@sanity/workflow-engine 0.30.0 → 0.32.0

package/dist/index.js

@@ -1,45 +1,16 @@
-import { rethrowWithContext, andConditions, deriveActivityKind, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, isAlwaysArrayFieldKind, evaluateCondition, isRecord, isSingleDocRefEntry, isAssignmentFieldEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, assignmentKindAcceptsRoles, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, classifyPrincipalId, directoryBridgeId, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, NonEmptyString, tolerantEntries, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, InstanceNotFoundError, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, firstCarriedGlobalId, driverKind, EffectNotFoundError, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
+import { rethrowWithContext, findOpenStageEntry, findCurrentActivityEntry, andConditions, deriveActivityKind, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, WorkflowError, gdrFromResource, selfGdr, isGdrUri, MUTATION_GUARD_ID_SPACES, mutationGuardActionIdSpace, LAKE_MUTATION_GUARD_ACTIONS, isBareDocumentId, toBareId, normalizeAssignmentMembers, isSingleDocRefKind, actorMatchesAssignment, assignmentMembers, resolvedChildStatus, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, isAssignmentFieldEntry, isAlwaysArrayFieldKind, evaluateCondition, isRecord, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, GUARD_ACTIONS_REQUIRED_MESSAGE, conditionEffectReads, EFFECTS_READ, datasetResourceParts, mutationGuardRequiresSplitEmission, MUTATION_GUARD_ACTIONS, assignmentKindAcceptsRoles, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, liveSubworkflows, isCascadeFired, classifyPrincipalId, directoryBridgeId, parseGdr, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, isParseableInstant, NonEmptyString, tolerantEntries, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, InstanceNotFoundError, evaluateConditionOutcome, runGroq as runGroq$1, FIELD_READ, resourceGdr, condemnSubworkflow, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, firstCarriedGlobalId, driverKind, actorFulfillsRole, condemnedSubworkflows, EffectNotFoundError, isFilterScopedOut, deriveExecutorClassification, validateTag, activeAssignmentMembers, extractDocumentId, UNIVERSAL_ROLE_ALIAS_KEY, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, groupMembershipNames } from "./_chunks-es/invariants.js";
 
-import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SIGNAL_SEMANTICS, SYSTEM_IDENTITY, clientConfigFromResource, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
+import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SIGNAL_SEMANTICS, SYSTEM_IDENTITY, assignmentMatch, assignmentState, assignmentStateCounts, clientConfigFromResource, gdrUri, identityMatchesAssignment, instanceAssignmentStateCounts, isNotesEntry, isTodoListEntry, isTodoListItem, openActivityAssignments, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
 
-import { atomNode, dedupeBy, analyzeCondition, atomReadsDataset, checklistLines as checklistLines$1, phrase, quoted, listAnd, describeAtom as describeAtom$1, describeCondition as describeCondition$1, guillemets, formatValue, humanize, listOr, scopeReadOf, describeRead, explainCondition, dedupeReads, whatIfCondition, MAX_COUNTERFACTUAL_INDEX } from "@sanity/groq-condition-describe";
+import { atomNode, dedupeBy, analyzeCondition, atomReadsDataset, checklistLines as checklistLines$1, phrase, quoted, listAnd, describeAtom as describeAtom$1, describeCondition as describeCondition$1, guillemets, formatValue, humanize, listOr, scopeReadOf, describeRead, explainCondition, _exhaustiveOptions, whatIfCondition, runGroq, formatRead, dedupeReads, MAX_COUNTERFACTUAL_INDEX } from "@sanity/groq-condition-describe";
 
-import { MAX_COUNTERFACTUAL_INDEX as MAX_COUNTERFACTUAL_INDEX2, NEUTRAL_MARK, OUTCOME_MARKS, analyzeCondition as analyzeCondition2, atomReadsDataset as atomReadsDataset2, explainCondition as explainCondition2, formatRead, guillemets as guillemets2, humanize as humanize2, isComparisonOp, quoted as quoted2, sentenceCase, whatIfCondition as whatIfCondition2, withAssignment } from "@sanity/groq-condition-describe";
+import { MAX_COUNTERFACTUAL_INDEX as MAX_COUNTERFACTUAL_INDEX2, NEUTRAL_MARK, OUTCOME_MARKS, analyzeCondition as analyzeCondition2, atomReadsDataset as atomReadsDataset2, explainCondition as explainCondition2, formatRead as formatRead2, guillemets as guillemets2, humanize as humanize2, isComparisonOp, quoted as quoted2, sentenceCase, whatIfCondition as whatIfCondition2, withAssignment } from "@sanity/groq-condition-describe";
 
 import { evaluate, parse } from "groq-js";
 
-import * as v from "valibot";
-
-function isFilterScopedOut(entry) {
-    return entry.status === "skipped" && entry.startedAt === void 0;
-}
-
-function liveSubworkflows(host) {
-    return (host.subworkflows ?? []).filter(row => row.resolved === void 0);
-}
-
-function resolvedChildStatus(child) {
-    if (!(child.completedAt === void 0 || child.completedAt === null)) return child.abortedAt !== void 0 && child.abortedAt !== null ? "aborted" : "done";
-}
-
-function condemnedSubworkflows(host) {
-    return liveSubworkflows(host).filter(row => row.abortPending !== void 0);
-}
-
-function condemnSubworkflow(row, owed) {
-    row.abortPending !== void 0 || row.resolved !== void 0 || (row.abortPending = {
-        at: owed.at,
-        reason: owed.reason
-    });
-}
+import { getPublishedId, getDraftId } from "@sanity/id-utils";
 
-function findOpenStageEntry(host) {
-    return host.stages.find(s => s.name === host.currentStage && s.exitedAt === void 0);
-}
-
-function findCurrentActivityEntry(host, activityName) {
-    return findOpenStageEntry(host)?.activities.find(a => a.name === activityName);
-}
+import * as v from "valibot";
 
 const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
 
@@ -458,6 +429,11 @@ function rolesGateOf(atom) {
     if (!(count.type !== "FuncCall" || count.name !== "count" || count.args.length !== 1)) return rolesFilterList(count.args[0]);
 }
 
+function isAssignedGate(atom) {
+    const node = atomNode(atom);
+    return !atom.negated && node.type === "Parameter" && node.name === "assigned";
+}
+
 function rolesFilterList(node) {
     if (node.type !== "Filter") return;
     const base = node.base;
@@ -1746,27 +1722,38 @@ function startContextSyntaxIssues({groq: groq, vars: vars, context: context, ski
     return [ ...conditionParameterNames(groq) ].filter(name => !bound.has(name) && name !== skip).map(name => `reads $${name}, which the ${context} context does not bind (an unbound variable is GROQ null, so the predicate silently misevaluates — failing closed or passing vacuously by shape). Bound here: ` + vars.map(v2 => `$${v2.name}`).join(", "));
 }
 
-function getPath(value, path) {
-    let current = value;
-    for (const part of path.split(".")) {
-        if (current == null || typeof current != "object") return;
-        current = current[part];
+const GUARD_DOC_TYPE = "temp.system.guard";
+
+class MutationGuardDeniedError extends WorkflowError {
+    denied;
+    documentId;
+    action;
+    constructor(args) {
+        const ids = args.denied.map(d => d.guardId).join(", ");
+        super("mutation-guard-denied", `Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), 
+        this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, 
+        this.action = args.action;
+    }
+    static fromGuards(args) {
+        return new MutationGuardDeniedError({
+            documentId: args.documentId,
+            action: args.action,
+            denied: deniedGuardRefs(args.guards)
+        });
     }
-    return current;
 }
 
-function isReferenceObject(value) {
-    return typeof value._ref == "string";
+function deniedGuardRefs(guards) {
+    return guards.map(g => ({
+        guardId: g._id,
+        ...g.name !== void 0 ? {
+            name: g.name
+        } : {}
+    }));
 }
 
-function walkDocPath(value, path) {
-    let current = value;
-    for (const part of path.split(".")) {
-        if (current == null || typeof current != "object") return;
-        if (isReferenceObject(current) && !Object.hasOwn(current, part)) throw new Error(`cannot read "${part}" through the nested reference "${current._ref}" — the workflow only loads references it declares. Declare it as a doc.ref field entry to read through it.`);
-        current = current[part];
-    }
-    return current;
+function deniedGuardLabels(denied) {
+    return denied.map(d => d.name ?? d.guardId);
 }
 
 function mapJsonStrings(value, transform) {
@@ -1835,199 +1822,658 @@ function overlayInstanceInSnapshot(snapshot, instance) {
     };
 }
 
-function resolveFieldRead(args) {
-    const {kind: kind, value: value, path: path, snapshot: snapshot, targetKind: targetKind} = args;
-    if (isSingleDocRefKind(kind)) {
-        if (!isGdr(value)) return null;
-        if (path === void 0 && targetKind !== void 0 && isSingleDocRefKind(targetKind)) return value;
-        const base = derefBase(value, snapshot);
-        return path === void 0 ? base : walkDocPath(base, path);
-    }
-    return path !== void 0 ? getPath(value, path) : value;
+function lakeGuardId(args) {
+    return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.guardName}`;
 }
 
-function derefBase(ref, snapshot) {
-    return (snapshot !== void 0 ? findSnapshotDoc(snapshot, ref.id) : void 0) ?? {
-        _id: ref.id,
-        _type: ref.type
-    };
+function lakeActionsFor(action) {
+    return action === "publish" ? [ "create", "update" ] : action === "unpublish" ? [ "delete" ] : [ action ];
 }
 
-function buildParams(args) {
-    const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
-    return {
-        self: selfGdr(instance),
-        fields: renderedFields(instance.fields ?? [], snapshot),
-        parent: parentRef(instance)?.id ?? null,
-        ancestors: instance.ancestors.map(a => a.id),
-        stage: instance.currentStage,
-        now: now,
-        context: contextMap(instance),
-        effects: effectOutputsMap(instance),
-        effectStatus: effectStatusMap(instance),
-        activities: currentActivities2,
-        subworkflows: subworkflowVarRows(instance, snapshot),
-        ...activityGateParams(currentActivities2),
-        ...extra
-    };
+function lakeGuardActions(actions) {
+    const requested = new Set(actions.flatMap(lakeActionsFor));
+    return LAKE_MUTATION_GUARD_ACTIONS.filter(action => requested.has(action));
 }
 
-function subworkflowVarRows(instance, snapshot) {
-    const openKey = findOpenStageEntry(instance)?._key;
-    return (instance.subworkflows ?? []).map(row => ({
-        _id: toBareId(row.ref.id),
-        rowKey: row.rowKey,
-        activity: row.activity,
-        action: row.action,
-        definition: row.definition,
-        current: row.stageEntry === openKey,
-        ...childState(row, snapshot),
-        spawnedAt: row.spawnedAt
-    }));
+function publishedId(id) {
+    return getPublishedId(id);
 }
 
-function childState(row, snapshot) {
-    if (row.resolved !== void 0) return {
-        stage: row.resolved.stage ?? null,
-        status: row.resolved.aborted === !0 ? "aborted" : "done"
+function draftId(id) {
+    return getDraftId(id);
+}
+
+function versionPatternTranslation(pattern) {
+    const documentSeparator = pattern.indexOf(".", 9);
+    if (documentSeparator === -1) return {
+        issue: `id pattern "${pattern}" does not identify a versioned document`
     };
-    const doc = snapshot === void 0 ? void 0 : findSnapshotDoc(snapshot, row.ref.id);
-    return doc === void 0 ? {
-        stage: null,
-        status: "active"
+    const documentPattern = pattern.slice(documentSeparator + 1);
+    return /^\*+$/.test(documentPattern) ? {
+        issue: `id pattern "${pattern}" cannot be translated from a release version to a draft or published document without broadening it to every document`
     } : {
-        stage: doc.currentStage ?? null,
-        status: resolvedChildStatus(doc) ?? "active"
+        documentPattern: documentPattern
     };
 }
 
-function activityGateParams(activities) {
-    return {
-        allActivitiesDone: activities.every(activity => activity.status === "done" || activity.status === "skipped"),
-        anyActivityFailed: activities.some(activity => activity.status === "failed")
-    };
+function publishedPattern(pattern) {
+    if (pattern.startsWith("drafts.")) return pattern.slice(7);
+    if (!pattern.startsWith("versions.")) return pattern;
+    const translated = versionPatternTranslation(pattern);
+    if (translated.issue !== void 0) throw new Error(translated.issue);
+    return translated.documentPattern;
 }
 
-function renderedFields(entries, snapshot) {
-    const out = {};
-    for (const entry of entries) out[entry.name] = renderedValue(entry, snapshot);
-    return out;
+function draftPattern(pattern) {
+    return `drafts.${publishedPattern(pattern)}`;
 }
 
-function renderedValue(entry, snapshot) {
-    return resolveFieldRead({
-        kind: entry._type,
-        value: entry.value,
-        path: void 0,
-        snapshot: snapshot
-    });
+function idsInSpace(args) {
+    const {ids: ids, space: space, sourceInstanceId: sourceInstanceId} = args;
+    return space === "authored" ? ids : space === "published" ? [ ...new Set(ids.map(publishedId)) ] : [ ...new Set(ids.map(id => publishedId(id) === sourceInstanceId ? publishedId(id) : draftId(id))) ];
 }
 
-function scopedFieldOverlay({instance: instance, snapshot: snapshot, activityName: activityName}) {
-    const stageEntry = findOpenStageEntry(instance);
-    if (stageEntry === void 0) return {};
-    const stageFields = renderedFields(stageEntry.fields ?? [], snapshot), activity = activityName ? stageEntry.activities.find(t => t.name === activityName) : void 0;
+function patternsInSpace(patterns, space) {
+    if (space === "authored") return patterns;
+    const convert = space === "edit" ? draftPattern : publishedPattern;
+    return [ ...new Set(patterns.map(convert)) ];
+}
+
+function matchInSpace(args) {
+    const {match: match, actions: actions, space: space, sourceInstanceId: sourceInstanceId} = args;
     return {
-        ...stageFields,
-        ...renderedFields(activity?.fields ?? [], snapshot)
+        ...match,
+        ...match.idRefs !== void 0 ? {
+            idRefs: idsInSpace({
+                ids: match.idRefs,
+                space: space,
+                sourceInstanceId: sourceInstanceId
+            })
+        } : {},
+        ...match.idPatterns !== void 0 ? {
+            idPatterns: patternsInSpace(match.idPatterns, space)
+        } : {},
+        actions: lakeGuardActions(actions)
     };
 }
 
-function assignedFor({instance: instance, activityName: activityName, actor: actor, roleAliases: roleAliases}) {
-    if (actor === void 0) return !1;
-    const entry = findCurrentActivityEntry(instance, activityName)?.fields?.find(s => s._type === "assignees");
-    return entry === void 0 ? !1 : entry.value.some(a => a.type === "user" ? a.id === actor.id : actorFulfillsRole({
-        actorRoles: actor.roles,
-        required: a.role,
-        aliases: roleAliases
+function guardPartitions(id, actions) {
+    return MUTATION_GUARD_ID_SPACES.flatMap(space => {
+        const matchingActions = actions.filter(action => mutationGuardActionIdSpace(action) === space);
+        return matchingActions.length > 0 ? [ {
+            space: space,
+            actions: matchingActions
+        } ] : [];
+    }).map((partition, index) => ({
+        ...partition,
+        id: index === 0 ? id : `${id}.${partition.space}`
     }));
 }
 
-function effectStatusMap(instance) {
-    const entry = findOpenStageEntry(instance);
-    if (entry === void 0) return {};
-    const out = {};
-    for (const run of instance.effectHistory) run.stageEntryKey === entry._key && (out[run.name] = run.status);
-    return out;
+function compiledGuardIds(args) {
+    return guardPartitions(args.id, args.actions).map(partition => partition.id);
 }
 
-function contextMap(instance) {
-    const out = {};
-    for (const entry of instance.context) out[entry.name] = entry._type === "context.json" ? parseJsonContextEntry(entry) : entry.value;
-    return out;
+function lakeGuardDocument(args) {
+    return {
+        _id: args.id,
+        _type: GUARD_DOC_TYPE,
+        resourceType: args.resourceType,
+        resourceId: args.resourceId,
+        owner: args.owner,
+        sourceInstanceId: args.sourceInstanceId,
+        sourceDefinition: args.sourceDefinition,
+        sourceStage: args.sourceStage,
+        ...args.name !== void 0 ? {
+            name: args.name
+        } : {},
+        ...args.description !== void 0 ? {
+            description: args.description
+        } : {},
+        match: args.match,
+        predicate: args.predicate,
+        metadata: args.metadata
+    };
 }
 
-function effectOutputsMap(instance) {
-    const out = {};
-    for (const run of instance.effectHistory) run.outputs !== void 0 && (out[run.name] = run.outputs);
-    return out;
+function compileGuards(args) {
+    const [first, ...remaining] = guardPartitions(args.id, args.match.actions);
+    if (first === void 0) throw new Error("cannot compile a guard without an action");
+    const compilePartition = ({space: space, actions: actions, id: id}) => lakeGuardDocument({
+        ...args,
+        id: id,
+        match: matchInSpace({
+            match: args.match,
+            actions: actions,
+            space: space,
+            sourceInstanceId: args.sourceInstanceId
+        })
+    });
+    return [ compilePartition(first), ...remaining.map(compilePartition) ];
 }
 
-function parseJsonContextEntry(entry) {
-    try {
-        return JSON.parse(entry.value);
-    } catch (err) {
-        rethrowWithContext(err, `context entry "${entry.name}" holds unparseable JSON`);
-    }
+function globMatch(pattern, value) {
+    if (!pattern.includes("*")) return pattern === value;
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`).test(value);
 }
 
-function paramsForLake(params) {
-    return {
-        ...params,
-        self: typeof params.self == "string" ? toBareId(params.self) : params.self,
-        parent: typeof params.parent == "string" ? toBareId(params.parent) : params.parent,
-        ancestors: Array.isArray(params.ancestors) ? params.ancestors.map(a => typeof a == "string" ? toBareId(a) : a) : params.ancestors,
-        fields: stripFieldsForLake(params.fields)
-    };
+function guardIdPatternIssue(pattern, actions) {
+    const representativeId = pattern.replaceAll("*", "x");
+    if (!isBareDocumentId(representativeId)) return `id pattern "${pattern}" is not a valid resource-local document-id glob; use document-id characters (letters, digits, \`_\`, \`-\`, \`.\`) and \`*\` wildcards`;
+    if (actions?.some(action => mutationGuardActionIdSpace(action) !== "authored") && pattern.startsWith("versions.")) return versionPatternTranslation(pattern).issue;
 }
 
-function stripFieldsForLake(value) {
-    return mapJsonStrings(value, s => toBareId(s));
+function parseGuardPredicate(predicate) {
+    return parse(predicate, {
+        mode: "delta"
+    });
 }
 
-function resolveStaticValueExpr(src, ctx) {
-    switch (src.type) {
-      case "literal":
-        return src.value;
-
-      case "param":
-        return ctx.params?.[src.param];
+function guardPredicateSyntaxIssue(predicate) {
+    try {
+        parseGuardPredicate(predicate);
+        return;
+    } catch (error) {
+        return errorMessage(error);
+    }
+}
 
-      case "actor":
-        return ctx.actor;
+function lakeDocumentIdForAction(id, action) {
+    return mutationGuardActionIdSpace(action) === "published" ? publishedId(id) : id;
+}
 
-      case "now":
-        return ctx.now;
+function legacyLifecycleActionFor(action, documentId) {
+    if (publishedId(documentId) === documentId) {
+        if (action === "create" || action === "update") return "publish";
+        if (action === "delete") return "unpublish";
     }
 }
 
-function randomKey(length = 12) {
-    const bytes = new Uint8Array(length);
-    return globalThis.crypto.getRandomValues(bytes), [ ...bytes ].map(b => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+function guardMatches({guard: guard, doc: doc, action: action}) {
+    const m = guard.match, documentId = lakeDocumentIdForAction(doc.id, action), legacyLifecycleAction = legacyLifecycleActionFor(action, documentId);
+    if (![ action, ...lakeActionsFor(action), legacyLifecycleAction ].some(candidate => candidate !== void 0 && m.actions.includes(candidate)) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type))) return !1;
+    if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
+        const byRef = m.idRefs?.includes(documentId) ?? !1, byPattern = m.idPatterns?.some(p => globMatch(p, documentId)) ?? !1;
+        if (!byRef && !byPattern) return !1;
+    }
+    return !0;
 }
 
-function instanceDocId(tag) {
-    return `${tag}.wf-instance.${randomKey()}`;
+function guardPredicateRoot(args) {
+    return {
+        document: {
+            before: args.context.before,
+            after: args.context.after
+        },
+        guard: args.guard,
+        mutation: {
+            action: args.context.action
+        }
+    };
 }
 
-function mapFieldRefValues(args) {
-    const {entryType: entryType, value: value, fields: fields, of: of, mapRef: mapRef} = args;
-    return value == null ? value : isSingleDocRefKind(entryType) || entryType === "release.ref" ? mapRef(value) : entryType === "doc.refs" ? mapItems(value, mapRef) : entryType === "object" ? mapRowRefValues({
-        row: value,
-        shapes: fields ?? [],
-        mapRef: mapRef
-    }) : entryType === "array" ? mapItems(value, row => mapRowRefValues({
-        row: row,
-        shapes: of ?? [],
-        mapRef: mapRef
-    })) : value;
+function lakeShapedSnapshotDocument(doc) {
+    return mapJsonStrings(doc, (value, key) => key === "_id" || key === "_ref" ? toBareId(value) : value);
 }
 
-function mapItems(value, mapItem) {
-    return Array.isArray(value) ? value.map(mapItem) : value;
+function snapshotGuardDereference(args) {
+    return ({_ref: _ref}) => {
+        const lookupId = isGdrUri(_ref) ? _ref : gdrFromResource(args.resource, _ref), found = findSnapshotDoc(args.snapshot, lookupId);
+        return Promise.resolve(found === void 0 ? null : lakeShapedSnapshotDocument(found));
+    };
 }
 
-function mapRowRefValues(args) {
+async function evaluateMutationGuard(args) {
+    const {guard: guard, context: context, dereference: dereference} = args;
+    if (guard.predicate === "") return !1;
+    const root = guardPredicateRoot({
+        guard: guard,
+        context: context
+    });
+    let dereferenceFailed = !1;
+    const guardedDereference = dereference === void 0 ? void 0 : async ref => {
+        try {
+            return await dereference(ref);
+        } catch (error) {
+            throw dereferenceFailed = !0, error;
+        }
+    };
+    try {
+        const tree = parseGuardPredicate(guard.predicate);
+        return await (await evaluate(tree, {
+            root: root,
+            before: context.before,
+            after: context.after,
+            ...guardedDereference !== void 0 ? {
+                dataset: [],
+                dereference: guardedDereference
+            } : {},
+            ...context.identity !== void 0 ? {
+                identity: context.identity
+            } : {}
+        })).get() === !0;
+    } catch (error) {
+        if (dereferenceFailed) throw error;
+        return !1;
+    }
+}
+
+async function denyingGuards(args) {
+    const {guards: guards, doc: doc, context: context, dereference: dereference} = args, denied = [];
+    for (const guard of guards) guardMatches({
+        guard: guard,
+        doc: doc,
+        action: context.action
+    }) && (await evaluateMutationGuard({
+        guard: guard,
+        context: context,
+        ...dereference !== void 0 ? {
+            dereference: dereference
+        } : {}
+    }) || denied.push(guard));
+    return denied;
+}
+
+async function documentActionDenials(args) {
+    const {mutation: mutation, resource: resource, guards: guards, identity: identity, dereference: dereference} = args, document = mutation.after ?? mutation.before;
+    if (document === null) throw new Error("a concrete Lake mutation requires a before or after image");
+    const enforceable = guards.filter(g => g.resourceType === resource.type && g.resourceId === resource.id);
+    return enforceable.length === 0 ? [] : denyingGuards({
+        guards: enforceable,
+        doc: {
+            id: document._id,
+            type: document._type
+        },
+        context: {
+            ...mutation,
+            ...identity !== void 0 ? {
+                identity: identity
+            } : {}
+        },
+        ...dereference !== void 0 ? {
+            dereference: dereference
+        } : {}
+    });
+}
+
+async function instanceWriteDenials(args) {
+    const {instance: instance, guards: guards, identity: identity, dereference: dereference} = args;
+    return documentActionDenials({
+        mutation: {
+            before: instance,
+            after: instance,
+            action: "update"
+        },
+        resource: instance.workflowResource,
+        guards: guards,
+        dereference: dereference,
+        ...identity !== void 0 ? {
+            identity: identity
+        } : {}
+    });
+}
+
+async function assertInstanceWriteAllowed(args) {
+    const denied = await instanceWriteDenials(args);
+    if (denied.length !== 0) throw MutationGuardDeniedError.fromGuards({
+        documentId: args.instance._id,
+        action: "update",
+        guards: denied
+    });
+}
+
+const ASSIGNMENT_LIST_MODEL = 9;
+
+function isAssignmentListModel(modelVersion) {
+    return modelVersion >= ASSIGNMENT_LIST_MODEL;
+}
+
+function definitionAssignmentModel(instance) {
+    if (typeof instance.definitionSnapshot != "string") return 0;
+    const modelVersion = parseDefinitionSnapshotValue({
+        _id: instance._id,
+        definitionSnapshot: instance.definitionSnapshot
+    }).modelVersion;
+    return typeof modelVersion == "number" ? modelVersion : 0;
+}
+
+function writesSingularAssignmentLists(instance) {
+    return isAssignmentListModel(definitionAssignmentModel(instance));
+}
+
+function legacyAssigneeValue(entry) {
+    return legacyAssignmentValue(entry.value, entry.name);
+}
+
+function legacyAssignmentValue(value, path) {
+    if (!Array.isArray(value)) return value;
+    if (value.length === 0) return null;
+    if (value.length === 1) return value[0];
+    throw new ContractViolationError(`legacy assignee field "${path}" cannot persist ${value.length} members; redeploy the definition at the assignment-list reader model before writing a role pool`);
+}
+
+function mapShapeValues(args) {
+    const {value: value, shapes: shapes, mapAssignee: mapAssignee, parentPath: parentPath} = args;
+    if (typeof value != "object" || value === null || Array.isArray(value)) return value;
+    const source = value, next = {
+        ...source
+    };
+    for (const shape of shapes) {
+        if (!Object.hasOwn(source, shape.name)) continue;
+        const path = `${parentPath}.${shape.name}`, member = source[shape.name], mapped = mappedShapeValue({
+            shape: shape,
+            member: member,
+            mapAssignee: mapAssignee,
+            path: path
+        });
+        mapped.found && defineOwnValue(next, {
+            name: shape.name,
+            value: mapped.value
+        });
+    }
+    return next;
+}
+
+function mappedShapeValue(args) {
+    const {shape: shape, member: member, mapAssignee: mapAssignee, path: path} = args;
+    return shape.type === "assignee" ? {
+        found: !0,
+        value: mapAssignee(member, path)
+    } : shape.type === "object" ? {
+        found: !0,
+        value: mapShapeValues({
+            value: member,
+            shapes: shape.fields ?? [],
+            mapAssignee: mapAssignee,
+            parentPath: path
+        })
+    } : shape.type !== "array" || !Array.isArray(member) ? {
+        found: !1
+    } : {
+        found: !0,
+        value: member.map((row, index) => mapShapeValues({
+            value: row,
+            shapes: shape.of ?? [],
+            mapAssignee: mapAssignee,
+            parentPath: `${path}[${index}]`
+        }))
+    };
+}
+
+function defineOwnValue(target, property) {
+    Object.defineProperty(target, property.name, {
+        configurable: !0,
+        enumerable: !0,
+        value: property.value,
+        writable: !0
+    });
+}
+
+function mapNestedAssignmentValues(entry, mapAssignee) {
+    return entry._type === "object" ? mapShapeValues({
+        value: entry.value,
+        shapes: entry.fields,
+        mapAssignee: mapAssignee,
+        parentPath: entry.name
+    }) : entry.value.map((row, index) => mapShapeValues({
+        value: row,
+        shapes: entry.of,
+        mapAssignee: mapAssignee,
+        parentPath: `${entry.name}[${index}]`
+    }));
+}
+
+function normalizeNestedAssignmentValues(entry) {
+    return entry._type !== "object" && entry._type !== "array" ? entry : {
+        ...entry,
+        value: mapNestedAssignmentValues(entry, normalizeAssignmentMembers)
+    };
+}
+
+function assignmentFieldsForWrite(fields, listModel) {
+    return listModel ? fields : fields.map(entry => entry._type === "assignee" ? {
+        ...entry,
+        value: legacyAssigneeValue(entry)
+    } : entry._type === "object" || entry._type === "array" ? {
+        ...entry,
+        value: mapNestedAssignmentValues(entry, legacyAssignmentValue)
+    } : entry);
+}
+
+function activityForWrite(activity, listModel) {
+    return {
+        ...activity,
+        ...activity.fields === void 0 ? {} : {
+            fields: assignmentFieldsForWrite(activity.fields, listModel)
+        }
+    };
+}
+
+function assignmentStagesForWrite(stages, listModel) {
+    return stages.map(stage => ({
+        ...stage,
+        fields: assignmentFieldsForWrite(stage.fields ?? [], listModel),
+        activities: stage.activities.map(activity => activityForWrite(activity, listModel))
+    }));
+}
+
+function getPath(value, path) {
+    let current = value;
+    for (const part of path.split(".")) {
+        if (current == null || typeof current != "object") return;
+        current = current[part];
+    }
+    return current;
+}
+
+function isReferenceObject(value) {
+    return typeof value._ref == "string";
+}
+
+function walkDocPath(value, path) {
+    let current = value;
+    for (const part of path.split(".")) {
+        if (current == null || typeof current != "object") return;
+        if (isReferenceObject(current) && !Object.hasOwn(current, part)) throw new Error(`cannot read "${part}" through the nested reference "${current._ref}" — the workflow only loads references it declares. Declare it as a doc.ref field entry to read through it.`);
+        current = current[part];
+    }
+    return current;
+}
+
+function resolveFieldRead(args) {
+    const {kind: kind, value: value, path: path, snapshot: snapshot, targetKind: targetKind} = args;
+    if (isSingleDocRefKind(kind)) {
+        if (!isGdr(value)) return null;
+        if (path === void 0 && targetKind !== void 0 && isSingleDocRefKind(targetKind)) return value;
+        const base = derefBase(value, snapshot);
+        return path === void 0 ? base : walkDocPath(base, path);
+    }
+    return path !== void 0 ? getPath(value, path) : value;
+}
+
+function derefBase(ref, snapshot) {
+    return (snapshot !== void 0 ? findSnapshotDoc(snapshot, ref.id) : void 0) ?? {
+        _id: ref.id,
+        _type: ref.type
+    };
+}
+
+function buildParams(args) {
+    const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
+    return {
+        self: selfGdr(instance),
+        fields: renderedFields(instance.fields ?? [], snapshot),
+        parent: parentRef(instance)?.id ?? null,
+        ancestors: instance.ancestors.map(a => a.id),
+        stage: instance.currentStage,
+        now: now,
+        context: contextMap(instance),
+        effects: effectOutputsMap(instance),
+        effectStatus: effectStatusMap(instance),
+        activities: currentActivities2,
+        subworkflows: subworkflowVarRows(instance, snapshot),
+        ...activityGateParams(currentActivities2),
+        ...extra
+    };
+}
+
+function subworkflowVarRows(instance, snapshot) {
+    const openKey = findOpenStageEntry(instance)?._key;
+    return (instance.subworkflows ?? []).map(row => ({
+        _id: toBareId(row.ref.id),
+        rowKey: row.rowKey,
+        activity: row.activity,
+        action: row.action,
+        definition: row.definition,
+        current: row.stageEntry === openKey,
+        ...childState(row, snapshot),
+        spawnedAt: row.spawnedAt
+    }));
+}
+
+function childState(row, snapshot) {
+    if (row.resolved !== void 0) return {
+        stage: row.resolved.stage ?? null,
+        status: row.resolved.aborted === !0 ? "aborted" : "done"
+    };
+    const doc = snapshot === void 0 ? void 0 : findSnapshotDoc(snapshot, row.ref.id);
+    return doc === void 0 ? {
+        stage: null,
+        status: "active"
+    } : {
+        stage: doc.currentStage ?? null,
+        status: resolvedChildStatus(doc) ?? "active"
+    };
+}
+
+function activityGateParams(activities) {
+    return {
+        allActivitiesDone: activities.every(activity => activity.status === "done" || activity.status === "skipped"),
+        anyActivityFailed: activities.some(activity => activity.status === "failed")
+    };
+}
+
+function renderedFields(entries, snapshot) {
+    const out = {};
+    for (const entry of entries) out[entry.name] = renderedValue(entry, snapshot);
+    return out;
+}
+
+function renderedValue(entry, snapshot) {
+    return resolveFieldRead({
+        kind: entry._type,
+        value: entry.value,
+        path: void 0,
+        snapshot: snapshot
+    });
+}
+
+function scopedFieldOverlay({instance: instance, snapshot: snapshot, activityName: activityName}) {
+    const stageEntry = findOpenStageEntry(instance);
+    if (stageEntry === void 0) return {};
+    const stageFields = renderedFields(stageEntry.fields ?? [], snapshot), activity = activityName ? stageEntry.activities.find(t => t.name === activityName) : void 0;
+    return {
+        ...stageFields,
+        ...renderedFields(activity?.fields ?? [], snapshot)
+    };
+}
+
+function assignedFor({instance: instance, activityName: activityName, actor: actor, roleAliases: roleAliases}) {
+    if (actor === void 0) return !1;
+    const activity = findCurrentActivityEntry(instance, activityName);
+    return actorMatchesAssignment({
+        actor: actor,
+        members: assignmentMembers(activity?.fields ?? []),
+        roleAliases: roleAliases
+    });
+}
+
+function effectStatusMap(instance) {
+    const entry = findOpenStageEntry(instance);
+    if (entry === void 0) return {};
+    const out = {};
+    for (const run of instance.effectHistory) run.stageEntryKey === entry._key && (out[run.name] = run.status);
+    return out;
+}
+
+function contextMap(instance) {
+    const out = {};
+    for (const entry of instance.context) out[entry.name] = entry._type === "context.json" ? parseJsonContextEntry(entry) : entry.value;
+    return out;
+}
+
+function effectOutputsMap(instance) {
+    const out = {};
+    for (const run of instance.effectHistory) run.outputs !== void 0 && (out[run.name] = run.outputs);
+    return out;
+}
+
+function parseJsonContextEntry(entry) {
+    try {
+        return JSON.parse(entry.value);
+    } catch (err) {
+        rethrowWithContext(err, `context entry "${entry.name}" holds unparseable JSON`);
+    }
+}
+
+function paramsForLake(params) {
+    return {
+        ...params,
+        self: typeof params.self == "string" ? toBareId(params.self) : params.self,
+        parent: typeof params.parent == "string" ? toBareId(params.parent) : params.parent,
+        ancestors: Array.isArray(params.ancestors) ? params.ancestors.map(a => typeof a == "string" ? toBareId(a) : a) : params.ancestors,
+        fields: stripFieldsForLake(params.fields)
+    };
+}
+
+function stripFieldsForLake(value) {
+    return mapJsonStrings(value, s => toBareId(s));
+}
+
+function resolveStaticValueExpr(src, ctx) {
+    switch (src.type) {
+      case "literal":
+        return src.value;
+
+      case "param":
+        return ctx.params?.[src.param];
+
+      case "actor":
+        return ctx.actor;
+
+      case "now":
+        return ctx.now;
+    }
+}
+
+function randomKey(length = 12) {
+    const bytes = new Uint8Array(length);
+    return globalThis.crypto.getRandomValues(bytes), [ ...bytes ].map(b => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
+
+function instanceDocId(tag) {
+    return `${tag}.wf-instance.${randomKey()}`;
+}
+
+function mapFieldRefValues(args) {
+    const {entryType: entryType, value: value, fields: fields, of: of, mapRef: mapRef} = args;
+    return value == null ? value : isSingleDocRefKind(entryType) || entryType === "release.ref" ? mapRef(value) : entryType === "doc.refs" ? mapItems(value, mapRef) : entryType === "object" ? mapRowRefValues({
+        row: value,
+        shapes: fields ?? [],
+        mapRef: mapRef
+    }) : entryType === "array" ? mapItems(value, row => mapRowRefValues({
+        row: row,
+        shapes: of ?? [],
+        mapRef: mapRef
+    })) : value;
+}
+
+function mapItems(value, mapItem) {
+    return Array.isArray(value) ? value.map(mapItem) : value;
+}
+
+function mapRowRefValues(args) {
     const {row: row, shapes: shapes, mapRef: mapRef} = args;
     if (typeof row != "object" || row === null || Array.isArray(row)) return row;
     const record = row, out = {
@@ -2254,10 +2700,12 @@ class WorkflowStateDivergedError extends WorkflowError {
 class PartialGuardDeployError extends WorkflowError {
     stageName;
     deployed;
+    rollbackError;
     constructor(args) {
         super("partial-guard-deploy", `Partial guard deploy on stage "${args.stageName}": ${args.deployed} guard(s) deployed before a later one failed.`, {
             cause: args.cause
-        }), this.name = "PartialGuardDeployError", this.stageName = args.stageName, this.deployed = args.deployed;
+        }), this.name = "PartialGuardDeployError", this.stageName = args.stageName, this.deployed = args.deployed, 
+        args.rollbackError !== void 0 && (this.rollbackError = args.rollbackError);
     }
 }
 
@@ -2298,7 +2746,23 @@ function staleClaimDetail(reason) {
 const CONCURRENT_COMMIT_MAX_ATTEMPTS = 3;
 
 function lostRaceMessage(args) {
-    return `${args.what} (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running — a concurrent writer kept committing first. Re-read and retry, or investigate a write storm on this instance.`;
+    return `${args.what} (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running — a concurrent writer kept committing first. ${args.recovery ?? "Re-read and retry, or investigate a write storm on this instance."}`;
+}
+
+function isRetryableInstanceCommitConflict(error) {
+    return !isCreateIdCollision(error) && isRevisionConflict(error);
+}
+
+class InstanceCommitRevisionConflict extends Error {
+    constructor(cause) {
+        super("Instance commit lost its revision fence", {
+            cause: cause
+        }), this.name = "InstanceCommitRevisionConflict";
+    }
+}
+
+function isInstanceCommitRevisionConflict(error) {
+    return error instanceof InstanceCommitRevisionConflict;
 }
 
 class ConcurrentFireActionError extends WorkflowError {
@@ -2316,6 +2780,19 @@ class ConcurrentFireActionError extends WorkflowError {
     }
 }
 
+class ConcurrentCascadeError extends WorkflowError {
+    instanceId;
+    attempts;
+    constructor(args) {
+        super("concurrent-cascade", lostRaceMessage({
+            what: "Automatic cascade",
+            instanceId: args.instanceId,
+            attempts: args.attempts,
+            recovery: "An earlier verb commit may already have landed. Re-read the instance and invoke tick after contention subsides."
+        })), this.name = "ConcurrentCascadeError", this.instanceId = args.instanceId, this.attempts = args.attempts;
+    }
+}
+
 function isRevisionConflict(error) {
     if (typeof error != "object" || error === null) return !1;
     const {statusCode: statusCode, message: message} = error;
@@ -2598,11 +3075,15 @@ function applyFieldSet(op, ctx) {
         ...entryShape(entry),
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.roleAliases,
-        ...entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
+        ...entry._type === "assignee" || entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
             previousValue: entry.value
         } : {}
     });
-    return assertRuntimeRefsWithinSurface({
+    return assertLegacySingularValue({
+        entry: entry,
+        value: validated,
+        ctx: ctx
+    }), assertRuntimeRefsWithinSurface({
         entryType: entry._type,
         entryName: entry.name,
         value: validated,
@@ -2619,12 +3100,12 @@ function applyFieldSet(op, ctx) {
 }
 
 function applyFieldSetIfMissing(op, ctx) {
-    const entry = locateEntry(ctx, op.target);
-    return isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+    const entry = locateEntry(ctx, op.target), legacySingular = isLegacySingularAssignment(entry, ctx);
+    return isAlwaysArrayFieldKind(entry._type) && !legacySingular && rejectFieldOpTarget({
         entry: entry,
         op: op,
         issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
-    }), entry.value !== null && entry.value !== void 0 ? {
+    }), entry.value !== null && entry.value !== void 0 && !(legacySingular && Array.isArray(entry.value) && entry.value.length === 0) ? {
         opType: op.type,
         target: op.target
     } : {
@@ -2744,7 +3225,14 @@ function applyFieldUnset(op, ctx) {
 }
 
 function applyFieldAppend(op, ctx) {
-    const entry = locateEntry(ctx, op.target), slot = appendItemSlot(entry), item = resolveOpValue({
+    const entry = locateEntry(ctx, op.target);
+    if (isLegacySingularAssignment(entry, ctx)) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "item",
+        issues: [ "legacy singular assignee entries do not support append; redeploy at model 9" ]
+    });
+    const slot = appendItemSlot(entry), item = resolveOpValue({
         src: op.value,
         ctx: ctx,
         ...slot !== void 0 ? {
@@ -2756,7 +3244,7 @@ function applyFieldAppend(op, ctx) {
         item: item,
         types: entry._type === "doc.refs" ? entry.types : void 0,
         of: entry._type === "array" ? entry.of : void 0,
-        roles: entry._type === "assignees" ? entry.roles : void 0,
+        roles: isAssignmentFieldEntry(entry) ? entry.roles : void 0,
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.roleAliases
     });
@@ -2768,8 +3256,16 @@ function applyFieldAppend(op, ctx) {
         ctx: ctx,
         src: op.value
     });
-    const current = Array.isArray(entry.value) ? entry.value : [];
-    return setEntryValue(entry, [ ...current, withRowKey(validated) ]), {
+    const next = [ ...Array.isArray(entry.value) ? entry.value : [], withRowKey(validated) ], value = isAssignmentFieldEntry(entry) ? validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: next,
+        ...assignmentEntryShape(entry),
+        previousValue: entry.value,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
+    }) : next;
+    return setEntryValue(entry, value), {
         opType: op.type,
         target: op.target,
         resolved: {
@@ -2846,7 +3342,14 @@ async function applyFieldUpdateWhere(op, ctx) {
 }
 
 async function applyFieldRemoveWhere(op, ctx) {
-    const entry = locateEntry(ctx, op.target), rows = requireArrayValue(entry, op), matches = await rowMatches({
+    const entry = locateEntry(ctx, op.target);
+    if (isLegacySingularAssignment(entry, ctx)) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ "legacy singular assignee entries do not support removeWhere; redeploy at model 9" ]
+    });
+    const rows = requireArrayValue(entry, op), matches = await rowMatches({
         where: op.where,
         rows: rows,
         ctx: ctx
@@ -2857,6 +3360,20 @@ async function applyFieldRemoveWhere(op, ctx) {
     };
 }
 
+function assertLegacySingularValue(args) {
+    const {entry: entry, value: value, ctx: ctx} = args;
+    if (!(!isLegacySingularAssignment(entry, ctx) || !Array.isArray(value) || value.length <= 1)) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ "legacy singular assignee entries accept at most one total member; redeploy at model 9" ]
+    });
+}
+
+function isLegacySingularAssignment(entry, ctx) {
+    return entry._type === "assignee" && !isAssignmentListModel(ctx.mutation.definitionModelVersion);
+}
+
 function requireMergeableRows(entry, op) {
     if (entry._type !== "array") throw new Error(`${op.type} target ${op.target.scope}:"${op.target.field}" is a ${entry._type} entry — updateWhere merges declared row sub-fields, so it targets \`array\` entries only`);
 }
@@ -3032,6 +3549,14 @@ function whereParams(ctx) {
 
 function validateDefinition(definition) {
     const v2 = createDefinitionValidator();
+    validateConditionSites(v2, definition), validateStart(v2, definition);
+    for (const entry of definition.fields ?? []) v2.checkEntry(entry, `workflow.fields "${entry.name}"`);
+    for (const stage of definition.stages) validateStage(v2, stage);
+    for (const issue of checkWorkflowInvariants(definition)) v2.errors.push(`  · ${formatIssuePath(issue.path)}: ${issue.message}`);
+    if (v2.errors.length > 0) throw new Error(`validateDefinition("${definition.name}"): ${v2.errors.length} deploy-time validation error${v2.errors.length === 1 ? "" : "s"}:\n` + v2.errors.join(`\n`));
+}
+
+function validateConditionSites(v2, definition) {
     for (const site of conditionSitesOf(definition)) {
         const {address: address} = site;
         address.kind !== "editable-field" && v2.checkCondition(site.condition, conditionSiteLabel({
@@ -3039,12 +3564,11 @@ function validateDefinition(definition) {
             address: address
         }));
     }
+}
+
+function validateStart(v2, definition) {
     definition.start?.filter !== void 0 && v2.report("start.filter", startFilterSyntaxIssues(definition.start.filter));
     for (const [index, requirement] of (definition.start?.requirements ?? []).entries()) requirement.type === "groq" && v2.report(`start.requirements[${index}].query`, startRequirementSyntaxIssues(requirement.query));
-    for (const entry of definition.fields ?? []) v2.checkEntry(entry, `workflow.fields "${entry.name}"`);
-    for (const stage of definition.stages) validateStage(v2, stage);
-    for (const issue of checkWorkflowInvariants(definition)) v2.errors.push(`  · ${formatIssuePath(issue.path)}: ${issue.message}`);
-    if (v2.errors.length > 0) throw new Error(`validateDefinition("${definition.name}"): ${v2.errors.length} deploy-time validation error${v2.errors.length === 1 ? "" : "s"}:\n` + v2.errors.join(`\n`));
 }
 
 function createDefinitionValidator() {
@@ -3073,35 +3597,14 @@ function createDefinitionValidator() {
     };
 }
 
-function conditionSiteLabel({stage: stage, address: address}) {
-    const at = `stage "${stage}"`;
-    switch (address.kind) {
-      case "predicate":
-        return `predicate "${address.predicate}"`;
-
-      case "transition":
-        return `${at} transition "${address.transition}" when`;
-
-      case "activity-filter":
-        return `${at} activity "${address.activity}".filter`;
-
-      case "requirement":
-        return `${at} activity "${address.activity}".requirements "${address.requirement}"`;
-
-      case "action":
-        return `${at} activity "${address.activity}" action "${address.action}".filter`;
-
-      case "action-when":
-        return `${at} activity "${address.activity}" action "${address.action}".when`;
-
-      case "editable-override":
-        return `${at}.editable "${address.name}"`;
-    }
+function conditionSiteLabel({stage: stage, address: address}) {
+    const at = `stage "${stage}"`;
+    return address.kind === "predicate" ? `predicate "${address.predicate}"` : address.kind === "transition" ? `${at} transition "${address.transition}" when` : address.kind === "activity-filter" ? `${at} activity "${address.activity}".filter` : address.kind === "requirement" ? `${at} activity "${address.activity}".requirements "${address.requirement}"` : address.kind === "action" ? `${at} activity "${address.activity}" action "${address.action}".filter` : address.kind === "action-when" ? `${at} activity "${address.activity}" action "${address.action}".when` : `${at}.editable "${address.name}"`;
 }
 
 function validateStage(v2, stage) {
     for (const entry of stage.fields ?? []) v2.checkEntry(entry, `stage "${stage.name}".fields "${entry.name}"`);
-    for (const guard of stage.guards ?? []) validateGuardReads({
+    for (const guard of stage.guards ?? []) validateGuard({
         v: v2,
         stageName: stage.name,
         guard: guard
@@ -3113,12 +3616,28 @@ function validateStage(v2, stage) {
     });
 }
 
-function validateGuardReads({v: v2, stageName: stageName, guard: guard}) {
+function validateGuard({v: v2, stageName: stageName, guard: guard}) {
     const where = `stage "${stageName}" guard "${guard.name}"`;
-    for (const expr of guard.match.idRefs ?? []) v2.checkGuardRead(expr, `${where} match.idRefs`);
+    if (validateGuardMatch({
+        v: v2,
+        where: where,
+        guard: guard
+    }), guard.predicate !== void 0 && guard.predicate !== "") {
+        const issue = guardPredicateSyntaxIssue(guard.predicate);
+        issue !== void 0 && v2.report(`${where} predicate`, [ issue ]);
+    }
     for (const [key, expr] of Object.entries(guard.metadata ?? {})) v2.checkGuardRead(expr, `${where} metadata "${key}"`);
 }
 
+function validateGuardMatch({v: v2, where: where, guard: guard}) {
+    guard.match.actions.length === 0 && v2.report(`${where} match.actions`, [ GUARD_ACTIONS_REQUIRED_MESSAGE ]);
+    for (const pattern of guard.match.idPatterns ?? []) {
+        const issue = guardIdPatternIssue(pattern, guard.match.actions);
+        issue !== void 0 && v2.report(`${where} match.idPatterns`, [ issue ]);
+    }
+    for (const expr of guard.match.idRefs ?? []) v2.checkGuardRead(expr, `${where} match.idRefs`);
+}
+
 function validateActivity({v: v2, stageName: stageName, activity: activity}) {
     const where = `stage "${stageName}" activity "${activity.name}"`;
     for (const entry of activity.fields ?? []) v2.checkEntry(entry, `${where}.fields "${entry.name}"`);
@@ -3259,175 +3778,7 @@ function hasPassed(instant, now) {
     return Date.parse(instant) <= Date.parse(now);
 }
 
-const GUARD_DOC_TYPE = "temp.system.guard";
-
-class MutationGuardDeniedError extends WorkflowError {
-    denied;
-    documentId;
-    action;
-    constructor(args) {
-        const ids = args.denied.map(d => d.guardId).join(", ");
-        super("mutation-guard-denied", `Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), 
-        this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, 
-        this.action = args.action;
-    }
-    static fromGuards(args) {
-        return new MutationGuardDeniedError({
-            documentId: args.documentId,
-            action: args.action,
-            denied: deniedGuardRefs(args.guards)
-        });
-    }
-}
-
-function deniedGuardRefs(guards) {
-    return guards.map(g => ({
-        guardId: g._id,
-        ...g.name !== void 0 ? {
-            name: g.name
-        } : {}
-    }));
-}
-
-function deniedGuardLabels(denied) {
-    return denied.map(d => d.name ?? d.guardId);
-}
-
-function lakeGuardId(args) {
-    return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.guardName}`;
-}
-
-function compileGuard(args) {
-    return {
-        _id: args.id,
-        _type: GUARD_DOC_TYPE,
-        resourceType: args.resourceType,
-        resourceId: args.resourceId,
-        owner: args.owner,
-        sourceInstanceId: args.sourceInstanceId,
-        sourceDefinition: args.sourceDefinition,
-        sourceStage: args.sourceStage,
-        ...args.name !== void 0 ? {
-            name: args.name
-        } : {},
-        ...args.description !== void 0 ? {
-            description: args.description
-        } : {},
-        match: args.match,
-        predicate: args.predicate,
-        metadata: args.metadata
-    };
-}
-
-function toGroqJsPredicate(predicate) {
-    return predicate.replace(new RegExp("(?<!\\$)\\bguard\\.", "g"), "$guard.").replace(new RegExp("(?<!\\$)\\bmutation\\.", "g"), "$mutation.");
-}
-
-function globMatch(pattern, value) {
-    if (!pattern.includes("*")) return pattern === value;
-    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    return new RegExp(`^${escaped}$`).test(value);
-}
-
-function guardMatches({guard: guard, doc: doc, action: action}) {
-    const m = guard.match;
-    if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type))) return !1;
-    if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
-        const byRef = m.idRefs?.includes(doc.id) ?? !1, byPattern = m.idPatterns?.some(p => globMatch(p, doc.id)) ?? !1;
-        if (!byRef && !byPattern) return !1;
-    }
-    return !0;
-}
-
-function guardPredicateParams(args) {
-    return {
-        guard: args.guard,
-        mutation: {
-            action: args.action
-        }
-    };
-}
-
-async function evaluateMutationGuard(args) {
-    const {guard: guard, context: context} = args;
-    if (guard.predicate === "") return !1;
-    const params = guardPredicateParams({
-        guard: guard,
-        action: context.action
-    });
-    try {
-        const tree = parse(toGroqJsPredicate(guard.predicate), {
-            mode: "delta",
-            params: params
-        });
-        return await (await evaluate(tree, {
-            before: context.before,
-            after: context.after,
-            params: params,
-            ...context.identity !== void 0 ? {
-                identity: context.identity
-            } : {}
-        })).get() === !0;
-    } catch {
-        return !1;
-    }
-}
-
-async function denyingGuards(args) {
-    const {guards: guards, doc: doc, context: context} = args, denied = [];
-    for (const guard of guards) guardMatches({
-        guard: guard,
-        doc: doc,
-        action: context.action
-    }) && (await evaluateMutationGuard({
-        guard: guard,
-        context: context
-    }) || denied.push(guard));
-    return denied;
-}
-
-async function documentActionDenials(args) {
-    const {doc: doc, resource: resource, action: action, guards: guards, identity: identity} = args, enforceable = guards.filter(g => g.resourceType === resource.type && g.resourceId === resource.id);
-    return enforceable.length === 0 ? [] : denyingGuards({
-        guards: enforceable,
-        doc: {
-            id: doc._id,
-            type: doc._type
-        },
-        context: {
-            action: action,
-            before: doc,
-            after: doc,
-            ...identity !== void 0 ? {
-                identity: identity
-            } : {}
-        }
-    });
-}
-
-async function instanceWriteDenials(args) {
-    const {instance: instance, guards: guards, identity: identity} = args;
-    return documentActionDenials({
-        doc: instance,
-        resource: instance.workflowResource,
-        action: "update",
-        guards: guards,
-        ...identity !== void 0 ? {
-            identity: identity
-        } : {}
-    });
-}
-
-async function assertInstanceWriteAllowed(args) {
-    const denied = await instanceWriteDenials(args);
-    if (denied.length !== 0) throw MutationGuardDeniedError.fromGuards({
-        documentId: args.instance._id,
-        action: "update",
-        guards: denied
-    });
-}
-
-const DATA_MODEL_VERSION = 8, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 8, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
+const DATA_MODEL_VERSION = 9, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 9, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/workflows/prerelease";
 
 class ReaderModelAcknowledgementError extends WorkflowError {
     code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
@@ -3567,6 +3918,22 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     compatibility: "reader-floor",
     applicability: "detectable",
     summary: "Assignee fields may restrict newly assigned users and collective roles by role."
+}), Object.freeze({
+    id: "split-guard-id-spaces",
+    introducedInModel: 9,
+    minReaderModel: 9,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Guards spanning edit and lifecycle id spaces emit independently retractable documents."
+}), Object.freeze({
+    id: "singular-assignee-lists",
+    introducedInModel: 9,
+    minReaderModel: 9,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Singular assignee fields use member lists with at most one user and any number of roles."
 }) ]);
 
 function recordOf(value) {
@@ -3690,6 +4057,25 @@ function hasRoleConstrainedAssignments(document) {
     return persistedFieldEntries(document).some(entry => entryKindMatches(entry, assignmentKindAcceptsRoles) && Array.isArray(entry.roles) && entry.roles.length > 0);
 }
 
+function hasSingularAssigneeLists(document) {
+    const root = recordOf(document);
+    if (root === void 0) return !1;
+    if (typeof root.definitionSnapshot != "string") return persistedFieldEntries(document).some(entry => entryHasKind(entry, "assignee"));
+    const snapshot = parsedDefinitionSnapshot(root);
+    return typeof snapshot?.modelVersion == "number" && isAssignmentListModel(snapshot.modelVersion) && persistedFieldEntries(document).some(entry => entryHasKind(entry, "assignee"));
+}
+
+function isMutationGuardAction(action) {
+    return typeof action == "string" && MUTATION_GUARD_ACTIONS.some(candidate => candidate === action);
+}
+
+function hasSplitGuardIdSpaces(document) {
+    return persistedDefinitionTree(document)?.stages.some(stage => recordsAt(stage, "guards").some(guard => {
+        const actions = recordOf(guard.match)?.actions;
+        return Array.isArray(actions) && mutationGuardRequiresSplitEmission(actions.filter(isMutationGuardAction));
+    })) ?? !1;
+}
+
 const featureDetectors = {
     "governed-model-stamps": () => !0,
     "subject-field-kind": document => hasFieldKind(document, "subject"),
@@ -3702,6 +4088,8 @@ const featureDetectors = {
     "readiness-requirements": hasReadinessRequirements,
     "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
     "role-constrained-assignment-fields": hasRoleConstrainedAssignments,
+    "singular-assignee-lists": hasSingularAssigneeLists,
+    "split-guard-id-spaces": hasSplitGuardIdSpaces,
     "node-semantics": hasNodeSemantics,
     "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
     "attributes-condition-var": () => !0
@@ -3837,8 +4225,93 @@ function findStageNode(args) {
     return args.definition?.stages.find(entry => entry.name === args.stageName);
 }
 
-function findActivityNode(args) {
-    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
+function findActivityNode(args) {
+    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
+}
+
+function requirementDescriptor(requirement) {
+    return {
+        name: requirement.name,
+        ...requirement.title !== void 0 ? {
+            title: requirement.title
+        } : {},
+        ...requirement.description !== void 0 ? {
+            description: requirement.description
+        } : {}
+    };
+}
+
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+}
+
+class ActionDisabledError extends WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
+    }
+}
+
+class StartNotAllowedError extends WorkflowError {
+    definition;
+    unmetRequirements;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
+    }
+}
+
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+}
+
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+    "activity-not-active": r => `activity status is "${r.status}"`,
+    "stage-terminal": r => `stage "${r.stage}" is terminal`,
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
+    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
+};
+
+function actionDisabledDetail(reason) {
+    return disabledReasonDetail[reason.kind](reason);
+}
+
+function formatDisabledReason({activity: activity, action: action, reason: reason}) {
+    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+}
+
+class EditFieldDeniedError extends WorkflowError {
+    reason;
+    target;
+    constructor(args) {
+        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
+        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
+    }
+}
+
+const editDisabledReasonDetail = {
+    "not-editable": () => "field is not declared editable",
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "edit-window-closed": r => `edit window closed (${r.detail})`,
+    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
+};
+
+function formatEditDisabledReason(target, reason) {
+    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
+    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
 }
 
 function liveChildrenField(instance) {
@@ -3867,7 +4340,8 @@ function openStage(instance) {
 }
 
 function assigneesOf(stage, activityName) {
-    return (stage?.activities.find(t => t.name === activityName)?.fields ?? []).filter(s => s._type === "assignees").flatMap(s => s.value);
+    const entry = stage?.activities.find(t => t.name === activityName);
+    return [ ...assignmentMembers(entry?.fields ?? []) ];
 }
 
 function isResolved(status) {
@@ -3900,11 +4374,16 @@ function failedActivityCause(input) {
 
 function waitingState(input) {
     const active = input.activities.find(t => t.status === "active" && (t.activity.actions ?? []).length > 0 && (t.unmetRequirements ?? []).length === 0);
-    if (active !== void 0) return {
+    if (active === void 0) return;
+    const actions = active.actions.filter(action => actionRendering(action) === "button" && action.allowed).map(action => action.action.name), hasManualAction = active.actions.some(action => !isCascadeFired(action.action));
+    let waitingFor = "automation";
+    return actions.length > 0 ? waitingFor = "caller" : hasManualAction && (waitingFor = "manual-action"), 
+    {
         state: "waiting",
         activity: active.activity.name,
         assignees: input.assignees[active.activity.name] ?? [],
-        actions: (active.activity.actions ?? []).filter(a => !isCascadeFired(a)).map(a => a.name)
+        actions: actions,
+        waitingFor: waitingFor
     };
 }
 
@@ -4030,7 +4509,7 @@ function isClaimExpired(claim, now) {
     return claim.leaseExpiresAt === void 0 || hasPassed(claim.leaseExpiresAt, now);
 }
 
-const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ];
+const EFFECT_RUN_STATUSES = _exhaustiveOptions()([ "done", "failed", "cancelled" ]);
 
 function userLoginProvider(user) {
     return user?.provider ?? user?.loginProvider;
@@ -4812,6 +5291,96 @@ function coerceToGdr(raw, workflowResource) {
     } : null;
 }
 
+const NOW = {
+    variable: "now",
+    path: []
+}, LAST_REPRESENTABLE_MS = 864e13;
+
+function readsNowIn(reads) {
+    return reads.some(read => read.variable === "now");
+}
+
+function readsNow(condition) {
+    return readsNowIn(analyzeCondition(condition).reads);
+}
+
+async function stageTimeSites(args) {
+    const {definition: definition, stage: stage, scopeFor: scopeFor} = args, sites = [];
+    for (const site of conditionSitesOf(definition)) {
+        if (site.stage !== stage || site.address.kind === "editable-override" || !readsNow(site.condition)) continue;
+        const activity = "activity" in site.address ? site.address.activity : void 0;
+        sites.push({
+            condition: site.condition,
+            params: await scopeFor(activity)
+        });
+    }
+    return sites;
+}
+
+async function nextEvaluationInstant(args) {
+    const {sites: sites, dataset: dataset, now: now} = args, boundaries = [];
+    for (const site of sites) {
+        const boundary = await siteBoundary({
+            ...site,
+            dataset: dataset,
+            now: now
+        });
+        boundary !== void 0 && boundaries.push(boundary);
+    }
+    return [ ...boundaries ].sort(byInstant)[0];
+}
+
+function byInstant(a, b) {
+    return Date.parse(a) - Date.parse(b);
+}
+
+async function siteBoundary(args) {
+    const {condition: condition, params: params, dataset: dataset, now: now} = args, insight = await explainCondition({
+        condition: condition,
+        dataset: dataset,
+        params: params
+    });
+    for (const candidate of await candidateInstants({
+        insight: insight,
+        params: params,
+        dataset: dataset,
+        now: now
+    })) if ((await whatIfCondition({
+        condition: condition,
+        dataset: dataset,
+        params: params,
+        assign: {
+            target: NOW,
+            value: candidate
+        }
+    })).changed) return candidate;
+}
+
+async function candidateInstants(args) {
+    const {insight: insight, params: params, dataset: dataset, now: now} = args, comparands = [];
+    for (const atom of insight.atoms) readsNowIn(atom.atom.reads) && comparands.push(...await comparandsOf({
+        atom: atom,
+        params: params,
+        dataset: dataset
+    }));
+    const instants = comparands.filter(isParseableInstant).map(normalizeInstant).filter(instant => Date.parse(instant) < LAST_REPRESENTABLE_MS).flatMap(instant => [ instant, addMs(instant, 1) ]).filter(instant => !hasPassed(instant, now));
+    return [ ...new Set(instants) ].sort(byInstant);
+}
+
+function normalizeInstant(value) {
+    return new Date(Date.parse(value)).toISOString();
+}
+
+async function comparandsOf(args) {
+    const {atom: atom, params: params, dataset: dataset} = args, requirement = atom.requirement, values = requirement !== void 0 && requirement.target.variable === "now" && "value" in requirement ? [ requirement.value ] : [];
+    for (const read of atom.atom.reads) read.variable !== "now" && values.push(await runGroq({
+        groq: formatRead(read),
+        params: params,
+        dataset: dataset
+    }));
+    return values;
+}
+
 const NonEmpty = NonEmptyString, PersistedAssignmentRolesSchema = v.pipe(v.array(NonEmptyString), v.minLength(1, "assignment roles must not be empty")), UnknownRecord = v.record(v.string(), v.unknown()), PersistedChoiceOptionsSchema = v.looseObject({
     list: v.array(v.looseObject({
         title: v.string(),
@@ -4864,7 +5433,7 @@ function fieldArm(kind, value) {
     };
 }
 
-const OptionalRefTypes = v.exactOptional(v.array(v.string())), ResolvedFieldEntrySchema = v.variant("_type", [ v.looseObject(tolerantEntries()({
+const OptionalRefTypes = v.exactOptional(v.array(v.string())), RawResolvedFieldEntrySchema = v.variant("_type", [ v.looseObject(tolerantEntries()({
     ...fieldArm("doc.ref", fieldValueSchemas["doc.ref"]),
     types: OptionalRefTypes
 })), v.looseObject(tolerantEntries()({
@@ -4885,7 +5454,7 @@ const OptionalRefTypes = v.exactOptional(v.array(v.string())), ResolvedFieldEntr
 })), v.looseObject(tolerantEntries()({
     ...fieldArm("array", v.array(UnknownRecord)),
     of: v.array(PersistedFieldShapeSchema)
-})) ]), EffectOriginSchema = tolerantObject()({
+})) ]), ResolvedFieldEntrySchema = v.pipe(RawResolvedFieldEntrySchema, v.transform(normalizeNestedAssignmentValues)), EffectOriginSchema = tolerantObject()({
     kind: v.literal("action"),
     name: NonEmpty
 }), PendingEffectClaimSchema = tolerantObject()({
@@ -5746,6 +6315,25 @@ function buildInstanceBase(args) {
     };
 }
 
+function instanceDocumentForWrite(instance) {
+    const listModel = writesSingularAssignmentLists(instance);
+    return {
+        ...instance,
+        fields: assignmentFieldsForWrite(instance.fields, listModel),
+        stages: assignmentStagesForWrite(instance.stages, listModel)
+    };
+}
+
+function memoizedBy(compute) {
+    const cache = /* @__PURE__ */ new Map;
+    return key => {
+        const hit = cache.get(key);
+        if (hit !== void 0) return hit;
+        const value = (async () => compute(key))();
+        return cache.set(key, value), value;
+    };
+}
+
 async function hydrateSnapshot(args) {
     const {client: client, clientForGdr: clientForGdr, instance: instance, overlay: overlay} = args, loaded = [], visited = /* @__PURE__ */ new Set;
     loaded.push({
@@ -5896,16 +6484,26 @@ function loadCallContext({client: client, instanceId: instanceId, options: optio
 
 async function retryOnRevisionConflict(args) {
     const {client: client, instanceId: instanceId, options: options, commit: commit, onExhausted: onExhausted} = args;
-    for (let attempt = 1; attempt <= CONCURRENT_COMMIT_MAX_ATTEMPTS; attempt++) {
-        const ctx = await loadCallContext({
+    return retryCommit({
+        load: () => loadCallContext({
             client: client,
             instanceId: instanceId,
             options: options
-        });
+        }),
+        commit: commit,
+        shouldRetry: isInstanceCommitRevisionConflict,
+        onExhausted: onExhausted
+    });
+}
+
+async function retryCommit(args) {
+    const {load: load, commit: commit, shouldRetry: shouldRetry, onExhausted: onExhausted} = args;
+    for (let attempt = 1; attempt <= CONCURRENT_COMMIT_MAX_ATTEMPTS; attempt++) {
+        const ctx = await load();
         try {
             return await commit(ctx);
         } catch (error) {
-            if (!isRevisionConflict(error)) throw error;
+            if (!shouldRetry(error)) throw error;
         }
     }
     throw onExhausted();
@@ -5953,6 +6551,22 @@ async function ctxConditionParams(ctx, opts) {
     }, opts);
 }
 
+async function ctxNextEvaluationAt(ctx) {
+    if (ctx.instance.completedAt !== void 0) return;
+    const scopeFor = memoizedBy(activityName => ctxConditionParams(ctx, activityName === void 0 ? void 0 : {
+        activityName: activityName
+    })), sites = await stageTimeSites({
+        definition: ctx.definition,
+        stage: ctx.instance.currentStage,
+        scopeFor: scopeFor
+    });
+    if (sites.length !== 0) return nextEvaluationInstant({
+        sites: sites,
+        dataset: ctx.snapshot.docs,
+        now: ctx.now
+    });
+}
+
 async function ctxEvaluateConditionOutcome({ctx: ctx, condition: condition, opts: opts}) {
     return condition === void 0 ? "satisfied" : evaluateConditionOutcome({
         condition: condition,
@@ -6124,7 +6738,7 @@ async function resolveActivityFieldEntries(args) {
 
 async function resolveBindings(args) {
     const resolved = {};
-    for (const [key, groq] of Object.entries(args.bindings ?? {})) resolved[key] = await runGroq({
+    for (const [key, groq] of Object.entries(args.bindings ?? {})) resolved[key] = await runGroq$1({
         groq: groq,
         params: args.params,
         snapshot: args.snapshot
@@ -6581,7 +7195,7 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
     if (route === null) return null;
     const resource = assertSingleResource(route.targets), types = resolveMatchTypes(route.targets, guard.match.types);
     return {
-        doc: compileGuard({
+        docs: compileGuards({
             id: route.guardId,
             resourceType: resource.type,
             resourceId: resource.id,
@@ -6613,19 +7227,63 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
 async function upsertGuard(args) {
     const {client: client, doc: doc, exists: exists} = args;
     if (!exists) try {
-        await client.create(doc, {
-            ...SYNC_COMMIT,
-            tag: REQUEST_TAG.guardDeploy
-        });
-        return;
+        return {
+            created: await client.create(doc, {
+                ...SYNC_COMMIT,
+                tag: REQUEST_TAG.guardDeploy
+            })
+        };
     } catch (error) {
         if (!isCreateIdCollision(error)) throw error;
     }
     const {_id: _id, _type: _type, _rev: _rev, _createdAt: _createdAt, _updatedAt: _updatedAt, ...body} = doc;
-    await client.patch(doc._id).set(body).commit({
+    return await client.patch(doc._id).set(body).commit({
         ...SYNC_COMMIT,
         tag: REQUEST_TAG.guardRefresh
+    }), {
+        created: void 0
+    };
+}
+
+async function retractCreatedGuards(guards) {
+    for (const {client: client, doc: doc} of guards.toReversed()) {
+        if (doc._rev === void 0) return new Error(`Cannot roll back guard ${doc._id}: created document has no revision`);
+        try {
+            const revisionCheck = client.patch(doc._id).set({
+                predicate: doc.predicate
+            }).ifRevisionId(doc._rev);
+            await client.transaction().patch(revisionCheck).delete(doc._id).commit({
+                tag: REQUEST_TAG.guardDeploy
+            });
+        } catch (error) {
+            return error;
+        }
+    }
+}
+
+async function deployResolvedGuard(args) {
+    const {client: client, resourceKey: resourceKey, doc: doc, guard: guard, stageArgs: stageArgs, existingByResource: existingByResource} = args, localized = await localizeGuardMetadata({
+        doc: doc,
+        guard: guard,
+        client: client,
+        instance: stageArgs.instance,
+        definition: stageArgs.definition
     });
+    return (await upsertGuard({
+        client: client,
+        doc: localized,
+        exists: existingByResource.get(resourceKey)?.has(doc._id) ?? !1
+    })).created;
+}
+
+async function failGuardDeploy(args) {
+    const {cause: cause, stageName: stageName, deployed: deployed, createdGuards: createdGuards, updatedExistingGuard: updatedExistingGuard} = args, rollbackError = updatedExistingGuard ? void 0 : await retractCreatedGuards(createdGuards);
+    throw deployed > 0 && (updatedExistingGuard || rollbackError !== void 0) ? new PartialGuardDeployError({
+        stageName: stageName,
+        deployed: deployed,
+        cause: cause,
+        rollbackError: rollbackError
+    }) : cause;
 }
 
 function resolvedStageGuards(args) {
@@ -6638,10 +7296,12 @@ function resolvedStageGuards(args) {
             now: args.now,
             snapshot: args.snapshot
         });
-        resolved !== null && out.push({
-            client: args.clientForGdr(resolved.routeGdr),
-            resourceKey: resourceGdr(resourceFromParsed(resolved.routeGdr)),
-            value: resolved.doc,
+        if (resolved === null) continue;
+        const client = args.clientForGdr(resolved.routeGdr), resourceKey = resourceGdr(resourceFromParsed(resolved.routeGdr));
+        for (const doc of resolved.docs) out.push({
+            client: client,
+            resourceKey: resourceKey,
+            value: doc,
             guard: guard
         });
     }
@@ -6657,10 +7317,15 @@ function resolvedStageGuardRoutes(args) {
     }, out = [];
     for (const guard of stage?.guards ?? []) {
         const route = resolveGuardRoute(guard, ctx);
-        route !== null && out.push({
-            client: args.clientForGdr(route.routeGdr),
-            resourceKey: resourceGdr(resourceFromParsed(route.routeGdr)),
-            value: route.guardId
+        if (route === null) continue;
+        const client = args.clientForGdr(route.routeGdr), resourceKey = resourceGdr(resourceFromParsed(route.routeGdr));
+        for (const guardId of compiledGuardIds({
+            id: route.guardId,
+            actions: guard.match.actions
+        })) out.push({
+            client: client,
+            resourceKey: resourceKey,
+            value: guardId
         });
     }
     return out;
@@ -6716,26 +7381,30 @@ async function deployStageGuards(args) {
     if (live === void 0 || live.currentStage !== args.stageName || live.abortedAt !== void 0) return;
     const routed = resolvedStageGuards(args), existingByResource = await existingGuardIds(groupByResource(routed));
     let deployed = 0;
+    const createdGuards = [];
+    let updatedExistingGuard = !1;
     for (const {client: client, resourceKey: resourceKey, value: doc, guard: guard} of routed) {
         try {
-            const localized = await localizeGuardMetadata({
+            const created = await deployResolvedGuard({
+                client: client,
+                resourceKey: resourceKey,
                 doc: doc,
                 guard: guard,
-                client: client,
-                instance: args.instance,
-                definition: args.definition
+                stageArgs: args,
+                existingByResource: existingByResource
             });
-            await upsertGuard({
+            created === void 0 ? updatedExistingGuard = !0 : createdGuards.push({
                 client: client,
-                doc: localized,
-                exists: existingByResource.get(resourceKey)?.has(doc._id) ?? !1
+                doc: created
             });
         } catch (cause) {
-            throw deployed > 0 ? new PartialGuardDeployError({
+            await failGuardDeploy({
+                cause: cause,
                 stageName: args.stageName,
                 deployed: deployed,
-                cause: cause
-            }) : cause;
+                createdGuards: createdGuards,
+                updatedExistingGuard: updatedExistingGuard
+            });
         }
         deployed += 1;
     }
@@ -6967,7 +7636,8 @@ async function persistThenDeploy({ctx: ctx, mutation: mutation, deploy: deploy})
         committedRev: committed._rev,
         restore: instanceStateFields({
             ...ctx.instance,
-            minReaderModel: minReaderModelOf(ctx.instance)
+            minReaderModel: minReaderModelOf(ctx.instance),
+            definitionModelVersion: definitionAssignmentModel(ctx.instance)
         }),
         unset: ctx.instance.completedAt === void 0 ? [ "completedAt" ] : [],
         reversible: !spawned,
@@ -7232,7 +7902,7 @@ async function projectRowFields({ctx: ctx, sub: sub, childDefinition: childDefin
     for (const [name, groq] of Object.entries(sub.with ?? {})) {
         const declared = (childDefinition.fields ?? []).find(e => e.name === name);
         if (declared === void 0) throw new Error(`spawn.with["${name}"]: subworkflow "${childDefinition.name}" declares no field entry "${name}"`);
-        const raw = await runGroq({
+        const raw = await runGroq$1({
             groq: groq,
             params: {
                 ...parentScope,
@@ -7275,7 +7945,7 @@ async function projectRowFields({ctx: ctx, sub: sub, childDefinition: childDefin
 async function resolveContextHandoff({ctx: ctx, sub: sub, parentScope: parentScope}) {
     const out = {};
     for (const [name, groq] of Object.entries(sub.context ?? {})) {
-        const v2 = await runGroq({
+        const v2 = await runGroq$1({
             groq: groq,
             params: parentScope,
             snapshot: ctx.snapshot
@@ -8061,91 +8731,6 @@ async function callerBoundVarsForCall(args) {
     });
 }
 
-function requirementDescriptor(requirement) {
-    return {
-        name: requirement.name,
-        ...requirement.title !== void 0 ? {
-            title: requirement.title
-        } : {},
-        ...requirement.description !== void 0 ? {
-            description: requirement.description
-        } : {}
-    };
-}
-
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
-}
-
-class ActionDisabledError extends WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
-    }
-}
-
-class StartNotAllowedError extends WorkflowError {
-    definition;
-    unmetRequirements;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
-    }
-}
-
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
-}
-
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
-    "activity-not-active": r => `activity status is "${r.status}"`,
-    "stage-terminal": r => `stage "${r.stage}" is terminal`,
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
-    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
-};
-
-function actionDisabledDetail(reason) {
-    return disabledReasonDetail[reason.kind](reason);
-}
-
-function formatDisabledReason({activity: activity, action: action, reason: reason}) {
-    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
-}
-
-class EditFieldDeniedError extends WorkflowError {
-    reason;
-    target;
-    constructor(args) {
-        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
-        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
-    }
-}
-
-const editDisabledReasonDetail = {
-    "not-editable": () => "field is not declared editable",
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "edit-window-closed": r => `edit window closed (${r.detail})`,
-    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
-};
-
-function formatEditDisabledReason(target, reason) {
-    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
-    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
-}
-
 async function fireAction(args) {
     const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
     return retryOnRevisionConflict({
@@ -8313,7 +8898,7 @@ async function commitAction({ctx: ctx, activityName: activityName, actionName: a
         actionName: actionName,
         callerParams: callerParams,
         options: options
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -8479,7 +9064,7 @@ async function primeInitialStage(args) {
         })
     });
     const terminal = isTerminalStage(stage), committed = await client.patch(instance._id).set({
-        stages: [ initialStageEntry ],
+        stages: assignmentStagesForWrite([ initialStageEntry ], writesSingularAssignmentLists(instance)),
         lastChangedAt: now,
         ...terminal ? {
             completedAt: now
@@ -8537,32 +9122,59 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
             settlingCohorts: settlingCohorts
         } : {},
         memberRolesLoader: memberRolesLoader
-    }, ctx = instance === void 0 ? await loadContext({
-        client: client,
-        instanceId: instanceId,
-        options: contextOptions
-    }) : await buildEngineContext({
-        client: client,
-        instance: instance,
-        definition: parseDefinitionSnapshot(instance),
-        ...contextOptions
+    };
+    let preloadedInstance = instance;
+    return retryCommit({
+        load: async () => {
+            if (preloadedInstance === void 0) return loadContext({
+                client: client,
+                instanceId: instanceId,
+                options: contextOptions
+            });
+            const loaded = preloadedInstance;
+            return preloadedInstance = void 0, buildEngineContext({
+                client: client,
+                instance: loaded,
+                definition: parseDefinitionSnapshot(loaded),
+                ...contextOptions
+            });
+        },
+        commit: ctx => commitCascadeHop({
+            ctx: ctx,
+            actor: actor
+        }),
+        shouldRetry: isInstanceCommitRevisionConflict,
+        onExhausted: () => new ConcurrentCascadeError({
+            instanceId: instanceId,
+            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
+        })
     });
+}
+
+async function commitCascadeHop({ctx: ctx, actor: actor}) {
     if (isTerminal(ctx)) return {
         moved: !1
     };
-    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), fired = await runTriggeredActions({
+    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startRevisionRetryMutation(ctx.instance), fired = await runTriggeredActions({
         ctx: ctx,
         mutation: mutation,
         stage: stage
     }), hopCtx = liveViewContext(ctx, mutation), transition = await pickTransition(hopCtx, stage);
-    return transition === void 0 ? (fired.fires > 0 && await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: stage.name,
-        didChangeState: fired.ranFieldOps
-    }), {
-        moved: !1
-    }) : (await commitStageMove({
+    if (transition === void 0) {
+        const nextEvaluationAt = await ctxNextEvaluationAt(hopCtx);
+        return fired.fires > 0 && await persistThenMaybeRefresh({
+            ctx: ctx,
+            mutation: mutation,
+            stageName: stage.name,
+            didChangeState: fired.ranFieldOps
+        }), {
+            moved: !1,
+            ...nextEvaluationAt !== void 0 ? {
+                nextEvaluationAt: nextEvaluationAt
+            } : {}
+        };
+    }
+    return await commitStageMove({
         ctx: ctx,
         mutation: mutation,
         fromStage: stage,
@@ -8572,7 +9184,7 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
         actor: actor
     }), {
         moved: !0
-    });
+    };
 }
 
 async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts}) {
@@ -8588,8 +9200,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry
-        });
-        if (!(await runCascadeHop({
+        }), hop = await runCascadeHop({
             client: client,
             instanceId: instanceId,
             actor: actor,
@@ -8604,7 +9215,13 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             ...drained.drained ? {} : {
                 instance: drained.instance
             }
-        })).moved) return count;
+        });
+        if (!hop.moved) return {
+            cascaded: count,
+            ...hop.nextEvaluationAt !== void 0 ? {
+                nextEvaluationAt: hop.nextEvaluationAt
+            } : {}
+        };
         if (count++, count >= CASCADE_LIMIT) throw new CascadeLimitError({
             instanceId: instanceId,
             limit: CASCADE_LIMIT
@@ -8904,6 +9521,8 @@ async function recordOrphanedPropagation({ctx: ctx, mutation: mutation, child: c
 function startMutation(instance) {
     return {
         minReaderModel: minReaderModelOf(instance),
+        definitionSnapshot: instance.definitionSnapshot,
+        definitionModelVersion: definitionAssignmentModel(instance),
         currentStage: instance.currentStage,
         fields: (instance.fields ?? []).map(s => ({
             ...s
@@ -8951,11 +9570,17 @@ function startMutation(instance) {
     };
 }
 
+function startRevisionRetryMutation(instance) {
+    const mutation = startMutation(instance);
+    return mutation.commitErrorMapper = error => isRetryableInstanceCommitConflict(error) ? new InstanceCommitRevisionConflict(error) : error, 
+    mutation;
+}
+
 function instanceStateFields(src) {
-    const state = {
+    const listModel = isAssignmentListModel(src.definitionModelVersion), state = {
         currentStage: src.currentStage,
-        fields: src.fields,
-        stages: src.stages,
+        fields: assignmentFieldsForWrite(src.fields, listModel),
+        stages: assignmentStagesForWrite(src.stages, listModel),
         subworkflows: src.subworkflows ?? [],
         pendingEffects: src.pendingEffects,
         effectHistory: src.effectHistory,
@@ -8972,7 +9597,10 @@ function instanceStateFields(src) {
     return {
         ...modelStampFor({
             documentType: "instance",
-            document: state,
+            document: {
+                ...state,
+                definitionSnapshot: src.definitionSnapshot
+            },
             storedMinReaderModel: src.minReaderModel
         }),
         ...state
@@ -9007,11 +9635,11 @@ async function persist(ctx, mutation) {
         ...instanceStateFields(mutation),
         lastChangedAt: ctx.now
     }, pendingCreates = mutation.pendingCreates;
-    if (pendingCreates.length === 0) return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT);
+    if (pendingCreates.length === 0) return commitInstanceWrite(() => ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT), mutation.commitErrorMapper);
     const tx = ctx.client.transaction();
-    for (const {body: body} of pendingCreates) tx.create(body);
+    for (const {body: body} of pendingCreates) tx.create(instanceDocumentForWrite(body));
     tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), 
-    await tx.commit(), mutation.pendingCreates = [];
+    await commitInstanceWrite(() => tx.commit(), mutation.commitErrorMapper), mutation.pendingCreates = [];
     const actorForPriming = ctx.actor, settlingCohorts = new Set(ctx.settlingCohorts).add(ctx.instance._id);
     for (const {body: body} of pendingCreates) try {
         const stepArgs = spawnStepArgs(ctx, {
@@ -9038,6 +9666,14 @@ async function persist(ctx, mutation) {
     return reloaded;
 }
 
+async function commitInstanceWrite(write, mapError) {
+    try {
+        return await write();
+    } catch (error) {
+        throw mapError?.(error) ?? error;
+    }
+}
+
 async function settleSpawnBatch(ctx, args) {
     try {
         await propagateSpawnBatch({
@@ -9300,7 +9936,7 @@ async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: sta
         outputs: outputs,
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.definition.roleAliases
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -9479,7 +10115,7 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         effect: pending.name,
         issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
     });
-    const mutation = startMutation(ctx.instance);
+    const mutation = startRevisionRetryMutation(ctx.instance);
     return recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -9515,7 +10151,7 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
     };
 }
 
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
+const RESET_ACTIVITY_TARGETS = _exhaustiveOptions()([ "active", "skipped" ]);
 
 function isResetActivityTarget(value) {
     return RESET_ACTIVITY_TARGETS.includes(value);
@@ -9627,6 +10263,10 @@ function replayable(args) {
     return (stage.activities ?? []).every(declared => primed.has(declared.name)) ? !(stage.activities ?? []).flatMap(declared => declared.actions ?? []).some(sibling => isCascadeFired(sibling) && sibling.spawn !== void 0) : !1;
 }
 
+function clientGuardDereference(client) {
+    return async ({_ref: _ref}) => await client.getDocument(toBareId(_ref)) ?? null;
+}
+
 async function buildFieldInsights({sites: sites, snapshot: snapshot}) {
     const insights = [];
     for (const field of fieldsReadAcross(sites)) {
@@ -9782,6 +10422,7 @@ async function evaluateInstance(args) {
         guards: guards,
         now: now,
         resourceGrants: resourceGrants,
+        guardDereference: clientGuardDereference(client),
         ...localPrincipalId !== void 0 ? {
             localPrincipalId: localPrincipalId
         } : {},
@@ -9794,16 +10435,6 @@ async function evaluateInstance(args) {
     });
 }
 
-function memoizedByName(render) {
-    const rendered = /* @__PURE__ */ new Map;
-    return activityName => {
-        const hit = rendered.get(activityName);
-        if (hit !== void 0) return hit;
-        const scope = render(activityName);
-        return rendered.set(activityName, scope), scope;
-    };
-}
-
 async function callerBoundProjectionScopes(args) {
     const can = await advisoryCan({
         instance: args.instance,
@@ -9824,13 +10455,17 @@ async function callerBoundProjectionScopes(args) {
     };
     return {
         scope: await renderConditionScope(args.scopeSource, opts),
-        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+        scopeForActivity: memoizedBy(activityName => renderConditionScope(args.scopeSource, {
             activityName: activityName,
             ...opts
         }))
     };
 }
 
+function clockSitesOf(instance, sites) {
+    return terminalState(instance) !== "in-flight" ? [] : sites.filter(entry => readsNowIn(entry.insight.analysis.reads));
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -9880,12 +10515,13 @@ async function evaluateFromSnapshot(args) {
         grants: grants,
         attributes: attributes,
         identity: anchorIdentity
-    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+    }), cascadeScopeForActivity = memoizedBy(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
         identity: anchorIdentity,
-        guards: args.guards
+        guards: args.guards,
+        dereference: args.guardDereference
     }), subjectDenials = await forecastSubjectDenials({
         instance: instance,
         snapshot: snapshot,
@@ -9942,6 +10578,10 @@ async function evaluateFromSnapshot(args) {
         scopeForActivity: scopeForActivity,
         guardDenial: editGuardDenial,
         sites: sites
+    }), nextEvaluationAt = await nextEvaluationInstant({
+        sites: clockSitesOf(instance, sites),
+        dataset: snapshot.docs,
+        now: now
     });
     return {
         instance: instance,
@@ -9956,7 +10596,10 @@ async function evaluateFromSnapshot(args) {
             sites: sites,
             snapshot: snapshot
         }),
-        autonomy: autonomy
+        autonomy: autonomy,
+        ...nextEvaluationAt !== void 0 ? {
+            nextEvaluationAt: nextEvaluationAt
+        } : {}
     };
 }
 
@@ -10104,7 +10747,8 @@ async function evaluateActivity(args) {
         subjectPermissionReason: subjectPermissionReason,
         requirementsReason: requirementsReason,
         sites: sites,
-        fireConsequence: a => fireConsequence(activity, a)
+        fireConsequence: a => fireConsequence(activity, a),
+        assignment: assignmentMembers(statusEntry?.fields ?? [])
     }));
     return {
         activity: activity,
@@ -10261,19 +10905,31 @@ function fireableActionVerdict({args: args, insights: insights}) {
         reason: args.requirementsReason,
         ...insights
     });
-    const {insight: insight} = insights;
-    return action.filter !== void 0 && insight !== void 0 && insight.outcome !== "satisfied" ? disabled({
+    const filterFailure = filterFailureVerdict(args, insights);
+    return filterFailure !== void 0 ? filterFailure : {
+        ...actionEvaluationIdentity(action),
+        allowed: !0,
+        ...insights
+    };
+}
+
+function filterFailureVerdict(args, insights) {
+    const {action: action} = args, {insight: insight} = insights;
+    if (action.filter === void 0 || insight === void 0 || insight.outcome === "satisfied") return;
+    const holderGate = insight.blockedBy.some(entry => isAssignedGate(entry.atom)) ? {
+        holders: [ ...activeAssignmentMembers(args.assignment) ]
+    } : void 0;
+    return disabled({
         action: action,
         reason: {
             kind: "filter-failed",
             filter: action.filter
         },
-        ...insights
-    }) : {
-        ...actionEvaluationIdentity(action),
-        allowed: !0,
-        ...insights
-    };
+        ...insights,
+        ...holderGate === void 0 ? {} : {
+            holderGate: holderGate
+        }
+    });
 }
 
 function actionEvaluationIdentity(action) {
@@ -10289,12 +10945,13 @@ function semanticsOf(node) {
     };
 }
 
-async function instanceGuardReason({instance: instance, identity: identity, guards: guards}) {
+async function instanceGuardReason({instance: instance, identity: identity, guards: guards, dereference: dereference}) {
     if (guards === void 0 || guards.length === 0) return;
     const denied = await instanceWriteDenials({
         instance: instance,
         guards: guards,
-        identity: identity
+        identity: identity,
+        dereference: dereference ?? (() => Promise.resolve(null))
     });
     if (denied.length !== 0) return {
         kind: "mutation-guard-denied",
@@ -10325,10 +10982,29 @@ function disabled(args) {
         } : {},
         ...args.whenInsight !== void 0 ? {
             whenInsight: args.whenInsight
+        } : {},
+        ...args.holderGate !== void 0 ? {
+            holderGate: args.holderGate
         } : {}
     };
 }
 
+const ASSIGNMENT_KINDS = '["assignee", "assignees"]', HAS_USER = '(count(value[@.type == "user"]) > 0 || value.type == "user")', HAS_MEMBER = "(count(value) > 0 || defined(value.type))";
+
+function assignmentActivityArm(state) {
+    const assignmentFields = `fields[_type in ${ASSIGNMENT_KINDS}]`;
+    return state === "unrouted" ? `count(${assignmentFields}[${HAS_MEMBER}]) == 0` : state === "held" ? `count(${assignmentFields}[${HAS_USER} && (count(value[@.type == "user" && id == $assignmentUserId]) > 0 || (value.type == "user" && value.id == $assignmentUserId))]) > 0` : `count(${assignmentFields}[${HAS_USER}]) == 0 && count(${assignmentFields}[count(value[@.type == "role" && role in $assignmentRoles]) > 0 || (value.type == "role" && value.role in $assignmentRoles)]) > 0`;
+}
+
+function assignmentPrefilter(assignment, params) {
+    if (assignment.userId.length === 0) throw new ContractViolationError("instancesQuery: assignment.userId must be non-empty");
+    const states = [ ...new Set(assignment.states ?? [ "unrouted", "routed", "held" ]) ];
+    if (states.length === 0) throw new ContractViolationError("instancesQuery: assignment.states must not be empty");
+    if (states.some(state => state !== "unrouted" && state !== "routed" && state !== "held")) throw new ContractViolationError("instancesQuery: assignment.states contains an unknown state");
+    return params.assignmentUserId = assignment.userId, params.assignmentRoles = [ ...new Set(assignment.roles ?? []) ].sort(), 
+    `count(stages[!defined(exitedAt)].activities[status == "active" && (${states.map(assignmentActivityArm).join(" || ")})]) > 0`;
+}
+
 function inFlightFilter() {
     return "!defined(completedAt)";
 }
@@ -10368,7 +11044,7 @@ function compiledConditions(filter, params) {
     const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, tagScopeFilter() ];
     filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
     params.definition = filter.definition), filter.stage !== void 0 && (conditions.push("currentStage == $stage"), 
-    params.stage = filter.stage);
+    params.stage = filter.stage), filter.assignment !== void 0 && conditions.push(assignmentPrefilter(filter.assignment, params));
     const cursor = beforeArm(filter, params);
     cursor !== void 0 && conditions.push(cursor);
     const arms = [ documentArm(filter, params), idsArm(filter, params) ].filter(arm => arm !== void 0);
@@ -10471,6 +11147,222 @@ function stripClaim(entry) {
     return rest;
 }
 
+function isProjectRole(value) {
+    return isRecord(value) && typeof value.name == "string";
+}
+
+async function projectRoleNames(request, projectId) {
+    const result = await request({
+        uri: `/projects/${encodeURIComponent(projectId)}/roles`
+    });
+    if (!Array.isArray(result) || !result.every(isProjectRole)) throw new Error(`Project role catalog response is invalid for project "${projectId}"`);
+    return new Set(result.map(role => role.name));
+}
+
+function memberRoleNames(member, projectId) {
+    if (!Array.isArray(member.roles) || !member.roles.every(isProjectRole)) throw new Error(`Project member role directory response is invalid for project "${projectId}" and member "${member.id}"`);
+    return member.roles.map(role => role.name);
+}
+
+function heldRoleNames(members, projectId) {
+    return new Set(members.flatMap(member => member.isRobot === !0 ? [] : memberRoleNames(member, projectId)));
+}
+
+function addRoles(collector, args) {
+    for (const role of args.roles ?? []) collector.references.push({
+        definition: collector.definition,
+        path: args.path,
+        role: role
+    });
+}
+
+function visitAssigneeValue(collector, args) {
+    const members = Array.isArray(args.value) ? args.value : [ args.value ];
+    for (const [index, member] of members.entries()) !isRecord(member) || member.type !== "role" || typeof member.role != "string" || collector.references.push({
+        definition: collector.definition,
+        path: `${args.path}[${index}].role`,
+        role: member.role
+    });
+}
+
+function visitObjectValue(collector, args) {
+    for (const shape of args.fields ?? []) visitShapeValue(collector, {
+        path: `${args.path}.${shape.name}`,
+        shape: shape,
+        value: args.value[shape.name]
+    });
+}
+
+function visitArrayValue(collector, args) {
+    for (const [index, row] of args.rows.entries()) if (isRecord(row)) for (const shape of args.shapes ?? []) visitShapeValue(collector, {
+        path: `${args.path}[${index}].${shape.name}`,
+        shape: shape,
+        value: row[shape.name]
+    });
+}
+
+function visitAssignmentValue(collector, args) {
+    args.kind === "assignee" || args.kind === "assignees" ? visitAssigneeValue(collector, args) : args.kind === "object" && isRecord(args.value) ? visitObjectValue(collector, {
+        ...args,
+        value: args.value
+    }) : args.kind === "array" && Array.isArray(args.value) && visitArrayValue(collector, {
+        path: args.path,
+        rows: args.value,
+        shapes: args.of
+    });
+}
+
+function visitShapeValue(collector, args) {
+    visitAssignmentValue(collector, {
+        path: args.path,
+        kind: args.shape.type,
+        value: args.value,
+        fields: args.shape.fields,
+        of: args.shape.of
+    });
+}
+
+function visitField(collector, args) {
+    addRoles(collector, {
+        path: `${args.path}.roles`,
+        roles: args.field.roles
+    });
+    for (const shape of args.field.fields ?? args.field.of ?? []) visitFieldShape(collector, {
+        parentPath: args.path,
+        shape: shape
+    });
+    args.field.initialValue?.type === "literal" && visitAssignmentValue(collector, {
+        path: `${args.path}.initialValue.value`,
+        kind: args.field.type,
+        value: args.field.initialValue.value,
+        fields: args.field.fields,
+        of: args.field.of
+    });
+}
+
+function visitFieldShape(collector, args) {
+    const path = `${args.parentPath}.${args.shape.name}`;
+    addRoles(collector, {
+        path: `${path}.roles`,
+        roles: args.shape.roles
+    });
+    for (const child of args.shape.fields ?? args.shape.of ?? []) visitFieldShape(collector, {
+        parentPath: path,
+        shape: child
+    });
+}
+
+function rolesFromConditions(definition) {
+    return conditionSitesOf(definition).flatMap(site => {
+        try {
+            return analyzeCondition(site.condition).atoms.flatMap(atom => rolesGateOf(atom) ?? []);
+        } catch {
+            return [];
+        }
+    });
+}
+
+function visitRoleAliases(collector, aliases) {
+    for (const [role, fulfillers] of Object.entries(aliases ?? {})) role !== UNIVERSAL_ROLE_ALIAS_KEY && collector.references.push({
+        definition: collector.definition,
+        path: `roleAliases.${role}`,
+        role: role
+    }), addRoles(collector, {
+        path: `roleAliases.${role}`,
+        roles: fulfillers
+    });
+}
+
+function visitFields(collector, args) {
+    for (const [index, field] of (args.fields ?? []).entries()) visitField(collector, {
+        path: `${args.parentPath}[${index}]`,
+        field: field
+    });
+}
+
+function visitAction(collector, args) {
+    addRoles(collector, {
+        path: `${args.path}.roles`,
+        roles: args.action.roles
+    });
+    for (const [effectIndex, effect] of (args.action.effects ?? []).entries()) for (const shape of effect.outputs ?? []) visitFieldShape(collector, {
+        parentPath: `${args.path}.effects[${effectIndex}].outputs`,
+        shape: shape
+    });
+}
+
+function visitStage(collector, args) {
+    const stagePath = `stages[${args.stageIndex}]`;
+    visitFields(collector, {
+        fields: args.stage.fields,
+        parentPath: `${stagePath}.fields`
+    });
+    for (const [activityIndex, activity] of (args.stage.activities ?? []).entries()) {
+        const activityPath = `${stagePath}.activities[${activityIndex}]`;
+        visitFields(collector, {
+            fields: activity.fields,
+            parentPath: `${activityPath}.fields`
+        });
+        for (const [actionIndex, action] of (activity.actions ?? []).entries()) visitAction(collector, {
+            action: action,
+            path: `${activityPath}.actions[${actionIndex}]`
+        });
+    }
+}
+
+function addConditionReferences(collector, definition) {
+    for (const role of rolesFromConditions(definition)) collector.references.push({
+        definition: collector.definition,
+        path: "generated role condition",
+        role: role
+    });
+}
+
+function definitionRoleReferences(definition) {
+    const collector = {
+        references: [],
+        definition: definition.name
+    };
+    visitRoleAliases(collector, definition.roleAliases), visitFields(collector, {
+        fields: definition.fields,
+        parentPath: "fields"
+    });
+    for (const [stageIndex, stage] of definition.stages.entries()) visitStage(collector, {
+        stage: stage,
+        stageIndex: stageIndex
+    });
+    return addConditionReferences(collector, definition), collector.references;
+}
+
+function definitionRoleNames(definition) {
+    return [ ...new Set(definitionRoleReferences(definition).map(reference => reference.role)) ];
+}
+
+function roleCatalogProjectId(client, resource) {
+    if (resource.type === "dataset") return datasetResourceParts(resource.id).projectId;
+    const projectId = client.config?.().projectId;
+    if (typeof projectId == "string" && projectId.length > 0) return projectId;
+    throw new Error(`workflow.deployDefinitions: definitions reference project roles on ${resource.type} workflow resources, but the client does not expose a projectId for the project role catalog`);
+}
+
+async function validateDefinitionRoles(args) {
+    const references = args.definitions.flatMap(definitionRoleReferences);
+    if (references.length === 0) /* @__PURE__ */ return new Map;
+    if (args.client.request === void 0) throw new Error("workflow.deployDefinitions: definitions reference project roles, but the client cannot read the project role catalog");
+    const projectId = roleCatalogProjectId(args.client, args.workflowResource), [known, members] = await Promise.all([ projectRoleNames(args.client.request, projectId), requestProjectMembers(args.client.request, projectId) ]), unknown = references.filter(reference => !known.has(reference.role));
+    if (unknown.length > 0) {
+        const lines = unknown.map(({definition: definition, path: path, role: role}) => `  - ${definition}: ${path} references unknown role "${role}"`);
+        throw new Error(`workflow.deployDefinitions: unknown project roles for project "${projectId}":\n${lines.join(`\n`)}`);
+    }
+    const held = heldRoleNames(members, projectId), warnings = /* @__PURE__ */ new Map;
+    for (const {definition: definition, role: role} of references) {
+        if (held.has(role)) continue;
+        const message = `Project role "${role}" has no current user holder; work routed to it has no recipient.`, definitionWarnings = warnings.get(definition) ?? [];
+        definitionWarnings.includes(message) || definitionWarnings.push(message), warnings.set(definition, definitionWarnings);
+    }
+    return warnings;
+}
+
 async function sortByDependencies({client: client, definitions: definitions, tag: tag}) {
     const byName = /* @__PURE__ */ new Map;
     for (const def of definitions) {
@@ -10771,7 +11663,7 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
         site: site,
         mode: mode,
         value: value
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -10915,14 +11807,14 @@ async function runCommitVerb(params) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    });
+    }), now = clock();
     return runDeduped({
         client: client,
         tag: tag,
         instanceId: instanceId,
         record: record,
         before: before,
-        now: clock(),
+        now: now,
         actor: context.actor,
         clientForGdr: context.clientForGdr,
         refSurface: context.refSurface,
@@ -10933,6 +11825,7 @@ async function runCommitVerb(params) {
         run: () => run({
             ...context,
             clock: clock,
+            now: now,
             record: record,
             before: before
         })
@@ -10956,7 +11849,7 @@ async function runDeduped(args) {
             client: client,
             instanceId: instanceId,
             tag: tag
-        }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+        }), settled = await cascadeAndReload({
             client: client,
             tag: tag,
             instanceId: instanceId,
@@ -10968,11 +11861,10 @@ async function runDeduped(args) {
             executionContext: executionContext,
             telemetry: telemetry
         });
-        return {
-            instance: instance,
-            cascaded: cascaded,
-            changed: instance._rev !== pre._rev
-        };
+        return settledResult({
+            ...settled,
+            changed: settled.instance._rev !== pre._rev
+        });
     };
     if (record !== void 0 && before !== void 0 && findProcessedRequest({
         instance: before,
@@ -10988,7 +11880,7 @@ async function runDeduped(args) {
 }
 
 async function cascade({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
-    const count = await cascadeAutoTransitions({
+    const settled = await cascadeAutoTransitions({
         client: client,
         instanceId: instanceId,
         actor: actor,
@@ -11024,13 +11916,13 @@ async function cascade({client: client, instanceId: instanceId, actor: actor, cl
         ...telemetry !== void 0 ? {
             telemetry: telemetry
         } : {}
-    }), count;
+    }), settled;
 }
 
 async function cascadeAndReload(args) {
     const {client: client, tag: tag, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock} = args;
     return {
-        cascaded: await cascade({
+        ...await cascade({
             client: client,
             instanceId: instanceId,
             actor: actor,
@@ -11053,6 +11945,84 @@ async function cascadeAndReload(args) {
     };
 }
 
+async function unchangedNextEvaluationAt(args) {
+    const {client: client, instance: instance, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, now: now} = args;
+    if (terminalState(instance) !== "in-flight") return;
+    const ctx = await buildEngineContext({
+        client: client,
+        instance: instance,
+        definition: parseDefinitionSnapshot(instance),
+        clientForGdr: clientForGdr,
+        refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
+        clock: () => now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {},
+        ...args.executionContext !== void 0 ? {
+            executionContext: args.executionContext
+        } : {},
+        ...args.telemetry !== void 0 ? {
+            telemetry: args.telemetry
+        } : {}
+    });
+    return ctxNextEvaluationAt(ctx);
+}
+
+async function adminOverrideResult(args) {
+    const {client: client, tag: tag, instanceId: instanceId, fired: fired, now: now, executionContext: executionContext, telemetry: telemetry, ...scope} = args, optional = {
+        ...executionContext !== void 0 ? {
+            executionContext: executionContext
+        } : {},
+        ...telemetry !== void 0 ? {
+            telemetry: telemetry
+        } : {}
+    }, settled = fired ? await cascade({
+        client: client,
+        instanceId: instanceId,
+        ...scope,
+        ...optional
+    }) : {
+        cascaded: 0
+    }, instance = await reload({
+        client: client,
+        instanceId: instanceId,
+        tag: tag
+    });
+    return settledResult({
+        ...settled,
+        instance: instance,
+        changed: fired,
+        ...fired ? {} : {
+            nextEvaluationAt: await unchangedNextEvaluationAt({
+                client: client,
+                instance: instance,
+                now: now,
+                actor: scope.actor,
+                clientForGdr: scope.clientForGdr,
+                refSurface: scope.refSurface,
+                memberRolesLoader: scope.memberRolesLoader,
+                ...optional
+            })
+        }
+    });
+}
+
+function settledResult(args) {
+    const {instance: instance, cascaded: cascaded, changed: changed, ranOps: ranOps, nextEvaluationAt: nextEvaluationAt} = args;
+    return {
+        instance: instance,
+        cascaded: cascaded,
+        changed: changed,
+        ...ranOps !== void 0 ? {
+            ranOps: ranOps
+        } : {},
+        ...nextEvaluationAt !== void 0 ? {
+            nextEvaluationAt: nextEvaluationAt
+        } : {}
+    };
+}
+
 async function settleStart(args) {
     const runArgs = {
         client: args.client,
@@ -11114,7 +12084,7 @@ async function resumeStart(args) {
         instance: existing,
         initialFieldCount: initialFieldCount,
         viaSpawn: !1
-    })), cascaded = await settleStart({
+    })), settled = await settleStart({
         ...settlementArgs,
         instanceId: existing._id,
         ...completesStart ? {
@@ -11125,11 +12095,11 @@ async function resumeStart(args) {
         instanceId: existing._id,
         tag: args.tag
     });
-    return {
+    return settledResult({
+        ...settled,
         instance: instance,
-        cascaded: cascaded,
         changed: instance._rev !== existing._rev
-    };
+    });
 }
 
 function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, executionContext: executionContext, telemetry: telemetry}) {
@@ -11228,7 +12198,7 @@ async function dispatchGatedWrite(args) {
         ...resourceClients !== void 0 ? {
             resourceClients: resourceClients
         } : {}
-    }), ranOps = await apply(args.before, evaluation), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+    }), ranOps = await apply(args.before, evaluation), settled = await cascadeAndReload({
         client: client,
         tag: tag,
         instanceId: instanceId,
@@ -11240,14 +12210,13 @@ async function dispatchGatedWrite(args) {
         executionContext: args.executionContext,
         telemetry: args.telemetry
     });
-    return {
-        instance: instance,
-        cascaded: cascaded,
+    return settledResult({
+        ...settled,
         changed: !0,
         ...ranOps !== void 0 ? {
             ranOps: ranOps
         } : {}
-    };
+    });
 }
 
 function guardDeniedError(instanceId, reason) {
@@ -11461,6 +12430,10 @@ async function abortInstances(args) {
     return aborted;
 }
 
+function lintDeadActivityInputSeeds(definition) {
+    return definition.stages.flatMap(stage => (stage.activities ?? []).flatMap(activity => (activity.fields ?? []).filter(field => field.initialValue?.type === "input").map(field => `Activity field "${stage.name}.${activity.name}.${field.name}" uses an input seed, but start/spawn inputs address workflow-scope fields only; this field will always materialize empty. Use a literal, query, field read, or working-memory field instead.`)));
+}
+
 function projectStartSliceRow(instance) {
     const subject = (instance.fields ?? []).find(field => field._type === "subject")?.value;
     return {
@@ -11488,14 +12461,18 @@ const workflow = {
         definitions.forEach(validateDefinition), assertReaderModelAcknowledgement(args.expectedMinReaderModel, {
             requiredMinReaderModel: requiredDefinitionReaderModel(definitions)
         });
-        const ordered = await sortByDependencies({
+        const roleWarnings = await validateDefinitionRoles({
+            client: client,
+            definitions: definitions,
+            workflowResource: workflowResource
+        }), ordered = await sortByDependencies({
             client: client,
             definitions: definitions,
             tag: tag
         }), results = [], deployed = [], tx = client.transaction();
         let hasWrites = !1;
         for (const def of ordered) {
-            const lint = lintEffectOutputs(def), warnings = lint.length > 0 ? {
+            const lint = [ ...lintEffectOutputs(def), ...lintDeadActivityInputSeeds(def), ...roleWarnings.get(def.name) ?? [] ], warnings = lint.length > 0 ? {
                 warnings: lint
             } : {}, latest = await loadLatestDeployed({
                 client: client,
@@ -11588,12 +12565,27 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "fireAction",
-            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
-                if (findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return {
+            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
+                if (findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return settledResult({
                     instance: before,
                     cascaded: 0,
-                    changed: !1
-                };
+                    changed: !1,
+                    nextEvaluationAt: await unchangedNextEvaluationAt({
+                        client: client,
+                        instance: before,
+                        actor: actor,
+                        clientForGdr: clientForGdr,
+                        refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
+                        now: now,
+                        ...executionContext !== void 0 ? {
+                            executionContext: executionContext
+                        } : {},
+                        ...args.telemetry !== void 0 ? {
+                            telemetry: args.telemetry
+                        } : {}
+                    })
+                });
                 const result = await dispatchGatedWrite({
                     client: client,
                     tag: tag,
@@ -11730,7 +12722,7 @@ const workflow = {
         });
     },
     completeEffect: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, now = clock(), record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "completeEffect",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11740,7 +12732,7 @@ const workflow = {
             tag: tag,
             instanceId: instanceId,
             record: record,
-            now: clock(),
+            now: now,
             ...operationContext,
             clock: clock,
             executionContext: executionContext,
@@ -11775,7 +12767,7 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+                }), settled = await cascadeAndReload({
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
@@ -11785,22 +12777,21 @@ const workflow = {
                     telemetry: args.telemetry
                 });
                 return resolveTelemetry(args.telemetry).log(WorkflowEffectCompleted, {
-                    ...definitionHashFragment(instance.pinnedContentHash),
+                    ...definitionHashFragment(settled.instance.pinnedContentHash),
                     instanceId: instanceId,
                     effect: completion.effect,
                     status: status,
                     origin: completion.origin,
-                    cascaded: cascaded
-                }), {
-                    instance: instance,
-                    cascaded: cascaded,
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     changed: !0
-                };
+                });
             }
         });
     },
     commitEffectOps: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, now = clock(), record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "commitEffectOps",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11811,7 +12802,7 @@ const workflow = {
             tag: tag,
             instanceId: instanceId,
             record: record,
-            now: clock(),
+            now: now,
             ...operationContext,
             clock: clock,
             executionContext: executionContext,
@@ -11831,7 +12822,7 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+                }), settled = await cascadeAndReload({
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
@@ -11841,15 +12832,14 @@ const workflow = {
                     telemetry: args.telemetry
                 });
                 return resolveTelemetry(args.telemetry).log(WorkflowEffectStateReported, {
-                    ...definitionHashFragment(instance.pinnedContentHash),
+                    ...definitionHashFragment(settled.instance.pinnedContentHash),
                     instanceId: instanceId,
                     effect: report.effect,
-                    cascaded: cascaded
-                }), {
-                    instance: instance,
-                    cascaded: cascaded,
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     changed: !0
-                };
+                });
             }
         });
     },
@@ -11862,9 +12852,10 @@ const workflow = {
         await assertInstanceWriteAllowed({
             instance: current,
             guards: guards,
-            identity: lakePrincipalId(access)
+            identity: lakePrincipalId(access),
+            dereference: clientGuardDereference(client)
         });
-        const {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+        const settled = await cascadeAndReload({
             client: client,
             tag: tag,
             instanceId: instanceId,
@@ -11874,21 +12865,20 @@ const workflow = {
             telemetry: args.telemetry
         });
         return resolveTelemetry(args.telemetry).log(WorkflowInstanceTicked, {
-            ...definitionHashFragment(instance.pinnedContentHash),
+            ...definitionHashFragment(settled.instance.pinnedContentHash),
             instanceId: instanceId,
-            cascaded: cascaded
-        }), {
-            instance: instance,
-            cascaded: cascaded,
-            changed: instance._rev !== current._rev
-        };
+            cascaded: settled.cascaded
+        }), settledResult({
+            ...settled,
+            changed: settled.instance._rev !== current._rev
+        });
     },
     setStage: async rawArgs => {
         const args = taggedScope(rawArgs, REQUEST_TAG.setStage), {client: client, tag: tag, instanceId: instanceId, targetStage: targetStage, reason: reason, executionContext: executionContext} = args;
         return runCommitVerb({
             args: args,
             op: "setStage",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
                 const result = await setStage({
                     client: client,
                     instanceId: instanceId,
@@ -11908,34 +12898,29 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), cascaded = result.fired ? await cascade({
+                });
+                return resolveTelemetry(args.telemetry).log(WorkflowStageSet, {
+                    ...definitionHashFragment(before.pinnedContentHash),
+                    instanceId: instanceId,
+                    changed: result.fired
+                }), adminOverrideResult({
                     client: client,
+                    tag: tag,
                     instanceId: instanceId,
+                    fired: result.fired,
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
                     memberRolesLoader: memberRolesLoader,
                     clock: clock,
+                    now: now,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
                     } : {},
                     ...args.telemetry !== void 0 ? {
                         telemetry: args.telemetry
                     } : {}
-                }) : 0;
-                return resolveTelemetry(args.telemetry).log(WorkflowStageSet, {
-                    ...definitionHashFragment(before.pinnedContentHash),
-                    instanceId: instanceId,
-                    changed: result.fired
-                }), {
-                    instance: await reload({
-                        client: client,
-                        instanceId: instanceId,
-                        tag: tag
-                    }),
-                    cascaded: cascaded,
-                    changed: result.fired
-                };
+                });
             }
         });
     },
@@ -11968,7 +12953,7 @@ const workflow = {
                     ...definitionHashFragment(before.pinnedContentHash),
                     instanceId: instanceId,
                     changed: changed
-                }), {
+                }), settledResult({
                     instance: await reload({
                         client: client,
                         instanceId: instanceId,
@@ -11976,7 +12961,7 @@ const workflow = {
                     }),
                     cascaded: 0,
                     changed: changed
-                };
+                });
             }
         });
     },
@@ -11986,7 +12971,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "resetActivity",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
                 const result = await resetActivity({
                     client: client,
                     instanceId: instanceId,
@@ -12004,34 +12989,29 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), cascaded = result.fired ? await cascade({
+                });
+                return resolveTelemetry(args.telemetry).log(WorkflowActivityReset, {
+                    ...definitionHashFragment(before.pinnedContentHash),
+                    instanceId: instanceId,
+                    changed: result.fired
+                }), adminOverrideResult({
                     client: client,
+                    tag: tag,
                     instanceId: instanceId,
+                    fired: result.fired,
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
                     memberRolesLoader: memberRolesLoader,
                     clock: clock,
+                    now: now,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
                     } : {},
                     ...args.telemetry !== void 0 ? {
                         telemetry: args.telemetry
                     } : {}
-                }) : 0;
-                return resolveTelemetry(args.telemetry).log(WorkflowActivityReset, {
-                    ...definitionHashFragment(before.pinnedContentHash),
-                    instanceId: instanceId,
-                    changed: result.fired
-                }), {
-                    instance: await reload({
-                        client: client,
-                        instanceId: instanceId,
-                        tag: tag
-                    }),
-                    cascaded: cascaded,
-                    changed: result.fired
-                };
+                });
             }
         });
     },
@@ -12364,8 +13344,8 @@ async function startFreshInstance(args) {
             extraHistory: fieldDiscards
         } : {}
     });
-    await client.create(base, SYNC_COMMIT);
-    const cascaded = await settleStart({
+    await client.create(instanceDocumentForWrite(base), SYNC_COMMIT);
+    const settled = await settleStart({
         client: client,
         tag: tag,
         instanceId: id,
@@ -12387,15 +13367,15 @@ async function startFreshInstance(args) {
             viaSpawn: !1
         }))
     });
-    return {
+    return settledResult({
+        ...settled,
         instance: await reload({
             client: client,
             instanceId: id,
             tag: tag
         }),
-        cascaded: cascaded,
         changed: !0
-    };
+    });
 }
 
 function assertInitialStageExists(definition) {
@@ -12570,7 +13550,7 @@ function missingHandlerMessage(info) {
 }
 
 async function verifyDeployedDefinitionsInternal(args) {
-    const {tag: tag, effectHandlers: effectHandlers, missingHandler: missingHandler, logger: logger} = args, client = withRequestTag(args.client, REQUEST_TAG.verifyDefinitions);
+    const {tag: tag, handlers: handlers, missingHandler: missingHandler, logger: logger} = args, client = withRequestTag(args.client, REQUEST_TAG.verifyDefinitions);
     validateTag(tag);
     const log = logger("verifyDeployedDefinitions"), definitions = (await client.fetch(definitionsListGroq("asc"), {
         tag: tag
@@ -12580,7 +13560,7 @@ async function verifyDeployedDefinitionsInternal(args) {
         version: def.version,
         _id: def._id
     }), walkEffectNames(def, (name, location) => {
-        if (effectHandlers[name] !== void 0) return;
+        if (handlers[name] !== void 0) return;
         const key = `${name}@@${def._id}`;
         let bucket = missingByName.get(key);
         bucket === void 0 && (bucket = {
@@ -12639,7 +13619,7 @@ function isCancelledCompletion(data) {
 }
 
 async function drainEffectsInternal(args) {
-    const {tag: tag, workflowResource: workflowResource, instanceId: instanceId, effectHandlers: effectHandlers, missingHandler: missingHandler, logger: logger, handlerClient: rawHandlerClient, handlerResourceClients: rawHandlerResourceClients} = args, cascadeTelemetry = drainCascadeTelemetry(args.telemetry), {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.drain), leaseMs = args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS, clock = args.clock ?? wallClock, handlerClient = effectHandlerClient(rawHandlerClient), handlerResourceClients = effectHandlerResolver(rawHandlerResourceClients), routeGdr = buildClientForGdr({
+    const {tag: tag, workflowResource: workflowResource, instanceId: instanceId, handlers: handlers, missingHandler: missingHandler, logger: logger, handlerClient: rawHandlerClient, handlerResourceClients: rawHandlerResourceClients} = args, cascadeTelemetry = drainCascadeTelemetry(args.telemetry), {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.drain), leaseMs = args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS, clock = args.clock ?? wallClock, handlerClient = effectHandlerClient(rawHandlerClient), handlerResourceClients = effectHandlerResolver(rawHandlerResourceClients), routeGdr = buildClientForGdr({
         client: handlerClient,
         workflowResource: workflowResource,
         resourceClients: handlerResourceClients
@@ -12659,7 +13639,7 @@ async function drainEffectsInternal(args) {
             resourceClients: resourceClients
         } : {},
         instanceId: instanceId,
-        effectHandlers: effectHandlers,
+        handlers: handlers,
         missingHandler: missingHandler,
         logger: logger,
         log: log,
@@ -12691,7 +13671,7 @@ async function drainOneCandidate(pass) {
         skippedKeys: skippedKeys
     });
     if (candidate === void 0) return !1;
-    const handler = pass.effectHandlers[candidate.name];
+    const handler = pass.handlers[candidate.name];
     if (handler === void 0) return await assertSkippableOrThrow({
         missingHandler: pass.missingHandler,
         candidate: candidate,
@@ -13100,6 +14080,7 @@ function createInstanceSession(args) {
             snapshot: snapshotFrom(held, normalizedSelf),
             guards: guards,
             resourceGrants: resourceGrants,
+            guardDereference: clientGuardDereference(evalScope.client),
             ...localPrincipalId !== void 0 ? {
                 localPrincipalId: localPrincipalId
             } : {},
@@ -13114,7 +14095,7 @@ function createInstanceSession(args) {
             } : {}
         });
     }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope, memberRolesLoader: memberRolesLoader}) => {
-        const cascaded = await cascadeHeld({
+        const settled = await cascadeHeld({
             scope: scope,
             actor: actor,
             held: held,
@@ -13124,14 +14105,14 @@ function createInstanceSession(args) {
             client: scope.client,
             instanceId: instance._id,
             tag: tag
-        }), {
+        }), settledResult({
+            ...settled,
             instance: instance,
-            cascaded: cascaded,
             changed: !0,
             ...ranOps !== void 0 ? {
                 ranOps: ranOps
             } : {}
-        };
+        });
     }, cascadeHeld = ({scope: scope, actor: actor, held: held, memberRolesLoader: memberRolesLoader}) => cascade({
         client: scope.client,
         instanceId: instance._id,
@@ -13242,13 +14223,14 @@ function createInstanceSession(args) {
                     identity: lakePrincipalId({
                         actor: actor,
                         localPrincipalId: localPrincipalId
-                    })
+                    }),
+                    dereference: clientGuardDereference(tickScope.client)
                 });
                 const before = await reload({
                     client: tickScope.client,
                     instanceId: instance._id,
                     tag: tag
-                }), cascaded = await cascadeHeld({
+                }), settled = await cascadeHeld({
                     scope: tickScope,
                     actor: actor,
                     held: held,
@@ -13261,12 +14243,12 @@ function createInstanceSession(args) {
                 }), telemetry.log(WorkflowInstanceTicked, {
                     ...definitionHashFragment(instance.pinnedContentHash),
                     instanceId: instance._id,
-                    cascaded: cascaded
-                }), {
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     instance: instance,
-                    cascaded: cascaded,
                     changed: instance._rev !== before._rev
-                };
+                });
             });
         },
         fireAction({activity: activity, action: action, params: params}) {
@@ -13416,7 +14398,10 @@ const silentLogger = {
 function createEngine(args) {
     const {workflowResource: workflowResource, clock: clock, tag: tag, executionContext: executionContext} = args, {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.engine);
     validateTag(tag);
-    const effectHandlers = args.effectHandlers ?? {}, missingHandler = args.missingHandler ?? "fail", logger = args.loggerFactory ?? defaultLoggerFactory, telemetry = resolveTelemetry(args.telemetry), EMPTY_DRAIN_LOG_INTERVAL_MS = 6e4;
+    const effects = {
+        handlers: args.effects?.handlers ?? {},
+        missingHandler: args.effects?.missingHandler ?? "fail"
+    }, logger = args.loggerFactory ?? defaultLoggerFactory, telemetry = resolveTelemetry(args.telemetry), EMPTY_DRAIN_LOG_INTERVAL_MS = 6e4;
     let lastEmptyDrainLoggedAt;
     const emptyDrainDue = () => {
         const now = Date.parse((clock ?? wallClock)());
@@ -13447,8 +14432,7 @@ function createEngine(args) {
         client: client,
         tag: tag,
         workflowResource: workflowResource,
-        effectHandlers: effectHandlers,
-        missingHandler: missingHandler,
+        effects: effects,
         logger: logger,
         telemetry: telemetry,
         resolveActor: rest => resolveClientActor(client, rest),
@@ -13502,12 +14486,11 @@ function createEngine(args) {
                 workflowResource: workflowResource,
                 ...optionalScope,
                 instanceId: instanceId,
-                effectHandlers: effectHandlers,
-                missingHandler: missingHandler,
+                ...effects,
                 logger: logger,
                 telemetry: telemetry,
-                ...args.effectLeaseMs !== void 0 ? {
-                    leaseMs: args.effectLeaseMs
+                ...args.effects?.leaseMs !== void 0 ? {
+                    leaseMs: args.effects.leaseMs
                 } : {}
             }), drained = result.drained;
             return (drained.length > 0 || emptyDrainDue()) && telemetry.log(WorkflowEffectsDrained, {
@@ -13520,8 +14503,7 @@ function createEngine(args) {
         verifyDeployedDefinitions: () => verifyDeployedDefinitionsInternal({
             client: client,
             tag: tag,
-            effectHandlers: effectHandlers,
-            missingHandler: missingHandler,
+            ...effects,
             logger: logger
         })
     };
@@ -14060,4 +15042,4 @@ function displayDescription(typeKey) {
     if (typeKey) return DISPLAY[typeKey]?.description;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MAX_READER, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DECISION_SEMANTICS, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstancePreviewSchema, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, actorFulfillsRole, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, documentStuckCause, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findActivityNode, findCurrentActivityEntry, findOpenStageEntry, findStageNode, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceChangesQuery, instanceDocId, instanceGuardQuery, instancePreviewsQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseInstancePreviewDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readInstancePreviewDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredDefinitionReaderModel, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resolveUserAttributes, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCascadeError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MAX_READER, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DECISION_SEMANTICS, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DOCUMENT_VALUE_PERMISSIONS, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstancePreviewSchema, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activeAssignmentMembers, activityAutonomyOf, actorFulfillsRole, actorMatchesAssignment, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, assignmentMatch, assignmentMembers, assignmentPrefilter, assignmentState, assignmentStateCounts, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientGuardDereference, clientProjectUserDirectory, compileGuards, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionRoleNames, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, documentStuckCause, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findActivityNode, findCurrentActivityEntry, findOpenStageEntry, findStageNode, formatRead2 as formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, identityMatchesAssignment, inFlightFilter, initialFieldIssues, instanceAssignmentStateCounts, instanceChangesQuery, instanceDocId, instanceGuardQuery, instancePreviewsQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, openActivityAssignments, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseInstancePreviewDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readInstancePreviewDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredDefinitionReaderModel, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resolveUserAttributes, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, snapshotGuardDereference, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };