
+    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        activityName: activityName
+    })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
+        instance: instance,
+        actor: actor,
+        guards: args.guards
+    }), subjectDenials = await forecastSubjectDenials({
+        instance: instance,
+        actor: actor,
+        snapshot: snapshot,
+        resourceGrants: args.resourceGrants
+    }), subjectPermissionReason = subjectDenials.length > 0 ? {
+        kind: "subject-permission-denied",
+        denied: subjectDenials
+    } : void 0, sites = [], activityEvaluations = [];
+    for (const activity of stage.activities ?? []) activityEvaluations.push(await evaluateActivity({
+        activity: activity,
+        statusEntry: currentActivityEntries.find(t => t.name === activity.name),
+        instance: instance,
+        snapshot: snapshot,
+        activityScope: await scopeForActivity(activity.name),
+        cascadeActivityScope: () => cascadeScopeForActivity(activity.name),
+        stageHasExits: !isTerminalStage(stage),
+        guardDenial: guardDenial,
+        subjectPermissionReason: subjectPermissionReason,
+        sites: sites,
+        autonomy: activityAutonomyOf(stageAutonomy2, activity.name),
+        fireConsequence: fireConsequence
+    }));
+    const cascadeParams = await renderConditionScope(scopeSource), transitionEvaluations = [];
+    for (const transition of stage.transitions ?? []) {
+        const insight = await explainSite({
+            site: {
+                kind: "transition",
+                transition: transition.name
+            },
+            condition: transition.when,
+            params: cascadeParams,
+            snapshot: snapshot,
+            sites: sites
+        });
+        transitionEvaluations.push({
+            transition: transition,
+            whenSatisfied: insight.outcome === "satisfied",
+            unevaluable: insight.outcome === "unevaluable",
+            insight: insight
+        });
+    }
+    const currentStage = {
+        stage: stage,
+        activities: activityEvaluations,
+        transitions: transitionEvaluations,
+        autonomy: stageAutonomy2
+    }, pendingOnYou = activityEvaluations.filter(t => t.pendingOnActor), canInteract = activityEvaluations.some(t => t.actions.some(a => a.allowed)), editGuardDenial = guardDenial?.kind === "mutation-guard-denied" ? guardDenial : void 0, editableFields = await evaluateEditableFields({
+        instance: instance,
+        definition: definition,
+        stage: stage,
+        snapshot: snapshot,
+        scope: scope,
+        scopeForActivity: scopeForActivity,
+        guardDenial: editGuardDenial,
+        sites: sites
+    });
+    return {
+        instance: instance,
+        definition: definition,
+        actor: actor,
+        currentStage: currentStage,
+        pendingOnYou: pendingOnYou,
+        canInteract: canInteract,
+        editableFields: editableFields,
+        fieldInsights: await buildFieldInsights({
+            sites: sites,
+            snapshot: snapshot
+        }),
+        autonomy: autonomy
     };
 }
 
-function requireMutationActivityEntry(mutation, activity) {
-    const mutEntry = currentActivities(mutation).find(t => t.name === activity);
-    if (mutEntry === void 0) throw new Error(`Activity "${activity}" disappeared from mutation copy — invariant broken`);
-    return mutEntry;
-}
+const AUTONOMY_CACHE = /* @__PURE__ */ new WeakMap;
 
-function findCurrentStageEntry(instance) {
-    return findOpenStageEntry(instance);
+function autonomyOf(definition) {
+    const hit = AUTONOMY_CACHE.get(definition);
+    if (hit !== void 0) return hit;
+    const derived = deriveWorkflowAutonomy(definition);
+    return AUTONOMY_CACHE.set(definition, derived), derived;
 }
 
-function findCurrentActivities(instance) {
-    return findCurrentStageEntry(instance)?.activities ?? [];
+async function evaluateEditableFields(args) {
+    const {instance: instance, definition: definition, stage: stage, snapshot: snapshot, scope: scope, scopeForActivity: scopeForActivity, guardDenial: guardDenial, sites: sites} = args, fields = [];
+    for (const site of editableFieldsInStage(definition, stage)) {
+        const window = fieldWindowOpen(instance, site), insight = await editPredicateInsight({
+            site: site,
+            snapshot: snapshot,
+            scope: scope,
+            scopeForActivity: scopeForActivity,
+            sites: sites
+        }), predicateSatisfied = insight === void 0 || insight.outcome === "satisfied", reason = editDisabledReason({
+            effective: site.effective,
+            instance: instance,
+            window: window,
+            guardDenial: guardDenial,
+            predicateSatisfied: predicateSatisfied
+        }), value = readFieldValue(instance, site);
+        fields.push({
+            scope: site.scope,
+            ...site.activity !== void 0 ? {
+                activity: site.activity
+            } : {},
+            name: site.name,
+            type: site.type,
+            ...site.title !== void 0 ? {
+                title: site.title
+            } : {},
+            ...site.validation !== void 0 ? {
+                validation: site.validation
+            } : {},
+            value: value,
+            editable: reason === void 0,
+            ...reason !== void 0 ? {
+                disabledReason: reason
+            } : {},
+            ...fieldProvenance(instance, site.ref),
+            ...insight !== void 0 ? {
+                insight: insight
+            } : {}
+        });
+    }
+    return fields;
 }
 
-async function completeEffect(args) {
-    const {client: client, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, requestRecord: requestRecord, options: options} = args;
-    if (status !== "done" && status !== "failed") throw new ContractViolationError(`completeEffect: status must be "done" or "failed", got ${JSON.stringify(status)} — "cancelled" is engine-stamped by abort, never reportable`);
-    return retryOnRevisionConflict({
-        client: client,
-        instanceId: instanceId,
-        options: options,
-        commit: ctx => commitCompleteEffect({
-            ctx: ctx,
-            effectKey: effectKey,
-            status: status,
-            outputs: outputs,
-            ops: ops,
-            detail: detail,
-            error: error,
-            durationMs: durationMs,
-            requestRecord: requestRecord,
-            actor: options.actor
-        }),
-        onExhausted: () => new ConcurrentCompleteEffectError({
-            instanceId: instanceId,
-            effectKey: effectKey,
-            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
-        })
+async function editPredicateInsight(args) {
+    const {site: site, snapshot: snapshot, scope: scope, scopeForActivity: scopeForActivity, sites: sites} = args;
+    if (typeof site.effective != "string") return;
+    const params = site.scope === "activity" && site.activity !== void 0 ? await scopeForActivity(site.activity) : scope;
+    return explainSite({
+        site: {
+            kind: "editable-field",
+            scope: site.scope,
+            name: site.name,
+            ...site.activity !== void 0 ? {
+                activity: site.activity
+            } : {}
+        },
+        condition: site.effective,
+        params: params,
+        snapshot: snapshot,
+        sites: sites
     });
 }
 
-function buildEffectHistoryEntry(pending, outcome) {
-    const {status: status, ranAt: ranAt, actor: actor, detail: detail, error: error, durationMs: durationMs, outputs: outputs} = outcome, resolvedActor = actor ?? pending.actor;
+async function forecastSubjectDenials(args) {
+    const {instance: instance, actor: actor, snapshot: snapshot, resourceGrants: resourceGrants} = args;
+    if (resourceGrants === void 0 || resourceGrants.size === 0) return [];
+    const denials = [], seen = /* @__PURE__ */ new Set;
+    for (const {ref: ref, parsed: parsed, resource: resource} of foreignSubjectRefs(instance)) {
+        if (seen.has(ref.id)) continue;
+        seen.add(ref.id);
+        const grants = resourceGrants.get(resourceGdr(resource));
+        if (grants === void 0) continue;
+        const doc = snapshot.docs.find(d => d._id === ref.id);
+        doc !== void 0 && await subjectUpdateAllowed({
+            doc: doc,
+            parsed: parsed,
+            grants: grants,
+            actorId: actor.id
+        }) === !1 && denials.push({
+            subject: ref.id,
+            resource: resourceGdr(resource),
+            permission: "update"
+        });
+    }
+    return denials;
+}
+
+async function subjectUpdateAllowed(args) {
+    const {doc: doc, parsed: parsed, grants: grants, actorId: actorId} = args;
+    try {
+        return await grantsPermissionOn({
+            document: {
+                ...doc,
+                _id: parsed.documentId
+            },
+            grants: grants,
+            permission: "update",
+            userId: actorId
+        });
+    } catch (err) {
+        console.warn(`workflow: subject-write forecast skipped for "${doc._id}" — evaluating that resource's grants failed (the lake still enforces the write). Original error: ${errorMessage(err)}`);
+        return;
+    }
+}
+
+async function evaluateActivity(args) {
+    const {activity: activity, statusEntry: statusEntry, instance: instance, snapshot: snapshot, activityScope: activityScope, cascadeActivityScope: cascadeActivityScope, stageHasExits: stageHasExits, guardDenial: guardDenial, subjectPermissionReason: subjectPermissionReason, sites: sites, autonomy: autonomy, fireConsequence: fireConsequence} = args, status = statusEntry?.status ?? "skipped", assigned = activityScope.assigned === !0, {unmetRequirements: unmetRequirements, ...conditionInsights} = await explainActivityConditions({
+        activity: activity,
+        activityScope: activityScope,
+        cascadeActivityScope: cascadeActivityScope,
+        snapshot: snapshot,
+        sites: sites
+    }), requirementsReason = unmetRequirements.length > 0 ? {
+        kind: "requirements-unmet",
+        unmetRequirements: unmetRequirements
+    } : void 0, actions = [];
+    for (const action of activity.actions ?? []) actions.push(await evaluateAction({
+        action: action,
+        activityName: activity.name,
+        status: status,
+        instance: instance,
+        snapshot: snapshot,
+        activityScope: activityScope,
+        cascadeActivityScope: cascadeActivityScope,
+        stageHasExits: stageHasExits,
+        guardDenial: guardDenial,
+        subjectPermissionReason: subjectPermissionReason,
+        requirementsReason: requirementsReason,
+        sites: sites,
+        fireConsequence: a => fireConsequence(activity, a)
+    }));
     return {
-        _key: pending._key,
-        name: pending.name,
-        ...pending.title !== void 0 ? {
-            title: pending.title
-        } : {},
-        ...pending.description !== void 0 ? {
-            description: pending.description
-        } : {},
-        params: pending.params,
-        origin: pending.origin,
-        ...resolvedActor !== void 0 ? {
-            actor: resolvedActor
-        } : {},
-        ...pending.stageEntryKey !== void 0 ? {
-            stageEntryKey: pending.stageEntryKey
-        } : {},
-        ranAt: ranAt,
-        ...durationMs !== void 0 ? {
-            durationMs: durationMs
-        } : {},
+        activity: activity,
         status: status,
-        ...detail !== void 0 ? {
-            detail: detail
-        } : {},
-        ...error !== void 0 ? {
-            error: error
+        kind: deriveActivityKind(activity),
+        classification: deriveExecutorClassification(activity),
+        autonomy: autonomy,
+        pendingOnActor: status === "active" && assigned,
+        scopedOut: isFilterScopedOut({
+            status: status,
+            startedAt: statusEntry?.startedAt
+        }),
+        ...unmetRequirements.length > 0 ? {
+            unmetRequirements: unmetRequirements
         } : {},
-        ...outputs !== void 0 ? {
-            outputs: outputs
-        } : {}
+        ...conditionInsights,
+        actions: actions
     };
 }
 
-function buildEffectSettlement(pending, outcome) {
-    const {status: status, ranAt: ranAt, actor: actor, detail: detail, outputs: outputs} = outcome;
+async function explainActivityConditions({activity: activity, activityScope: activityScope, cascadeActivityScope: cascadeActivityScope, snapshot: snapshot, sites: sites}) {
+    const explainAt = (site, condition) => explainSite({
+        site: site,
+        condition: condition,
+        params: activityScope,
+        snapshot: snapshot,
+        sites: sites
+    }), requirementEntries = [];
+    for (const [name, condition] of Object.entries(activity.requirements ?? {})) requirementEntries.push([ name, await explainAt({
+        kind: "requirement",
+        activity: activity.name,
+        requirement: name
+    }, condition) ]);
+    const requirementInsights = Object.fromEntries(requirementEntries), unmetRequirements = requirementEntries.filter(([, insight]) => insight.outcome !== "satisfied").map(([name]) => name), filterInsight = activity.filter !== void 0 ? await explainSite({
+        site: {
+            kind: "activity-filter",
+            activity: activity.name
+        },
+        condition: activity.filter,
+        params: await cascadeActivityScope(),
+        snapshot: snapshot,
+        sites: sites
+    }) : void 0;
     return {
-        run: buildEffectHistoryEntry(pending, outcome),
-        event: {
-            _key: randomKey(),
-            _type: "effectCompleted",
-            at: ranAt,
-            effectKey: pending._key,
-            effect: pending.name,
-            status: status,
-            ...outputs !== void 0 ? {
-                outputs: outputs
-            } : {},
-            ...detail !== void 0 ? {
-                detail: detail
-            } : {},
-            ...actor !== void 0 ? {
-                actor: actor
-            } : {}
-        }
+        unmetRequirements: unmetRequirements,
+        ...activity.requirements !== void 0 ? {
+            requirementInsights: requirementInsights
+        } : {},
+        ...filterInsight !== void 0 ? {
+            filterInsight: filterInsight
+        } : {}
     };
 }
 
-function validateEffectOutputs(args) {
-    const {outputs: outputs, declared: declared, effectName: effectName} = args, byName = new Map(declared.map(shape => [ shape.name, shape ])), issues = [];
-    for (const [key, value] of Object.entries(outputs)) {
-        const shape = byName.get(key);
-        if (shape === void 0) {
-            issues.push(`"${key}" is not a declared output`);
-            continue;
-        }
-        const shapeIssues = effectOutputIssues(shape, value);
-        shapeIssues !== void 0 && issues.push(...shapeIssues.map(i => `"${key}": ${i}`));
-    }
-    if (issues.length > 0) throw new EffectOutputsInvalidError({
-        effect: effectName,
-        issues: issues
+async function evaluateAction(args) {
+    const {action: action, activityName: activityName, snapshot: snapshot, activityScope: activityScope, sites: sites} = args, conditionScope = isCascadeFired(action) ? await args.cascadeActivityScope() : activityScope, insights = await explainActionGates({
+        action: action,
+        activityName: activityName,
+        conditionScope: conditionScope,
+        snapshot: snapshot,
+        sites: sites
     });
-}
-
-function effectOutputIssues(shape, value) {
-    return checkFieldValue({
-        entryType: shape.type,
-        value: value,
-        ...shape.fields !== void 0 ? {
-            fields: shape.fields
-        } : {},
-        ...shape.of !== void 0 ? {
-            of: shape.of
-        } : {},
-        ...shape.options !== void 0 ? {
-            options: shape.options
-        } : {},
-        ...shape.validation !== void 0 ? {
-            validation: shape.validation
-        } : {}
+    if (action.when !== void 0) return triggeredActionVerdict({
+        action: action,
+        when: action.when,
+        insights: insights
     });
+    const verdict = fireableActionVerdict({
+        args: args,
+        insights: insights
+    }), firing = await args.fireConsequence(action);
+    return firing !== void 0 ? {
+        ...verdict,
+        firing: firing
+    } : verdict;
 }
 
-function requirePendingEffect(instance, effectKey) {
-    const pending = instance.pendingEffects.find(e => e._key === effectKey);
-    if (pending !== void 0) return pending;
-    const run = instance.effectHistory.find(e => e._key === effectKey), settled = run !== void 0 ? {
-        status: run.status,
-        ranAt: run.ranAt,
-        ...run.detail !== void 0 ? {
-            detail: run.detail
-        } : {}
-    } : void 0;
-    throw new EffectNotFoundError({
-        instanceId: instance._id,
-        effectKey: effectKey,
-        ...settled !== void 0 ? {
-            settled: settled
+async function explainActionGates({action: action, activityName: activityName, conditionScope: conditionScope, snapshot: snapshot, sites: sites}) {
+    const insight = action.filter !== void 0 ? await explainSite({
+        site: {
+            kind: "action",
+            activity: activityName,
+            action: action.name
+        },
+        condition: action.filter,
+        params: conditionScope,
+        snapshot: snapshot,
+        sites: sites
+    }) : void 0, whenInsight = action.when !== void 0 ? await explainSite({
+        site: {
+            kind: "action-when",
+            activity: activityName,
+            action: action.name
+        },
+        condition: action.when,
+        params: conditionScope,
+        snapshot: snapshot,
+        sites: sites
+    }) : void 0;
+    return {
+        ...insight !== void 0 ? {
+            insight: insight
+        } : {},
+        ...whenInsight !== void 0 ? {
+            whenInsight: whenInsight
         } : {}
-    });
+    };
 }
 
-function validateCompletionInput({pending: pending, definition: definition, status: status, ops: ops, outputs: outputs}) {
-    if (status === "failed" && ops !== void 0 && ops.length > 0) throw new EffectOpsInvalidError({
-        effect: pending.name,
-        issues: [ "ops cannot accompany a failed completion — field.set the outcome on a done completion instead" ]
-    });
-    if (status === "failed" && outputs !== void 0) throw new EffectOutputsInvalidError({
-        effect: pending.name,
-        issues: [ "outputs cannot accompany a failed completion — report outputs on a done completion instead" ]
-    });
-    if (outputs !== void 0) {
-        const declared = findEffect(definition, pending.name)?.outputs ?? [];
-        validateEffectOutputs({
-            outputs: outputs,
-            declared: declared,
-            effectName: pending.name
-        });
-    }
-    return ops !== void 0 ? validateEffectOps(ops, pending.name) : [];
+function triggeredActionVerdict({action: action, when: when, insights: insights}) {
+    return insights.insight !== void 0 && insights.insight.outcome === "unsatisfied" ? disabled({
+        action: action,
+        reason: {
+            kind: "filter-failed",
+            filter: action.filter ?? ""
+        },
+        ...insights
+    }) : {
+        ...actionEvaluationIdentity(action),
+        allowed: !1,
+        triggered: !0,
+        disabledReason: {
+            kind: "cascade-fired",
+            when: when
+        },
+        ...insights
+    };
 }
 
-async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, requestRecord: requestRecord, actor: actor}) {
-    assertRequestUnprocessed({
-        instance: ctx.instance,
-        record: requestRecord,
-        now: ctx.now
-    });
-    const pending = requirePendingEffect(ctx.instance, effectKey), validatedOps = validateCompletionInput({
-        pending: pending,
-        definition: ctx.definition,
-        status: status,
-        ops: ops,
-        outputs: outputs
-    }), mutation = startMutation(ctx.instance);
-    recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), mutation.pendingEffects = mutation.pendingEffects.filter(e => e._key !== effectKey);
-    const ranAt = ctx.now, settlement = buildEffectSettlement(pending, {
+function fireableActionVerdict({args: args, insights: insights}) {
+    const {action: action, status: status, instance: instance, stageHasExits: stageHasExits, guardDenial: guardDenial} = args, lifecycle = lifecycleReason({
+        instance: instance,
         status: status,
-        ranAt: ranAt,
-        actor: actor,
-        detail: detail,
-        error: error,
-        durationMs: durationMs,
-        outputs: outputs
+        stageHasExits: stageHasExits
     });
-    mutation.effectHistory.push(settlement.run);
-    const wroteEffectOutputs = status === "done" && outputs !== void 0;
-    mutation.history.push(settlement.event);
-    const ranOps = await runOps({
-        ops: validatedOps,
-        mutation: mutation,
-        stage: ctx.instance.currentStage,
-        origin: {
-            effect: pending.name
+    if (lifecycle !== void 0) return disabled({
+        action: action,
+        reason: lifecycle,
+        ...insights
+    });
+    if (guardDenial !== void 0) return disabled({
+        action: action,
+        reason: guardDenial,
+        ...insights
+    });
+    if (args.subjectPermissionReason !== void 0 && (action.effects?.length ?? 0) > 0) return disabled({
+        action: action,
+        reason: args.subjectPermissionReason,
+        ...insights
+    });
+    if (args.requirementsReason !== void 0) return disabled({
+        action: action,
+        reason: args.requirementsReason,
+        ...insights
+    });
+    const {insight: insight} = insights;
+    return action.filter !== void 0 && insight !== void 0 && insight.outcome !== "satisfied" ? disabled({
+        action: action,
+        reason: {
+            kind: "filter-failed",
+            filter: action.filter
         },
-        params: pending.params,
-        actor: actor,
-        self: selfGdr(ctx.instance),
-        now: ranAt,
-        snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
-    }), needsGuardRefresh = wroteEffectOutputs || ranOps.some(isFieldOp);
-    return await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: ctx.instance.currentStage,
-        didChangeState: needsGuardRefresh
-    }), {
-        effectKey: effectKey,
-        effect: pending.name,
-        status: status,
-        origin: pending.origin.kind
+        ...insights
+    }) : {
+        ...actionEvaluationIdentity(action),
+        allowed: !0,
+        ...insights
     };
 }
 
-function buildQueuedEffect({effect: effect, origin: origin, params: params, actor: actor, now: now, stageEntryKey: stageEntryKey}) {
-    const key = randomKey(), pending = {
-        _key: key,
-        _type: "pendingEffect",
-        name: effect.name,
-        ...effect.title !== void 0 ? {
-            title: effect.title
-        } : {},
-        ...effect.description !== void 0 ? {
-            description: effect.description
-        } : {},
-        ...effect.bindings !== void 0 ? {
-            bindings: effect.bindings
-        } : {},
-        params: params,
-        origin: origin,
-        ...actor !== void 0 ? {
-            actor: actor
-        } : {},
-        queuedAt: now,
-        ...stageEntryKey !== void 0 ? {
-            stageEntryKey: stageEntryKey
+function actionEvaluationIdentity(action) {
+    return {
+        action: action,
+        ...action.semantics !== void 0 ? {
+            semantics: action.semantics
         } : {}
-    }, history = {
-        _key: randomKey(),
-        _type: "effectQueued",
-        at: now,
-        effectKey: key,
-        effect: effect.name,
-        origin: origin
     };
-    return {
-        pending: pending,
-        history: history
+}
+
+async function instanceGuardReason({instance: instance, actor: actor, guards: guards}) {
+    if (guards === void 0 || guards.length === 0) return;
+    const denied = await instanceWriteDenials({
+        instance: instance,
+        guards: guards,
+        identity: actor.id
+    });
+    if (denied.length !== 0) return {
+        kind: "mutation-guard-denied",
+        denied: deniedGuardRefs(denied)
     };
 }
 
-async function queueEffects({ctx: ctx, mutation: mutation, effects: effects, origin: origin, actor: actor, opts: opts}) {
-    if (!effects || effects.length === 0) return;
-    const now = ctx.now, liveCtx = {
-        ...ctx,
-        instance: materializeInstance(ctx.instance, mutation)
-    }, stageEntryKey = opts?.stageEntryKey ?? findOpenStageEntry(liveCtx.instance)?._key, params = await ctxConditionParams(liveCtx, {
-        ...opts?.activityName !== void 0 ? {
-            activityName: opts.activityName
-        } : {},
-        ...actor !== void 0 ? {
-            actor: actor
+function lifecycleReason({instance: instance, status: status, stageHasExits: stageHasExits}) {
+    const terminalReason = instanceTerminalReason(instance);
+    if (terminalReason !== void 0) return terminalReason;
+    if (!stageHasExits) return {
+        kind: "stage-terminal",
+        stage: instance.currentStage
+    };
+    if (isTerminalActivityStatus(status)) return {
+        kind: "activity-not-active",
+        status: status
+    };
+}
+
+function disabled(args) {
+    return {
+        ...actionEvaluationIdentity(args.action),
+        allowed: !1,
+        disabledReason: args.reason,
+        ...args.insight !== void 0 ? {
+            insight: args.insight
         } : {},
-        vars: {
-            params: opts?.callerParams ?? {}
-        }
-    });
-    for (const effect of effects) {
-        const resolved = await resolveBindings({
-            bindings: effect.bindings,
-            staticInput: effect.input,
-            snapshot: ctx.snapshot,
-            params: params
-        }), {pending: pending, history: history} = buildQueuedEffect({
-            effect: effect,
-            origin: origin,
-            params: resolved,
-            actor: actor,
-            now: now,
-            stageEntryKey: stageEntryKey
-        });
-        mutation.pendingEffects.push(pending), mutation.history.push(history);
-    }
+        ...args.whenInsight !== void 0 ? {
+            whenInsight: args.whenInsight
+        } : {}
+    };
 }
 
 function inFlightFilter() {
@@ -8090,25 +8317,81 @@ function idsArm(filter, params) {
     }
 }
 
-function instancesQuery(args) {
-    const {tag: tag, filter: filter = {}} = args;
-    if (validateTag(tag), filter.limit !== void 0 && (!Number.isInteger(filter.limit) || filter.limit <= 0)) throw new ContractViolationError(`instancesQuery: limit must be a positive integer; got ${JSON.stringify(filter.limit)}`);
-    const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, tagScopeFilter() ], params = {
-        tag: tag
-    };
-    filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
-    params.definition = filter.definition), filter.stage !== void 0 && (conditions.push("currentStage == $stage"), 
-    params.stage = filter.stage);
-    const arms = [ documentArm(filter, params), idsArm(filter, params) ].filter(arm => arm !== void 0);
-    arms.length > 0 && conditions.push(`(${arms.join(" || ")})`);
-    const body = `*[${conditions.join(" && ")}]`;
-    return filter.limit !== void 0 ? {
-        query: `${body} | order(startedAt desc) [0...${filter.limit}]`,
-        params: params
-    } : {
-        query: `${body} | order(startedAt asc)`,
-        params: params
-    };
+function instancesQuery(args) {
+    const {tag: tag, filter: filter = {}} = args;
+    if (validateTag(tag), filter.limit !== void 0 && (!Number.isInteger(filter.limit) || filter.limit <= 0)) throw new ContractViolationError(`instancesQuery: limit must be a positive integer; got ${JSON.stringify(filter.limit)}`);
+    const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, tagScopeFilter() ], params = {
+        tag: tag
+    };
+    filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
+    params.definition = filter.definition), filter.stage !== void 0 && (conditions.push("currentStage == $stage"), 
+    params.stage = filter.stage);
+    const arms = [ documentArm(filter, params), idsArm(filter, params) ].filter(arm => arm !== void 0);
+    arms.length > 0 && conditions.push(`(${arms.join(" || ")})`);
+    const body = `*[${conditions.join(" && ")}]`;
+    return filter.limit !== void 0 ? {
+        query: `${body} | order(startedAt desc) [0...${filter.limit}]`,
+        params: params
+    } : {
+        query: `${body} | order(startedAt asc)`,
+        params: params
+    };
+}
+
+const DEFAULT_EFFECT_LEASE_MS = 300 * 1e3;
+
+function claimReleasedEntry(args) {
+    return {
+        _key: randomKey(),
+        _type: "effectClaimReleased",
+        at: args.at,
+        effectKey: args.pending._key,
+        effect: args.pending.name,
+        claim: args.claim,
+        via: args.via,
+        actor: args.actor
+    };
+}
+
+const SWEEP_MAX_ATTEMPTS = 5;
+
+async function sweepStaleClaims(args) {
+    const {tag: tag, instanceId: instanceId} = args, client = pinApiVersion(args.client);
+    validateTag(tag);
+    const clock = args.clock ?? wallClock, {actor: actor} = await resolveAccess(client), stamp = resolveExecutionContext(args.executionContext);
+    for (let attempt = 1; attempt <= SWEEP_MAX_ATTEMPTS; attempt++) {
+        const now = clock(), instance = await reload({
+            client: client,
+            instanceId: instanceId,
+            tag: tag
+        }), expired = instance.pendingEffects.filter(e => e.claim !== void 0 && isClaimExpired(e.claim, now));
+        if (expired.length === 0) return {
+            released: []
+        };
+        const expiredKeys = new Set(expired.map(e => e._key)), releasedQueue = instance.pendingEffects.map(e => expiredKeys.has(e._key) ? stripClaim(e) : e), auditRows = stampHistoryEntries(expired.map(pending => claimReleasedEntry({
+            pending: pending,
+            claim: pending.claim,
+            at: now,
+            via: "sweep",
+            actor: actor
+        })), stamp);
+        try {
+            return await client.patch(instance._id).ifRevisionId(instance._rev).set({
+                pendingEffects: releasedQueue,
+                history: [ ...instance.history, ...auditRows ]
+            }).commit(SYNC_COMMIT), {
+                released: expired
+            };
+        } catch (error) {
+            if (!isRevisionConflict(error)) throw error;
+        }
+    }
+    throw new Error(`sweepStaleClaims lost the optimistic-locking race ${SWEEP_MAX_ATTEMPTS} attempts running on ${instanceId} — a concurrent writer kept committing first. Retry later, or investigate a write storm on this instance.`);
+}
+
+function stripClaim(entry) {
+    const {claim: _claim, ...rest} = entry;
+    return rest;
 }
 
 async function sortByDependencies({client: client, definitions: definitions, tag: tag}) {
@@ -9402,6 +9685,66 @@ const workflow = {
             }
         });
     },
+    commitEffectOps: async rawArgs => {
+        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+            idempotencyKey: args.idempotencyKey,
+            op: "commitEffectOps",
+            idempotencyTtlMs: args.idempotencyTtlMs
+        });
+        if (record === void 0) throw new ContractViolationError("commitEffectOps: idempotencyKey is required — the engine cannot assume a supplied field op is idempotent, so every mid-dispatch report must be retry-safe");
+        return runDeduped({
+            client: client,
+            tag: tag,
+            instanceId: instanceId,
+            record: record,
+            now: clock(),
+            actor: actor,
+            clientForGdr: clientForGdr,
+            refSurface: refSurface,
+            clock: clock,
+            executionContext: executionContext,
+            telemetry: args.telemetry,
+            run: async () => {
+                const report = await commitEffectOps({
+                    client: client,
+                    instanceId: instanceId,
+                    effectKey: effectKey,
+                    claimToken: claimToken,
+                    ops: ops,
+                    requestRecord: record,
+                    leaseMs: args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS,
+                    options: engineOptionsForActor({
+                        actor: actor,
+                        clock: clock,
+                        clientForGdr: clientForGdr,
+                        refSurface: refSurface,
+                        executionContext: executionContext,
+                        telemetry: args.telemetry
+                    })
+                }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+                    client: client,
+                    tag: tag,
+                    instanceId: instanceId,
+                    actor: actor,
+                    clientForGdr: clientForGdr,
+                    refSurface: refSurface,
+                    clock: clock,
+                    executionContext: executionContext,
+                    telemetry: args.telemetry
+                });
+                return resolveTelemetry(args.telemetry).log(WorkflowEffectStateReported, {
+                    ...definitionHashFragment(instance.pinnedContentHash),
+                    instanceId: instanceId,
+                    effect: report.effect,
+                    cascaded: cascaded
+                }), {
+                    instance: instance,
+                    cascaded: cascaded,
+                    changed: !0
+                };
+            }
+        });
+    },
     tick: async rawArgs => {
         const args = taggedScope(rawArgs, REQUEST_TAG.tick), {client: client, tag: tag, instanceId: instanceId, executionContext: executionContext} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload({
             client: client,
@@ -10003,64 +10346,100 @@ async function resolveActor(directory, actor) {
     };
 }
 
-const DEFAULT_EFFECT_LEASE_MS = 300 * 1e3;
+const EFFECT_COMMIT_QUEUE_DEPTH = 32, EFFECT_COMMIT_DISPATCH_CAP = 200;
 
-function isClaimExpired(claim, now) {
-    return claim.leaseExpiresAt === void 0 || hasPassed(claim.leaseExpiresAt, now);
+class EffectCommitQueueOverflowError extends WorkflowError {
+    effectKey;
+    bound;
+    limit;
+    constructor(args) {
+        super("effect-commit-queue-overflow", args.bound === "queue-depth" ? `Effect dispatch "${args.effectKey}" has ${args.limit} mid-dispatch commits queued — await your ctx.commitOps/ctx.setProgress calls (or report less often); the queue serializes real engine commits and cannot grow without bound` : `Effect dispatch "${args.effectKey}" already made ${args.limit} mid-dispatch commits — the per-dispatch cap bounds instance history growth; report more coarsely`), 
+        this.name = "EffectCommitQueueOverflowError", this.effectKey = args.effectKey, this.bound = args.bound, 
+        this.limit = args.limit;
+    }
 }
 
-function claimReleasedEntry(args) {
-    return {
-        _key: randomKey(),
-        _type: "effectClaimReleased",
-        at: args.at,
-        effectKey: args.pending._key,
-        effect: args.pending.name,
-        claim: args.claim,
-        via: args.via,
-        actor: args.actor
-    };
+function isClaimLoss(err) {
+    return err instanceof StaleEffectClaimError || err instanceof EffectNotFoundError;
 }
 
-const SWEEP_MAX_ATTEMPTS = 5;
+function pendingEntry(args) {
+    let resolve, reject;
+    const promise = new Promise((res, rej) => {
+        resolve = res, reject = rej;
+    });
+    return promise.catch(() => {}), {
+        ...args,
+        resolve: resolve,
+        reject: reject,
+        promise: promise
+    };
+}
 
-async function sweepStaleClaims(args) {
-    const {tag: tag, instanceId: instanceId} = args, client = pinApiVersion(args.client);
-    validateTag(tag);
-    const clock = args.clock ?? wallClock, {actor: actor} = await resolveAccess(client), stamp = resolveExecutionContext(args.executionContext);
-    for (let attempt = 1; attempt <= SWEEP_MAX_ATTEMPTS; attempt++) {
-        const now = clock(), instance = await reload({
-            client: client,
-            instanceId: instanceId,
-            tag: tag
-        }), expired = instance.pendingEffects.filter(e => e.claim !== void 0 && isClaimExpired(e.claim, now));
-        if (expired.length === 0) return {
-            released: []
-        };
-        const expiredKeys = new Set(expired.map(e => e._key)), releasedQueue = instance.pendingEffects.map(e => expiredKeys.has(e._key) ? stripClaim(e) : e), auditRows = stampHistoryEntries(expired.map(pending => claimReleasedEntry({
-            pending: pending,
-            claim: pending.claim,
-            at: now,
-            via: "sweep",
-            actor: actor
-        })), stamp);
-        try {
-            return await client.patch(instance._id).ifRevisionId(instance._rev).set({
-                pendingEffects: releasedQueue,
-                history: [ ...instance.history, ...auditRows ]
-            }).commit(SYNC_COMMIT), {
-                released: expired
-            };
-        } catch (error) {
-            if (!isRevisionConflict(error)) throw error;
+function createEffectCommitQueue(args) {
+    const {effectKey: effectKey, claimToken: claimToken, commit: commit} = args, pending = [];
+    let admitted = 0, dead, closed = !1, tail = Promise.resolve();
+    function assertOpen() {
+        if (dead !== void 0) throw dead;
+        if (closed) throw new Error(`Effect dispatch "${effectKey}" already settled — a mid-dispatch report after the handler returned cannot commit; await your reports inside the handler`);
+    }
+    function admit(entry) {
+        if (assertOpen(), pending.length >= EFFECT_COMMIT_QUEUE_DEPTH) throw new EffectCommitQueueOverflowError({
+            effectKey: effectKey,
+            bound: "queue-depth",
+            limit: EFFECT_COMMIT_QUEUE_DEPTH
+        });
+        if (admitted >= EFFECT_COMMIT_DISPATCH_CAP) throw new EffectCommitQueueOverflowError({
+            effectKey: effectKey,
+            bound: "dispatch-cap",
+            limit: EFFECT_COMMIT_DISPATCH_CAP
+        });
+        return admitted += 1, pending.push(entry), tail = tail.then(runNext), entry.promise;
+    }
+    function die(err) {
+        dead = err;
+        for (const entry of pending.splice(0)) entry.reject(err);
+    }
+    async function runNext() {
+        const entry = pending.shift();
+        if (entry !== void 0) try {
+            await commit({
+                ops: entry.buildOps(),
+                idempotencyKey: entry.idempotencyKey
+            }), entry.resolve();
+        } catch (err) {
+            entry.reject(err), die(err);
         }
     }
-    throw new Error(`sweepStaleClaims lost the optimistic-locking race ${SWEEP_MAX_ATTEMPTS} attempts running on ${instanceId} — a concurrent writer kept committing first. Retry later, or investigate a write storm on this instance.`);
-}
-
-function stripClaim(entry) {
-    const {claim: _claim, ...rest} = entry;
-    return rest;
+    return {
+        commitOps: req => admit(pendingEntry({
+            buildOps: () => req.ops,
+            idempotencyKey: req.idempotencyKey
+        })),
+        setProgress: (target, value) => {
+            assertOpen();
+            const ref = typeof target == "string" ? {
+                scope: "workflow",
+                field: target
+            } : target, coalesceKey = `${ref.scope}:${ref.field}`, queued = pending.find(entry2 => entry2.coalesceKey === coalesceKey);
+            if (queued !== void 0) return queued.latestValue = value, queued.promise;
+            const entry = pendingEntry({
+                buildOps: () => [ {
+                    type: "field.set",
+                    target: ref,
+                    value: {
+                        type: "literal",
+                        value: entry.latestValue
+                    }
+                } ],
+                idempotencyKey: `effect:${effectKey}:${claimToken}:progress:${coalesceKey}:${admitted}`,
+                coalesceKey: coalesceKey,
+                latestValue: value
+            });
+            return admit(entry);
+        },
+        settle: async () => (closed = !0, await tail, dead !== void 0 && !isClaimLoss(dead) ? dead : void 0)
+    };
 }
 
 class MissingHandlerError extends WorkflowError {
@@ -10156,74 +10535,126 @@ async function drainEffectsInternal(args) {
         failed: [],
         skipped: [],
         lost: []
-    }, skippedKeys = /* @__PURE__ */ new Set;
-    for (;;) {
-        const now = clock(), before = await reload({
-            client: client,
-            instanceId: instanceId,
-            tag: tag
-        });
-        noteDrainedInstanceHash(buckets, before);
-        const candidate = findClaimableCandidate({
-            instance: before,
-            now: now,
-            skippedKeys: skippedKeys
-        });
-        if (candidate === void 0) break;
-        const handler = effectHandlers[candidate.name];
-        if (handler === void 0) {
-            await assertSkippableOrThrow({
-                missingHandler: missingHandler,
-                candidate: candidate,
-                instanceId: instanceId,
-                log: log
-            }), buckets.skipped.push(candidate), skippedKeys.add(candidate._key);
-            continue;
-        }
-        if (!await claimPendingEffect({
-            client: client,
-            instance: before,
-            candidate: candidate,
-            drainerActor: drainerActor,
-            now: now,
-            leaseMs: leaseMs,
-            ...executionContext !== void 0 ? {
-                executionContext: executionContext
-            } : {}
-        })) continue;
-        const outcome = await dispatchAndReport({
-            handler: handler,
-            candidate: candidate,
-            client: client,
-            handlerClient: handlerClient,
-            tag: tag,
-            workflowResource: workflowResource,
-            ...resourceClients !== void 0 ? {
-                resourceClients: resourceClients
-            } : {},
-            instanceId: instanceId,
-            clientFor: clientFor,
-            logger: logger,
-            log: log,
-            ...executionContext !== void 0 ? {
-                executionContext: executionContext
-            } : {},
-            telemetry: cascadeTelemetry,
-            clock: clock
-        });
-        buckets[outcome].push(candidate);
-    }
+    }, pass = {
+        client: client,
+        handlerClient: handlerClient,
+        tag: tag,
+        workflowResource: workflowResource,
+        ...resourceClients !== void 0 ? {
+            resourceClients: resourceClients
+        } : {},
+        instanceId: instanceId,
+        effectHandlers: effectHandlers,
+        missingHandler: missingHandler,
+        logger: logger,
+        log: log,
+        leaseMs: leaseMs,
+        clock: clock,
+        ...executionContext !== void 0 ? {
+            executionContext: executionContext
+        } : {},
+        telemetry: cascadeTelemetry,
+        drainerActor: drainerActor,
+        clientFor: clientFor,
+        buckets: buckets,
+        skippedKeys: /* @__PURE__ */ new Set
+    };
+    for (;await drainOneCandidate(pass); ) ;
     return buckets;
 }
 
+async function drainOneCandidate(pass) {
+    const {client: client, tag: tag, instanceId: instanceId, buckets: buckets, skippedKeys: skippedKeys} = pass, now = pass.clock(), before = await reload({
+        client: client,
+        instanceId: instanceId,
+        tag: tag
+    });
+    noteDrainedInstanceHash(buckets, before);
+    const candidate = findClaimableCandidate({
+        instance: before,
+        now: now,
+        skippedKeys: skippedKeys
+    });
+    if (candidate === void 0) return !1;
+    const handler = pass.effectHandlers[candidate.name];
+    if (handler === void 0) return await assertSkippableOrThrow({
+        missingHandler: pass.missingHandler,
+        candidate: candidate,
+        instanceId: instanceId,
+        log: pass.log
+    }), buckets.skipped.push(candidate), skippedKeys.add(candidate._key), !0;
+    const claimed = await claimPendingEffect({
+        client: client,
+        instance: before,
+        candidate: candidate,
+        drainerActor: pass.drainerActor,
+        now: now,
+        leaseMs: pass.leaseMs,
+        ...pass.executionContext !== void 0 ? {
+            executionContext: pass.executionContext
+        } : {}
+    });
+    if (claimed === void 0) return !0;
+    const outcome = await dispatchAndReport({
+        handler: handler,
+        candidate: candidate,
+        claimToken: claimed.claimToken,
+        leaseMs: pass.leaseMs,
+        client: client,
+        handlerClient: pass.handlerClient,
+        tag: tag,
+        workflowResource: pass.workflowResource,
+        ...pass.resourceClients !== void 0 ? {
+            resourceClients: pass.resourceClients
+        } : {},
+        instanceId: instanceId,
+        clientFor: pass.clientFor,
+        logger: pass.logger,
+        log: pass.log,
+        ...pass.executionContext !== void 0 ? {
+            executionContext: pass.executionContext
+        } : {},
+        telemetry: pass.telemetry,
+        clock: pass.clock
+    });
+    return buckets[outcome].push(candidate), !0;
+}
+
 function findClaimableCandidate({instance: instance, now: now, skippedKeys: skippedKeys}) {
     return instance.pendingEffects.find(e => (e.claim === void 0 || isClaimExpired(e.claim, now)) && !skippedKeys.has(e._key));
 }
 
 async function dispatchAndReport(args) {
-    const {handler: handler, candidate: candidate, client: client, handlerClient: handlerClient, tag: tag, workflowResource: workflowResource, resourceClients: resourceClients, instanceId: instanceId, clientFor: clientFor, logger: logger, log: log, executionContext: executionContext, telemetry: telemetry, clock: clock} = args, {outputs: outputs, ops: ops, dispatchError: dispatchError} = await dispatchEffect({
+    const {handler: handler, candidate: candidate, claimToken: claimToken, leaseMs: leaseMs, client: client, handlerClient: handlerClient, tag: tag, workflowResource: workflowResource, resourceClients: resourceClients, instanceId: instanceId, clientFor: clientFor, logger: logger, log: log, executionContext: executionContext, telemetry: telemetry, clock: clock} = args, commitQueue = createEffectCommitQueue({
+        effectKey: candidate._key,
+        claimToken: claimToken,
+        commit: async req => {
+            await workflow.commitEffectOps({
+                client: client,
+                tag: tag,
+                workflowResource: workflowResource,
+                ...resourceClients !== void 0 ? {
+                    resourceClients: resourceClients
+                } : {},
+                ...executionContext !== void 0 ? {
+                    executionContext: executionContext
+                } : {},
+                ...telemetry !== void 0 ? {
+                    telemetry: telemetry
+                } : {},
+                instanceId: instanceId,
+                effectKey: candidate._key,
+                claimToken: claimToken,
+                ops: req.ops,
+                idempotencyKey: req.idempotencyKey,
+                leaseMs: leaseMs,
+                clock: clock
+            });
+        }
+    }), {outputs: outputs, ops: ops, dispatchError: dispatchError} = await dispatchEffect({
         handler: handler,
         candidate: candidate,
+        queue: commitQueue,
         ctx: {
             client: handlerClient,
             clientFor: clientFor,
@@ -10303,11 +10734,12 @@ async function assertSkippableOrThrow({missingHandler: missingHandler, candidate
 }
 
 async function claimPendingEffect({client: client, instance: instance, candidate: candidate, drainerActor: drainerActor, now: now, leaseMs: leaseMs, executionContext: executionContext}) {
-    const priorClaim = candidate.claim, claim = {
+    const priorClaim = candidate.claim, claimToken = randomKey(), claim = {
         _type: "pendingEffect.claim",
         claimedAt: now,
         claimedBy: drainerActor,
-        leaseExpiresAt: addMs(now, leaseMs)
+        leaseExpiresAt: addMs(now, leaseMs),
+        claimToken: claimToken
     }, takeoverAudit = priorClaim !== void 0 ? stampHistoryEntries([ claimReleasedEntry({
         pending: candidate,
         claim: priorClaim,
@@ -10321,43 +10753,64 @@ async function claimPendingEffect({client: client, instance: instance, candidate
             ...takeoverAudit !== void 0 ? {
                 history: [ ...instance.history, takeoverAudit ]
             } : {}
-        }).commit(SYNC_COMMIT), !0;
+        }).commit(SYNC_COMMIT), {
+            claimToken: claimToken
+        };
     } catch (error) {
         if (!isRevisionConflict(error)) throw error;
-        return !1;
+        return;
     }
 }
 
-async function dispatchEffect({handler: handler, candidate: candidate, ctx: ctx}) {
+async function invokeHandler({handler: handler, candidate: candidate, queue: queue, ctx: ctx}) {
     try {
         const result = await handler(candidate.params, {
             client: ctx.client,
             clientFor: ctx.clientFor,
             instanceId: ctx.instanceId,
             effectKey: candidate._key,
-            log: (message, extra) => ctx.logger(`effect.${candidate.name}`).info(message, extra)
+            log: (message, extra) => ctx.logger(`effect.${candidate.name}`).info(message, extra),
+            commitOps: queue.commitOps,
+            setProgress: queue.setProgress
         });
-        return {
-            ...result?.outputs !== void 0 ? {
-                outputs: result.outputs
-            } : {},
-            ...result?.ops !== void 0 ? {
-                ops: result.ops
-            } : {}
+        return result === void 0 ? {} : {
+            result: result
         };
     } catch (err) {
-        const message = errorMessage(err), stack = err instanceof Error && err.stack !== void 0 ? err.stack : void 0;
         return {
-            dispatchError: stack !== void 0 ? {
-                message: message,
-                stack: stack
-            } : {
-                message: message
+            thrown: {
+                err: err
             }
         };
     }
 }
 
+function shapeDispatchError(err) {
+    const message = errorMessage(err), stack = err instanceof Error && err.stack !== void 0 ? err.stack : void 0;
+    return stack !== void 0 ? {
+        message: message,
+        stack: stack
+    } : {
+        message: message
+    };
+}
+
+async function dispatchEffect(args) {
+    const {result: result, thrown: thrown} = await invokeHandler(args), settleFailure = await args.queue.settle(), failed = thrown ?? (settleFailure !== void 0 ? {
+        err: settleFailure
+    } : void 0);
+    return failed !== void 0 ? {
+        dispatchError: shapeDispatchError(failed.err)
+    } : {
+        ...result?.outputs !== void 0 ? {
+            outputs: result.outputs
+        } : {},
+        ...result?.ops !== void 0 ? {
+            ops: result.ops
+        } : {}
+    };
+}
+
 async function applyMissingHandler({policy: policy, info: info, log: log}) {
     if (policy === "fail") return "fail";
     if (policy === "skip") return log.warn(`Missing effect handler "${info.name}" — skipping`, {
@@ -10834,6 +11287,7 @@ function createEngine(args) {
         fireAction: rest => workflow.fireAction(withScope(rest)),
         editField: rest => workflow.editField(withScope(rest)),
         completeEffect: rest => workflow.completeEffect(withScope(rest)),
+        commitEffectOps: rest => workflow.commitEffectOps(withScope(rest)),
         tick: rest => workflow.tick(withScope(rest)),
         evaluate: rest => workflow.evaluate(withScope(rest)),
         diagnose: rest => workflow.diagnose(withScope(rest)),
@@ -11240,6 +11694,10 @@ const HISTORY_DISPLAY = {
         title: "Number value",
         description: "Numeric entry."
     },
+    progress: {
+        title: "Progress",
+        description: "Application-defined completion, 0–100 inclusive (fractions allowed)."
+    },
     boolean: {
         title: "Boolean value",
         description: "True/false entry."
@@ -11402,4 +11860,4 @@ function displayDescription(typeKey) {
     if (typeKey) return DISPLAY[typeKey]?.description;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, OP_DISPLAY, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, START_ALLOWED_VARS, START_FILTER_VARS, SpawnContractsInvalidError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartAllowed, extractDocumentId, fieldTreeShape, findCurrentActivityEntry, findOpenStageEntry, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesQuery, isCascadeFired, isClaimExpired, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundAllowedReads, unsatisfiedTransitionSummaries, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, OP_DISPLAY, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, START_ALLOWED_VARS, START_FILTER_VARS, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartAllowed, extractDocumentId, fieldTreeShape, findCurrentActivityEntry, findOpenStageEntry, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesQuery, isCascadeFired, isClaimExpired, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundAllowedReads, unsatisfiedTransitionSummaries, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };