@sanity/workflow-engine 0.2.0 → 0.4.0

package/dist/index.js

@@ -1,58 +1,15 @@
 import { parse, evaluate } from "groq-js";
+import { isTerminalTaskStatus, WORKFLOW_DEFINITION_TYPE, DOCUMENT_VALUE_PERMISSIONS } from "./_chunks-es/schema.js";
 import * as v from "valibot";
-function validateDefinition(definition) {
-  const v2 = createDefinitionValidator();
-  for (const slot of definition.state ?? [])
-    v2.checkSlot(slot, `workflow.state "${slot.id}"`);
-  for (const p of definition.predicates ?? [])
-    p.groq && v2.checkFilter(p.groq, `predicate "${p.id}"`);
-  for (const stage of definition.stages)
-    validateStage(v2, stage);
-  if (v2.errors.length > 0)
-    throw new Error(
-      `defineWorkflow("${definition.workflowId}", v${definition.version}): ${v2.errors.length} validation error${v2.errors.length === 1 ? "" : "s"}:
-` + v2.errors.join(`
-`)
-    );
-}
-function createDefinitionValidator() {
-  const errors = [], tryParse = (groq, where) => {
-    try {
-      parse(groq);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      errors.push(`  \xB7 ${where}: ${message}`);
-    }
-  }, rejectTypeScan = (groq, where) => {
-    /\*\s*\[\s*_type\b/.test(groq) && errors.push(
-      `  \xB7 ${where}: filter scans by \`_type\` \u2014 that's a discovery query, not a predicate. Filters evaluate against the in-memory snapshot (instance + ancestors + state-declared docs). To bring extra docs in scope, declare a \`workflow.state.doc.ref\` (or \`doc.refs\`) slot on the workflow or this stage. For lake scans like "all articles in this release", use spawn \`forEach.groq\` instead.`
-    );
-  };
-  return { errors, tryParse, checkFilter: (groq, where) => {
-    tryParse(groq, where), rejectTypeScan(groq, where);
-  }, checkSlot: (slot, slotLabel) => {
-    slot.source.kind === "query" && tryParse(slot.source.query, `${slotLabel}.query`);
-  } };
+function getPath(value, path) {
+  let current = value;
+  for (const part of path.split(".")) {
+    if (current == null || typeof current != "object") return;
+    current = current[part];
+  }
+  return current;
 }
-function validateStage(v2, stage) {
-  for (const slot of stage.state ?? [])
-    v2.checkSlot(slot, `stage "${stage.id}".state "${slot.id}"`);
-  typeof stage.completion == "string" && v2.tryParse(stage.completion, `stage "${stage.id}".completion`);
-  for (const t of stage.transitions ?? [])
-    typeof t.filter == "string" && v2.checkFilter(t.filter, `transition ${stage.id} \u2192 ${t.to} filter`);
-  for (const task of stage.tasks ?? [])
-    validateTask(v2, stage.id, task);
-}
-function validateTask(v2, stageId, task) {
-  const where = `stage "${stageId}" task "${task.id}"`;
-  for (const slot of task.state ?? [])
-    v2.checkSlot(slot, `${where}.state "${slot.id}"`);
-  typeof task.filter == "string" && v2.checkFilter(task.filter, `${where}.filter`), typeof task.completeWhen == "string" && v2.checkFilter(task.completeWhen, `${where}.completeWhen`);
-  for (const a of task.actions ?? [])
-    typeof a.filter == "string" && v2.checkFilter(a.filter, `task "${task.id}" action "${a.id}".filter`);
-  task.spawns?.forEach?.groq && v2.tryParse(task.spawns.forEach.groq, `task "${task.id}".spawns.forEach.groq`);
-}
-const wallClock = () => (/* @__PURE__ */ new Date()).toISOString(), KNOWN_SCHEMES = /* @__PURE__ */ new Set(["dataset", "canvas", "media-library", "dashboard"]);
+const KNOWN_SCHEMES = /* @__PURE__ */ new Set(["dataset", "canvas", "media-library", "dashboard"]);
 function parseGdr(uri) {
   const colon = uri.indexOf(":");
   if (colon < 0)
@@ -109,12 +66,15 @@ function refMediaLibrary(resourceId, documentId, type) {
 function refDashboard(resourceId, documentId, type) {
   return { id: gdrUri({ scheme: "dashboard", resourceId, documentId }), type };
 }
+function datasetResourceParts(id) {
+  const dot = id.indexOf(".");
+  if (dot <= 0 || dot === id.length - 1)
+    throw new Error(`Invalid dataset resource id "${id}": expected "<projectId>.<dataset>".`);
+  return { projectId: id.slice(0, dot), dataset: id.slice(dot + 1) };
+}
 function gdrFromResource(res, documentId) {
   if (res.type === "dataset") {
-    const dot = res.id.indexOf(".");
-    if (dot < 0)
-      throw new Error(`Invalid dataset resource id "${res.id}": expected "<projectId>.<dataset>".`);
-    const projectId = res.id.slice(0, dot), dataset = res.id.slice(dot + 1);
+    const { projectId, dataset } = datasetResourceParts(res.id);
     return gdrUri({ scheme: "dataset", projectId, dataset, documentId });
   }
   return gdrUri({ scheme: res.type, resourceId: res.id, documentId });
@@ -136,23 +96,326 @@ function gdrRef(res, documentId, type) {
 function isGdr(value) {
   return typeof value == "object" && value !== null && typeof value.id == "string" && typeof value.type == "string";
 }
-function buildParams(instance, now, extra) {
+function resourceOf(p) {
+  return p.scheme === "dataset" ? { type: "dataset", id: `${p.projectId}.${p.dataset}` } : { type: p.scheme, id: p.resourceId ?? "" };
+}
+const STATE_READ = /^\$state\.(\w+)(?:\.(.+))?$/;
+function isGuardReadExpr(expr) {
+  return expr === "$self" || expr === "$now" || STATE_READ.test(expr);
+}
+function resolveGuardRead(expr, ctx) {
+  if (expr === "$self") return selfGdr(ctx.instance);
+  if (expr === "$now") return ctx.now;
+  const stateRead = STATE_READ.exec(expr);
+  if (stateRead !== null) {
+    const value = (ctx.instance.state ?? []).find((s) => s.name === stateRead[1])?.value;
+    return stateRead[2] !== void 0 ? getPath(value, stateRead[2]) : value;
+  }
+  throw new Error(
+    `Guard read "${expr}" is not a supported deploy-time value \u2014 use "$self", "$now", or "$state.<name>[.path]" (guards store resolved values; the lake cannot see $state)`
+  );
+}
+function resolveIdRefTarget(expr, ctx) {
+  const value = resolveGuardRead(expr, ctx);
+  if (typeof value == "string" && isGdrUri(value))
+    return { parsed: parseGdr(value) };
+  if (value && typeof value == "object") {
+    const v2 = value;
+    if (typeof v2.id == "string" && isGdrUri(v2.id))
+      return typeof v2.type == "string" ? { parsed: parseGdr(v2.id), type: v2.type } : { parsed: parseGdr(v2.id) };
+  }
+  return null;
+}
+function resolveIdRefTargets(idRefs, ctx) {
+  const targets = [];
+  for (const expr of idRefs ?? []) {
+    const target = resolveIdRefTarget(expr, ctx);
+    if (target === null) return null;
+    targets.push(target);
+  }
+  return targets.length === 0 ? null : targets;
+}
+function assertSingleResource(targets) {
+  const resource = resourceOf(targets[0].parsed);
+  for (const g of targets) {
+    const r = resourceOf(g.parsed);
+    if (r.type !== resource.type || r.id !== resource.id)
+      throw new Error(
+        `Guard targets span multiple resources (${resource.type}:${resource.id} vs ${r.type}:${r.id}); a guard is single-resource.`
+      );
+  }
+  return resource;
+}
+function bareIdRefs(targets) {
+  return targets.flatMap((g) => [g.parsed.documentId, `drafts.${g.parsed.documentId}`]);
+}
+function resolveMatchTypes(targets, authorTypes) {
+  if (authorTypes !== void 0) return authorTypes;
+  const inferred = [...new Set(targets.map((g) => g.type).filter((t) => !!t))];
+  return inferred.length > 0 ? inferred : void 0;
+}
+function resolveMetadata(metadata, ctx) {
+  const out = {};
+  for (const [k, expr] of Object.entries(metadata ?? {}))
+    out[k] = resolveGuardRead(expr, ctx);
+  return out;
+}
+function validateDefinition(definition) {
+  const v2 = createDefinitionValidator();
+  for (const entry of definition.state ?? [])
+    v2.checkEntry(entry, `workflow.state "${entry.name}"`);
+  for (const [name, groq] of Object.entries(definition.predicates ?? {}))
+    v2.checkCondition(groq, `predicate "${name}"`);
+  for (const stage of definition.stages)
+    validateStage(v2, stage);
+  if (v2.errors.length > 0)
+    throw new Error(
+      `defineWorkflow("${definition.name}", v${definition.version}): ${v2.errors.length} validation error${v2.errors.length === 1 ? "" : "s"}:
+` + v2.errors.join(`
+`)
+    );
+}
+function createDefinitionValidator() {
+  const errors = [], tryParse = (groq, where) => {
+    try {
+      parse(groq);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      errors.push(`  \xB7 ${where}: ${message}`);
+    }
+  }, rejectTypeScan = (groq, where) => {
+    /\*\s*\[\s*_type\b/.test(groq) && errors.push(
+      `  \xB7 ${where}: condition scans by \`_type\` \u2014 that's a discovery query, not a predicate. Conditions evaluate against the in-memory snapshot (instance + ancestors + state-declared docs). To bring extra docs in scope, declare a \`doc.ref\` (or \`doc.refs\`) state entry on the workflow or this stage. For lake scans like "all articles in this release", use \`subworkflows.forEach\` instead.`
+    );
+  };
+  return { errors, tryParse, checkCondition: (groq, where) => {
+    tryParse(groq, where), rejectTypeScan(groq, where);
+  }, checkEntry: (entry, label) => {
+    entry.source.type === "query" && tryParse(entry.source.query, `${label}.query`);
+  }, checkGuardRead: (expr, where) => {
+    isGuardReadExpr(expr) || errors.push(
+      `  \xB7 ${where}: guard read "${expr}" is not a supported deploy-time value \u2014 use "$self", "$now", or "$state.<name>[.path]" (guards store resolved values; the lake cannot see $state)`
+    );
+  } };
+}
+function validateStage(v2, stage) {
+  for (const entry of stage.state ?? [])
+    v2.checkEntry(entry, `stage "${stage.name}".state "${entry.name}"`);
+  for (const guard of stage.guards ?? [])
+    validateGuardReads(v2, stage.name, guard);
+  for (const t of stage.transitions ?? []) {
+    v2.checkCondition(t.filter, `transition "${t.name}" (${stage.name} \u2192 ${t.to}) filter`);
+    for (const [key, groq] of effectBindings(t.effects))
+      v2.tryParse(groq, `transition "${t.name}" effect binding "${key}"`);
+  }
+  for (const task of stage.tasks ?? [])
+    validateTask(v2, stage.name, task);
+}
+function validateGuardReads(v2, stageName, guard) {
+  const where = `stage "${stageName}" guard "${guard.name}"`;
+  for (const expr of guard.match.idRefs ?? [])
+    v2.checkGuardRead(expr, `${where} match.idRefs`);
+  for (const [key, expr] of Object.entries(guard.metadata ?? {}))
+    v2.checkGuardRead(expr, `${where} metadata "${key}"`);
+}
+function validateTask(v2, stageName, task) {
+  const where = `stage "${stageName}" task "${task.name}"`;
+  for (const entry of task.state ?? [])
+    v2.checkEntry(entry, `${where}.state "${entry.name}"`);
+  task.filter !== void 0 && v2.checkCondition(task.filter, `${where}.filter`), task.completeWhen !== void 0 && v2.checkCondition(task.completeWhen, `${where}.completeWhen`), task.failWhen !== void 0 && v2.checkCondition(task.failWhen, `${where}.failWhen`);
+  for (const [key, groq] of effectBindings(task.effects))
+    v2.tryParse(groq, `${where} effect binding "${key}"`);
+  validateTaskActions(v2, task), task.subworkflows !== void 0 && validateSubworkflows(v2, where, task.subworkflows);
+}
+function validateTaskActions(v2, task) {
+  for (const a of task.actions ?? []) {
+    a.filter !== void 0 && v2.checkCondition(a.filter, `task "${task.name}" action "${a.name}".filter`);
+    for (const [key, groq] of effectBindings(a.effects))
+      v2.tryParse(groq, `task "${task.name}" action "${a.name}" effect binding "${key}"`);
+  }
+}
+function validateSubworkflows(v2, where, sub) {
+  v2.tryParse(sub.forEach, `${where}.subworkflows.forEach`);
+  for (const [key, groq] of Object.entries(sub.with ?? {}))
+    v2.tryParse(groq, `${where}.subworkflows.with "${key}"`);
+  for (const [key, groq] of Object.entries(sub.context ?? {}))
+    v2.tryParse(groq, `${where}.subworkflows.context "${key}"`);
+}
+function effectBindings(effects) {
+  return (effects ?? []).flatMap(
+    (e) => Object.entries(e.bindings ?? {}).map(([k, groq]) => [`${e.name}.${k}`, groq])
+  );
+}
+const wallClock = () => (/* @__PURE__ */ new Date()).toISOString(), GUARD_DOC_TYPE = "temp.system.guard";
+class MutationGuardDeniedError extends Error {
+  denied;
+  documentId;
+  action;
+  constructor(args) {
+    const ids = args.denied.map((d) => d.guardId).join(", ");
+    super(`Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, this.action = args.action;
+  }
+  /**
+   * Build the error straight from the denying guard docs — the one mapping
+   * from {@link MutationGuardDoc} to the structured `denied` payload, shared
+   * by every enforcement site (engine pre-flight, bench write seam).
+   */
+  static fromGuards(args) {
+    return new MutationGuardDeniedError({
+      documentId: args.documentId,
+      action: args.action,
+      denied: args.guards.map((g) => ({
+        guardId: g._id,
+        ...g.name !== void 0 ? { name: g.name } : {}
+      }))
+    });
+  }
+}
+function lakeGuardId(args) {
+  return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.guardName}`;
+}
+function compileGuard(args) {
+  return {
+    _id: args.id,
+    _type: GUARD_DOC_TYPE,
+    resourceType: args.resourceType,
+    resourceId: args.resourceId,
+    owner: args.owner,
+    sourceInstanceId: args.sourceInstanceId,
+    sourceDefinition: args.sourceDefinition,
+    sourceStage: args.sourceStage,
+    ...args.name !== void 0 ? { name: args.name } : {},
+    ...args.description !== void 0 ? { description: args.description } : {},
+    match: args.match,
+    predicate: args.predicate,
+    metadata: args.metadata
+  };
+}
+function toGroqJsPredicate(predicate) {
+  return predicate.replace(new RegExp("(?<!\\$)\\bguard\\.", "g"), "$guard.").replace(new RegExp("(?<!\\$)\\bmutation\\.", "g"), "$mutation.");
+}
+function globMatch(pattern, value) {
+  if (!pattern.includes("*")) return pattern === value;
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`).test(value);
+}
+function guardMatches(guard, doc, action) {
+  const m = guard.match;
+  if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type)))
+    return !1;
+  if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
+    const byRef = m.idRefs?.includes(doc.id) ?? !1, byPattern = m.idPatterns?.some((p) => globMatch(p, doc.id)) ?? !1;
+    if (!byRef && !byPattern) return !1;
+  }
+  return !0;
+}
+async function evaluateMutationGuard(args) {
+  const { guard, context } = args;
+  if (guard.predicate === "") return !1;
+  const params = { guard, mutation: { action: context.action } };
+  try {
+    const tree = parse(toGroqJsPredicate(guard.predicate), { mode: "delta", params });
+    return await (await evaluate(tree, {
+      before: context.before,
+      after: context.after,
+      params,
+      ...context.identity !== void 0 ? { identity: context.identity } : {}
+    })).get() === !0;
+  } catch {
+    return !1;
+  }
+}
+async function denyingGuards(args) {
+  const { guards, doc, context } = args, denied = [];
+  for (const guard of guards)
+    guardMatches(guard, doc, context.action) && (await evaluateMutationGuard({ guard, context }) || denied.push(guard));
+  return denied;
+}
+async function instanceWriteDenials(args) {
+  const { instance, guards, identity } = args, enforceable = guards.filter(
+    (g) => g.resourceType === instance.workflowResource.type && g.resourceId === instance.workflowResource.id
+  );
+  if (enforceable.length === 0) return [];
+  const doc = instance;
+  return denyingGuards({
+    guards: enforceable,
+    doc: { id: instance._id, type: instance._type },
+    context: {
+      action: "update",
+      before: doc,
+      after: doc,
+      ...identity !== void 0 ? { identity } : {}
+    }
+  });
+}
+async function assertInstanceWriteAllowed(args) {
+  const denied = await instanceWriteDenials(args);
+  if (denied.length !== 0)
+    throw MutationGuardDeniedError.fromGuards({
+      documentId: args.instance._id,
+      action: "update",
+      guards: denied
+    });
+}
+function findOpenStageEntry(host) {
+  return host.stages.find((s) => s.name === host.currentStage && s.exitedAt === void 0);
+}
+function buildParams(args) {
+  const { instance, now, snapshot, extra } = args, currentTasks2 = findOpenStageEntry(instance)?.tasks ?? [];
   return {
     self: selfGdr(instance),
-    state: stateMap(instance.state ?? []),
+    state: renderedState(instance.state ?? [], snapshot),
     parent: instance.ancestors.at(-1)?.id ?? null,
     ancestors: instance.ancestors.map((a) => a.id),
-    /** Current stage id — bind for filters that scope to the current stage. */
-    stage: instance.currentStageId,
+    stage: instance.currentStage,
     now,
+    /** `$effects` — parent context handoff by entry name, completed-effect
+     *  outputs namespaced under the effect's name (`$effects['x.y'].out`). */
+    effects: effectsContextMap(instance),
+    /** `$tasks` — the current stage's task rows, statuses included. */
+    tasks: currentTasks2,
+    allTasksDone: currentTasks2.every((t) => t.status === "done" || t.status === "skipped"),
+    anyTaskFailed: currentTasks2.some((t) => t.status === "failed"),
     ...extra
   };
 }
-function stateMap(slots) {
+function renderedState(entries, snapshot) {
+  const out = {};
+  for (const entry of entries) out[entry.name] = renderedValue(entry, snapshot);
+  return out;
+}
+function renderedValue(entry, snapshot) {
+  return entry._type !== "doc.ref" || entry.value === null || snapshot === void 0 ? entry.value : snapshot.docs.find((d) => d._id === entry.value.id) ?? entry.value;
+}
+function scopedStateOverlay(instance, snapshot, taskName) {
+  const stageEntry = findOpenStageEntry(instance);
+  if (stageEntry === void 0) return {};
+  const stageState = renderedState(stageEntry.state ?? [], snapshot), task = taskName ? stageEntry.tasks.find((t) => t.name === taskName) : void 0;
+  return { ...stageState, ...renderedState(task?.state ?? [], snapshot) };
+}
+function assignedFor(instance, taskName, actor) {
+  if (actor === void 0) return !1;
+  const entry = findOpenStageEntry(instance)?.tasks.find((t) => t.name === taskName)?.state?.find((s) => s._type === "assignees");
+  return entry === void 0 ? !1 : entry.value.some(
+    (a) => a.type === "user" ? a.id === actor.id : (actor.roles ?? []).includes(a.role)
+  );
+}
+function effectsContextMap(instance) {
   const out = {};
-  for (const s of slots) out[s.id] = s;
+  for (const entry of instance.effectsContext)
+    out[entry.name] = entry._type === "effectsContext.json" ? parseJsonContextEntry(entry) : entry.value;
   return out;
 }
+function parseJsonContextEntry(entry) {
+  try {
+    return JSON.parse(entry.value);
+  } catch (err) {
+    throw new Error(
+      `effectsContext entry "${entry.name}" holds unparseable JSON: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+}
 function paramsForLake(params) {
   return {
     ...params,
@@ -177,67 +440,83 @@ function stripStateForLake(value) {
 function bareId(id) {
   return isGdrUri(id) ? extractDocumentId(id) : id;
 }
-function randomKey(length = 12) {
-  const bytes = new Uint8Array(length);
-  return globalThis.crypto.getRandomValues(bytes), [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+const GUARD_OWNER = "robot:workflow-engine", GUARD_LIFTED_PREDICATE = "true";
+function resolveGuard(guard, instance, stageName, now) {
+  const ctx = { instance, now }, targets = resolveIdRefTargets(guard.match.idRefs, ctx);
+  if (targets === null) return null;
+  const resource = assertSingleResource(targets), types = resolveMatchTypes(targets, guard.match.types);
+  return { doc: compileGuard({
+    id: lakeGuardId({ instanceDocId: instance._id, guardName: guard.name }),
+    resourceType: resource.type,
+    resourceId: resource.id,
+    owner: GUARD_OWNER,
+    sourceInstanceId: instance._id,
+    sourceDefinition: instance.definition,
+    sourceStage: stageName,
+    name: guard.name,
+    ...guard.description !== void 0 ? { description: guard.description } : {},
+    match: {
+      ...types !== void 0 ? { types } : {},
+      idRefs: bareIdRefs(targets),
+      ...guard.match.idPatterns !== void 0 ? { idPatterns: guard.match.idPatterns } : {},
+      actions: guard.match.actions
+    },
+    predicate: guard.predicate ?? "",
+    metadata: resolveMetadata(guard.metadata, ctx)
+  }), routeGdr: targets[0].parsed };
 }
-async function evaluateFilter(args) {
-  const { filter, definition, snapshot, params } = args;
-  if (filter === void 0) return !0;
-  if (typeof filter == "string")
-    return runGroqAgainstSnapshot(filter, params, snapshot);
-  const predicate = (definition.predicates ?? []).find((p) => p.id === filter.ref);
-  if (predicate === void 0)
-    throw new Error(`Unknown predicate ref: ${filter.ref}`);
-  validatePredicateArgs(predicate, filter.args ?? {});
-  const merged = { ...params, ...filter.args };
-  return runGroqAgainstSnapshot(predicate.groq, merged, snapshot);
-}
-async function runGroqAgainstSnapshot(groq, params, snapshot) {
-  if (!groq.includes("*")) {
-    const tree2 = parse(groq, { params });
-    return !!await (await evaluate(tree2, { params })).get();
+async function upsertGuard(client, doc) {
+  if (!await client.getDocument(doc._id)) {
+    await client.create(doc);
+    return;
   }
-  const tree = parse(groq, { params });
-  return !!await (await evaluate(tree, { dataset: snapshot.docs, params })).get();
+  const { _id, _type, _rev, _createdAt, _updatedAt, ...body } = doc;
+  await client.patch(doc._id).set(body).commit();
 }
-function validatePredicateArgs(predicate, args) {
-  for (const param of predicate.params ?? [])
-    validatePredicateParam(predicate.id, param, args);
+function resolvedStageGuards(args) {
+  const stage = args.definition.stages.find((s) => s.name === args.stageName), out = [];
+  for (const guard of stage?.guards ?? []) {
+    const resolved = resolveGuard(guard, args.instance, args.stageName, args.now);
+    resolved !== null && out.push({ client: args.clientForGdr(resolved.routeGdr), doc: resolved.doc });
+  }
+  return out;
 }
-function validatePredicateParam(predicateId, param, args) {
-  if (!(param.id in args))
-    throw new Error(`Predicate "${predicateId}" requires param "${param.id}"`);
-  const value = args[param.id];
-  if (!matchesParamType(param.type, value))
-    throw new Error(
-      `Predicate "${predicateId}" param "${param.id}" must be of type ${param.type}; got ${describeValue(value)}`
-    );
-  if (param.enum && !param.enum.includes(value))
-    throw new Error(
-      `Predicate "${predicateId}" param "${param.id}" must be one of ${param.enum.join(", ")}; got "${String(value)}"`
-    );
+async function committedInstance(args) {
+  return await args.client.getDocument(args.instance._id) ?? void 0;
 }
-function matchesParamType(type, value) {
-  switch (type) {
-    case "string":
-      return typeof value == "string";
-    case "number":
-      return typeof value == "number";
-    case "boolean":
-      return typeof value == "boolean";
-    case "string[]":
-      return Array.isArray(value) && value.every((v2) => typeof v2 == "string");
-    case "reference":
-      return isGdr(value);
-  }
+async function deployStageGuards(args) {
+  const live = await committedInstance(args);
+  if (!(live === void 0 || live.currentStage !== args.stageName) && live.abortedAt === void 0)
+    for (const { client, doc } of resolvedStageGuards(args))
+      await upsertGuard(client, doc);
 }
-function describeValue(value) {
-  return Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
+async function retractStageGuards(args) {
+  const live = await committedInstance(args);
+  if (live !== void 0 && !(live.currentStage === args.stageName && live.abortedAt === void 0))
+    for (const { client, doc } of resolvedStageGuards(args))
+      await client.getDocument(doc._id) && await client.patch(doc._id).set({ predicate: GUARD_LIFTED_PREDICATE }).commit();
 }
-function buildSnapshot(args) {
-  const docs = [], knownIds = /* @__PURE__ */ new Set();
-  for (const { doc, resource } of args.docs) {
+function randomKey(length = 12) {
+  const bytes = new Uint8Array(length);
+  return globalThis.crypto.getRandomValues(bytes), [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
+async function evaluateCondition(args) {
+  const { condition, snapshot, params } = args;
+  return condition === void 0 ? !0 : !!await runGroq(condition, params, snapshot);
+}
+async function evaluatePredicates(args) {
+  const out = {};
+  for (const [name, groq] of Object.entries(args.predicates ?? {}))
+    out[name] = !!await runGroq(groq, args.params, args.snapshot);
+  return out;
+}
+async function runGroq(groq, params, snapshot) {
+  const tree = parse(groq, { params });
+  return (await evaluate(tree, { dataset: snapshot.docs, params })).get();
+}
+function buildSnapshot(args) {
+  const docs = [], knownIds = /* @__PURE__ */ new Set();
+  for (const { doc, resource } of args.docs) {
     const uri = gdrFromResource(resource, doc._id), restamped = restampForSnapshot(doc, uri, resource);
     docs.push(restamped), knownIds.add(uri);
   }
@@ -255,74 +534,112 @@ function rewriteRefsRecursive(value, resource) {
     k === "_ref" && typeof v2 == "string" ? out[k] = v2.includes(":") ? v2 : gdrFromResource(resource, v2) : out[k] = rewriteRefsRecursive(v2, resource);
   return out;
 }
+const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
+function parseDefinitionSnapshot(instance) {
+  try {
+    return JSON.parse(instance.definitionSnapshot);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse definitionSnapshot on instance "${instance._id}": ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+}
+function collectWatchRefs(instance) {
+  const stage = findOpenStageEntry(instance);
+  return [
+    gdrRef(instance.workflowResource, instance._id, instance._type),
+    ...instance.ancestors,
+    ...entryDocRefs(instance.state),
+    ...entryDocRefs(stage?.state),
+    ...entryReleaseRefs(instance.state),
+    ...entryReleaseRefs(stage?.state)
+  ];
+}
+function readsRaw(ref) {
+  return ref.type === WORKFLOW_INSTANCE_TYPE || ref.type === "system.release";
+}
+function contentReleaseName(args) {
+  const { ref, perspective } = args;
+  if (!readsRaw(ref) && Array.isArray(perspective))
+    return perspective.find((entry) => entry !== "drafts" && entry !== "published" && entry !== "raw");
+}
+function subscriptionDocument(ref) {
+  return { ...parseGdr(ref.id), globalDocumentId: ref.id, type: ref.type };
+}
+function subscriptionDocumentsForInstance(instance) {
+  const seen = /* @__PURE__ */ new Set(), documents = [];
+  for (const ref of collectWatchRefs(instance))
+    !isGdrUri(ref.id) || seen.has(ref.id) || (seen.add(ref.id), documents.push(subscriptionDocument(ref)));
+  return {
+    documents,
+    ...instance.perspective !== void 0 ? { perspective: instance.perspective } : {}
+  };
+}
+function entryDocRefs(state) {
+  return stateEntries(state).flatMap((entry) => entry._type === "doc.ref" ? isGdr(entry.value) ? [entry.value] : [] : entry._type === "doc.refs" ? Array.isArray(entry.value) ? entry.value.filter(isGdr) : [] : []);
+}
+function entryReleaseRefs(state) {
+  return stateEntries(state).flatMap(
+    (entry) => entry._type === "release.ref" && isGdr(entry.value) ? [entry.value] : []
+  );
+}
+function stateEntries(state) {
+  return Array.isArray(state) ? state.filter(
+    (entry) => !!entry && typeof entry == "object"
+  ) : [];
+}
 async function hydrateSnapshot(args) {
-  const { client, clientForGdr, instance, definition } = args, loaded = [], visited = /* @__PURE__ */ new Set(), loadInto = async (uri) => {
+  const { client, clientForGdr, instance, overlay } = args, loaded = [], visited = /* @__PURE__ */ new Set(), loadInto = async (uri, perspective) => {
     if (visited.has(uri)) return;
-    const fetched = await loadByGdr(client, clientForGdr, instance.workflowResource, uri);
+    const held = overlay?.get(uri);
+    if (held !== void 0) {
+      loaded.push(held), visited.add(uri);
+      return;
+    }
+    const fetched = await loadByGdr(
+      client,
+      clientForGdr,
+      instance.workflowResource,
+      uri,
+      perspective
+    );
     fetched && (loaded.push(fetched), visited.add(uri));
   };
   loaded.push({ doc: instance, resource: instance.workflowResource }), visited.add(selfGdr(instance));
-  for (const ancestor of instance.ancestors)
-    await loadInto(ancestor.id);
-  for (const uri of collectSlotDocUris(instance.state))
-    await loadInto(uri);
-  if (definition) {
-    const stageEntry = instance.stages.find(
-      (s) => s.id === instance.currentStageId && s.exitedAt === void 0
-    );
-    for (const uri of collectSlotDocUris(stageEntry?.state))
-      await loadInto(uri);
-  }
+  for (const ref of collectWatchRefs(instance))
+    await loadInto(ref.id, readsRaw(ref) ? void 0 : instance.perspective);
   return buildSnapshot({ docs: loaded });
 }
-async function loadByGdr(defaultClient, clientForGdr, defaultResource, uri) {
+async function loadByGdr(defaultClient, clientForGdr, defaultResource, uri, perspective) {
   let parsed;
   try {
     parsed = parseGdr(uri);
   } catch {
-    const doc2 = await defaultClient.getDocument(uri);
+    const doc2 = await readDoc(defaultClient, uri, perspective);
     return doc2 ? { doc: doc2, resource: defaultResource } : null;
   }
-  const doc = await clientForGdr(parsed).getDocument(parsed.documentId);
+  const routed = clientForGdr(parsed), doc = await readDoc(routed, parsed.documentId, perspective);
   return doc ? { doc, resource: resourceFromParsed(parsed) } : null;
 }
+async function readDoc(client, id, perspective) {
+  return perspective === void 0 ? await client.getDocument(id) ?? null : await client.fetch("*[_id == $id][0]", { id }, { perspective }) ?? null;
+}
 function resourceFromParsed(parsed) {
   return parsed.scheme === "dataset" ? { type: "dataset", id: `${parsed.projectId}.${parsed.dataset}` } : { type: parsed.scheme, id: parsed.resourceId ?? "" };
 }
-function collectSlotDocUris(resolvedStateSlots) {
-  return Array.isArray(resolvedStateSlots) ? resolvedStateSlots.flatMap(slotDocUris) : [];
-}
-function slotDocUris(slot) {
-  if (!slot || typeof slot != "object") return [];
-  const s = slot;
-  if (s._type === "workflow.state.doc.ref") {
-    const v2 = s.value, id = refId(v2);
-    return id !== void 0 ? [id] : [];
-  }
-  if (s._type === "workflow.state.doc.refs") {
-    const v2 = s.value;
-    return Array.isArray(v2) ? v2.map(refId).filter((id) => id !== void 0) : [];
-  }
-  return [];
-}
-function refId(ref) {
-  return ref && typeof ref.id == "string" ? ref.id : void 0;
-}
-function getPath(value, path) {
-  let current = value;
-  for (const part of path.split(".")) {
-    if (current == null || typeof current != "object") return;
-    current = current[part];
-  }
-  return current;
+function collectEntryDocUris(resolvedStateEntries) {
+  return entryDocRefs(resolvedStateEntries).map((ref) => ref.id);
 }
-class SlotValueShapeError extends Error {
-  slotType;
-  slotId;
+class StateValueShapeError extends Error {
+  entryType;
+  entryName;
   issues;
   constructor(args) {
     const issueText = args.issues.join("; ");
-    super(`Slot ${args.mode} shape invalid for "${args.slotId}" (${args.slotType}): ${issueText}`), this.name = "SlotValueShapeError", this.slotType = args.slotType, this.slotId = args.slotId, this.issues = args.issues;
+    super(
+      `State entry ${args.mode} shape invalid for "${args.entryName}" (${args.entryType}): ${issueText}`
+    ), this.name = "StateValueShapeError", this.entryType = args.entryType, this.entryName = args.entryName, this.issues = args.issues;
   }
 }
 const GdrShape = v.looseObject({
@@ -344,8 +661,8 @@ const GdrShape = v.looseObject({
   roles: v.optional(v.array(v.string())),
   onBehalfOf: v.optional(v.string())
 }), AssigneeShape = v.union([
-  v.looseObject({ kind: v.literal("user"), id: v.pipe(v.string(), v.minLength(1)) }),
-  v.looseObject({ kind: v.literal("role"), role: v.pipe(v.string(), v.minLength(1)) })
+  v.looseObject({ type: v.literal("user"), id: v.pipe(v.string(), v.minLength(1)) }),
+  v.looseObject({ type: v.literal("role"), role: v.pipe(v.string(), v.minLength(1)) })
 ]), ChecklistItemShape = v.looseObject({
   label: v.pipe(v.string(), v.minLength(1)),
   done: v.boolean(),
@@ -367,59 +684,59 @@ const GdrShape = v.looseObject({
     v.check((s) => !Number.isNaN(Date.parse(s)), "must be an ISO-8601 datetime string")
   )
 ]), NullableUrl = NullableString, valueSchemas = {
-  "workflow.state.doc.ref": v.union([v.null(), GdrShape]),
-  "workflow.state.doc.refs": v.array(GdrShape),
-  "workflow.state.release.ref": v.union([v.null(), ReleaseRefShape]),
-  "workflow.state.query": v.any(),
-  "workflow.state.value.string": NullableString,
-  "workflow.state.value.url": NullableUrl,
-  "workflow.state.value.number": NullableNumber,
-  "workflow.state.value.boolean": NullableBoolean,
-  "workflow.state.value.dateTime": NullableDateTime,
-  "workflow.state.value.actor": v.union([v.null(), ActorShape]),
-  "workflow.state.checklist": v.array(ChecklistItemShape),
-  "workflow.state.notes": v.array(NoteItemShape),
-  "workflow.state.assignees": v.array(AssigneeShape)
+  "doc.ref": v.union([v.null(), GdrShape]),
+  "doc.refs": v.array(GdrShape),
+  "release.ref": v.union([v.null(), ReleaseRefShape]),
+  query: v.any(),
+  "value.string": NullableString,
+  "value.url": NullableUrl,
+  "value.number": NullableNumber,
+  "value.boolean": NullableBoolean,
+  "value.dateTime": NullableDateTime,
+  "value.actor": v.union([v.null(), ActorShape]),
+  checklist: v.array(ChecklistItemShape),
+  notes: v.array(NoteItemShape),
+  assignees: v.array(AssigneeShape)
 }, itemSchemas = {
-  "workflow.state.doc.refs": GdrShape,
-  "workflow.state.checklist": ChecklistItemShape,
-  "workflow.state.notes": NoteItemShape,
-  "workflow.state.assignees": AssigneeShape
+  "doc.refs": GdrShape,
+  checklist: ChecklistItemShape,
+  notes: NoteItemShape,
+  assignees: AssigneeShape
 };
-function isAppendable(slotType) {
-  return slotType in itemSchemas;
+function isAppendable(entryType) {
+  return entryType in itemSchemas;
 }
-function validateSlotValue(args) {
-  const schema = valueSchemas[args.slotType];
+function validateStateValue(args) {
+  const schema = valueSchemas[args.entryType];
   if (schema === void 0)
-    throw new SlotValueShapeError({
-      slotType: args.slotType,
-      slotId: args.slotId,
-      issues: [`unknown slot type ${args.slotType}`],
+    throw new StateValueShapeError({
+      entryType: args.entryType,
+      entryName: args.entryName,
+      issues: [`unknown state entry type ${args.entryType}`],
       mode: "value"
     });
   const result = v.safeParse(schema, args.value);
   if (!result.success)
-    throw new SlotValueShapeError({
-      slotType: args.slotType,
-      slotId: args.slotId,
+    throw new StateValueShapeError({
+      entryType: args.entryType,
+      entryName: args.entryName,
       issues: formatIssues(result.issues),
       mode: "value"
     });
 }
-function validateSlotAppendItem(args) {
-  if (!isAppendable(args.slotType))
-    throw new SlotValueShapeError({
-      slotType: args.slotType,
-      slotId: args.slotId,
-      issues: [`slot type ${args.slotType} does not support append`],
+function validateStateAppendItem(args) {
+  if (!isAppendable(args.entryType))
+    throw new StateValueShapeError({
+      entryType: args.entryType,
+      entryName: args.entryName,
+      issues: [`state entry type ${args.entryType} does not support append`],
       mode: "item"
     });
-  const schema = itemSchemas[args.slotType], result = v.safeParse(schema, args.item);
+  const schema = itemSchemas[args.entryType], result = v.safeParse(schema, args.item);
   if (!result.success)
-    throw new SlotValueShapeError({
-      slotType: args.slotType,
-      slotId: args.slotId,
+    throw new StateValueShapeError({
+      entryType: args.entryType,
+      entryName: args.entryName,
       issues: formatIssues(result.issues),
       mode: "item"
     });
@@ -430,115 +747,115 @@ function formatIssues(issues) {
     return `${keys.length > 0 ? `at ${keys.join(".")}: ` : ""}${i.message}`;
   });
 }
-function derivePerspectiveFromState(slots) {
-  if (slots !== void 0) {
-    for (const slot of slots)
-      if (slot._type === "workflow.state.release.ref" && slot.value !== null) {
-        const releaseName = slot.value.releaseName;
+function derivePerspectiveFromState(entries) {
+  if (entries !== void 0) {
+    for (const entry of entries)
+      if (entry._type === "release.ref" && entry.value !== null) {
+        const releaseName = entry.value.releaseName;
         if (typeof releaseName == "string" && releaseName.length > 0)
           return [releaseName];
       }
   }
 }
 async function resolveDeclaredState(args) {
-  const { slotDefs, initialState, ctx, randomKey: randomKey2 } = args;
-  if (slotDefs === void 0 || slotDefs.length === 0) return [];
+  const { entryDefs, initialState, ctx, randomKey: randomKey2 } = args;
+  if (entryDefs === void 0 || entryDefs.length === 0) return [];
   const out = [];
-  for (const slot of slotDefs) {
+  for (const entry of entryDefs) {
     const scopedCtx = { ...ctx, resolvedState: out };
-    out.push(await resolveOneSlot(slot, initialState, scopedCtx, randomKey2));
+    out.push(await resolveOneEntry(entry, initialState, scopedCtx, randomKey2));
   }
   return out;
 }
 const ARRAY_SLOT_TYPES = /* @__PURE__ */ new Set([
-  "workflow.state.doc.refs",
-  "workflow.state.checklist",
-  "workflow.state.notes",
-  "workflow.state.assignees"
+  "doc.refs",
+  "checklist",
+  "notes",
+  "assignees"
 ]);
-function defaultSlotValue(slotType) {
-  return ARRAY_SLOT_TYPES.has(slotType) ? [] : null;
+function defaultEntryValue(entryType) {
+  return ARRAY_SLOT_TYPES.has(entryType) ? [] : null;
 }
-function resolveInitValue(slot, initialState, defaultValue) {
-  const initMatch = initialState.find((s) => s.id === slot.id && s.type === slot.type);
-  return initMatch === void 0 ? defaultValue : (assertInitValueShape(slot, initMatch.value), initMatch.value);
+function resolveInitValue(entry, initialState, defaultValue) {
+  const initMatch = initialState.find((s) => s.name === entry.name && s.type === entry.type);
+  return initMatch === void 0 ? defaultValue : (assertInitValueShape(entry, initMatch.value), initMatch.value);
 }
 function resolveStateReadValue(source, ctx, defaultValue) {
-  const target = (source.scope === "workflow" ? ctx.workflowState ?? [] : ctx.resolvedState ?? []).find((s) => s.id === source.slotId), targetValue = target === void 0 ? void 0 : target.value;
+  const target = (source.scope === "workflow" ? ctx.workflowState ?? [] : ctx.resolvedState ?? []).find((s) => s.name === source.state), targetValue = target === void 0 ? void 0 : target.value;
   return (source.path !== void 0 ? getPath(targetValue, source.path) : targetValue) ?? defaultValue;
 }
-async function resolveQueryValue(slot, source, ctx, client, defaultValue) {
+async function resolveQueryValue(entry, source, ctx, client, defaultValue) {
   const params = paramsForLake({
     self: ctx.selfId ?? null,
     state: stateMapFromResolved(ctx.resolvedState ?? []),
-    stage: ctx.stageId ?? null,
-    task: ctx.taskId ?? null,
+    stage: ctx.stageName ?? null,
+    task: ctx.taskName ?? null,
     now: ctx.now,
     engineTags: ctx.tags ?? []
   });
   try {
     const fetchOptions = ctx.perspective !== void 0 ? { perspective: ctx.perspective } : void 0, result = await client.fetch(source.query, params, fetchOptions);
-    return normalizeQueryResult(slot.type, result, ctx.workflowResource) ?? defaultValue;
+    return normalizeQueryResult(entry.type, result, ctx.workflowResource) ?? defaultValue;
   } catch (err) {
     throw new Error(
-      `Failed to resolve query slot "${slot.id}" (${slot.type}): ${err instanceof Error ? err.message : String(err)}`,
+      `Failed to resolve query entry "${entry.name}" (${entry.type}): ${err instanceof Error ? err.message : String(err)}`,
       { cause: err }
     );
   }
 }
-async function resolveSlotValue(slot, initialState, ctx, defaultValue) {
-  const source = slot.source;
-  return source.kind === "init" ? resolveInitValue(slot, initialState, defaultValue) : source.kind === "literal" ? source.value ?? defaultValue : source.kind === "stateRead" ? resolveStateReadValue(source, ctx, defaultValue) : source.kind === "query" && ctx.client !== void 0 ? resolveQueryValue(slot, source, ctx, ctx.client, defaultValue) : defaultValue;
+async function resolveEntryValue(entry, initialState, ctx, defaultValue) {
+  const source = entry.source;
+  return source.type === "init" ? resolveInitValue(entry, initialState, defaultValue) : source.type === "literal" ? source.value ?? defaultValue : source.type === "stateRead" ? resolveStateReadValue(source, ctx, defaultValue) : source.type === "query" && ctx.client !== void 0 ? resolveQueryValue(entry, source, ctx, ctx.client, defaultValue) : defaultValue;
 }
-function buildResolvedSlot(slot, value, _key, now) {
-  const titleProp = slot.title !== void 0 ? { title: slot.title } : {}, descriptionProp = slot.description !== void 0 ? { description: slot.description } : {};
-  return slot.type === "workflow.state.query" ? {
+function buildResolvedEntry(entry, value, _key, now) {
+  const titleProp = entry.title !== void 0 ? { title: entry.title } : {}, descriptionProp = entry.description !== void 0 ? { description: entry.description } : {};
+  return entry.type === "query" ? {
     _key,
-    _type: "workflow.state.query",
-    id: slot.id,
+    _type: "query",
+    name: entry.name,
     ...titleProp,
     ...descriptionProp,
     value,
     resolvedAt: now
   } : {
     _key,
-    _type: slot.type,
-    id: slot.id,
+    _type: entry.type,
+    name: entry.name,
     ...titleProp,
     ...descriptionProp,
     value
   };
 }
-async function resolveOneSlot(slot, initialState, ctx, randomKey2) {
-  const defaultValue = defaultSlotValue(slot.type), value = await resolveSlotValue(slot, initialState, ctx, defaultValue);
-  return validateSlotValue({ slotType: slot.type, slotId: slot.id, value }), buildResolvedSlot(slot, value, randomKey2(), ctx.now);
+async function resolveOneEntry(entry, initialState, ctx, randomKey2) {
+  const defaultValue = defaultEntryValue(entry.type), value = await resolveEntryValue(entry, initialState, ctx, defaultValue);
+  return validateStateValue({ entryType: entry.type, entryName: entry.name, value }), buildResolvedEntry(entry, value, randomKey2(), ctx.now);
 }
-function stateMapFromResolved(slots) {
+function stateMapFromResolved(entries) {
   const out = {};
-  for (const s of slots) out[s.id] = s;
+  for (const s of entries) out[s.name] = s.value;
   return out;
 }
-function assertInitValueShape(slot, value) {
-  if (slot.type === "workflow.state.doc.ref") {
-    assertGdrShape(value, `state slot "${slot.id}" (workflow.state.doc.ref)`);
+function assertInitValueShape(entry, value) {
+  if (entry.type === "doc.ref") {
+    assertGdrShape(value, `state entry "${entry.name}" (doc.ref)`);
     return;
   }
-  if (slot.type === "workflow.state.release.ref") {
-    assertGdrShape(value, `state slot "${slot.id}" (workflow.state.release.ref)`);
+  if (entry.type === "release.ref") {
+    assertGdrShape(value, `state entry "${entry.name}" (release.ref)`);
     const v2 = value;
     if (typeof v2.releaseName != "string" || v2.releaseName.length === 0)
       throw new Error(
-        `Invalid init value for state slot "${slot.id}" (workflow.state.release.ref): \`releaseName\` must be a non-empty string. Got ${JSON.stringify(v2.releaseName)}.`
+        `Invalid init value for state entry "${entry.name}" (release.ref): \`releaseName\` must be a non-empty string. Got ${JSON.stringify(v2.releaseName)}.`
       );
     return;
   }
-  if (slot.type === "workflow.state.doc.refs") {
+  if (entry.type === "doc.refs") {
     if (!Array.isArray(value))
       throw new Error(
-        `Invalid init value for state slot "${slot.id}" (workflow.state.doc.refs): expected an array of GDRs, got ${typeof value}.`
+        `Invalid init value for state entry "${entry.name}" (doc.refs): expected an array of GDRs, got ${typeof value}.`
       );
     for (const [i, item] of value.entries())
-      assertGdrShape(item, `state slot "${slot.id}" (workflow.state.doc.refs) item [${i}]`);
+      assertGdrShape(item, `state entry "${entry.name}" (doc.refs) item [${i}]`);
   }
 }
 function assertGdrShape(value, context) {
@@ -556,8 +873,8 @@ function assertGdrShape(value, context) {
       `Invalid GDR for ${context}: \`type\` (schema name) must be a non-empty string. Got ${JSON.stringify(v2.type)}.`
     );
 }
-function normalizeQueryResult(slotType, raw, workflowResource) {
-  return raw == null ? raw : slotType === "workflow.state.doc.ref" ? coerceToGdr(raw, workflowResource) : slotType === "workflow.state.doc.refs" ? Array.isArray(raw) ? raw.map((item) => coerceToGdr(item, workflowResource)).filter((v2) => v2 !== null) : [] : raw;
+function normalizeQueryResult(entryType, raw, workflowResource) {
+  return raw == null ? raw : entryType === "doc.ref" ? coerceToGdr(raw, workflowResource) : entryType === "doc.refs" ? Array.isArray(raw) ? raw.map((item) => coerceToGdr(item, workflowResource)).filter((v2) => v2 !== null) : [] : raw;
 }
 function toGdrUri(docId, workflowResource) {
   return isGdrUri(docId) ? docId : gdrFromResource(workflowResource, docId);
@@ -582,15 +899,36 @@ async function loadContext(client, instanceId, options) {
   const instance = await client.getDocument(instanceId);
   if (!instance)
     throw new Error(`Workflow instance ${instanceId} not found`);
-  const definition = JSON.parse(instance.definitionSnapshot), clientForGdr = options?.clientForGdr ?? (() => client), clock = options?.clock ?? wallClock, snapshot = await hydrateSnapshot({ client, clientForGdr, instance, definition });
+  const definition = parseDefinitionSnapshot(instance), clientForGdr = options?.clientForGdr ?? (() => client), clock = options?.clock ?? wallClock, snapshot = await hydrateSnapshot({
+    client,
+    clientForGdr,
+    instance,
+    ...options?.overlay !== void 0 ? { overlay: options.overlay } : {}
+  });
   return { client, clientForGdr, clock, now: clock(), instance, definition, snapshot };
 }
-function ctxEvaluateFilter(ctx, filter) {
-  return evaluateFilter({
-    filter,
-    definition: ctx.definition,
+async function ctxConditionParams(ctx, opts) {
+  const base = buildParams({ instance: ctx.instance, now: ctx.now, snapshot: ctx.snapshot }), state = {
+    ...base.state,
+    ...scopedStateOverlay(ctx.instance, ctx.snapshot, opts?.taskName)
+  }, params = {
+    ...base,
+    state,
+    actor: opts?.actor,
+    assigned: opts?.taskName !== void 0 ? assignedFor(ctx.instance, opts.taskName, opts?.actor) : !1,
+    ...opts?.vars
+  };
+  return { ...await evaluatePredicates({
+    predicates: ctx.definition.predicates,
+    snapshot: ctx.snapshot,
+    params
+  }), ...params };
+}
+async function ctxEvaluateCondition(ctx, condition, opts) {
+  return condition === void 0 ? !0 : evaluateCondition({
+    condition,
     snapshot: ctx.snapshot,
-    params: buildParams(ctx.instance, ctx.now)
+    params: await ctxConditionParams(ctx, opts)
   });
 }
 async function buildEngineContext(args) {
@@ -602,167 +940,94 @@ async function buildEngineContext(args) {
     now: clock(),
     instance,
     definition,
-    snapshot: await hydrateSnapshot({ client, clientForGdr, instance, definition })
+    snapshot: await hydrateSnapshot({ client, clientForGdr, instance })
   };
 }
-function findStage(definition, stageId) {
-  const stage = definition.stages.find((s) => s.id === stageId);
+function findStage(definition, stageName) {
+  const stage = definition.stages.find((s) => s.name === stageName);
   if (stage === void 0)
-    throw new Error(`Stage "${stageId}" not found in definition ${definition.workflowId}`);
+    throw new Error(`Stage "${stageName}" not found in definition ${definition.name}`);
   return stage;
 }
-async function resolveStageStateSlots(args) {
+async function resolveStageStateEntries(args) {
   const { client, instance, stage, now, initialState } = args;
   return resolveDeclaredState({
-    slotDefs: stage.state,
+    entryDefs: stage.state,
     initialState: initialState ?? [],
     ctx: {
       client,
       now,
       selfId: instance._id,
       tags: instance.tags ?? [],
-      stageId: stage.id,
+      stageName: stage.name,
       workflowResource: instance.workflowResource,
-      // Allow stage-scope slots' `source: { kind: "stateRead", scope:
-      // "workflow", ... }` to see the already-resolved workflow-scope
-      // state.
+      // Allow stage-scope entries' `source: { type: "stateRead", scope:
+      // "workflow", ... }` to see the already-resolved workflow-scope state.
       workflowState: instance.state ?? [],
       ...instance.perspective !== void 0 ? { perspective: instance.perspective } : {}
     },
     randomKey
   });
 }
-async function resolveTaskStateSlots(args) {
+async function resolveTaskStateEntries(args) {
   const { client, instance, stage, task, now } = args;
   return resolveDeclaredState({
-    slotDefs: task.state,
+    entryDefs: task.state,
     initialState: [],
     ctx: {
       client,
       now,
       selfId: instance._id,
       tags: instance.tags ?? [],
-      stageId: stage.id,
+      stageName: stage.name,
       workflowResource: instance.workflowResource,
-      taskId: task.id,
+      taskName: task.name,
       workflowState: instance.state ?? [],
       ...instance.perspective !== void 0 ? { perspective: instance.perspective } : {}
     },
     randomKey
   });
 }
-function readStateSlot(instance, scope, slotId, stageId, taskId) {
-  if (scope === "workflow")
-    return slotValue$1(instance.state?.find((s) => s.id === slotId));
-  const stageEntry = instance.stages.find(
-    (s) => s.id === (stageId ?? instance.currentStageId) && s.exitedAt === void 0
-  );
-  if (stageEntry === void 0) return;
-  if (scope === "stage")
-    return slotValue$1(stageEntry.state?.find((s) => s.id === slotId));
-  const taskEntry = stageEntry.tasks.find((t) => t.id === taskId);
-  return slotValue$1(taskEntry?.state?.find((s) => s.id === slotId));
-}
-function slotValue$1(slot) {
-  if (slot != null && typeof slot == "object")
-    return slot.value;
-}
-function resolveStaticSource(src, ctx) {
-  switch (src.source) {
-    case "literal":
-      return { handled: !0, value: src.value };
-    case "param":
-      return { handled: !0, value: ctx.params?.[src.paramId] };
-    case "actor":
-      return { handled: !0, value: ctx.actor };
-    case "now":
-      return { handled: !0, value: ctx.now };
-    default:
-      return { handled: !1 };
-  }
-}
-function resolveSource(src, ctx) {
-  const staticValue = resolveStaticSource(src, ctx);
-  if (staticValue.handled) return staticValue.value;
-  switch (src.source) {
-    case "self":
-      return ctx.instance._id;
-    case "stageId":
-      return ctx.stageId ?? ctx.instance.currentStageId;
-    case "stateRead":
-      return resolveStateRead(src, ctx);
-    case "effectOutput":
-      return resolveEffectOutput(src, ctx);
-    case "object":
-      return resolveObject(src, ctx);
-    case "row":
-    case "parentState":
-      return;
-    default:
-      return;
-  }
-}
-function resolveStateRead(src, ctx) {
-  const value = readStateSlot(ctx.instance, src.scope, src.slotId, ctx.stageId, ctx.taskId);
-  return src.path !== void 0 ? getPath(value, src.path) : value;
-}
-function resolveEffectOutput(src, ctx) {
-  const entry = ctx.instance.effectsContext.find((e) => e.id === src.contextId);
-  if (entry === void 0) return null;
-  const value = src.path !== void 0 ? getPath(entry.value, src.path) : entry.value;
-  return value === void 0 ? null : value;
-}
-function resolveObject(src, ctx) {
-  const out = {};
-  for (const [field, fieldSrc] of Object.entries(src.fields))
-    out[field] = resolveSource(fieldSrc, ctx);
-  return out;
-}
 async function resolveBindings(args) {
-  const { bindings, staticInput, instance, now, params, actor } = args, resolved = {};
-  if (bindings) {
-    const ctx = {
-      instance,
-      now,
-      ...params !== void 0 ? { params } : {},
-      ...actor !== void 0 ? { actor } : {}
-    };
-    for (const [key, src] of Object.entries(bindings))
-      resolved[key] = resolveSource(src, ctx);
-  }
-  return { ...resolved, ...staticInput };
+  const resolved = {};
+  for (const [key, groq] of Object.entries(args.bindings ?? {}))
+    resolved[key] = await runGroq(groq, args.params, args.snapshot);
+  return { ...resolved, ...args.staticInput };
 }
-function effectsContextEntry(id, value) {
+function effectsContextEntry(name, value) {
   const _key = randomKey();
-  return typeof value == "string" ? { _key, _type: "effectsContext.string", id, value } : typeof value == "number" ? { _key, _type: "effectsContext.number", id, value } : typeof value == "boolean" ? { _key, _type: "effectsContext.boolean", id, value } : { _key, _type: "effectsContext.ref", id, value };
+  return typeof value == "string" ? { _key, _type: "effectsContext.string", name, value } : typeof value == "number" ? { _key, _type: "effectsContext.number", name, value } : typeof value == "boolean" ? { _key, _type: "effectsContext.boolean", name, value } : { _key, _type: "effectsContext.ref", name, value };
+}
+function effectsContextJsonEntry(name, value) {
+  return { _key: randomKey(), _type: "effectsContext.json", name, value: JSON.stringify(value) };
 }
 function buildInstanceBase(args) {
   const { id, now, actor, perspective } = args;
   return {
     _id: id,
-    _type: "workflow.instance",
+    _type: WORKFLOW_INSTANCE_TYPE,
     _rev: "",
     _createdAt: now,
     _updatedAt: now,
     tags: args.tags,
     workflowResource: args.workflowResource,
-    workflowId: args.workflowId,
+    definition: args.definitionName,
     pinnedVersion: args.pinnedVersion,
     definitionSnapshot: JSON.stringify(args.definition),
     state: args.state,
     effectsContext: args.effectsContext,
     ancestors: args.ancestors,
     ...perspective !== void 0 ? { perspective } : {},
-    currentStageId: args.initialStageId,
+    currentStage: args.initialStage,
     stages: [],
     pendingEffects: [],
     effectHistory: [],
     history: [
       {
         _key: randomKey(),
-        _type: "workflow.history.stageEntered",
+        _type: "stageEntered",
         at: now,
-        stageId: args.initialStageId,
+        stage: args.initialStage,
         ...actor !== void 0 ? { actor } : {}
       }
     ],
@@ -770,188 +1035,15 @@ function buildInstanceBase(args) {
     lastChangedAt: now
   };
 }
-const GUARD_DOC_TYPE = "temp.system.guard";
-class MutationGuardDeniedError extends Error {
-  denied;
-  documentId;
-  action;
-  constructor(args) {
-    const ids = args.denied.map((d) => d.guardId).join(", ");
-    super(`Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, this.action = args.action;
-  }
-}
-function lakeGuardId(args) {
-  return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.stageId}.${args.index}`;
-}
-function compileGuard(args) {
-  return {
-    _id: args.id,
-    _type: GUARD_DOC_TYPE,
-    resourceType: args.resourceType,
-    resourceId: args.resourceId,
-    owner: args.owner,
-    sourceInstanceId: args.sourceInstanceId,
-    sourceDefinitionId: args.sourceDefinitionId,
-    sourceStageId: args.sourceStageId,
-    ...args.name !== void 0 ? { name: args.name } : {},
-    ...args.description !== void 0 ? { description: args.description } : {},
-    match: args.match,
-    predicate: args.predicate,
-    metadata: args.metadata
-  };
-}
-function toGroqJsPredicate(predicate) {
-  return predicate.replace(new RegExp("(?<!\\$)\\bguard\\.", "g"), "$guard.").replace(new RegExp("(?<!\\$)\\bmutation\\.", "g"), "$mutation.");
-}
-function globMatch(pattern, value) {
-  if (!pattern.includes("*")) return pattern === value;
-  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`).test(value);
-}
-function guardMatches(guard, doc, action) {
-  const m = guard.match;
-  if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type)))
-    return !1;
-  if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
-    const byRef = m.idRefs?.includes(doc.id) ?? !1, byPattern = m.idPatterns?.some((p) => globMatch(p, doc.id)) ?? !1;
-    if (!byRef && !byPattern) return !1;
-  }
-  return !0;
-}
-async function evaluateMutationGuard(args) {
-  const { guard, context } = args;
-  if (guard.predicate === "") return !1;
-  const params = { guard, mutation: { action: context.action } };
-  try {
-    const tree = parse(toGroqJsPredicate(guard.predicate), { mode: "delta", params });
-    return await (await evaluate(tree, {
-      before: context.before,
-      after: context.after,
-      params,
-      ...context.identity !== void 0 ? { identity: context.identity } : {}
-    })).get() === !0;
-  } catch {
-    return !1;
-  }
-}
-async function denyingGuards(args) {
-  const { guards, doc, context } = args, denied = [];
-  for (const guard of guards)
-    guardMatches(guard, doc, context.action) && (await evaluateMutationGuard({ guard, context }) || denied.push(guard));
-  return denied;
-}
-function resourceOf(p) {
-  return p.scheme === "dataset" ? { type: "dataset", id: `${p.projectId}.${p.dataset}` } : { type: p.scheme, id: p.resourceId ?? "" };
-}
-function resolveIdRefTarget(src, ctx) {
-  const value = resolveSource(src, ctx);
-  if (typeof value == "string" && isGdrUri(value))
-    return { parsed: parseGdr(value) };
-  if (value && typeof value == "object") {
-    const v2 = value;
-    if (typeof v2.id == "string" && isGdrUri(v2.id))
-      return typeof v2.type == "string" ? { parsed: parseGdr(v2.id), type: v2.type } : { parsed: parseGdr(v2.id) };
-  }
-  return null;
-}
-function resolveIdRefTargets(idRefs, ctx) {
-  const targets = [];
-  for (const src of idRefs ?? []) {
-    const target = resolveIdRefTarget(src, ctx);
-    if (target === null) return null;
-    targets.push(target);
-  }
-  return targets.length === 0 ? null : targets;
-}
-function assertSingleResource(targets) {
-  const resource = resourceOf(targets[0].parsed);
-  for (const g of targets) {
-    const r = resourceOf(g.parsed);
-    if (r.type !== resource.type || r.id !== resource.id)
-      throw new Error(
-        `Guard targets span multiple resources (${resource.type}:${resource.id} vs ${r.type}:${r.id}); a guard is single-resource.`
-      );
-  }
-  return resource;
-}
-function bareIdRefs(targets) {
-  return targets.flatMap((g) => [g.parsed.documentId, `drafts.${g.parsed.documentId}`]);
-}
-function resolveMatchTypes(targets, authorTypes) {
-  if (authorTypes !== void 0) return authorTypes;
-  const inferred = [...new Set(targets.map((g) => g.type).filter((t) => !!t))];
-  return inferred.length > 0 ? inferred : void 0;
-}
-function resolveMetadata(metadata, ctx) {
-  const out = {};
-  for (const [k, src] of Object.entries(metadata ?? {}))
-    out[k] = resolveSource(src, ctx);
-  return out;
-}
-const GUARD_OWNER = "robot:workflow-engine", GUARD_LIFTED_PREDICATE = "true";
-function resolveGuard(guard, index, instance, stageId, now) {
-  const ctx = { instance, stageId, now }, targets = resolveIdRefTargets(guard.match.idRefs, ctx);
-  if (targets === null) return null;
-  const resource = assertSingleResource(targets), types = resolveMatchTypes(targets, guard.match.types);
-  return { doc: compileGuard({
-    id: lakeGuardId({ instanceDocId: instance._id, stageId, index }),
-    resourceType: resource.type,
-    resourceId: resource.id,
-    owner: GUARD_OWNER,
-    sourceInstanceId: instance._id,
-    sourceDefinitionId: instance.workflowId,
-    sourceStageId: stageId,
-    ...guard.name !== void 0 ? { name: guard.name } : {},
-    ...guard.description !== void 0 ? { description: guard.description } : {},
-    match: {
-      ...types !== void 0 ? { types } : {},
-      idRefs: bareIdRefs(targets),
-      ...guard.match.idPatterns !== void 0 ? { idPatterns: guard.match.idPatterns } : {},
-      actions: guard.match.actions
-    },
-    predicate: guard.predicate ?? "",
-    metadata: resolveMetadata(guard.metadata, ctx)
-  }), routeGdr: targets[0].parsed };
-}
-async function upsertGuard(client, doc) {
-  if (!await client.getDocument(doc._id)) {
-    await client.create(doc);
-    return;
-  }
-  const { _id, _type, _rev, _createdAt, _updatedAt, ...body } = doc;
-  await client.patch(doc._id).set(body).commit();
-}
-function resolvedStageGuards(args) {
-  const stage = args.definition.stages.find((s) => s.id === args.stageId), out = [];
-  for (const [index, guard] of (stage?.guards ?? []).entries()) {
-    const resolved = resolveGuard(guard, index, args.instance, args.stageId, args.now);
-    resolved !== null && out.push({ client: args.clientForGdr(resolved.routeGdr), doc: resolved.doc });
-  }
-  return out;
-}
-async function committedStageId(args) {
-  return (await args.client.getDocument(args.instance._id))?.currentStageId;
-}
-async function deployStageGuards(args) {
-  if (await committedStageId(args) === args.stageId)
-    for (const { client, doc } of resolvedStageGuards(args))
-      await upsertGuard(client, doc);
-}
-async function retractStageGuards(args) {
-  const live = await committedStageId(args);
-  if (!(live === void 0 || live === args.stageId))
-    for (const { client, doc } of resolvedStageGuards(args))
-      await client.getDocument(doc._id) && await client.patch(doc._id).set({ predicate: GUARD_LIFTED_PREDICATE }).commit();
-}
 class ActionParamsInvalidError extends Error {
   action;
-  taskId;
+  task;
   issues;
   constructor(args) {
-    const lines = args.issues.map((i) => `  - ${i.paramId}: ${i.reason}`).join(`
+    const lines = args.issues.map((i) => `  - ${i.param}: ${i.reason}`).join(`
 `);
-    super(`Action "${args.action}" on task "${args.taskId}" rejected: invalid params
-${lines}`), this.name = "ActionParamsInvalidError", this.action = args.action, this.taskId = args.taskId, this.issues = args.issues;
+    super(`Action "${args.action}" on task "${args.task}" rejected: invalid params
+${lines}`), this.name = "ActionParamsInvalidError", this.action = args.action, this.task = args.task, this.issues = args.issues;
   }
 }
 class WorkflowStateDivergedError extends Error {
@@ -970,13 +1062,13 @@ class WorkflowStateDivergedError extends Error {
 const CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS = 3;
 class ConcurrentFireActionError extends Error {
   instanceId;
-  taskId;
+  task;
   action;
   attempts;
   constructor(args) {
     super(
-      `Action "${args.action}" on task "${args.taskId}" (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running \u2014 a concurrent writer kept committing first. Re-read and retry, or investigate a write storm on this instance.`
-    ), this.name = "ConcurrentFireActionError", this.instanceId = args.instanceId, this.taskId = args.taskId, this.action = args.action, this.attempts = args.attempts;
+      `Action "${args.action}" on task "${args.task}" (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running \u2014 a concurrent writer kept committing first. Re-read and retry, or investigate a write storm on this instance.`
+    ), this.name = "ConcurrentFireActionError", this.instanceId = args.instanceId, this.task = args.task, this.action = args.action, this.attempts = args.attempts;
   }
 }
 function isRevisionConflict(error) {
@@ -984,38 +1076,103 @@ function isRevisionConflict(error) {
   const { statusCode, message } = error;
   return statusCode === 409 ? !0 : typeof message == "string" && message.includes("ifRevisionId check failed");
 }
-class CascadeLimitError extends Error {
-  instanceId;
-  limit;
-  constructor(args) {
-    super(
-      `Cascade did not stabilise after ${args.limit} auto-transitions on ${args.instanceId} \u2014 likely a runaway loop (transition guards that stay mutually satisfied). Check that each transition's filter eventually goes false.`
-    ), this.name = "CascadeLimitError", this.instanceId = args.instanceId, this.limit = args.limit;
-  }
+class CascadeLimitError extends Error {
+  instanceId;
+  limit;
+  constructor(args) {
+    super(
+      `Cascade did not stabilise after ${args.limit} auto-transitions on ${args.instanceId} \u2014 likely a runaway loop (transition guards that stay mutually satisfied). Check that each transition's filter eventually goes false.`
+    ), this.name = "CascadeLimitError", this.instanceId = args.instanceId, this.limit = args.limit;
+  }
+}
+async function deployOrRollback(args) {
+  try {
+    await args.deploy();
+  } catch (guardError) {
+    if (!args.reversible)
+      throw new WorkflowStateDivergedError({
+        instanceId: args.instanceId,
+        guardError,
+        reason: "the move created child instances a parent-only rollback cannot undo"
+      });
+    try {
+      let patch = args.client.patch(args.instanceId).set(args.restore);
+      args.unset && args.unset.length > 0 && (patch = patch.unset(args.unset)), args.committedRev !== void 0 && (patch = patch.ifRevisionId(args.committedRev)), await patch.commit();
+    } catch (rollbackError) {
+      throw new WorkflowStateDivergedError({
+        instanceId: args.instanceId,
+        guardError,
+        rollbackError,
+        reason: "rollback of the committed move failed"
+      });
+    }
+    throw guardError;
+  }
+}
+function applyTaskStatusChange(args) {
+  const { entry, history, stage, to, at, actor } = args, from = entry.status;
+  entry.status = to, isTerminalTaskStatus(to) && (entry.completedAt = at, actor !== void 0 && (entry.completedBy = actor.id)), history.push({
+    _key: randomKey(),
+    _type: "taskStatusChanged",
+    at,
+    stage,
+    task: entry.name,
+    from,
+    to,
+    ...actor !== void 0 ? { actor } : {}
+  });
+}
+function stageTransitionHistory(args) {
+  const { fromStage, toStage, at, transition, actor, via, reason } = args, shared = {
+    at,
+    ...transition !== void 0 ? { transition } : {},
+    ...actor !== void 0 ? { actor } : {},
+    ...via !== void 0 ? { via } : {},
+    ...reason !== void 0 ? { reason } : {}
+  };
+  return [
+    {
+      _key: randomKey(),
+      _type: "stageExited",
+      stage: fromStage,
+      toStage,
+      ...shared
+    },
+    {
+      _key: randomKey(),
+      _type: "transitionFired",
+      fromStage,
+      toStage,
+      ...shared
+    },
+    {
+      _key: randomKey(),
+      _type: "stageEntered",
+      stage: toStage,
+      fromStage,
+      ...shared
+    }
+  ];
+}
+const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
+function validateTags(tags) {
+  if (tags.length === 0)
+    throw new Error("tags: must be a non-empty array");
+  for (const tag of tags)
+    if (!TAG_RE.test(tag))
+      throw new Error(
+        `tags: invalid tag "${tag}" \u2014 must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`
+      );
+}
+function canonicalTag(tags) {
+  return tags[0];
+}
+function tagScopeFilter(param = "engineTags") {
+  return `count(tags[@ in $${param}]) > 0`;
 }
-async function deployOrRollback(args) {
-  try {
-    await args.deploy();
-  } catch (guardError) {
-    if (!args.reversible)
-      throw new WorkflowStateDivergedError({
-        instanceId: args.instanceId,
-        guardError,
-        reason: "the move created child instances a parent-only rollback cannot undo"
-      });
-    try {
-      let patch = args.client.patch(args.instanceId).set(args.restore);
-      args.unset && args.unset.length > 0 && (patch = patch.unset(args.unset)), args.committedRev !== void 0 && (patch = patch.ifRevisionId(args.committedRev)), await patch.commit();
-    } catch (rollbackError) {
-      throw new WorkflowStateDivergedError({
-        instanceId: args.instanceId,
-        guardError,
-        rollbackError,
-        reason: "rollback of the committed move failed"
-      });
-    }
-    throw guardError;
-  }
+function definitionLookupGroq(explicit) {
+  const scoped = `_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${tagScopeFilter()}`;
+  return explicit ? `*[${scoped} && version == $version][0]` : `*[${scoped}] | order(version desc)[0]`;
 }
 async function discoverItems(args) {
   const { client, groq, params, perspective } = args, fetchOptions = perspective !== void 0 ? { perspective } : void 0;
@@ -1029,23 +1186,49 @@ function clientForDiscovery(defaultClient, clientForGdr, subjectGdrUri) {
     return defaultClient;
   }
 }
-const MAX_SPAWN_DEPTH = 6;
-async function spawnChildren(ctx, mutation, task, spawn, actor) {
+const MAX_SPAWN_DEPTH = 6, SUBWORKFLOWS_ALL_DONE = "count($subworkflows[status != 'done']) == 0", FAIL_WHEN_SYSTEM_ID = "engine.failWhen", COMPLETE_WHEN_SYSTEM_ID = "engine.completeWhen";
+function gateActor(outcome) {
+  return {
+    kind: "system",
+    id: outcome === "failed" ? FAIL_WHEN_SYSTEM_ID : COMPLETE_WHEN_SYSTEM_ID
+  };
+}
+function effectiveCompleteWhen(task) {
+  return task.completeWhen ?? (task.subworkflows !== void 0 ? SUBWORKFLOWS_ALL_DONE : void 0);
+}
+async function evaluateResolutionGate(ctx, task, vars) {
+  const scope = { taskName: task.name, vars };
+  if (task.failWhen !== void 0 && await ctxEvaluateCondition(ctx, task.failWhen, scope))
+    return "failed";
+  const completeWhen = effectiveCompleteWhen(task);
+  if (completeWhen !== void 0 && await ctxEvaluateCondition(ctx, completeWhen, scope))
+    return "done";
+}
+async function spawnSubworkflows(ctx, mutation, task, sub, actor) {
   if (ctx.instance.ancestors.length + 1 > MAX_SPAWN_DEPTH) {
     const chain = [...ctx.instance.ancestors.map((a) => a.id), selfGdr(ctx.instance)].join(" \u2192 ");
     throw new Error(
-      `Spawn depth limit (${MAX_SPAWN_DEPTH}) exceeded on task "${task.id}" of ${ctx.instance._id}. Ancestor chain: ${chain}`
+      `Subworkflow depth limit (${MAX_SPAWN_DEPTH}) exceeded on task "${task.name}" of ${ctx.instance._id}. Ancestor chain: ${chain}`
+    );
+  }
+  const now = ctx.now, definition = await resolveDefinitionRef(ctx.client, sub.definition, ctx.instance.tags ?? []);
+  if (definition === null) {
+    const versionLabel = sub.definition.version === void 0 || sub.definition.version === "latest" ? "latest" : `v${sub.definition.version}`;
+    throw new Error(
+      `Subworkflow definition "${sub.definition.name}" ${versionLabel} not deployed (parent ${ctx.instance._id}, task ${task.name})`
     );
   }
-  const now = ctx.now, rows = await resolveSpawnRows(ctx, spawn), refs = [];
+  const parentScope = await ctxConditionParams(ctx, {
+    taskName: task.name,
+    ...actor ? { actor } : {}
+  }), rows = await resolveSpawnRows(ctx, sub), effectsContext = await resolveContextHandoff(ctx, sub, parentScope), refs = [];
   for (const row of rows) {
-    const projected = projectSpawnRow(ctx.instance, spawn, row, now), { ref, body } = await prepareChildInstance({
+    const initialState = await projectRowState(ctx, sub, definition, parentScope, row), { ref, body } = await prepareChildInstance({
       client: ctx.client,
       parent: ctx.instance,
-      task,
-      spawn,
-      initialState: projected.initialState,
-      effectsContext: projected.effectsContext,
+      definition,
+      initialState,
+      effectsContext,
       actor,
       now
     });
@@ -1053,8 +1236,8 @@ async function spawnChildren(ctx, mutation, task, spawn, actor) {
   }
   return refs;
 }
-async function resolveSpawnRows(ctx, spawn) {
-  const params = buildParams(ctx.instance, ctx.now), groq = spawn.forEach.groq;
+async function resolveSpawnRows(ctx, sub) {
+  const params = buildParams({ instance: ctx.instance, now: ctx.now, snapshot: ctx.snapshot }), groq = sub.forEach;
   let value;
   if (groq.includes("*")) {
     const routingUri = firstDocRefGdrUri(ctx.instance.state), client = clientForDiscovery(ctx.client, ctx.clientForGdr, routingUri);
@@ -1070,60 +1253,39 @@ async function resolveSpawnRows(ctx, spawn) {
   }
   return Array.isArray(value) ? value : value == null ? [] : [value];
 }
-function firstDocRefGdrUri(slots) {
-  if (slots) {
-    for (const s of slots)
-      if (s._type === "workflow.state.doc.ref" && s.value !== null) return s.value.id;
+function firstDocRefGdrUri(entries) {
+  if (entries) {
+    for (const s of entries)
+      if (s._type === "doc.ref" && s.value !== null) return s.value.id;
   }
 }
-function resolveSpawnSource(source, parent, row, now) {
-  switch (source.source) {
-    case "literal":
-      return source.value;
-    case "row":
-      return source.path !== void 0 ? getPath(row, source.path) : row;
-    case "parentState": {
-      const slot = parent.state?.find((s) => s.id === source.slotId);
-      return slot === void 0 ? null : source.path !== void 0 ? getPath(slot, source.path) : slot;
-    }
-    case "self":
-      return selfGdr(parent);
-    case "stageId":
-      return parent.currentStageId;
-    case "now":
-      return now;
-    case "object": {
-      const out = {};
-      for (const [k, v2] of Object.entries(source.fields))
-        out[k] = resolveSpawnSource(v2, parent, row, now);
-      return out;
-    }
-    case "actor":
-    case "param":
-    case "stateRead":
-    case "effectOutput":
-      return null;
-  }
-}
-function projectSpawnRow(parent, spawn, row, now) {
-  const initialState = [];
-  for (const entry of spawn.forEach.as.initialState ?? []) {
-    const raw = resolveSpawnSource(entry.value, parent, row, now), value = canonicaliseSpawnValue(entry.type, raw, parent.workflowResource);
-    initialState.push({
-      type: entry.type,
-      id: entry.id,
+async function projectRowState(ctx, sub, childDefinition, parentScope, row) {
+  const out = [];
+  for (const [name, groq] of Object.entries(sub.with ?? {})) {
+    const declared = (childDefinition.state ?? []).find((e) => e.name === name);
+    if (declared === void 0)
+      throw new Error(
+        `subworkflows.with["${name}"]: subworkflow "${childDefinition.name}" declares no state entry "${name}"`
+      );
+    const raw = await runGroq(groq, { ...parentScope, row }, ctx.snapshot), value = canonicaliseSpawnValue(declared.type, raw, ctx.instance.workflowResource);
+    value != null && out.push({
+      type: declared.type,
+      name,
       value
     });
   }
-  const effectsContext = {};
-  for (const [k, src] of Object.entries(spawn.forEach.as.effectsContext ?? {})) {
-    const v2 = resolveSpawnSource(src, parent, row, now);
-    v2 != null && (typeof v2 == "string" || typeof v2 == "number" || typeof v2 == "boolean" || typeof v2 == "object" && "id" in v2 && "type" in v2) && (effectsContext[k] = v2);
+  return out;
+}
+async function resolveContextHandoff(ctx, sub, parentScope) {
+  const out = {};
+  for (const [name, groq] of Object.entries(sub.context ?? {})) {
+    const v2 = await runGroq(groq, parentScope, ctx.snapshot);
+    v2 != null && (typeof v2 == "string" || typeof v2 == "number" || typeof v2 == "boolean" || typeof v2 == "object" && "id" in v2 && "type" in v2) && (out[name] = v2);
   }
-  return { initialState, effectsContext };
+  return out;
 }
-function canonicaliseSpawnValue(slotType, value, workflowResource) {
-  return slotType === "workflow.state.doc.ref" ? coerceSpawnGdr(value, workflowResource) : slotType === "workflow.state.doc.refs" && Array.isArray(value) ? value.map((v2) => coerceSpawnGdr(v2, workflowResource)).filter((v2) => v2 !== null) : value;
+function canonicaliseSpawnValue(kind, value, workflowResource) {
+  return kind === "doc.ref" ? coerceSpawnGdr(value, workflowResource) : kind === "doc.refs" && Array.isArray(value) ? value.map((v2) => coerceSpawnGdr(v2, workflowResource)).filter((v2) => v2 !== null) : value;
 }
 function coerceSpawnGdr(raw, workflowResource) {
   const toUri = (id) => isGdrUri(id) ? id : gdrFromResource(workflowResource, id);
@@ -1139,28 +1301,22 @@ function coerceSpawnGdr(raw, workflowResource) {
   }
   return typeof raw == "string" && raw.length > 0 ? { id: toUri(raw), type: "document" } : null;
 }
-async function resolveLogicalDefinition(client, ref, tags) {
-  const wantsExplicit = typeof ref.version == "number", params = { workflowId: ref.workflowId, tags };
-  wantsExplicit && (params.version = ref.version);
-  const groq = wantsExplicit ? '*[_type == "workflow.definition" && workflowId == $workflowId && version == $version && count(tags[@ in $tags]) > 0][0]' : '*[_type == "workflow.definition" && workflowId == $workflowId && count(tags[@ in $tags]) > 0] | order(version desc)[0]';
-  return await client.fetch(groq, params) ?? null;
+async function resolveDefinitionRef(client, ref, tags) {
+  const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, engineTags: tags };
+  return wantsExplicit && (params.version = ref.version), await client.fetch(
+    definitionLookupGroq(wantsExplicit),
+    params
+  ) ?? null;
 }
 async function prepareChildInstance(args) {
-  const { client, parent, task, spawn, initialState, effectsContext, actor, now } = args, definition = await resolveLogicalDefinition(client, spawn.definitionRef, parent.tags ?? []);
-  if (definition === null) {
-    const versionLabel = spawn.definitionRef.version === void 0 || spawn.definitionRef.version === "latest" ? "latest" : `v${spawn.definitionRef.version}`;
-    throw new Error(
-      `Spawn target workflowId="${spawn.definitionRef.workflowId}" ${versionLabel} not deployed (parent ${parent._id}, task ${task.id})`
-    );
-  }
-  const childTags = parent.tags ?? [], childPrefix = childTags[0] ?? "wf", workflowResource = parent.workflowResource, childDocId = `${childPrefix}.wf-instance.${randomKey()}`, childRef = { id: gdrFromResource(workflowResource, childDocId), type: "workflow.instance" }, ancestors = [
+  const { client, parent, definition, initialState, effectsContext, actor, now } = args, childTags = parent.tags ?? [], childPrefix = childTags[0] ?? "wf", workflowResource = parent.workflowResource, childDocId = `${childPrefix}.wf-instance.${randomKey()}`, childRef = { id: gdrFromResource(workflowResource, childDocId), type: WORKFLOW_INSTANCE_TYPE }, ancestors = [
     ...parent.ancestors,
     {
       id: selfGdr(parent),
-      type: "workflow.instance"
+      type: WORKFLOW_INSTANCE_TYPE
     }
   ], inheritedPerspective = parent.perspective, childState = await resolveDeclaredState({
-    slotDefs: definition.state,
+    entryDefs: definition.state,
     initialState,
     ctx: {
       client,
@@ -1176,7 +1332,7 @@ async function prepareChildInstance(args) {
       if (typeof value == "object" && value !== null && "id" in value && "type" in value) {
         if (!isGdrUri(value.id))
           throw new Error(
-            `spawn.forEach.as.effectsContext["${key}"]: GDR id must be a "<scheme>:..." URI, got ${JSON.stringify(value.id)}.`
+            `subworkflows.context["${key}"]: GDR id must be a "<scheme>:..." URI, got ${JSON.stringify(value.id)}.`
           );
         return effectsContextEntry(key, { id: value.id, type: value.type });
       }
@@ -1187,77 +1343,274 @@ async function prepareChildInstance(args) {
     now,
     tags: childTags,
     workflowResource,
-    workflowId: definition.workflowId,
+    definitionName: definition.name,
     pinnedVersion: definition.version,
     definition,
     state: childState,
     effectsContext: effectsContextEntries,
     ancestors,
     perspective: childPerspective,
-    initialStageId: definition.initialStageId,
+    initialStage: definition.initialStage,
     actor
   });
   return { ref: childRef, body: base };
 }
-async function checkSpawnCompletion(client, entry, spawn) {
-  const refs = entry.spawnedInstances ?? [];
-  if (refs.length === 0) {
-    const policy2 = spawn.completionPolicy ?? { kind: "all" };
-    return policy2.kind === "all" || policy2.kind === "count" && policy2.n === 0;
-  }
-  const ids = refs.map((r) => r.id.includes(":") ? gdrToBareId(r.id) : r.id), children = await client.fetch("*[_id in $ids]{_id, currentStageId, definitionSnapshot}", { ids });
-  let terminalCount = 0;
-  for (const child of children)
-    JSON.parse(child.definitionSnapshot).stages.find((s) => s.id === child.currentStageId)?.kind === "terminal" && terminalCount++;
-  const policy = spawn.completionPolicy ?? { kind: "all" };
-  switch (policy.kind) {
+async function subworkflowRows(ctx, refs) {
+  if (refs.length === 0) return [];
+  const ids = refs.map((r) => gdrToBareId(r.id));
+  return (await ctx.client.fetch("*[_id in $ids]{_id, currentStage, completedAt}", { ids })).map((c) => ({
+    _id: c._id,
+    stage: c.currentStage,
+    status: c.completedAt !== void 0 && c.completedAt !== null ? "done" : "active"
+  }));
+}
+function resolveStaticSource(src, ctx) {
+  switch (src.type) {
+    case "literal":
+      return { handled: !0, value: src.value };
+    case "param":
+      return { handled: !0, value: ctx.params?.[src.param] };
+    case "actor":
+      return { handled: !0, value: ctx.actor };
+    case "now":
+      return { handled: !0, value: ctx.now };
+    default:
+      return { handled: !1 };
+  }
+}
+const STATE_OP_TYPES = [
+  "state.set",
+  "state.unset",
+  "state.append",
+  "state.updateWhere",
+  "state.removeWhere"
+];
+function isStateOp(summary) {
+  return STATE_OP_TYPES.includes(summary.opType);
+}
+function validateActionParams(action, taskName, callerParams) {
+  const declared = action.params ?? [], params = callerParams ?? {}, issues = [];
+  for (const decl of declared) {
+    const value = params[decl.name], present = decl.name in params && value !== void 0 && value !== null;
+    if (decl.required === !0 && !present) {
+      issues.push({ param: decl.name, reason: "required but missing" });
+      continue;
+    }
+    present && (checkParamType(value, decl) || issues.push({
+      param: decl.name,
+      reason: `expected type=${decl.type}, got ${typeof value}`
+    }));
+  }
+  if (issues.length > 0)
+    throw new ActionParamsInvalidError({ action: action.name, task: taskName, issues });
+  return params;
+}
+function hasStringField(value, field) {
+  return typeof value == "object" && value !== null && field in value && typeof value[field] == "string";
+}
+function checkParamType(value, decl) {
+  switch (decl.type) {
+    case "string":
+    case "url":
+    case "dateTime":
+      return typeof value == "string";
+    case "number":
+      return typeof value == "number" && Number.isFinite(value);
+    case "boolean":
+      return typeof value == "boolean";
+    case "actor":
+      return hasStringField(value, "kind");
+    case "doc.ref":
+      return hasStringField(value, "id");
+    case "doc.refs":
+      return Array.isArray(value) && value.every((v2) => checkParamType(v2, { type: "doc.ref" }));
+    case "json":
+      return !0;
+    default:
+      return !1;
+  }
+}
+function runOps(args) {
+  const { ops, mutation, stage, origin, params, actor, self, now } = args;
+  if (ops === void 0 || ops.length === 0) return [];
+  const summaries = [];
+  for (const op of ops) {
+    const summary = applyOp(op, { mutation, stage, taskName: origin.task, params, actor, self, now });
+    summaries.push(summary), mutation.history.push({
+      _key: randomKey(),
+      _type: "opApplied",
+      at: now,
+      stage,
+      ...origin.task !== void 0 ? { task: origin.task } : {},
+      ...origin.action !== void 0 ? { action: origin.action } : {},
+      ...origin.transition !== void 0 ? { transition: origin.transition } : {},
+      opType: summary.opType,
+      ...summary.target !== void 0 ? { target: summary.target } : {},
+      ...summary.resolved !== void 0 ? { resolved: summary.resolved } : {},
+      ...actor !== void 0 ? { actor } : {}
+    });
+  }
+  return summaries;
+}
+function applyOp(op, ctx) {
+  switch (op.type) {
+    case "state.set":
+      return applyStateSet(op, ctx);
+    case "state.unset":
+      return applyStateUnset(op, ctx);
+    case "state.append":
+      return applyStateAppend(op, ctx);
+    case "state.updateWhere":
+      return applyStateUpdateWhere(op, ctx);
+    case "state.removeWhere":
+      return applyStateRemoveWhere(op, ctx);
+    case "status.set":
+      return applyStatusSet(op, ctx);
+  }
+}
+function applyStateSet(op, ctx) {
+  const value = resolveOpSource(op.value, ctx), entry = locateEntry(ctx, op.target);
+  return validateStateValue({ entryType: entry._type, entryName: entry.name, value }), setEntryValue(entry, value), { opType: op.type, target: op.target, resolved: { value } };
+}
+const EMPTY_BY_KIND = {
+  "doc.refs": [],
+  checklist: [],
+  notes: [],
+  assignees: []
+};
+function applyStateUnset(op, ctx) {
+  const entry = locateEntry(ctx, op.target);
+  return setEntryValue(entry, EMPTY_BY_KIND[entry._type] ?? null), { opType: op.type, target: op.target };
+}
+function applyStateAppend(op, ctx) {
+  const item = resolveOpSource(op.value, ctx), entry = locateEntry(ctx, op.target);
+  validateStateAppendItem({ entryType: entry._type, entryName: entry.name, item });
+  const current = Array.isArray(entry.value) ? entry.value : [];
+  return setEntryValue(entry, [...current, withRowKey(item)]), { opType: op.type, target: op.target, resolved: { item } };
+}
+function withRowKey(item) {
+  return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? { _key: randomKey(), ...item } : item;
+}
+function applyStateUpdateWhere(op, ctx) {
+  const entry = locateEntry(ctx, op.target), rows = requireArrayValue(entry, op), merge = resolveOpSource(op.value, ctx);
+  if (merge === null || typeof merge != "object" || Array.isArray(merge))
+    throw new Error(
+      `state.updateWhere value must resolve to an object of fields to merge (target "${op.target.state}")`
+    );
+  return setEntryValue(
+    entry,
+    rows.map(
+      (row) => evalOpPredicate(op.where, row, ctx) ? { ...row, ...merge } : row
+    )
+  ), { opType: op.type, target: op.target, resolved: { merge } };
+}
+function applyStateRemoveWhere(op, ctx) {
+  const entry = locateEntry(ctx, op.target), rows = requireArrayValue(entry, op);
+  return setEntryValue(
+    entry,
+    rows.filter((row) => !evalOpPredicate(op.where, row, ctx))
+  ), { opType: op.type, target: op.target };
+}
+function requireArrayValue(entry, op) {
+  if (!Array.isArray(entry.value))
+    throw new Error(
+      `${op.type} target ${op.target.scope}:"${op.target.state}" holds a non-array ${entry._type} value \u2014 where-ops operate on array entries`
+    );
+  return entry.value;
+}
+function applyStatusSet(op, ctx) {
+  const entry = findOpenStageEntry(ctx.mutation)?.tasks.find((t) => t.name === op.task);
+  if (entry === void 0)
+    throw new Error(`status.set targets task "${op.task}" which has no entry in the open stage`);
+  return applyTaskStatusChange({
+    entry,
+    history: ctx.mutation.history,
+    stage: ctx.stage,
+    to: op.status,
+    at: ctx.now,
+    ...ctx.actor !== void 0 ? { actor: ctx.actor } : {}
+  }), { opType: op.type, resolved: { task: op.task, status: op.status } };
+}
+function setEntryValue(entry, value) {
+  entry.value = value;
+}
+function locateEntry(ctx, target) {
+  const entry = stateHost(ctx, target.scope)?.find((s) => s.name === target.state);
+  if (entry === void 0)
+    throw new Error(
+      `Op target ${target.scope}:"${target.state}" has no resolved state entry on this instance \u2014 the deployed definition and the instance state have diverged`
+    );
+  return entry;
+}
+function stateHost(ctx, scope) {
+  if (scope === "workflow") return ctx.mutation.state;
+  const stageEntry = findOpenStageEntry(ctx.mutation);
+  if (scope === "stage") return stageEntry?.state;
+  const task = stageEntry?.tasks.find((t) => t.name === ctx.taskName);
+  return task !== void 0 && task.state === void 0 && (task.state = []), task?.state;
+}
+function resolveOpSource(src, ctx) {
+  const staticValue = resolveStaticSource(src, ctx);
+  if (staticValue.handled) return staticValue.value;
+  switch (src.type) {
+    case "self":
+      return ctx.self;
+    case "stage":
+      return ctx.stage;
+    case "stateRead": {
+      const value = readEntryFromMutation(ctx, src);
+      return src.path !== void 0 ? getPath(value, src.path) : value;
+    }
+    case "object": {
+      const out = {};
+      for (const [field, fieldSrc] of Object.entries(src.fields))
+        out[field] = resolveOpSource(fieldSrc, ctx);
+      return out;
+    }
+    default:
+      throw new Error(`Source type "${src.type}" is a state-entry origin, not a value`);
+  }
+}
+function entryValue(entries, name) {
+  return entries?.find((s) => s.name === name)?.value;
+}
+function readEntryFromMutation(ctx, src) {
+  const scopes = src.scope !== void 0 ? [src.scope] : ["stage", "workflow"], stageEntry = findOpenStageEntry(ctx.mutation);
+  for (const scope of scopes) {
+    const host = scope === "workflow" ? ctx.mutation.state : stageEntry?.state, value = entryValue(host, src.state);
+    if (value !== void 0) return value;
+  }
+}
+function evalOpPredicate(p, row, ctx) {
+  switch (p.type) {
     case "all":
-      return terminalCount === refs.length;
+      return p.of.every((sub) => evalOpPredicate(sub, row, ctx));
     case "any":
-      return terminalCount >= 1;
-    case "count":
-      return terminalCount >= policy.n;
+      return p.of.some((sub) => evalOpPredicate(sub, row, ctx));
+    case "field":
+      return row[p.field] === resolveOpSource(p.equals, ctx);
   }
 }
 async function invokeTask(args) {
-  const { client, instanceId, taskId, options } = args, ctx = await loadContext(client, instanceId, {
+  const { client, instanceId, task: taskName, options } = args, ctx = await loadContext(client, instanceId, {
     ...options?.clock ? { clock: options.clock } : {}
   });
-  return commitInvoke(ctx, taskId, options?.actor);
+  return commitInvoke(ctx, taskName, options?.actor);
 }
-async function commitInvoke(ctx, taskId, actor) {
-  const { task } = findTaskInCurrentStage(ctx, taskId), entry = findCurrentTasks(ctx.instance).find((t) => t.id === taskId);
+async function commitInvoke(ctx, taskName, actor) {
+  const { task } = findTaskInCurrentStage(ctx, taskName), entry = findCurrentTasks(ctx.instance).find((t) => t.name === taskName);
   if (entry === void 0)
-    throw new Error(`Task "${taskId}" has no status entry on instance ${ctx.instance._id}`);
+    throw new Error(`Task "${taskName}" has no status entry on instance ${ctx.instance._id}`);
   if (entry.status !== "pending")
-    return { invoked: !1, taskId };
-  const mutation = startMutation(ctx.instance), mutEntry = requireMutationTaskEntry(mutation, taskId);
-  return await activateTask(ctx, mutation, task, mutEntry, actor), await persist(ctx, mutation), { invoked: !0, taskId };
-}
-async function autoResolveOnActivate(ctx, mutation, task, entry, now) {
-  const checks = [
-    { filter: task.failWhen, outcome: "failed", systemId: "engine.failWhen" },
-    { filter: task.completeWhen, outcome: "done", systemId: "engine.completeWhen" }
-  ];
-  for (const { filter, outcome, systemId } of checks)
-    if (filter !== void 0 && await ctxEvaluateFilter(ctx, filter))
-      return entry.status = outcome, entry.completedAt = now, entry.completedBy = systemId, mutation.history.push(
-        taskStatusChangedEntry({
-          stageId: mutation.currentStageId,
-          taskId: task.id,
-          from: "active",
-          to: outcome,
-          at: now,
-          actor: { kind: "system", id: systemId }
-        })
-      ), !0;
-  return !1;
+    return { invoked: !1, task: taskName };
+  const mutation = startMutation(ctx.instance), mutEntry = requireMutationTaskEntry(mutation, taskName);
+  return await activateTask(ctx, mutation, task, mutEntry, actor), await persist(ctx, mutation), { invoked: !0, task: taskName };
 }
 async function activateTask(ctx, mutation, task, entry, actor) {
   const now = ctx.now;
   if (entry.status = "active", entry.startedAt = now, task.state !== void 0 && task.state.length > 0) {
-    const stage = findStage(ctx.definition, mutation.currentStageId);
-    entry.state = await resolveTaskStateSlots({
+    const stage = findStage(ctx.definition, mutation.currentStage);
+    entry.state = await resolveTaskStateEntries({
       client: ctx.client,
       instance: ctx.instance,
       stage,
@@ -1265,55 +1618,73 @@ async function activateTask(ctx, mutation, task, entry, actor) {
       now
     });
   }
-  if (!await autoResolveOnActivate(ctx, mutation, task, entry, now) && (mutation.history.push({
+  runOps({
+    ops: task.ops,
+    mutation,
+    stage: mutation.currentStage,
+    origin: { task: task.name },
+    params: {},
+    actor,
+    self: selfGdr(ctx.instance),
+    now
+  }), mutation.history.push({
     _key: randomKey(),
-    _type: "workflow.history.taskActivated",
+    _type: "taskActivated",
     at: now,
-    stageId: mutation.currentStageId,
-    taskId: task.id,
+    stage: mutation.currentStage,
+    task: task.name,
     ...actor !== void 0 ? { actor } : {}
-  }), await queueEffects(
-    ctx,
-    mutation,
-    task.effects,
-    {
-      kind: "taskInvoke",
-      id: task.id
-    },
-    actor
-  ), task.spawns !== void 0)) {
-    const refs = await spawnChildren(ctx, mutation, task, task.spawns, actor);
-    entry.spawnedInstances = refs;
+  }), await queueEffects(ctx, mutation, task.effects, { kind: "task", name: task.name }, actor, {
+    taskName: task.name
+  });
+  let pendingChildren;
+  if (task.subworkflows !== void 0) {
+    const createsBefore = mutation.pendingCreates.length, refs = await spawnSubworkflows(ctx, mutation, task, task.subworkflows, actor);
+    entry.spawnedInstances = refs, pendingChildren = mutation.pendingCreates.slice(createsBefore).map((c) => ({ _id: c._id, stage: c.currentStage, status: "active" }));
     for (const ref of refs)
       mutation.history.push({
         _key: randomKey(),
-        _type: "workflow.history.spawned",
+        _type: "spawned",
         at: now,
-        taskId: task.id,
+        task: task.name,
         instanceRef: ref
       });
-    if (await checkSpawnCompletion(ctx.client, entry, task.spawns)) {
-      const previousStatus = entry.status;
-      entry.status = "done", entry.completedAt = now, mutation.history.push(
-        taskStatusChangedEntry({
-          stageId: mutation.currentStageId,
-          taskId: task.id,
-          from: previousStatus,
-          to: "done",
-          at: now,
-          ...actor !== void 0 ? { actor } : {}
-        })
-      );
-    }
   }
+  await autoResolveOnActivate(ctx, mutation, task, entry, now, pendingChildren) || resolveMachineStep(mutation, task, entry, now);
+}
+async function autoResolveOnActivate(ctx, mutation, task, entry, now, pendingChildren) {
+  if (task.failWhen === void 0 && effectiveCompleteWhen(task) === void 0) return !1;
+  const vars = pendingChildren !== void 0 ? { subworkflows: pendingChildren } : await taskConditionVars(ctx, entry), outcome = await evaluateResolutionGate(ctx, task, vars);
+  return outcome === void 0 ? !1 : (applyTaskStatusChange({
+    entry,
+    history: mutation.history,
+    stage: mutation.currentStage,
+    to: outcome,
+    at: now,
+    actor: gateActor(outcome)
+  }), !0);
+}
+async function taskConditionVars(ctx, entry) {
+  return entry.spawnedInstances === void 0 || entry.spawnedInstances.length === 0 ? { subworkflows: [] } : { subworkflows: await subworkflowRows(ctx, entry.spawnedInstances) };
+}
+function resolveMachineStep(mutation, task, entry, now) {
+  const waitsForActor = task.actions !== void 0 && task.actions.length > 0, waitsForCondition = task.completeWhen !== void 0 || task.subworkflows !== void 0;
+  waitsForActor || waitsForCondition || applyTaskStatusChange({
+    entry,
+    history: mutation.history,
+    stage: mutation.currentStage,
+    to: "done",
+    at: now,
+    actor: { kind: "system", id: "engine.machineStep" }
+  });
 }
 async function buildStageTasks(ctx, stage) {
   const entries = [];
   for (const task of stage.tasks ?? []) {
-    const inScope = await ctxEvaluateFilter(ctx, task.filter);
+    const inScope = await ctxEvaluateCondition(ctx, task.filter, { taskName: task.name });
     entries.push({
       _key: randomKey(),
-      id: task.id,
+      name: task.name,
       status: inScope ? "pending" : "skipped",
       ...task.filter !== void 0 ? {
         filterEvaluation: {
@@ -1325,22 +1696,22 @@ async function buildStageTasks(ctx, stage) {
   }
   return entries;
 }
-function activatesOnStageEnter(task) {
-  return task.invokeOn === "stageEnter" || task.spawns !== void 0 || task.completeWhen !== void 0 || task.failWhen !== void 0;
+function isTerminalStage(stage) {
+  return (stage.transitions ?? []).length === 0;
 }
 async function setStage(args) {
-  const { client, instanceId, targetStageId, reason, options } = args, ctx = await loadContext(client, instanceId, {
+  const { client, instanceId, targetStage, reason, options } = args, ctx = await loadContext(client, instanceId, {
     ...options?.clock ? { clock: options.clock } : {}
   });
-  return commitSetStage(ctx, targetStageId, reason, options?.actor);
+  return commitSetStage(ctx, targetStage, reason, options?.actor);
 }
 async function enterStage(ctx, mutation, nextStage, actor, at) {
-  mutation.currentStageId = nextStage.id;
+  mutation.currentStage = nextStage.name;
   const nextStageEntry = {
     _key: randomKey(),
-    id: nextStage.id,
+    name: nextStage.name,
     enteredAt: at,
-    state: await resolveStageStateSlots({
+    state: await resolveStageStateEntries({
       client: ctx.client,
       instance: ctx.instance,
       stage: nextStage,
@@ -1348,55 +1719,44 @@ async function enterStage(ctx, mutation, nextStage, actor, at) {
     }),
     tasks: await buildStageTasks(ctx, nextStage)
   };
-  mutation.stages.push(nextStageEntry), await queueEffects(
-    ctx,
-    mutation,
-    nextStage.onEnter,
-    { kind: "stageEnter", id: nextStage.id },
-    actor
-  );
+  mutation.stages.push(nextStageEntry);
   for (const task of nextStage.tasks ?? []) {
-    if (!activatesOnStageEnter(task)) continue;
-    const entry = nextStageEntry.tasks.find((t) => t.id === task.id);
+    if (task.activation !== "auto") continue;
+    const entry = nextStageEntry.tasks.find((t) => t.name === task.name);
     entry && entry.status === "pending" && await activateTask(ctx, mutation, task, entry, actor);
   }
-  nextStage.kind === "terminal" && (mutation.completedAt = at);
+  isTerminalStage(nextStage) && (mutation.completedAt = at);
 }
-async function beginStageMove(ctx, currentStage, actor) {
-  const mutation = startMutation(ctx.instance), at = ctx.now;
-  return await queueEffects(
-    ctx,
-    mutation,
-    currentStage.onExit,
-    { kind: "stageExit", id: currentStage.id },
-    actor
-  ), { mutation, at };
+function isTerminal(ctx) {
+  return ctx.instance.completedAt !== void 0;
 }
-async function commitSetStage(ctx, targetStageId, reason, actor) {
-  const currentStage = findStage(ctx.definition, ctx.instance.currentStageId), nextStage = findStage(ctx.definition, targetStageId);
-  if (currentStage.id === nextStage.id)
+async function commitSetStage(ctx, targetStage, reason, actor) {
+  if (isTerminal(ctx))
     return { fired: !1 };
-  const { mutation, at } = await beginStageMove(ctx, currentStage, actor), transitionId = `setStage:${currentStage.id}->${nextStage.id}`;
+  const currentStage = findStage(ctx.definition, ctx.instance.currentStage), nextStage = findStage(ctx.definition, targetStage);
+  if (currentStage.name === nextStage.name)
+    return { fired: !1 };
+  const mutation = startMutation(ctx.instance), at = ctx.now, transitionName = `setStage:${currentStage.name}->${nextStage.name}`;
   mutation.history.push(
     ...stageTransitionHistory({
-      fromStageId: currentStage.id,
-      toStageId: nextStage.id,
+      fromStage: currentStage.name,
+      toStage: nextStage.name,
       at,
-      transitionId,
+      transition: transitionName,
       via: "setStage",
       ...actor !== void 0 ? { actor } : {},
       ...reason !== void 0 ? { reason } : {}
     })
   );
   const priorEntry = findOpenStageEntry(mutation);
-  return priorEntry !== void 0 && (priorEntry.exitedAt = at), await enterStage(ctx, mutation, nextStage, actor, at), await persistStageMove(ctx, mutation, currentStage.id, nextStage.id), {
+  return priorEntry !== void 0 && (priorEntry.exitedAt = at), await enterStage(ctx, mutation, nextStage, actor, at), await persistStageMove(ctx, mutation, currentStage.name, nextStage.name), {
     fired: !0,
-    fromStageId: currentStage.id,
-    toStageId: nextStage.id,
-    transitionId
+    fromStage: currentStage.name,
+    toStage: nextStage.name,
+    transition: transitionName
   };
 }
-async function persistStageMove(ctx, mutation, exitedStageId, enteredStageId) {
+async function persistStageMove(ctx, mutation, exitedStage, enteredStage) {
   await persistThenDeploy(
     ctx,
     mutation,
@@ -1405,7 +1765,7 @@ async function persistStageMove(ctx, mutation, exitedStageId, enteredStageId) {
       clientForGdr: ctx.clientForGdr,
       instance: materializeInstance(ctx.instance, mutation),
       definition: ctx.definition,
-      stageId: enteredStageId,
+      stageName: enteredStage,
       now: ctx.now
     })
   ), await retractStageGuards({
@@ -1413,7 +1773,7 @@ async function persistStageMove(ctx, mutation, exitedStageId, enteredStageId) {
     clientForGdr: ctx.clientForGdr,
     instance: ctx.instance,
     definition: ctx.definition,
-    stageId: exitedStageId,
+    stageName: exitedStage,
     now: ctx.now
   });
 }
@@ -1429,112 +1789,91 @@ async function persistThenDeploy(ctx, mutation, deploy) {
     deploy
   });
 }
-async function refreshStageGuards(ctx, mutation, stageId) {
+async function refreshStageGuards(ctx, mutation, stageName) {
   await deployStageGuards({
     client: ctx.client,
     clientForGdr: ctx.clientForGdr,
     instance: materializeInstance(ctx.instance, mutation),
     definition: ctx.definition,
-    stageId,
+    stageName,
     now: ctx.now
   });
 }
-async function commitTransition(ctx, action, actor) {
-  const currentStage = findStage(ctx.definition, ctx.instance.currentStageId), transition = await pickTransition(ctx, currentStage);
+async function commitTransition(ctx, actor) {
+  if (isTerminal(ctx))
+    return { fired: !1 };
+  const currentStage = findStage(ctx.definition, ctx.instance.currentStage), transition = await pickTransition(ctx, currentStage);
   if (transition === void 0)
     return { fired: !1 };
-  const { mutation, at } = await beginStageMove(ctx, currentStage, actor);
-  await queueEffects(
+  const mutation = startMutation(ctx.instance), at = ctx.now;
+  runOps({
+    ops: transition.ops,
+    mutation,
+    stage: currentStage.name,
+    origin: { transition: transition.name },
+    params: {},
+    actor,
+    self: selfGdr(ctx.instance),
+    now: at
+  }), await queueEffects(
     ctx,
     mutation,
     transition.effects,
     {
       kind: "transition",
-      id: transition.id ?? `${currentStage.id}->${transition.to}`
+      name: transition.name
     },
     actor
   ), mutation.history.push(
     ...stageTransitionHistory({
-      fromStageId: currentStage.id,
-      toStageId: transition.to,
+      fromStage: currentStage.name,
+      toStage: transition.to,
       at,
-      ...transition.id !== void 0 ? { transitionId: transition.id } : {},
+      transition: transition.name,
       ...actor !== void 0 ? { actor } : {}
     })
   );
   const priorEntry = findOpenStageEntry(mutation);
   priorEntry !== void 0 && (priorEntry.exitedAt = at);
   const nextStage = findStage(ctx.definition, transition.to);
-  return await enterStage(ctx, mutation, nextStage, actor, at), await persistStageMove(ctx, mutation, currentStage.id, nextStage.id), {
+  return await enterStage(ctx, mutation, nextStage, actor, at), await persistStageMove(ctx, mutation, currentStage.name, nextStage.name), {
     fired: !0,
-    fromStageId: currentStage.id,
-    toStageId: transition.to,
-    ...transition.id !== void 0 ? { transitionId: transition.id } : {}
+    fromStage: currentStage.name,
+    toStage: transition.to,
+    transition: transition.name
   };
 }
-async function pickTransition(ctx, stage, action) {
-  const candidates = (stage.transitions ?? []).filter((t) => t.on === void 0);
-  for (const candidate of candidates)
-    if (await ctxEvaluateFilter(ctx, candidate.filter)) return candidate;
+async function pickTransition(ctx, stage) {
+  for (const candidate of stage.transitions ?? [])
+    if (await ctxEvaluateCondition(ctx, candidate.filter)) return candidate;
 }
 async function evaluateAutoTransitions(args) {
-  const { client, instanceId, options, clientForGdr, clock } = args, ctx = await loadContext(client, instanceId, {
+  const { client, instanceId, options, clientForGdr, clock, overlay } = args, ctx = await loadContext(client, instanceId, {
     ...clientForGdr ? { clientForGdr } : {},
-    ...clock ? { clock } : {}
+    ...clock ? { clock } : {},
+    ...overlay ? { overlay } : {}
   });
-  return commitTransition(ctx, void 0, options?.actor);
+  return commitTransition(ctx, options?.actor);
 }
 async function primeInitialStage(client, instanceId, actor, clientForGdr, clock) {
   const instance = await client.getDocument(instanceId);
-  if (!instance || instance.stages.length > 0 || instance.pendingEffects.length > 0) return;
-  const definition = JSON.parse(instance.definitionSnapshot), stage = definition.stages.find((s) => s.id === instance.currentStageId);
+  if (!instance || instance.stages.length > 0) return;
+  const definition = parseDefinitionSnapshot(instance), stage = definition.stages.find((s) => s.name === instance.currentStage);
   if (stage === void 0) return;
-  const now = (clock ?? wallClock)(), snapshot = await hydrateSnapshot({
+  const ctx = await buildEngineContext({
     client,
     clientForGdr: clientForGdr ?? (() => client),
     instance,
-    definition
-  }), tasks = [];
-  for (const task of stage.tasks ?? []) {
-    const inScope = await evaluateFilter({
-      filter: task.filter,
-      definition,
-      snapshot,
-      params: buildParams(instance, now)
-    });
-    tasks.push({
-      _key: randomKey(),
-      id: task.id,
-      status: inScope ? "pending" : "skipped"
-    });
-  }
-  const initialStageEntry = {
+    definition,
+    ...clock ? { clock } : {}
+  }), now = ctx.now, initialStageEntry = {
     _key: randomKey(),
-    id: stage.id,
+    name: stage.name,
     enteredAt: now,
-    state: await resolveStageStateSlots({ client, instance, stage, now }),
-    tasks
-  }, pendingEffects = [], newHistory = [...instance.history];
-  for (const effect of stage.onEnter ?? []) {
-    const params = await resolveBindings({
-      bindings: effect.bindings,
-      staticInput: effect.input,
-      instance,
-      now,
-      ...actor !== void 0 ? { actor } : {}
-    }), { pending, history } = buildQueuedEffect(
-      effect,
-      { kind: "stageEnter", id: stage.id },
-      params,
-      actor,
-      now
-    );
-    pendingEffects.push(pending), newHistory.push(history);
-  }
-  const committed = await client.patch(instance._id).set({
+    state: await resolveStageStateEntries({ client, instance, stage, now }),
+    tasks: await buildStageTasks(ctx, stage)
+  }, committed = await client.patch(instance._id).set({
     stages: [initialStageEntry],
-    pendingEffects,
-    history: newHistory,
     lastChangedAt: now
   }).ifRevisionId(instance._rev).commit();
   await deployOrRollback({
@@ -1543,7 +1882,6 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr, clock)
     committedRev: committed._rev,
     restore: {
       stages: instance.stages,
-      pendingEffects: instance.pendingEffects,
       history: instance.history
     },
     reversible: !0,
@@ -1552,7 +1890,7 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr, clock)
       clientForGdr: clientForGdr ?? (() => client),
       instance,
       definition,
-      stageId: stage.id,
+      stageName: stage.name,
       now
     })
   }), await autoActivatePrimedTasks(client, instanceId, definition, stage, actor, clientForGdr, clock);
@@ -1560,7 +1898,7 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr, clock)
 async function autoActivatePrimedTasks(client, instanceId, definition, stage, actor, clientForGdr, clock) {
   const resolvedClientForGdr = clientForGdr ?? (() => client);
   for (const task of stage.tasks ?? []) {
-    if (!activatesOnStageEnter(task)) continue;
+    if (task.activation !== "auto") continue;
     const updated = await client.getDocument(instanceId);
     if (!updated) continue;
     const updatedCtx = await buildEngineContext({
@@ -1569,119 +1907,116 @@ async function autoActivatePrimedTasks(client, instanceId, definition, stage, ac
       instance: updated,
       definition,
       ...clock ? { clock } : {}
-    }), mutation = startMutation(updated), mutEntry = currentTasks(mutation).find((t) => t.id === task.id);
+    }), mutation = startMutation(updated), mutEntry = currentTasks(mutation).find((t) => t.name === task.name);
     mutEntry && mutEntry.status === "pending" && (await activateTask(updatedCtx, mutation, task, mutEntry, actor), await persist(updatedCtx, mutation));
   }
 }
 const CASCADE_LIMIT = 100;
 async function gatherAutoResolveCandidates(ctx, tasks) {
   const currentTasksList = findCurrentTasks(ctx.instance), candidates = [];
-  for (const task of tasks)
-    if (currentTasksList.find((e) => e.id === task.id)?.status === "active") {
-      if (task.failWhen !== void 0 && await ctxEvaluateFilter(ctx, task.failWhen)) {
-        candidates.push({ task, outcome: "failed" });
-        continue;
-      }
-      task.completeWhen !== void 0 && await ctxEvaluateFilter(ctx, task.completeWhen) && candidates.push({ task, outcome: "done" });
-    }
+  for (const task of tasks) {
+    const entry = currentTasksList.find((e) => e.name === task.name);
+    if (entry?.status !== "active") continue;
+    const outcome = await evaluateResolutionGate(ctx, task, await taskConditionVars(ctx, entry));
+    outcome !== void 0 && candidates.push({ task, outcome });
+  }
   return candidates;
 }
-async function resolveCompleteWhen(client, instanceId, clientForGdr, clock) {
+async function resolveCompleteWhen(client, instanceId, clientForGdr, clock, overlay) {
   const ctx = await loadContext(client, instanceId, {
     ...clientForGdr ? { clientForGdr } : {},
-    ...clock ? { clock } : {}
-  }), stage = findStage(ctx.definition, ctx.instance.currentStageId), tasksWithAutoPredicate = (stage.tasks ?? []).filter(
-    (t) => t.completeWhen !== void 0 || t.failWhen !== void 0
+    ...clock ? { clock } : {},
+    ...overlay ? { overlay } : {}
+  }), stage = findStage(ctx.definition, ctx.instance.currentStage), gatedTasks = (stage.tasks ?? []).filter(
+    (t) => effectiveCompleteWhen(t) !== void 0 || t.failWhen !== void 0
   );
-  if (tasksWithAutoPredicate.length === 0) return 0;
-  const candidates = await gatherAutoResolveCandidates(ctx, tasksWithAutoPredicate);
+  if (gatedTasks.length === 0) return 0;
+  const candidates = await gatherAutoResolveCandidates(ctx, gatedTasks);
   if (candidates.length === 0) return 0;
   const mutation = startMutation(ctx.instance);
   let count = 0;
   for (const { task, outcome } of candidates) {
-    const mutEntry = currentTasks(mutation).find((t) => t.id === task.id);
-    if (mutEntry === void 0 || mutEntry.status !== "active") continue;
-    const previousStatus = mutEntry.status, actor = {
-      kind: "system",
-      id: outcome === "failed" ? "engine.failWhen" : "engine.completeWhen"
-    }, now = ctx.now;
-    mutEntry.status = outcome, mutEntry.completedAt = now, mutEntry.completedBy = actor.id, mutation.history.push(
-      taskStatusChangedEntry({
-        stageId: stage.id,
-        taskId: task.id,
-        from: previousStatus,
-        to: outcome,
-        at: now,
-        actor
-      })
-    ), count++;
+    const mutEntry = currentTasks(mutation).find((t) => t.name === task.name);
+    mutEntry === void 0 || mutEntry.status !== "active" || (applyTaskStatusChange({
+      entry: mutEntry,
+      history: mutation.history,
+      stage: stage.name,
+      to: outcome,
+      at: ctx.now,
+      actor: gateActor(outcome)
+    }), count++);
   }
   return count > 0 && await persist(ctx, mutation), count;
 }
-async function cascadeAutoTransitions(client, instanceId, actor, clientForGdr, clock) {
+async function cascadeAutoTransitions(client, instanceId, actor, clientForGdr, clock, overlay) {
   let count = 0;
   for (; ; ) {
-    if (await resolveCompleteWhen(client, instanceId, clientForGdr, clock), !(await evaluateAutoTransitions({
+    if (await resolveCompleteWhen(client, instanceId, clientForGdr, clock, overlay), !(await evaluateAutoTransitions({
       client,
       instanceId,
       ...actor !== void 0 ? { options: { actor } } : {},
       ...clientForGdr ? { clientForGdr } : {},
-      ...clock ? { clock } : {}
+      ...clock ? { clock } : {},
+      ...overlay ? { overlay } : {}
     })).fired) return count;
     if (count++, count >= CASCADE_LIMIT)
       throw new CascadeLimitError({ instanceId, limit: CASCADE_LIMIT });
   }
 }
-async function findSatisfiedParentSpawn(client, child) {
+async function findResolvedParentSpawn(client, child, clientForGdr, clock) {
   const parentRef = child.ancestors.at(-1);
   if (parentRef === void 0) return;
   const parent = await client.getDocument(gdrToBareId(parentRef.id));
-  if (!parent || parent._type !== "workflow.instance" || typeof parent.definitionSnapshot != "string") return;
-  const definition = JSON.parse(parent.definitionSnapshot), stage = definition.stages.find((s) => s.id === parent.currentStageId);
+  if (!parent || parent._type !== WORKFLOW_INSTANCE_TYPE || typeof parent.definitionSnapshot != "string") return;
+  const definition = parseDefinitionSnapshot(parent), stage = definition.stages.find((s) => s.name === parent.currentStage);
   if (stage === void 0) return;
-  const parentCurrentTasks = findCurrentTasks(parent), task = (stage.tasks ?? []).find((t) => t.spawns === void 0 ? !1 : parentCurrentTasks.find((e) => e.id === t.id)?.spawnedInstances?.some((r) => gdrToBareId(r.id) === child._id) ?? !1);
-  if (task?.spawns === void 0) return;
-  const entry = parentCurrentTasks.find((e) => e.id === task.id);
-  if (!(entry === void 0 || entry.status === "done") && await checkSpawnCompletion(client, entry, task.spawns))
-    return { parent, definition, stage, task };
+  const parentCurrentTasks = findCurrentTasks(parent), task = (stage.tasks ?? []).find((t) => t.subworkflows === void 0 ? !1 : parentCurrentTasks.find((e) => e.name === t.name)?.spawnedInstances?.some((r) => gdrToBareId(r.id) === child._id) ?? !1);
+  if (task?.subworkflows === void 0) return;
+  const entry = parentCurrentTasks.find((e) => e.name === task.name);
+  if (entry === void 0 || entry.status !== "active") return;
+  const ctx = await buildEngineContext({
+    client,
+    clientForGdr,
+    instance: parent,
+    definition,
+    ...clock ? { clock } : {}
+  }), outcome = await evaluateResolutionGate(ctx, task, await taskConditionVars(ctx, entry));
+  if (outcome !== void 0)
+    return { parent, definition, stage, task, outcome };
 }
 async function propagateToAncestors(client, instanceId, actor, clientForGdr, clock) {
   const instance = await client.getDocument(instanceId);
   if (!instance) return;
-  const found = await findSatisfiedParentSpawn(client, instance);
+  const resolvedClientForGdr = clientForGdr ?? (() => client), found = await findResolvedParentSpawn(client, instance, resolvedClientForGdr, clock);
   if (found === void 0) return;
-  const { parent, definition, stage, task } = found, ctx = await buildEngineContext({
+  const { parent, definition, stage, task, outcome } = found, ctx = await buildEngineContext({
     client,
-    clientForGdr: clientForGdr ?? (() => client),
+    clientForGdr: resolvedClientForGdr,
     instance: parent,
     definition,
     ...clock ? { clock } : {}
-  }), mutation = startMutation(parent), mutEntry = currentTasks(mutation).find((e) => e.id === task.id);
-  if (mutEntry === void 0) return;
-  const previousStatus = mutEntry.status, now = ctx.now;
-  mutEntry.status = "done", mutEntry.completedAt = now, mutation.history.push(
-    taskStatusChangedEntry({
-      stageId: stage.id,
-      taskId: task.id,
-      from: previousStatus,
-      to: "done",
-      at: now,
-      ...actor !== void 0 ? { actor } : {}
-    })
-  ), await persist(ctx, mutation), await cascadeAutoTransitions(client, parent._id, actor, clientForGdr, clock), await propagateToAncestors(client, parent._id, actor, clientForGdr, clock);
+  }), mutation = startMutation(parent), mutEntry = currentTasks(mutation).find((e) => e.name === task.name);
+  mutEntry !== void 0 && (applyTaskStatusChange({
+    entry: mutEntry,
+    history: mutation.history,
+    stage: stage.name,
+    to: outcome,
+    at: ctx.now,
+    actor: gateActor(outcome)
+  }), await persist(ctx, mutation), await cascadeAutoTransitions(client, parent._id, actor, clientForGdr, clock), await propagateToAncestors(client, parent._id, actor, clientForGdr, clock));
 }
 function startMutation(instance) {
   return {
-    currentStageId: instance.currentStageId,
-    // Deep-ish copy. Per-scope state slot arrays need their own copies
+    currentStage: instance.currentStage,
+    // Deep-ish copy. Per-scope state entry arrays need their own copies
     // so ops can mutate without leaking into the source.
     state: (instance.state ?? []).map((s) => ({ ...s })),
     stages: instance.stages.map((s) => ({
       ...s,
-      state: (s.state ?? []).map((slot) => ({ ...slot })),
+      state: (s.state ?? []).map((entry) => ({ ...entry })),
       tasks: s.tasks.map((t) => ({
         ...t,
-        ...t.state !== void 0 ? { state: t.state.map((slot) => ({ ...slot })) } : {}
+        ...t.state !== void 0 ? { state: t.state.map((entry) => ({ ...entry })) } : {}
       }))
     })),
     pendingEffects: [...instance.pendingEffects],
@@ -1690,56 +2025,13 @@ function startMutation(instance) {
     history: [...instance.history],
     lastChangedAt: instance.lastChangedAt,
     ...instance.completedAt !== void 0 ? { completedAt: instance.completedAt } : {},
+    ...instance.abortedAt !== void 0 ? { abortedAt: instance.abortedAt } : {},
     pendingCreates: []
   };
 }
-function taskStatusChangedEntry(args) {
-  return {
-    _key: randomKey(),
-    _type: "workflow.history.taskStatusChanged",
-    at: args.at,
-    stageId: args.stageId,
-    taskId: args.taskId,
-    from: args.from,
-    to: args.to,
-    ...args.actor !== void 0 ? { actor: args.actor } : {}
-  };
-}
-function stageTransitionHistory(args) {
-  const { fromStageId, toStageId, at, transitionId, actor, via, reason } = args, shared = {
-    at,
-    ...transitionId !== void 0 ? { transitionId } : {},
-    ...actor !== void 0 ? { actor } : {},
-    ...via !== void 0 ? { via } : {},
-    ...reason !== void 0 ? { reason } : {}
-  };
-  return [
-    {
-      _key: randomKey(),
-      _type: "workflow.history.stageExited",
-      stageId: fromStageId,
-      toStageId,
-      ...shared
-    },
-    {
-      _key: randomKey(),
-      _type: "workflow.history.transitionFired",
-      fromStageId,
-      toStageId,
-      ...shared
-    },
-    {
-      _key: randomKey(),
-      _type: "workflow.history.stageEntered",
-      stageId: toStageId,
-      fromStageId,
-      ...shared
-    }
-  ];
-}
 function instanceStateFields(src) {
   const fields = {
-    currentStageId: src.currentStageId,
+    currentStage: src.currentStage,
     state: src.state,
     stages: src.stages,
     pendingEffects: src.pendingEffects,
@@ -1747,12 +2039,12 @@ function instanceStateFields(src) {
     effectsContext: src.effectsContext,
     history: src.history
   };
-  return src.completedAt !== void 0 && (fields.completedAt = src.completedAt), fields;
+  return src.completedAt !== void 0 && (fields.completedAt = src.completedAt), src.abortedAt !== void 0 && (fields.abortedAt = src.abortedAt), fields;
 }
 function materializeInstance(base, mutation) {
   return {
     ...base,
-    currentStageId: mutation.currentStageId,
+    currentStage: mutation.currentStage,
     state: mutation.state,
     stages: mutation.stages
   };
@@ -1775,32 +2067,29 @@ async function persist(ctx, mutation) {
     throw new Error(`Instance ${ctx.instance._id} disappeared after transaction commit`);
   return reloaded;
 }
-function findOpenStageEntry(host) {
-  return host.stages.find((s) => s.id === host.currentStageId && s.exitedAt === void 0);
-}
 function currentStageEntry(mutation) {
   const entry = findOpenStageEntry(mutation);
   if (entry === void 0)
     throw new Error(
-      `Mutation invariant broken: no current (un-exited) StageEntry for currentStageId "${mutation.currentStageId}"`
+      `Mutation invariant broken: no current (un-exited) StageEntry for currentStage "${mutation.currentStage}"`
     );
   return entry;
 }
 function currentTasks(mutation) {
   return currentStageEntry(mutation).tasks;
 }
-function findTaskInCurrentStage(ctx, taskId) {
-  const stage = findStage(ctx.definition, ctx.instance.currentStageId), task = (stage.tasks ?? []).find((t) => t.id === taskId);
+function findTaskInCurrentStage(ctx, taskName) {
+  const stage = findStage(ctx.definition, ctx.instance.currentStage), task = (stage.tasks ?? []).find((t) => t.name === taskName);
   if (task === void 0)
     throw new Error(
-      `Task "${taskId}" not found in current stage "${stage.id}" of ${ctx.definition.workflowId}`
+      `Task "${taskName}" not found in current stage "${stage.name}" of ${ctx.definition.name}`
     );
   return { stage, task };
 }
-function requireMutationTaskEntry(mutation, taskId) {
-  const mutEntry = currentTasks(mutation).find((t) => t.id === taskId);
+function requireMutationTaskEntry(mutation, task) {
+  const mutEntry = currentTasks(mutation).find((t) => t.name === task);
   if (mutEntry === void 0)
-    throw new Error(`Task "${taskId}" disappeared from mutation copy \u2014 invariant broken`);
+    throw new Error(`Task "${task}" disappeared from mutation copy \u2014 invariant broken`);
   return mutEntry;
 }
 function findCurrentStageEntry(instance) {
@@ -1825,15 +2114,15 @@ async function completeEffect(args) {
   );
 }
 function buildEffectHistoryEntry(pending, outcome) {
-  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome;
+  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome, resolvedActor = actor ?? pending.actor;
   return {
     _key: pending._key,
-    effectId: pending.effectId,
+    name: pending.name,
     ...pending.title !== void 0 ? { title: pending.title } : {},
     ...pending.description !== void 0 ? { description: pending.description } : {},
     params: pending.params,
     origin: pending.origin,
-    ...actor !== void 0 ? { actor } : pending.actor !== void 0 ? { actor: pending.actor } : {},
+    ...resolvedActor !== void 0 ? { actor: resolvedActor } : {},
     ranAt,
     ...durationMs !== void 0 ? { durationMs } : {},
     status,
@@ -1842,11 +2131,9 @@ function buildEffectHistoryEntry(pending, outcome) {
     ...outputs !== void 0 ? { outputs } : {}
   };
 }
-function upsertEffectsContext(mutation, outputs) {
-  for (const [id, value] of Object.entries(outputs)) {
-    const existingIndex = mutation.effectsContext.findIndex((e) => e.id === id), entry = effectsContextEntry(id, value);
-    existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
-  }
+function upsertEffectsContext(mutation, effectName, outputs) {
+  const existingIndex = mutation.effectsContext.findIndex((e) => e.name === effectName), entry = effectsContextJsonEntry(effectName, outputs);
+  existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
 }
 async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, error, durationMs, actor) {
   const pending = ctx.instance.pendingEffects.find((e) => e._key === effectKey);
@@ -1857,12 +2144,12 @@ async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, err
   const ranAt = ctx.now;
   return mutation.effectHistory.push(
     buildEffectHistoryEntry(pending, { status, ranAt, actor, detail, error, durationMs, outputs })
-  ), status === "done" && outputs !== void 0 && upsertEffectsContext(mutation, outputs), mutation.history.push({
+  ), status === "done" && outputs !== void 0 && upsertEffectsContext(mutation, pending.name, outputs), mutation.history.push({
     _key: randomKey(),
-    _type: "workflow.history.effectCompleted",
+    _type: "effectCompleted",
     at: ranAt,
     effectKey,
-    effectId: pending.effectId,
+    effect: pending.name,
     status,
     ...outputs !== void 0 ? { outputs } : {},
     ...detail !== void 0 ? { detail } : {},
@@ -1872,8 +2159,8 @@ async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, err
 function buildQueuedEffect(effect, origin, params, actor, now) {
   const key = randomKey(), pending = {
     _key: key,
-    _type: "workflow.pendingEffect",
-    effectId: effect.id,
+    _type: "pendingEffect",
+    name: effect.name,
     ...effect.title !== void 0 ? { title: effect.title } : {},
     ...effect.description !== void 0 ? { description: effect.description } : {},
     ...effect.bindings !== void 0 ? { bindings: effect.bindings } : {},
@@ -1883,338 +2170,69 @@ function buildQueuedEffect(effect, origin, params, actor, now) {
     queuedAt: now
   }, history = {
     _key: randomKey(),
-    _type: "workflow.history.effectQueued",
+    _type: "effectQueued",
     at: now,
     effectKey: key,
-    effectId: effect.id,
+    effect: effect.name,
     origin
   };
   return { pending, history };
 }
-async function queueEffects(ctx, mutation, effects, origin, actor, callerParams) {
-  if (!effects) return;
-  const now = ctx.now, liveInstance = {
-    ...ctx.instance,
-    state: mutation.state,
-    stages: mutation.stages,
-    effectsContext: mutation.effectsContext
-  };
+async function queueEffects(ctx, mutation, effects, origin, actor, opts) {
+  if (!effects || effects.length === 0) return;
+  const now = ctx.now, liveCtx = { ...ctx, instance: materializeInstance(ctx.instance, mutation) }, params = await ctxConditionParams(liveCtx, {
+    ...opts?.taskName !== void 0 ? { taskName: opts.taskName } : {},
+    ...actor !== void 0 ? { actor } : {},
+    // Caller-supplied action params, readable in bindings as `$params.<name>`.
+    vars: { params: opts?.callerParams ?? {} }
+  });
   for (const effect of effects) {
-    const params = await resolveBindings({
+    const resolved = await resolveBindings({
       bindings: effect.bindings,
       staticInput: effect.input,
-      instance: liveInstance,
-      now,
-      ...callerParams !== void 0 ? { params: callerParams } : {},
-      ...actor !== void 0 ? { actor } : {}
-    }), { pending, history } = buildQueuedEffect(effect, origin, params, actor, now);
+      snapshot: ctx.snapshot,
+      params
+    }), { pending, history } = buildQueuedEffect(effect, origin, resolved, actor, now);
     mutation.pendingEffects.push(pending), mutation.history.push(history);
   }
 }
-const STATE_OP_TYPES = [
-  "workflow.op.state.set",
-  "workflow.op.state.append",
-  "workflow.op.state.updateWhere",
-  "workflow.op.state.removeWhere"
-];
-function isStateOp(summary) {
-  return STATE_OP_TYPES.includes(summary.opType);
-}
-function validateActionParams(action, taskId, callerParams) {
-  const declared = action.params ?? [], params = callerParams ?? {}, issues = [];
-  for (const decl of declared) {
-    const value = params[decl.id], present = decl.id in params && value !== void 0 && value !== null;
-    if (decl.required === !0 && !present) {
-      issues.push({ paramId: decl.id, reason: "required but missing" });
-      continue;
-    }
-    present && (checkParamType(value, decl) || issues.push({
-      paramId: decl.id,
-      reason: `expected paramType=${decl.paramType}, got ${typeof value}`
-    }));
-  }
-  if (issues.length > 0)
-    throw new ActionParamsInvalidError({ action: action.id, taskId, issues });
-  return params;
-}
-function hasStringField(value, field) {
-  return typeof value == "object" && value !== null && field in value && typeof value[field] == "string";
-}
-function checkParamType(value, decl) {
-  switch (decl.paramType) {
-    case "string":
-    case "url":
-    case "dateTime":
-      return typeof value == "string";
-    case "number":
-      return typeof value == "number" && Number.isFinite(value);
-    case "boolean":
-      return typeof value == "boolean";
-    case "actor":
-      return hasStringField(value, "kind");
-    case "doc.ref":
-      return hasStringField(value, "id");
-    case "doc.refs":
-      return Array.isArray(value) && value.every((v2) => checkParamType(v2, { paramType: "doc.ref" }));
-    case "json":
-      return !0;
-    default:
-      return !1;
-  }
-}
-async function runActionOps(args) {
-  const { ops, mutation, stageId, taskId, actionName, params, actor, self, now } = args;
-  if (ops === void 0 || ops.length === 0) return [];
-  const summaries = [];
-  for (const op of ops) {
-    const summary = applyOp(op, { mutation, stageId, taskId, params, actor, self, now });
-    summaries.push(summary), mutation.history.push({
-      _key: randomKey(),
-      _type: "workflow.history.opApplied",
-      at: now,
-      stageId,
-      taskId,
-      actionId: actionName,
-      opType: summary.opType,
-      ...summary.target !== void 0 ? { target: summary.target } : {},
-      ...summary.resolved !== void 0 ? { resolved: summary.resolved } : {},
-      ...actor !== void 0 ? { actor } : {}
-    });
-  }
-  return summaries;
-}
-function applyOp(op, ctx) {
-  switch (op.type) {
-    case "workflow.op.state.set":
-      return applyStateSet(op, ctx);
-    case "workflow.op.state.append":
-      return applyStateAppend(op, ctx);
-    case "workflow.op.state.updateWhere":
-      return applyStateUpdateWhere(op, ctx);
-    case "workflow.op.state.removeWhere":
-      return applyStateRemoveWhere(op, ctx);
-    case "workflow.op.status.set":
-      return applyStatusSet(op, ctx);
-  }
-}
-function applyStateSet(op, ctx) {
-  const value = resolveOpSource(op.value, ctx), slot = locateSlot(
-    ctx,
-    op.target,
-    /*createIfMissing*/
-    !0
-  );
-  return slot !== void 0 && (validateSlotValue({ slotType: slot._type, slotId: slot.id, value }), slot.value = value), { opType: op.type, target: op.target, resolved: { value } };
-}
-function applyStateAppend(op, ctx) {
-  const item = resolveOpSource(op.item, ctx), slot = locateSlot(
-    ctx,
-    op.target,
-    /*createIfMissing*/
-    !0
-  );
-  if (slot !== void 0) {
-    validateSlotAppendItem({ slotType: slot._type, slotId: slot.id, item });
-    const current = Array.isArray(slot.value) ? slot.value : [];
-    slot.value = [...current, withRowKey(item)];
-  }
-  return { opType: op.type, target: op.target, resolved: { item } };
-}
-function withRowKey(item) {
-  return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? { _key: randomKey(), ...item } : item;
-}
-function applyStateUpdateWhere(op, ctx) {
-  const slot = locateSlot(
-    ctx,
-    op.target,
-    /*createIfMissing*/
-    !1
-  ), resolvedMerge = {};
-  for (const [k, v2] of Object.entries(op.merge))
-    resolvedMerge[k] = resolveOpSource(v2, ctx);
-  return slot !== void 0 && Array.isArray(slot.value) && (slot.value = slot.value.map(
-    (row) => evalOpPredicate(op.where, row, ctx) ? { ...row, ...resolvedMerge } : row
-  )), { opType: op.type, target: op.target, resolved: { merge: resolvedMerge } };
-}
-function applyStateRemoveWhere(op, ctx) {
-  const slot = locateSlot(
-    ctx,
-    op.target,
-    /*createIfMissing*/
-    !1
-  );
-  return slot !== void 0 && Array.isArray(slot.value) && (slot.value = slot.value.filter(
-    (row) => !evalOpPredicate(op.where, row, ctx)
-  )), { opType: op.type, target: op.target };
-}
-function applyStatusSet(op, ctx) {
-  const entry = findOpenStageEntry(ctx.mutation)?.tasks.find((t) => t.id === op.taskId);
-  return entry !== void 0 && (entry.status = op.status), { opType: op.type, resolved: { taskId: op.taskId, status: op.status } };
-}
-function locateSlot(ctx, target, createIfMissing) {
-  let host;
-  if (target.scope === "workflow")
-    host = ctx.mutation.state;
-  else if (target.scope === "stage")
-    host = findOpenStageEntry(ctx.mutation)?.state;
-  else {
-    const task = findOpenStageEntry(ctx.mutation)?.tasks.find((t) => t.id === ctx.taskId);
-    host = task?.state, host === void 0 && task !== void 0 && createIfMissing && (task.state = [], host = task.state);
-  }
-  if (host === void 0)
-    throw new Error(
-      `Op target scope "${target.scope}" has no state container on this instance \u2014 declare the slot or check stage/task identity`
-    );
-  let slot = host.find((s) => s.id === target.slotId);
-  return slot === void 0 && createIfMissing && (slot = {
-    _key: randomKey(),
-    _type: "workflow.state.value.string",
-    id: target.slotId,
-    value: null
-  }, host.push(slot)), slot;
-}
-function resolveOpSource(src, ctx) {
-  const staticValue = resolveStaticSource(src, ctx);
-  if (staticValue.handled) return staticValue.value;
-  switch (src.source) {
-    case "self":
-      return ctx.self;
-    case "stageId":
-      return ctx.stageId;
-    case "stateRead": {
-      const value = readSlotFromMutation(ctx, src.scope, src.slotId);
-      return src.path !== void 0 ? getPath(value, src.path) : value;
-    }
-    case "effectOutput": {
-      const entry = ctx.mutation.effectsContext.find((e) => e.id === src.contextId);
-      if (entry === void 0) return null;
-      const v2 = src.path !== void 0 ? getPath(entry.value, src.path) : entry.value;
-      return v2 === void 0 ? null : v2;
-    }
-    case "object": {
-      const out = {};
-      for (const [field, fieldSrc] of Object.entries(src.fields))
-        out[field] = resolveOpSource(fieldSrc, ctx);
-      return out;
-    }
-    case "row":
-    case "parentState":
-      return;
-    default:
-      return;
-  }
-}
-function slotValue(slots, slotId) {
-  return slots?.find((s) => s.id === slotId)?.value;
-}
-function readSlotFromMutation(ctx, scope, slotId) {
-  if (scope === "workflow") return slotValue(ctx.mutation.state, slotId);
-  const stageEntry = findOpenStageEntry(ctx.mutation);
-  if (scope === "stage") return slotValue(stageEntry?.state, slotId);
-  const task = stageEntry?.tasks.find((t) => t.id === ctx.taskId);
-  return slotValue(task?.state, slotId);
-}
-function evalOpPredicate(p, row, ctx) {
-  if ("all" in p) return p.all.every((sub) => evalOpPredicate(sub, row, ctx));
-  if ("any" in p) return p.any.some((sub) => evalOpPredicate(sub, row, ctx));
-  const target = resolveOpSource(p.equals, ctx);
-  return row[p.field] === target;
-}
-async function fireAction(args) {
-  const { client, instanceId, taskId, action, params, options } = args;
-  for (let attempt = 1; attempt <= CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS; attempt++) {
-    const ctx = await loadContext(client, instanceId, {
-      ...options?.clock ? { clock: options.clock } : {}
-    });
-    try {
-      return await commitAction(ctx, taskId, action, params, options?.actor);
-    } catch (error) {
-      if (!isRevisionConflict(error)) throw error;
-    }
-  }
-  throw new ConcurrentFireActionError({
-    instanceId,
-    taskId,
-    action,
-    attempts: CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS
+async function abortInstance(args) {
+  const { client, instanceId, reason, options } = args, ctx = await loadContext(client, instanceId, {
+    ...options?.clock ? { clock: options.clock } : {}
   });
+  return commitAbort(ctx, reason, options?.actor);
 }
-async function resolveActionCommit(ctx, taskId, actionName, callerParams) {
-  const { stage, task } = findTaskInCurrentStage(ctx, taskId), action = (task.actions ?? []).find((a) => a.id === actionName);
-  if (action === void 0)
-    throw new Error(`Action "${actionName}" not declared on task "${taskId}"`);
-  if (!await ctxEvaluateFilter(ctx, action.filter))
-    throw new Error(`Action "${actionName}" filter rejected on task "${taskId}"`);
-  const entry = findCurrentTasks(ctx.instance).find((t) => t.id === taskId);
-  if (entry === void 0 || entry.status !== "active")
-    throw new Error(
-      `Task "${taskId}" must be active to fire action "${actionName}"; status is ${entry?.status ?? "missing"}`
-    );
-  const params = validateActionParams(action, taskId, callerParams);
-  return { stage, task, action, params };
-}
-function applyActionSetStatus(action, mutation, mutEntry, stageId, taskId, actor, now) {
-  if (action.setStatus === void 0) return;
-  const initialStatus = mutEntry.status, newStatus = action.setStatus;
-  return mutEntry.status = newStatus, mutEntry.completedAt = now, actor && (mutEntry.completedBy = actor.id), mutation.history.push(
-    taskStatusChangedEntry({
-      stageId,
-      taskId,
-      from: initialStatus,
-      to: newStatus,
-      at: now,
-      ...actor !== void 0 ? { actor } : {}
-    })
-  ), newStatus;
-}
-async function commitAction(ctx, taskId, actionName, callerParams, actor) {
-  const { stage, task, action, params } = await resolveActionCommit(
-    ctx,
-    taskId,
-    actionName,
-    callerParams
-  ), mutation = startMutation(ctx.instance), mutEntry = requireMutationTaskEntry(mutation, taskId), now = ctx.now;
-  mutation.history.push({
+async function commitAbort(ctx, reason, actor) {
+  if (ctx.instance.completedAt !== void 0)
+    return { fired: !1 };
+  const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), at = ctx.now, openEntry = findOpenStageEntry(mutation);
+  return openEntry !== void 0 && (openEntry.exitedAt = at), mutation.effectHistory.push(
+    ...mutation.pendingEffects.map(
+      (pending) => buildEffectHistoryEntry(pending, {
+        status: "failed",
+        ranAt: at,
+        actor,
+        detail: "instance aborted before dispatch",
+        error: void 0,
+        durationMs: void 0,
+        outputs: void 0
+      })
+    )
+  ), mutation.pendingEffects = [], mutation.history.push({
     _key: randomKey(),
-    _type: "workflow.history.actionFired",
-    at: now,
-    stageId: stage.id,
-    taskId,
-    actionId: actionName,
+    _type: "aborted",
+    at,
+    stage: stage.name,
+    ...reason !== void 0 ? { reason } : {},
     ...actor !== void 0 ? { actor } : {}
-  });
-  const ranOps = await runActionOps({
-    ops: action.ops,
-    mutation,
-    stageId: stage.id,
-    taskId,
-    actionName,
-    params,
-    actor,
-    self: selfGdr(ctx.instance),
-    now
-  }), newStatus = applyActionSetStatus(action, mutation, mutEntry, stage.id, taskId, actor, now);
-  return await queueEffects(
-    ctx,
-    mutation,
-    action.effects,
-    {
-      kind: "action",
-      id: `${task.id}:${actionName}`
-    },
-    actor,
-    params
-  ), await persistThenDeploy(
-    ctx,
-    mutation,
-    () => ranOps.some(isStateOp) ? refreshStageGuards(ctx, mutation, stage.id) : Promise.resolve()
-  ), {
-    fired: !0,
-    taskId,
-    action: actionName,
-    ...newStatus !== void 0 ? { newStatus } : {},
-    ...ranOps.length > 0 ? { ranOps } : {}
-  };
+  }), mutation.completedAt = at, mutation.abortedAt = at, await persist(ctx, mutation), await retractStageGuards({
+    client: ctx.client,
+    clientForGdr: ctx.clientForGdr,
+    instance: ctx.instance,
+    definition: ctx.definition,
+    stageName: stage.name,
+    now: ctx.now
+  }), { fired: !0, stage: stage.name };
 }
 const parsedFilters = /* @__PURE__ */ new Map();
 async function matchesFilter(args) {
@@ -2255,7 +2273,7 @@ async function resolveAccess(client, args = {}) {
       );
     return { actor: overrideActor };
   }
-  const actorPromise = overrideActor !== void 0 ? Promise.resolve(overrideActor) : cachedActor(client, requestFn), grantsPromise = overrideGrants !== void 0 ? Promise.resolve(overrideGrants) : args.grantsFromPath !== void 0 ? cachedGrants(client, requestFn, args.grantsFromPath) : Promise.resolve(void 0), [actor, grants] = await Promise.all([actorPromise, grantsPromise]);
+  const actorPromise = overrideActor !== void 0 ? Promise.resolve(overrideActor) : cachedActor(client, requestFn), grantsPromise = resolveGrants(overrideGrants, args.grantsFromPath, client, requestFn), [actor, grants] = await Promise.all([actorPromise, grantsPromise]);
   if (actor === void 0)
     throw new Error(
       "workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity \u2014 check the token, or pass `access.actor` explicitly."
@@ -2270,6 +2288,9 @@ function cachedActor(client, requestFn) {
   });
   return actorCache.set(client, pending), pending;
 }
+function resolveGrants(overrideGrants, grantsFromPath, client, requestFn) {
+  return overrideGrants !== void 0 ? Promise.resolve(overrideGrants) : grantsFromPath !== void 0 ? cachedGrants(client, requestFn, grantsFromPath) : Promise.resolve(void 0);
+}
 function cachedGrants(client, requestFn, resourcePath) {
   let byPath = grantsCache.get(client);
   byPath === void 0 && (byPath = /* @__PURE__ */ new Map(), grantsCache.set(client, byPath));
@@ -2307,20 +2328,93 @@ async function fetchGrantsCached(requestFn, resourcePath) {
     return;
   }
 }
-const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
-function validateTags(tags) {
-  if (tags.length === 0)
-    throw new Error("tags: must be a non-empty array");
-  for (const tag of tags)
-    if (!TAG_RE.test(tag))
-      throw new Error(
-        `tags: invalid tag "${tag}" \u2014 must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`
-      );
+const resourceKey = (r) => `${r.type}.${r.id}`;
+function guardsForResource(client) {
+  return client.fetch("*[_type == $t] | order(_id asc)", { t: GUARD_DOC_TYPE });
+}
+function instanceGuardQuery(instanceId) {
+  return {
+    query: "*[_type == $guardType && sourceInstanceId == $instanceId]",
+    params: { guardType: GUARD_DOC_TYPE, instanceId }
+  };
+}
+function verdictGuardsForInstance(client, instanceId) {
+  const { query, params } = instanceGuardQuery(instanceId);
+  return client.fetch(query, params);
+}
+async function guardsForInstance(args) {
+  const { client, clientForGdr, instance } = args, stateUris = [
+    ...collectEntryDocUris(instance.state),
+    ...instance.stages.flatMap((stage) => collectEntryDocUris(stage.state))
+  ], clients = resourceClientMap(
+    instance.workflowResource,
+    client,
+    clientForGdr,
+    stateUris.map((uri) => tryParseGdr(uri))
+  ), { query, params } = instanceGuardQuery(instance._id);
+  return queryGuardsAcross(clients.values(), query, params);
+}
+async function guardsForDefinition(args) {
+  const { client, clientForGdr, workflowResource, definition, definitions } = args, gdrs = definitions.flatMap(
+    (def) => guardIdRefs(def).map(({ idRef, stage }) => staticIdRefGdr(idRef, stage, def))
+  ), clients = resourceClientMap(workflowResource, client, clientForGdr, gdrs);
+  return queryGuardsAcross(clients.values(), "*[_type == $t && sourceDefinition == $definition]", {
+    t: GUARD_DOC_TYPE,
+    definition
+  });
+}
+function guardIdRefs(definition) {
+  return definition.stages.flatMap(
+    (stage) => (stage.guards ?? []).flatMap(
+      (guard) => (guard.match.idRefs ?? []).map((idRef) => ({ idRef, stage }))
+    )
+  );
+}
+function staticIdRefGdr(idRef, stage, definition) {
+  const read = /^\$state\.([\w-]+)/.exec(idRef);
+  if (read === null) return;
+  const source = entriesInScope(stage, definition).find((e) => e.name === read[1])?.source;
+  return source?.type === "literal" ? gdrFromValue(source.value) : void 0;
+}
+function entriesInScope(stage, definition) {
+  return [
+    ...definition.state ?? [],
+    ...stage.state ?? [],
+    ...(stage.tasks ?? []).flatMap((task) => task.state ?? [])
+  ];
+}
+function gdrFromValue(value) {
+  if (typeof value == "string") return tryParseGdr(value);
+  if (typeof value == "object" && value !== null && "id" in value) {
+    const id = value.id;
+    return typeof id == "string" ? tryParseGdr(id) : void 0;
+  }
+}
+function tryParseGdr(uri) {
+  try {
+    return parseGdr(uri);
+  } catch {
+    return;
+  }
+}
+function resourceClientMap(base, baseClient, clientForGdr, gdrs) {
+  const map = /* @__PURE__ */ new Map([[resourceKey(base), baseClient]]);
+  for (const parsed of gdrs) {
+    if (parsed === void 0) continue;
+    const key = resourceKey(resourceFromParsed(parsed));
+    map.has(key) || map.set(key, clientForGdr(parsed));
+  }
+  return map;
 }
-function canonicalTag(tags) {
-  return tags[0];
+async function queryGuardsAcross(clients, query, params) {
+  const perResource = await Promise.all(
+    [...clients].map((c) => c.fetch(query, params))
+  );
+  return dedupById(perResource.flat());
+}
+function dedupById(guards) {
+  return [...new Map(guards.map((g) => [g._id, g])).values()].sort((a, b) => a._id.localeCompare(b._id));
 }
-const WILDCARD_ROLE = "*";
 async function evaluateInstance(args) {
   const { client, tags, instanceId, resourceClients } = args, now = (args.clock ?? wallClock)();
   validateTags(tags);
@@ -2332,41 +2426,45 @@ async function evaluateInstance(args) {
     throw new Error(`Workflow instance "${instanceId}" not found`);
   if (!tags.some((t) => instance.tags?.includes(t)))
     throw new Error(`Workflow instance "${instanceId}" not visible to this engine (tag mismatch)`);
-  const definition = parseDefinitionSnapshot(instance), stage = definition.stages.find((s) => s.id === instance.currentStageId);
+  const definition = parseDefinitionSnapshot(instance), snapshot = await hydrateSnapshot({ client, clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client, instance }), guards = await verdictGuardsForInstance(client, instance._id);
+  return evaluateFromSnapshot({
+    instance,
+    definition,
+    actor,
+    snapshot,
+    guards,
+    now,
+    ...grants !== void 0 ? { grants } : {}
+  });
+}
+async function evaluateFromSnapshot(args) {
+  const { instance, definition, actor, grants, snapshot } = args, now = args.now ?? wallClock(), stage = definition.stages.find((s) => s.name === instance.currentStage);
   if (stage === void 0)
     throw new Error(
-      `Instance "${instanceId}" currentStageId "${instance.currentStageId}" not in definition`
+      `Instance "${instance._id}" currentStage "${instance.currentStage}" not in definition`
     );
-  const snapshot = await hydrateSnapshot({
-    client,
-    clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client,
-    instance,
-    definition
-  }), currentTaskEntries = instance.stages.find(
-    (s) => s.id === instance.currentStageId && s.exitedAt === void 0
-  )?.tasks ?? [], taskEvaluations = [];
+  const scope = await renderScope({ instance, definition, actor, grants, snapshot, now }), currentTaskEntries = findOpenStageEntry(instance)?.tasks ?? [], guardDenial = await instanceGuardReason(instance, actor, args.guards), taskEvaluations = [];
   for (const task of stage.tasks ?? [])
     taskEvaluations.push(
       await evaluateTask({
         task,
-        statusEntry: currentTaskEntries.find((t) => t.id === task.id),
+        statusEntry: currentTaskEntries.find((t) => t.name === task.name),
         instance,
-        definition,
         actor,
-        grants,
         snapshot,
-        now
+        scope,
+        stageHasExits: !isTerminalStage(stage),
+        guardDenial
       })
     );
   const transitionEvaluations = [];
   for (const transition of stage.transitions ?? [])
     transitionEvaluations.push({
       transition,
-      filterSatisfied: await evaluateFilter({
-        filter: transition.filter,
-        definition,
+      filterSatisfied: await evaluateCondition({
+        condition: transition.filter,
         snapshot,
-        params: buildParams(instance, now)
+        params: scope
       })
     });
   const currentStage = {
@@ -2383,164 +2481,102 @@ async function evaluateInstance(args) {
     canInteract
   };
 }
+async function renderScope(args) {
+  const { instance, definition, actor, grants, snapshot, now } = args, params = {
+    ...buildParams({ instance, now, snapshot }),
+    actor,
+    assigned: !1,
+    can: await advisoryCan(instance, actor, grants)
+  };
+  return { ...await evaluatePredicates({
+    predicates: definition.predicates,
+    snapshot,
+    params
+  }), ...params };
+}
+async function advisoryCan(instance, actor, grants) {
+  if (grants === void 0) return;
+  const can = {};
+  for (const permission of DOCUMENT_VALUE_PERMISSIONS)
+    can[permission] = await grantsPermissionOn({
+      document: instance,
+      grants,
+      permission,
+      userId: actor.id
+    });
+  return can;
+}
 async function evaluateTask(args) {
-  const { task, statusEntry, instance, definition, actor, grants, snapshot, now } = args, status = statusEntry?.status ?? "pending", actions = [];
+  const { task, statusEntry, instance, actor, snapshot, scope, stageHasExits, guardDenial } = args, status = statusEntry?.status ?? "pending", assigned = assignedFor(instance, task.name, actor), taskScope = {
+    ...scope,
+    state: {
+      ...scope.state,
+      ...scopedStateOverlay(instance, snapshot, task.name)
+    },
+    assigned
+  }, actions = [];
   for (const action of task.actions ?? [])
     actions.push(
       await evaluateAction({
         action,
-        task,
-        ...statusEntry !== void 0 ? { statusEntry } : {},
         status,
         instance,
-        definition,
-        actor,
-        ...grants !== void 0 ? { grants } : {},
         snapshot,
-        now
+        taskScope,
+        stageHasExits,
+        guardDenial
       })
     );
   return {
     task,
     status,
     // "pending on actor" treats both `pending` and `active` as waiting on
-    // the assignee — pending tasks just haven't been auto-invoked yet, but
-    // they're still inbox items.
-    pendingOnActor: (status === "active" || status === "pending") && actorIsAssignee(actor, task.assignees ?? []),
+    // the assignee — pending tasks just haven't been activated yet, but
+    // they're still inbox items. The inbox reads the assignees-kind state
+    // entry BY KIND (who-data is state).
+    pendingOnActor: (status === "active" || status === "pending") && assigned,
     actions
   };
 }
 async function evaluateAction(args) {
-  const { action, task, status, instance, definition, actor, grants, snapshot, now } = args, syncReason = lifecycleReason(instance, definition, status) ?? actorReason(action, task, actor);
-  if (syncReason !== void 0) return disabled(action, syncReason);
-  const asyncReason = await permissionReason(action, instance, actor, grants) ?? await filterReason(action, instance, definition, snapshot, now);
-  return asyncReason !== void 0 ? disabled(action, asyncReason) : { action, allowed: !0 };
+  const { action, status, instance, snapshot, taskScope, stageHasExits, guardDenial } = args, lifecycle = lifecycleReason(instance, status, stageHasExits);
+  return lifecycle !== void 0 ? disabled(action, lifecycle) : guardDenial !== void 0 ? disabled(action, guardDenial) : action.filter !== void 0 && !await evaluateCondition({
+    condition: action.filter,
+    snapshot,
+    params: taskScope
+  }) ? disabled(action, { kind: "filter-failed", filter: action.filter }) : { action, allowed: !0 };
+}
+async function instanceGuardReason(instance, actor, guards) {
+  if (guards === void 0 || guards.length === 0) return;
+  const denied = await instanceWriteDenials({ instance, guards, identity: actor.id });
+  if (denied.length !== 0)
+    return {
+      kind: "mutation-guard-denied",
+      guardIds: denied.map((g) => g._id),
+      detail: denied.map((g) => g.name ?? g._id).join(", ")
+    };
 }
-function lifecycleReason(instance, definition, status) {
+function lifecycleReason(instance, status, stageHasExits) {
   if (instance.completedAt !== void 0)
     return { kind: "instance-completed", completedAt: instance.completedAt };
-  if (definition.stages.find((s) => s.id === instance.currentStageId)?.kind === "terminal")
-    return { kind: "stage-terminal", stageId: instance.currentStageId };
-  if (status === "done" || status === "skipped" || status === "failed")
+  if (!stageHasExits)
+    return { kind: "stage-terminal", stage: instance.currentStage };
+  if (isTerminalTaskStatus(status))
     return { kind: "task-not-active", status };
 }
-function actorReason(action, task, actor) {
-  const actorRoles = actor.roles ?? [];
-  if (action.roles !== void 0 && action.roles.length > 0 && !(actorRoles.includes(WILDCARD_ROLE) || action.roles.some((r) => actorRoles.includes(r))))
-    return { kind: "role-required", required: [...action.roles], actorRoles: [...actorRoles] };
-  if (action.requireAssignment === !0 && !actorIsAssignee(actor, task.assignees ?? []))
-    return { kind: "not-assigned", assignees: [...task.assignees ?? []], actorId: actor.id };
-}
-async function permissionReason(action, instance, actor, grants) {
-  if (grants === void 0) return;
-  const permission = action.requiredPermission ?? "update";
-  if (!await grantsPermissionOn({
-    document: instance,
-    grants,
-    permission,
-    userId: actor.id
-  }))
-    return { kind: "permission-denied", permission, matchingGrants: grants.length };
-}
-async function filterReason(action, instance, definition, snapshot, now) {
-  if (!(action.filter === void 0 || await evaluateFilter({
-    filter: action.filter,
-    definition,
-    snapshot,
-    params: buildParams(instance, now)
-  })))
-    return { kind: "filter-failed", filter: action.filter };
-}
 function disabled(action, reason) {
   return { action, allowed: !1, disabledReason: reason };
 }
-function actorIsAssignee(actor, assignees) {
-  if (assignees.length === 0) return !1;
-  const actorRoles = actor.roles ?? [], wildcard = actorRoles.includes(WILDCARD_ROLE);
-  for (const assignee of assignees)
-    if (assignee.kind === "user" && assignee.id === actor.id || assignee.kind === "role" && (wildcard || actorRoles.includes(assignee.role)))
-      return !0;
-  return !1;
-}
-function parseDefinitionSnapshot(instance) {
-  try {
-    return JSON.parse(instance.definitionSnapshot);
-  } catch (err) {
-    throw new Error(
-      `Failed to parse definitionSnapshot on instance "${instance._id}": ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err }
-    );
-  }
-}
-const resourceKey = (r) => `${r.type}.${r.id}`;
-function guardsForResource(client) {
-  return client.fetch("*[_type == $t] | order(_id asc)", { t: GUARD_DOC_TYPE });
-}
-async function guardsForInstance(args) {
-  const { client, clientForGdr, instance } = args, clientsByResource = /* @__PURE__ */ new Map([
-    [resourceKey(instance.workflowResource), client]
-  ]), stateUris = [
-    ...collectSlotDocUris(instance.state),
-    ...instance.stages.flatMap((stage) => collectSlotDocUris(stage.state))
-  ];
-  for (const uri of stateUris) {
-    const parsed = tryParseGdr(uri);
-    if (parsed === void 0) continue;
-    const key = resourceKey(resourceFromParsed(parsed));
-    clientsByResource.has(key) || clientsByResource.set(key, clientForGdr(parsed));
-  }
-  const perResource = await Promise.all(
-    [...clientsByResource.values()].map(
-      (c) => c.fetch("*[_type == $t && sourceInstanceId == $id]", {
-        t: GUARD_DOC_TYPE,
-        id: instance._id
-      })
-    )
-  );
-  return dedupById(perResource.flat());
-}
-function tryParseGdr(uri) {
-  try {
-    return parseGdr(uri);
-  } catch {
-    return;
-  }
-}
-function dedupById(guards) {
-  return [...new Map(guards.map((g) => [g._id, g])).values()].sort((a, b) => a._id.localeCompare(b._id));
-}
-class ActionDisabledError extends Error {
-  reason;
-  taskId;
-  action;
-  constructor(args) {
-    super(formatDisabledReason(args.taskId, args.action, args.reason)), this.name = "ActionDisabledError", this.reason = args.reason, this.taskId = args.taskId, this.action = args.action;
-  }
-}
-const disabledReasonDetail = {
-  "role-required": (r) => `requires one of [${r.required.join(", ")}]; actor has [${r.actorRoles.join(", ") || "(none)"}]`,
-  "not-assigned": (r) => `actor "${r.actorId}" is not in the task assignees`,
-  "permission-denied": (r) => `actor lacks "${r.permission}" permission on the workflow instance`,
-  "filter-failed": (r) => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-  "task-not-active": (r) => `task status is "${r.status}"`,
-  "stage-terminal": (r) => `stage "${r.stageId}" is terminal`,
-  "instance-completed": (r) => `instance completed at ${r.completedAt}`,
-  "mutation-guard-denied": (r) => `blocked by mutation guard(s) [${r.guardIds.join(", ")}]${r.detail ? ` (${r.detail})` : ""}`
-};
-function formatDisabledReason(taskId, action, reason) {
-  const detail = disabledReasonDetail[reason.kind](reason);
-  return `Action "${taskId}:${action}" is not allowed: ${detail}`;
-}
-function definitionDocId(_workflowResource, prefix, workflowId, version) {
-  return `${prefix}.${workflowId}.v${version}`;
+function definitionDocId(_workflowResource, prefix, definition, version) {
+  return `${prefix}.${definition}.v${version}`;
 }
 async function sortByDependencies(client, definitions, tags, workflowResource) {
-  const prefix = canonicalTag(tags), byWorkflowId = /* @__PURE__ */ new Map();
+  const prefix = canonicalTag(tags), byName = /* @__PURE__ */ new Map();
   for (const def of definitions) {
-    const list = byWorkflowId.get(def.workflowId) ?? [];
-    list.push(def), byWorkflowId.set(def.workflowId, list);
+    const list = byName.get(def.name) ?? [];
+    list.push(def), byName.set(def.name, list);
   }
-  const findInBatch = (ref) => findRefInBatch(byWorkflowId, ref);
+  const findInBatch = (ref) => findRefInBatch(byName, ref);
   return await assertCrossBatchRefsDeployed(client, definitions, {
     tags,
     workflowResource,
@@ -2548,8 +2584,8 @@ async function sortByDependencies(client, definitions, tags, workflowResource) {
     findInBatch
   }), topoSortDefinitions(definitions, { workflowResource, prefix, findInBatch });
 }
-function findRefInBatch(byWorkflowId, ref) {
-  const candidates = byWorkflowId.get(ref.workflowId);
+function findRefInBatch(byName, ref) {
+  const candidates = byName.get(ref.name);
   if (!(candidates === void 0 || candidates.length === 0))
     return typeof ref.version == "number" ? candidates.find((c) => c.version === ref.version) : candidates.reduce(
       (best, c) => best === void 0 || c.version > best.version ? c : best,
@@ -2559,7 +2595,7 @@ function findRefInBatch(byWorkflowId, ref) {
 async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
   const missing = [];
   for (const def of definitions) {
-    const fromId = definitionDocId(ctx.workflowResource, ctx.prefix, def.workflowId, def.version);
+    const fromId = definitionDocId(ctx.workflowResource, ctx.prefix, def.name, def.version);
     for (const ref of refsOf(def)) {
       if (ctx.findInBatch(ref) !== void 0) continue;
       const label = await resolveDeployedRefLabel(client, ref, ctx.tags);
@@ -2575,16 +2611,16 @@ async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
   );
 }
 async function resolveDeployedRefLabel(client, ref, tags) {
-  const wantsExplicit = typeof ref.version == "number", params = { workflowId: ref.workflowId, tags };
+  const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, engineTags: tags };
   if (wantsExplicit && (params.version = ref.version), !await client.fetch(
     definitionLookupGroq(wantsExplicit),
     params
   ))
-    return wantsExplicit ? `${ref.workflowId} v${ref.version}` : ref.workflowId;
+    return wantsExplicit ? `${ref.name} v${ref.version}` : ref.name;
 }
 function topoSortDefinitions(definitions, ctx) {
   const visited = /* @__PURE__ */ new Set(), visiting = /* @__PURE__ */ new Set(), ordered = [], visit = (def) => {
-    const id = definitionDocId(ctx.workflowResource, ctx.prefix, def.workflowId, def.version);
+    const id = definitionDocId(ctx.workflowResource, ctx.prefix, def.name, def.version);
     if (!visited.has(id)) {
       if (visiting.has(id))
         throw new Error(`workflow.deployDefinitions: dependency cycle involving "${id}"`);
@@ -2599,16 +2635,13 @@ function topoSortDefinitions(definitions, ctx) {
   for (const def of definitions) visit(def);
   return ordered;
 }
-function definitionLookupGroq(wantsExplicit) {
-  return wantsExplicit ? '*[_type == "workflow.definition" && workflowId == $workflowId && version == $version && count(tags[@ in $tags]) > 0][0]' : '*[_type == "workflow.definition" && workflowId == $workflowId && count(tags[@ in $tags]) > 0] | order(version desc)[0]';
-}
 function refsOf(def) {
   const out = [];
   for (const stage of def.stages)
     for (const task of stage.tasks ?? []) {
-      const ref = task.spawns?.definitionRef;
+      const ref = task.subworkflows?.definition;
       ref !== void 0 && out.push({
-        workflowId: ref.workflowId,
+        name: ref.name,
         ...ref.version !== void 0 ? { version: ref.version } : {}
       });
     }
@@ -2628,24 +2661,129 @@ function stableStringify(value) {
     ([a], [b]) => a.localeCompare(b)
   ).map(([k, v2]) => `${JSON.stringify(k)}:${stableStringify(v2)}`).join(",")}}`;
 }
-async function loadDefinition(client, workflowId, version, tags) {
+async function loadDefinition(client, definition, version, tags) {
   if (version !== void 0) {
     const doc = await client.fetch(
-      "*[_type == 'workflow.definition' && workflowId == $id && version == $v && count(tags[@ in $engineTags]) > 0][0]",
-      { id: workflowId, v: version, engineTags: tags }
+      definitionLookupGroq(!0),
+      { definition, version, engineTags: tags }
     );
     if (!doc)
-      throw new Error(`Workflow definition ${workflowId} v${version} not deployed`);
+      throw new Error(`Workflow definition ${definition} v${version} not deployed`);
     return doc;
   }
-  const latest = await client.fetch(
-    "*[_type == 'workflow.definition' && workflowId == $id && count(tags[@ in $engineTags]) > 0] | order(version desc)[0]",
-    { id: workflowId, engineTags: tags }
-  );
+  const latest = await client.fetch(definitionLookupGroq(!1), {
+    definition,
+    engineTags: tags
+  });
   if (!latest)
-    throw new Error(`No deployed definition for workflow ${workflowId}`);
+    throw new Error(`No deployed definition for workflow ${definition}`);
   return latest;
 }
+async function loadDefinitionVersions(client, definition, tags) {
+  return client.fetch(
+    `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && count(tags[@ in $engineTags]) > 0] | order(version desc)`,
+    { definition, engineTags: tags }
+  );
+}
+async function fireAction(args) {
+  const { client, instanceId, task, action, params, options } = args;
+  for (let attempt = 1; attempt <= CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS; attempt++) {
+    const ctx = await loadContext(client, instanceId, {
+      ...options?.clock ? { clock: options.clock } : {}
+    });
+    try {
+      return await commitAction(ctx, task, action, params, options);
+    } catch (error) {
+      if (!isRevisionConflict(error)) throw error;
+    }
+  }
+  throw new ConcurrentFireActionError({
+    instanceId,
+    task,
+    action,
+    attempts: CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS
+  });
+}
+async function resolveActionCommit(ctx, taskName, actionName, callerParams, options) {
+  const actor = options?.actor, { stage, task } = findTaskInCurrentStage(ctx, taskName), action = (task.actions ?? []).find((a) => a.name === actionName);
+  if (action === void 0)
+    throw new Error(`Action "${actionName}" not declared on task "${taskName}"`);
+  const can = options?.grants !== void 0 && actor !== void 0 ? await advisoryCan(ctx.instance, actor, options.grants) : void 0;
+  if (!await ctxEvaluateCondition(ctx, action.filter, {
+    taskName,
+    ...actor !== void 0 ? { actor } : {},
+    ...can !== void 0 ? { vars: { can } } : {}
+  }))
+    throw new Error(`Action "${actionName}" filter rejected on task "${taskName}"`);
+  const entry = findCurrentTasks(ctx.instance).find((t) => t.name === taskName);
+  if (entry === void 0 || entry.status !== "active")
+    throw new Error(
+      `Task "${taskName}" must be active to fire action "${actionName}"; status is ${entry?.status ?? "missing"}`
+    );
+  const params = validateActionParams(action, taskName, callerParams);
+  return { stage, task, action, params };
+}
+async function commitAction(ctx, taskName, actionName, callerParams, options) {
+  const actor = options?.actor, { stage, action, params } = await resolveActionCommit(
+    ctx,
+    taskName,
+    actionName,
+    callerParams,
+    options
+  ), mutation = startMutation(ctx.instance), mutEntry = requireMutationTaskEntry(mutation, taskName), now = ctx.now;
+  mutation.history.push({
+    _key: randomKey(),
+    _type: "actionFired",
+    at: now,
+    stage: stage.name,
+    task: taskName,
+    action: actionName,
+    ...actor !== void 0 ? { actor } : {}
+  });
+  const statusBefore = mutEntry.status, ranOps = await runOps({
+    ops: action.ops,
+    mutation,
+    stage: stage.name,
+    origin: { task: taskName, action: actionName },
+    params,
+    actor,
+    self: selfGdr(ctx.instance),
+    now
+  }), newStatus = mutEntry.status !== statusBefore ? mutEntry.status : void 0;
+  return await queueEffects(ctx, mutation, action.effects, { kind: "action", name: actionName }, actor, {
+    callerParams: params,
+    taskName
+  }), await persistThenDeploy(
+    ctx,
+    mutation,
+    () => ranOps.some(isStateOp) ? refreshStageGuards(ctx, mutation, stage.name) : Promise.resolve()
+  ), {
+    fired: !0,
+    task: taskName,
+    action: actionName,
+    ...newStatus !== void 0 ? { newStatus } : {},
+    ...ranOps.length > 0 ? { ranOps } : {}
+  };
+}
+class ActionDisabledError extends Error {
+  reason;
+  task;
+  action;
+  constructor(args) {
+    super(formatDisabledReason(args.task, args.action, args.reason)), this.name = "ActionDisabledError", this.reason = args.reason, this.task = args.task, this.action = args.action;
+  }
+}
+const disabledReasonDetail = {
+  "filter-failed": (r) => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+  "task-not-active": (r) => `task status is "${r.status}"`,
+  "stage-terminal": (r) => `stage "${r.stage}" is terminal`,
+  "instance-completed": (r) => `instance completed at ${r.completedAt}`,
+  "mutation-guard-denied": (r) => `blocked by mutation guard(s) [${r.guardIds.join(", ")}]${r.detail ? ` (${r.detail})` : ""}`
+};
+function formatDisabledReason(task, action, reason) {
+  const detail = disabledReasonDetail[reason.kind](reason);
+  return `Action "${task}:${action}" is not allowed: ${detail}`;
+}
 function bareIdFromSpawnRef(uri) {
   if (!uri.includes(":")) return [uri];
   try {
@@ -2666,8 +2804,15 @@ async function resolveOperationContext(args) {
     clientForGdr: buildClientForGdr(args.client, args.resourceClients)
   };
 }
-async function cascade(client, instanceId, actor, clientForGdr, clock) {
-  const count = await cascadeAutoTransitions(client, instanceId, actor, clientForGdr, clock);
+async function cascade(client, instanceId, actor, clientForGdr, clock, overlay) {
+  const count = await cascadeAutoTransitions(
+    client,
+    instanceId,
+    actor,
+    clientForGdr,
+    clock,
+    overlay
+  );
   return await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), count;
 }
 function buildClientForGdr(defaultClient, resolver) {
@@ -2686,20 +2831,36 @@ function intersectsTags(docTags, engineTags) {
 function toEffectsContextEntries(ctx) {
   return Object.entries(ctx).map(([id, value]) => effectsContextEntry(id, value));
 }
+function assertActionAllowed(evaluation, task, action) {
+  const actionEval = evaluation.currentStage.tasks.find((t) => t.task.name === task)?.actions.find((a) => a.action.name === action);
+  if (actionEval?.allowed === !1 && actionEval.disabledReason)
+    throw new ActionDisabledError({ task, action, reason: actionEval.disabledReason });
+}
+async function applyAction(args) {
+  const { client, instance, task, action, params, actor, grants, clock } = args, options = {
+    actor,
+    ...grants !== void 0 ? { grants } : {},
+    ...clock !== void 0 ? { clock } : {}
+  };
+  return findOpenStageEntry(instance)?.tasks.find((t) => t.name === task)?.status === "pending" && await invokeTask({ client, instanceId: instance._id, task, options }), (await fireAction({
+    client,
+    instanceId: instance._id,
+    task,
+    action,
+    ...params !== void 0 ? { params } : {},
+    options
+  })).ranOps;
+}
 const workflow = {
   /**
-   * Persist a workflow definition to the lake. Stored as a
-   * `workflow.definition` document with id
-   * `workflow.definition.<workflowId>.v<version>`. Subsequent versions
-   * are stored alongside earlier ones — `startInstance` picks the
-   * highest version by default.
-   */
-  /**
-   * Deploy a set of workflow definitions as one call. The SDK figures
-   * out the dependency order itself (children before parents that spawn
-   * them via `task.spawns.definitionRef`), idempotently writes any
-   * definition whose content has changed, and reports a per-definition
-   * outcome (`created` / `updated` / `unchanged`).
+   * Deploy a set of workflow definitions as one call. Each lands as a
+   * {@link WORKFLOW_DEFINITION_TYPE} document; subsequent versions are
+   * stored alongside earlier ones — `startInstance` picks the highest
+   * version by default. The SDK figures out the dependency order itself
+   * (children before parents that spawn them via
+   * `subworkflows.definition`), idempotently writes any definition
+   * whose content has changed, and reports a per-definition outcome
+   * (`created` / `updated` / `unchanged`).
    *
    * Refs may point inside the batch OR at already-deployed definitions
    * in the lake — both are valid. A ref pointing at neither errors with
@@ -2715,14 +2876,14 @@ const workflow = {
     const ordered = await sortByDependencies(client, definitions, tags, workflowResource), results = [], prefix = canonicalTag(tags), tx = client.transaction();
     let hasWrites = !1;
     for (const def of ordered) {
-      const id = definitionDocId(workflowResource, prefix, def.workflowId, def.version), expected = {
+      const id = definitionDocId(workflowResource, prefix, def.name, def.version), expected = {
         ...def,
         _id: id,
-        _type: "workflow.definition",
+        _type: WORKFLOW_DEFINITION_TYPE,
         tags
       }, existing = await client.getDocument(id);
       if (existing && intersectsTags(existing.tags, tags) && isDefinitionUnchanged(existing, expected)) {
-        results.push({ workflowId: def.workflowId, version: def.version, status: "unchanged" });
+        results.push({ definition: def.name, version: def.version, status: "unchanged" });
         continue;
       }
       if (existing) {
@@ -2733,7 +2894,7 @@ const workflow = {
       } else
         tx.create(expected);
       hasWrites = !0, results.push({
-        workflowId: def.workflowId,
+        definition: def.name,
         version: def.version,
         status: existing ? "updated" : "created"
       });
@@ -2753,20 +2914,20 @@ const workflow = {
       client,
       tags,
       workflowResource,
-      workflowId,
+      definition: definitionName,
       version,
       initialState,
       ancestors,
       effectsContext,
       instanceId,
       perspective
-    } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, definition = await loadDefinition(client, workflowId, version, tags), id = instanceId ?? `${canonicalTag(tags)}.wf-instance.${randomKey()}`;
-    if (definition.stages.find((s) => s.id === definition.initialStageId) === void 0)
+    } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, definition = await loadDefinition(client, definitionName, version, tags), id = instanceId ?? `${canonicalTag(tags)}.wf-instance.${randomKey()}`;
+    if (definition.stages.find((s) => s.name === definition.initialStage) === void 0)
       throw new Error(
-        `Initial stage "${definition.initialStageId}" missing in ${workflowId} v${definition.version}`
+        `Initial stage "${definition.initialStage}" missing in ${definitionName} v${definition.version}`
       );
     const now = clock(), effectsContextEntries = effectsContext ? toEffectsContextEntries(effectsContext) : [], resolvedState = await resolveDeclaredState({
-      slotDefs: definition.state ?? [],
+      entryDefs: definition.state ?? [],
       initialState: initialState ?? [],
       ctx: {
         client,
@@ -2782,14 +2943,14 @@ const workflow = {
       now,
       tags,
       workflowResource,
-      workflowId: definition.workflowId,
+      definitionName: definition.name,
       pinnedVersion: definition.version,
       definition,
       state: resolvedState,
       effectsContext: effectsContextEntries,
       ancestors: ancestors ?? [],
       perspective: effectivePerspective,
-      initialStageId: definition.initialStageId,
+      initialStage: definition.initialStage,
       actor
     });
     return await client.create(base), await primeInitialStage(client, id, actor, clientForGdr, clock), await cascade(client, id, actor, clientForGdr, clock), reload(client, id, tags);
@@ -2809,49 +2970,38 @@ const workflow = {
       client,
       tags,
       instanceId,
-      taskId,
+      task,
       action,
       params,
       idempotent,
       resourceClients
-    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload(client, instanceId, tags), taskEntry = before.stages.find(
-      (s) => s.id === before.currentStageId && s.exitedAt === void 0
-    )?.tasks.find((t) => t.id === taskId);
-    if (taskEntry === void 0 && idempotent === !0)
+    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload(client, instanceId, tags);
+    if (findOpenStageEntry(before)?.tasks.find((t) => t.name === task) === void 0 && idempotent === !0)
       return { instance: before, cascaded: 0, fired: !1 };
-    const actionEval = (await evaluateInstance({
+    const evaluation = await evaluateInstance({
       client,
       tags,
       instanceId,
       access,
       clock,
       ...resourceClients !== void 0 ? { resourceClients } : {}
-    })).currentStage.tasks.find((t) => t.task.id === taskId)?.actions.find((a) => a.action.id === action);
-    if (actionEval !== void 0 && !actionEval.allowed && actionEval.disabledReason)
-      throw new ActionDisabledError({
-        taskId,
-        action,
-        reason: actionEval.disabledReason
-      });
-    taskEntry?.status === "pending" && await invokeTask({
-      client,
-      instanceId,
-      taskId,
-      options: { actor, clock }
     });
-    const actionResult = await fireAction({
+    assertActionAllowed(evaluation, task, action);
+    const ranOps = await applyAction({
       client,
-      instanceId,
-      taskId,
+      instance: before,
+      task,
       action,
-      ...params !== void 0 ? { params } : {},
-      options: { actor, clock }
+      actor,
+      ...access.grants !== void 0 ? { grants: access.grants } : {},
+      clock,
+      ...params !== void 0 ? { params } : {}
     }), cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
       instance: await reload(client, instanceId, tags),
       cascaded,
       fired: !0,
-      ...actionResult.ranOps !== void 0 ? { ranOps: actionResult.ranOps } : {}
+      ...ranOps !== void 0 ? { ranOps } : {}
     };
   },
   /**
@@ -2891,8 +3041,8 @@ const workflow = {
    * affected instances and the engine re-evaluates.
    */
   tick: async (args) => {
-    const { client, tags, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
-    await reload(client, instanceId, tags);
+    const { client, tags, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload(client, instanceId, tags), guards = await verdictGuardsForInstance(client, current._id);
+    await assertInstanceWriteAllowed({ instance: current, guards, identity: actor.id });
     const cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
       instance: await reload(client, instanceId, tags),
@@ -2901,17 +3051,17 @@ const workflow = {
     };
   },
   /**
-   * Admin override — force the instance into `targetStageId` regardless
+   * Admin override — force the instance into `targetStage` regardless
    * of filters or declared transitions. ACL gating should be enforced
    * upstream; this verb performs the mechanical move.
    */
   setStage: async (args) => {
-    const { client, tags, instanceId, targetStageId, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
+    const { client, tags, instanceId, targetStage, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
     await reload(client, instanceId, tags);
     const result = await setStage({
       client,
       instanceId,
-      targetStageId,
+      targetStage,
       ...reason !== void 0 ? { reason } : {},
       options: { ...actor !== void 0 ? { actor } : {}, clock }
     }), cascaded = result.fired ? await cascade(client, instanceId, actor, clientForGdr, clock) : 0;
@@ -2921,6 +3071,28 @@ const workflow = {
       fired: result.fired
     };
   },
+  /**
+   * Admin override — hard-stop an in-flight instance where it stands.
+   * No stage move, no transition effects, pending effects cancelled; see
+   * the engine-level {@link engineAbortInstance} for the full contract.
+   * Ancestors are propagated (not cascaded — the instance is terminal)
+   * so a parent gate waiting on this child re-evaluates.
+   */
+  abortInstance: async (args) => {
+    const { client, tags, instanceId, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
+    await reload(client, instanceId, tags);
+    const result = await abortInstance({
+      client,
+      instanceId,
+      ...reason !== void 0 ? { reason } : {},
+      options: { ...actor !== void 0 ? { actor } : {}, clock }
+    });
+    return result.fired && await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), {
+      instance: await reload(client, instanceId, tags),
+      cascaded: 0,
+      fired: result.fired
+    };
+  },
   /**
    * Fetch a workflow instance by id, scoped to the engine's tags.
    * Throws when the instance doesn't exist or isn't visible to this
@@ -2940,6 +3112,20 @@ const workflow = {
       instance
     });
   },
+  guardsForDefinition: async (args) => {
+    const { client, tags, workflowResource, definition, resourceClients } = args;
+    validateTags(tags);
+    const definitions = await loadDefinitionVersions(client, definition, tags);
+    if (definitions.length === 0)
+      throw new Error(`No deployed definition for workflow ${definition}`);
+    return guardsForDefinition({
+      client,
+      clientForGdr: buildClientForGdr(client, resourceClients),
+      workflowResource,
+      definition,
+      definitions
+    });
+  },
   /**
    * Run a caller-supplied GROQ query with the engine's tags bound as
    * `$engineTags`. This does NOT rewrite the query — arbitrary GROQ
@@ -2962,12 +3148,13 @@ const workflow = {
    * Snapshot-aware GROQ — runs against the same in-memory view that
    * filters see for a given instance.
    *
-   * Hydrates the instance's snapshot (instance + subject + ancestors
-   * + every doc declared by a `doc.ref` / `doc.refs` slot in scope),
-   * then evaluates the supplied GROQ in groq-js against that dataset.
-   * Reserved params are auto-bound: `$self`, `$subject`, `$parent`,
-   * `$ancestors`, `$stage`, `$now` — all in GDR URI form to match the
-   * snapshot's keying.
+   * Hydrates the instance's snapshot (instance + ancestors + every doc
+   * declared by a `doc.ref` / `doc.refs` entry in scope), then
+   * evaluates the supplied GROQ in groq-js against that dataset. The
+   * rendered scope is auto-bound: `$self`, `$state`, `$parent`,
+   * `$ancestors`, `$stage`, `$now`, `$effects`, `$tasks`,
+   * `$allTasksDone`, `$anyTaskFailed` — ids in GDR URI form to match
+   * the snapshot's keying.
    *
    * Use when an external consumer (a UI, a debug pane, a test) wants
    * to ask "what does the engine see for this workflow right now?"
@@ -2976,7 +3163,7 @@ const workflow = {
   queryInScope: async (args) => {
     const { client, tags, instanceId, groq, params, resourceClients } = args, clock = args.clock ?? wallClock;
     validateTags(tags);
-    const instance = await reload(client, instanceId, tags), definition = JSON.parse(instance.definitionSnapshot), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance, definition }), reserved = buildParams(instance, clock()), tree = parse(groq, { params: { ...reserved, ...params } });
+    const instance = await reload(client, instanceId, tags), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance }), reserved = buildParams({ instance, now: clock(), snapshot }), tree = parse(groq, { params: { ...reserved, ...params } });
     return await (await evaluate(tree, {
       dataset: snapshot.docs,
       params: { ...reserved, ...params }
@@ -2992,7 +3179,7 @@ const workflow = {
    * filters on claim presence; `names` restricts to specific effect
    * names. Both filters compose (AND).
    */
-  findPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tags)).pendingEffects.filter((e) => !(args.claimed === !0 && e.claim === void 0 || args.claimed === !1 && e.claim !== void 0 || args.names !== void 0 && !args.names.includes(e.effectId))),
+  findPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tags)).pendingEffects.filter((e) => !(args.claimed === !0 && e.claim === void 0 || args.claimed === !1 && e.claim !== void 0 || args.names !== void 0 && !args.names.includes(e.name))),
   /**
    * Project the instance from a given actor's perspective. Returns a
    * `WorkflowEvaluation` with per-action verdicts (`allowed` + a
@@ -3005,21 +3192,21 @@ const workflow = {
   /**
    * Materialised spawned children of a parent instance.
    *
-   * Walks `history` for `workflow.history.spawned` events — the durable
+   * Walks `history` for `spawned` events — the durable
    * record. (The per-task `spawnedInstances` field on the active stage
    * only exists while that stage is current; history survives.) Strips
    * the GDR URI on each `instanceRef` to a bare `_id`, fetches the
    * instances, drops any that aren't visible to this engine's tags, and
    * returns them sorted by `startedAt` ascending.
    *
-   * Pass `taskId` to restrict to a single spawning task on the parent.
+   * Pass `task` to restrict to a single spawning task on the parent.
    */
   children: async (args) => {
-    const { client, tags, instanceId, taskId } = args;
+    const { client, tags, instanceId, task } = args;
     validateTags(tags);
-    const parent = await reload(client, instanceId, tags), isSpawned = (h) => h._type === "workflow.history.spawned", ids = parent.history.filter(isSpawned).filter((h) => taskId === void 0 || h.taskId === taskId).flatMap((h) => bareIdFromSpawnRef(h.instanceRef.id));
+    const parent = await reload(client, instanceId, tags), isSpawned = (h) => h._type === "spawned", ids = parent.history.filter(isSpawned).filter((h) => task === void 0 || h.task === task).flatMap((h) => bareIdFromSpawnRef(h.instanceRef.id));
     return ids.length === 0 ? [] : client.fetch(
-      "*[_id in $ids && count(tags[@ in $engineTags]) > 0] | order(startedAt asc)",
+      `*[_id in $ids && ${tagScopeFilter()}] | order(startedAt asc)`,
       { ids, engineTags: tags }
     );
   },
@@ -3038,11 +3225,11 @@ async function verifyDeployedDefinitionsInternal(args) {
   const { client, tags, effectHandlers, missingHandler, logger } = args;
   validateTags(tags);
   const log = logger("verifyDeployedDefinitions"), definitions = await client.fetch(
-    '*[_type == "workflow.definition" && count(tags[@ in $engineTags]) > 0] | order(workflowId asc, version asc)',
+    `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}] | order(name asc, version asc)`,
     { engineTags: tags }
   ), seen = [], missingByName = /* @__PURE__ */ new Map();
   for (const def of definitions)
-    seen.push({ workflowId: def.workflowId, version: def.version, _id: def._id }), walkEffectNames(def, (name, location) => {
+    seen.push({ name: def.name, version: def.version, _id: def._id }), walkEffectNames(def, (name, location) => {
       if (effectHandlers[name] !== void 0) return;
       const key = `${name}@@${def._id}`;
       let bucket = missingByName.get(key);
@@ -3073,17 +3260,16 @@ async function verifyDeployedDefinitionsInternal(args) {
 }
 function walkEffectNames(def, visit) {
   const visitEffects = (effects, location) => {
-    for (const e of effects ?? []) visit(e.id, location);
+    for (const e of effects ?? []) visit(e.name, location);
   };
   for (const stage of def.stages ?? []) {
-    visitEffects(stage.onEnter, `stage[${stage.id}].onEnter`), visitEffects(stage.onExit, `stage[${stage.id}].onExit`);
     for (const t of stage.tasks ?? []) {
-      visitEffects(t.effects, `stage[${stage.id}].task[${t.id}].effects`);
+      visitEffects(t.effects, `stage[${stage.name}].task[${t.name}].effects`);
       for (const a of t.actions ?? [])
-        visitEffects(a.effects, `stage[${stage.id}].task[${t.id}].action[${a.id}].effects`);
+        visitEffects(a.effects, `stage[${stage.name}].task[${t.name}].action[${a.name}].effects`);
     }
     for (const tr of stage.transitions ?? [])
-      visitEffects(tr.effects, `stage[${stage.id}].transition[${tr.to}].effects`);
+      visitEffects(tr.effects, `stage[${stage.name}].transition[${tr.name}].effects`);
   }
 }
 async function drainEffectsInternal(args) {
@@ -3107,7 +3293,7 @@ async function drainEffectsInternal(args) {
       (e) => e.claim === void 0 && !skippedKeys.has(e._key)
     );
     if (candidate === void 0) break;
-    const handler = effectHandlers[candidate.effectId];
+    const handler = effectHandlers[candidate.name];
     if (handler === void 0) {
       await assertSkippableOrThrow(missingHandler, candidate, instanceId, log), skipped.push(candidate), skippedKeys.add(candidate._key);
       continue;
@@ -3145,16 +3331,16 @@ async function reportEffectOutcome(args) {
 async function assertSkippableOrThrow(missingHandler, candidate, instanceId, log) {
   if (await applyMissingHandler(
     missingHandler,
-    { phase: "drain", name: candidate.effectId, effectKey: candidate._key, instanceId },
+    { phase: "drain", name: candidate.name, effectKey: candidate._key, instanceId },
     log
   ) === "fail")
     throw new Error(
-      `drainEffects: no handler registered for "${candidate.effectId}" (effectKey=${candidate._key}, instanceId=${instanceId})`
+      `drainEffects: no handler registered for "${candidate.name}" (effectKey=${candidate._key}, instanceId=${instanceId})`
     );
 }
 async function claimPendingEffect(client, instance, effectKey, drainerActor) {
   const claim = {
-    _type: "workflow.pendingEffect.claim",
+    _type: "pendingEffect.claim",
     claimedAt: (/* @__PURE__ */ new Date()).toISOString(),
     claimedBy: drainerActor
   };
@@ -3171,7 +3357,7 @@ async function dispatchEffect(handler, candidate, ctx) {
       client: ctx.client,
       instanceId: ctx.instanceId,
       effectKey: candidate._key,
-      log: (message, extra) => ctx.logger(`effect.${candidate.effectId}`).info(message, extra)
+      log: (message, extra) => ctx.logger(`effect.${candidate.name}`).info(message, extra)
     });
     return result?.outputs !== void 0 ? { outputs: result.outputs } : {};
   } catch (err) {
@@ -3189,6 +3375,95 @@ async function applyMissingHandler(policy, info, log) {
     return "fail";
   }
 }
+function createInstanceSession(args) {
+  const { client, tags, clock } = args, clientForGdr = buildClientForGdr(client, args.resourceClients);
+  let instance = asHeldInstance(args.instance), overlay = /* @__PURE__ */ new Map(), heldGuards = [], committing = !1, buffered;
+  const selfUri = () => gdrFromResource(instance.workflowResource, instance._id), applyUpdate = (docs) => {
+    const next = /* @__PURE__ */ new Map();
+    for (const ld of docs) {
+      const owned = { doc: structuredClone(ld.doc), resource: ld.resource }, uri = gdrFromResource(owned.resource, owned.doc._id);
+      if (uri === selfUri()) {
+        instance = asHeldInstance(owned.doc);
+        continue;
+      }
+      next.set(uri, owned);
+    }
+    overlay = next;
+  }, access = () => resolveAccess(client, {
+    ...args.access !== void 0 ? { override: args.access } : {},
+    ...args.grantsFromPath !== void 0 ? { grantsFromPath: args.grantsFromPath } : {}
+  }), snapshotFrom = (held) => buildSnapshot({ docs: [{ doc: instance, resource: instance.workflowResource }, ...held.values()] }), evaluateWith = async (held, guards) => {
+    const { actor, grants } = await access();
+    return evaluateFromSnapshot({
+      instance,
+      definition: parseDefinitionSnapshot(instance),
+      actor,
+      snapshot: snapshotFrom(held),
+      guards,
+      ...clock !== void 0 ? { now: clock() } : {},
+      ...grants !== void 0 ? { grants } : {}
+    });
+  }, commit = async (run) => {
+    committing = !0;
+    const held = new Map(overlay);
+    try {
+      const { actor } = await access();
+      return await run(actor, held);
+    } finally {
+      if (committing = !1, buffered !== void 0) {
+        const next = buffered;
+        buffered = void 0, applyUpdate(next);
+      }
+    }
+  };
+  return {
+    get subscriptionDocuments() {
+      return subscriptionDocumentsForInstance(instance);
+    },
+    update(docs) {
+      if (committing) {
+        buffered = docs;
+        return;
+      }
+      applyUpdate(docs);
+    },
+    updateGuards(guards) {
+      heldGuards = guards.map((guard) => structuredClone(guard));
+    },
+    evaluate() {
+      return evaluateWith(overlay, heldGuards);
+    },
+    tick() {
+      return commit(async (actor, held) => {
+        await assertInstanceWriteAllowed({ instance, guards: heldGuards, identity: actor.id });
+        const cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
+        return instance = await reload(client, instance._id, tags), { instance, cascaded, fired: cascaded > 0 };
+      });
+    },
+    fireAction({ task, action, params }) {
+      return commit(async (actor, held) => {
+        assertActionAllowed(await evaluateWith(held, heldGuards), task, action);
+        const { grants } = await access(), ranOps = await applyAction({
+          client,
+          instance,
+          task,
+          action,
+          actor,
+          ...grants !== void 0 ? { grants } : {},
+          ...clock !== void 0 ? { clock } : {},
+          ...params !== void 0 ? { params } : {}
+        }), cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
+        return instance = await reload(client, instance._id, tags), { instance, cascaded, fired: !0, ...ranOps !== void 0 ? { ranOps } : {} };
+      });
+    }
+  };
+}
+function asHeldInstance(doc) {
+  const candidate = doc;
+  if (candidate._type !== WORKFLOW_INSTANCE_TYPE || typeof candidate.currentStage != "string" || !Array.isArray(candidate.stages))
+    throw new Error(`update: self-doc ${doc._id} is not a valid workflow.instance`);
+  return doc;
+}
 const defaultLoggerFactory = (name) => ({
   // info/warn/error all go to stderr — these are diagnostic, not
   // program output. Keeps stdout reserved for the caller's own data
@@ -3230,7 +3505,18 @@ function createEngine(args) {
     tick: (rest) => workflow.tick(bind(rest)),
     evaluateInstance: (rest) => evaluateInstance(bind(rest)),
     setStage: (rest) => workflow.setStage(bind(rest)),
+    abortInstance: (rest) => workflow.abortInstance(bind(rest)),
     getInstance: ({ instanceId }) => workflow.getInstance({ client, tags, workflowResource, instanceId }),
+    subscriptionDocumentsForInstance: ({ instanceId }) => workflow.getInstance({ client, tags, workflowResource, instanceId }).then(subscriptionDocumentsForInstance),
+    instance: (instanceDoc, opts) => createInstanceSession({
+      client,
+      tags,
+      instance: instanceDoc,
+      ...resourceClients !== void 0 ? { resourceClients } : {},
+      ...clock !== void 0 ? { clock } : {},
+      ...opts?.access !== void 0 ? { access: opts.access } : {},
+      ...opts?.grantsFromPath !== void 0 ? { grantsFromPath: opts.grantsFromPath } : {}
+    }),
     guardsForInstance: ({ instanceId }) => workflow.guardsForInstance({
       client,
       tags,
@@ -3238,12 +3524,19 @@ function createEngine(args) {
       instanceId,
       ...resourceClients !== void 0 ? { resourceClients } : {}
     }),
-    children: ({ instanceId, taskId }) => workflow.children({
+    guardsForDefinition: ({ definition }) => workflow.guardsForDefinition({
+      client,
+      tags,
+      workflowResource,
+      definition,
+      ...resourceClients !== void 0 ? { resourceClients } : {}
+    }),
+    children: ({ instanceId, task }) => workflow.children({
       client,
       tags,
       workflowResource,
       instanceId,
-      ...taskId !== void 0 ? { taskId } : {}
+      ...task !== void 0 ? { task } : {}
     }),
     query: ({ groq, params }) => workflow.query({
       client,
@@ -3291,111 +3584,127 @@ function createEngine(args) {
   };
 }
 const HISTORY_DISPLAY = {
-  "workflow.history.stageEntered": {
+  stageEntered: {
     title: "Stage entered",
     description: "The instance crossed into a new stage."
   },
-  "workflow.history.stageExited": {
+  stageExited: {
     title: "Stage exited",
     description: "The instance left a stage on the way to the next one."
   },
-  "workflow.history.taskActivated": {
+  taskActivated: {
     title: "Task activated",
     description: "A task flipped from `pending` to `active` and its onEnter effects queued."
   },
-  "workflow.history.taskStatusChanged": {
+  taskStatusChanged: {
     title: "Task status changed",
     description: "An action or op flipped a task's status (active \u2192 done / skipped / failed)."
   },
-  "workflow.history.actionFired": {
+  actionFired: {
     title: "Action fired",
     description: "An action was invoked against a task \u2014 ops ran, status may have flipped, effects queued."
   },
-  "workflow.history.transitionFired": {
+  transitionFired: {
     title: "Transition fired",
     description: "A transition committed and the instance moved to a new stage."
   },
-  "workflow.history.effectQueued": {
+  effectQueued: {
     title: "Effect queued",
     description: "A pending effect was added to the queue, waiting for a drainer to dispatch it."
   },
-  "workflow.history.effectCompleted": {
+  effectCompleted: {
     title: "Effect completed",
     description: "A drainer ran an effect handler to completion (done or failed) and merged its outputs into effectsContext."
   },
-  "workflow.history.spawned": {
+  spawned: {
     title: "Spawned child",
-    description: "A `task.spawns` declaration spawned a child workflow instance."
+    description: "A task's `subworkflows` declaration spawned a child workflow instance."
   },
-  "workflow.history.opApplied": {
+  aborted: {
+    title: "Instance aborted",
+    description: "An admin hard-stopped the instance \u2014 pending effects cancelled, stage guards lifted, abortedAt + completedAt stamped."
+  },
+  opApplied: {
     title: "Op applied",
     description: "An inline state-mutation op (state.set / state.append / status.set / etc.) ran during an action commit."
   }
 }, STATE_SLOT_DISPLAY = {
-  "workflow.state.doc.ref": {
+  "doc.ref": {
     title: "Document reference",
     description: "Single GDR pointer at a document in this or another resource."
   },
-  "workflow.state.doc.refs": {
+  "doc.refs": {
     title: "Document references",
     description: "Ordered list of GDR pointers \u2014 multi-doc selection."
   },
-  "workflow.state.query": {
+  "release.ref": {
+    title: "Content Release reference",
+    description: "GDR pointer at a Content Release system doc, carrying the release name the engine derives the instance's read perspective from."
+  },
+  query: {
     title: "Query result",
-    description: "Snapshot of a GROQ projection captured at slot-resolve time; resolvedAt is stamped on the value."
+    description: "Snapshot of a GROQ projection captured at entry-resolve time; resolvedAt is stamped on the value."
   },
-  "workflow.state.value.string": {
+  "value.string": {
     title: "String value",
-    description: "Free-form string slot."
+    description: "Free-form string entry."
   },
-  "workflow.state.value.url": {
+  "value.url": {
     title: "URL value",
-    description: "Validated URL slot."
+    description: "Validated URL entry."
   },
-  "workflow.state.value.number": {
+  "value.number": {
     title: "Number value",
-    description: "Numeric slot."
+    description: "Numeric entry."
   },
-  "workflow.state.value.boolean": {
+  "value.boolean": {
     title: "Boolean value",
-    description: "True/false slot."
+    description: "True/false entry."
   },
-  "workflow.state.value.dateTime": {
+  "value.dateTime": {
     title: "Date / time value",
-    description: "ISO-timestamp slot."
+    description: "ISO-timestamp entry."
   },
-  "workflow.state.checklist": {
+  "value.actor": {
+    title: "Actor value",
+    description: "A typed (user|ai|system) actor identity."
+  },
+  checklist: {
     title: "Checklist",
     description: "Append-only list of checkable items; ops add/update/remove entries."
   },
-  "workflow.state.notes": {
+  notes: {
     title: "Notes log",
     description: "Append-only structured-note log (signoffs, comments, audit rows)."
   },
-  "workflow.state.assignees": {
+  assignees: {
     title: "Assignees",
     description: "Ordered list of typed (user|role) assignees."
   }
 }, OP_DISPLAY = {
-  "workflow.op.state.set": {
-    title: "Set slot",
-    description: "Overwrite a state slot's value with a resolved Source."
+  "state.set": {
+    title: "Set state entry",
+    description: "Overwrite a state entry's value with a resolved Source."
+  },
+  "state.unset": {
+    title: "Unset state entry",
+    description: "Reset a state entry to its default (null for scalars, [] for array kinds)."
   },
-  "workflow.op.state.append": {
-    title: "Append to slot",
-    description: "Push a resolved item onto an array-typed slot (notes, checklist, assignees, refs)."
+  "state.append": {
+    title: "Append to state entry",
+    description: "Push a resolved item onto an array-kind entry (notes, checklist, assignees, refs)."
   },
-  "workflow.op.state.updateWhere": {
+  "state.updateWhere": {
     title: "Update matching rows",
-    description: "Merge fields into rows of an array-typed slot that match the predicate."
+    description: "Merge fields into rows of an array-kind entry that match the predicate."
   },
-  "workflow.op.state.removeWhere": {
+  "state.removeWhere": {
     title: "Remove matching rows",
-    description: "Drop rows of an array-typed slot that match the predicate."
+    description: "Drop rows of an array-kind entry that match the predicate."
   },
-  "workflow.op.status.set": {
+  "status.set": {
     title: "Set task status",
-    description: "Flip a task's status explicitly (action.setStatus is the more common path)."
+    description: "Flip a task's status explicitly (the action-level `status:` sugar desugars to this)."
   }
 }, EFFECTS_CONTEXT_DISPLAY = {
   "effectsContext.string": {
@@ -3419,53 +3728,21 @@ const HISTORY_DISPLAY = {
     description: "Stable JSON payload for effect handlers."
   }
 }, AUTHORING_DISPLAY = {
-  "workflow.stage": {
-    title: "Stage",
-    description: "A bucket of tasks the workflow is currently in."
-  },
-  "workflow.task": {
-    title: "Task",
-    description: "A unit of work inside a stage; carries actions and may spawn children."
-  },
-  "workflow.action": {
-    title: "Action",
-    description: "An invocable transition on a task \u2014 runs ops, queues effects, may flip status."
-  },
-  "workflow.action.param": {
-    title: "Action param",
-    description: "Caller-supplied parameter on an action; validated before any commit."
-  },
-  "workflow.transition": {
-    title: "Transition",
-    description: "An edge between stages, gated by a filter."
-  },
-  "workflow.predicate": {
-    title: "Predicate",
-    description: "Named GROQ filter, reusable across transitions / tasks / actions."
-  },
-  "workflow.effect": {
-    title: "Effect",
-    description: "Externally-dispatched side effect; queued on commit, drained by a runtime, completed asynchronously."
-  },
-  "workflow.spawn": {
-    title: "Spawn",
-    description: "Declares a task that fans out one or more child workflow instances."
-  },
-  "workflow.pendingEffect": {
+  pendingEffect: {
     title: "Pending effect",
     description: "An effect that has been queued but not yet dispatched."
   },
-  "workflow.pendingEffect.claim": {
+  "pendingEffect.claim": {
     title: "Claim",
     description: "A drainer's lock on a pending effect while it dispatches."
   },
-  "workflow.definition": {
+  [WORKFLOW_DEFINITION_TYPE]: {
     title: "Workflow definition",
-    description: "An immutable workflow blueprint pinned by `workflowId` + `version`."
+    description: "An immutable workflow blueprint, addressed by `name` + `version`."
   },
-  "workflow.instance": {
+  [WORKFLOW_INSTANCE_TYPE]: {
     title: "Workflow instance",
-    description: "A running (or finished) workflow against a subject."
+    description: "A running (or finished) workflow against its declared state."
   }
 }, DISPLAY = {
   ...HISTORY_DISPLAY,
@@ -3496,37 +3773,53 @@ export {
   MutationGuardDeniedError,
   OP_DISPLAY,
   STATE_SLOT_DISPLAY,
+  WORKFLOW_DEFINITION_TYPE,
+  WORKFLOW_INSTANCE_TYPE,
   WorkflowStateDivergedError,
+  buildSnapshot,
   canonicalTag,
   compileGuard,
+  contentReleaseName,
   createEngine,
+  datasetResourceParts,
   defaultLoggerFactory,
   denyingGuards,
   deployStageGuards,
   displayDescription,
   displayTitle,
+  effectsContextMap,
+  evaluateFromSnapshot,
   evaluateMutationGuard,
   extractDocumentId,
   gdrFromResource,
   gdrRef,
   gdrUri,
   guardMatches,
+  guardsForDefinition,
   guardsForInstance,
   guardsForResource,
+  instanceGuardQuery,
   isDefinitionUnchanged,
   isGdr,
+  isTerminalStage,
   lakeGuardId,
   parseGdr,
+  readsRaw,
   refCanvas,
   refDashboard,
   refDataset,
   refMediaLibrary,
   resolveAccess,
+  resourceFromParsed,
   retractStageGuards,
   silentLogger,
   stripSystemFields,
+  subscriptionDocument,
+  subscriptionDocumentsForInstance,
+  tagScopeFilter,
   validateDefinition,
   validateTags,
+  verdictGuardsForInstance,
   wallClock,
   workflow
 };