@sanity/workflow-engine 0.31.0 → 0.32.0

package/dist/index.cjs

@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", {
     value: !0
 });
 
-var invariants = require("./_chunks-cjs/invariants.cjs"), groqConditionDescribe = require("@sanity/groq-condition-describe"), groqJs = require("groq-js"), v = require("valibot");
+var invariants = require("./_chunks-cjs/invariants.cjs"), groqConditionDescribe = require("@sanity/groq-condition-describe"), groqJs = require("groq-js"), idUtils = require("@sanity/id-utils"), v = require("valibot");
 
 function _interopNamespaceCompat(e) {
     if (e && typeof e == "object" && "default" in e) return e;
@@ -24,37 +24,6 @@ function _interopNamespaceCompat(e) {
 
 var v__namespace = /* @__PURE__ */ _interopNamespaceCompat(v);
 
-function isFilterScopedOut(entry) {
-    return entry.status === "skipped" && entry.startedAt === void 0;
-}
-
-function liveSubworkflows(host) {
-    return (host.subworkflows ?? []).filter(row => row.resolved === void 0);
-}
-
-function resolvedChildStatus(child) {
-    if (!(child.completedAt === void 0 || child.completedAt === null)) return child.abortedAt !== void 0 && child.abortedAt !== null ? "aborted" : "done";
-}
-
-function condemnedSubworkflows(host) {
-    return liveSubworkflows(host).filter(row => row.abortPending !== void 0);
-}
-
-function condemnSubworkflow(row, owed) {
-    row.abortPending !== void 0 || row.resolved !== void 0 || (row.abortPending = {
-        at: owed.at,
-        reason: owed.reason
-    });
-}
-
-function findOpenStageEntry(host) {
-    return host.stages.find(s => s.name === host.currentStage && s.exitedAt === void 0);
-}
-
-function findCurrentActivityEntry(host, activityName) {
-    return findOpenStageEntry(host)?.activities.find(a => a.name === activityName);
-}
-
 const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
 
 function terminalState(instance) {
@@ -189,7 +158,7 @@ function fieldWindowOpen(instance, site) {
     if (site.scope !== "activity") return {
         open: !0
     };
-    const status = findCurrentActivityEntry(instance, site.activity)?.status;
+    const status = invariants.findCurrentActivityEntry(instance, site.activity)?.status;
     return status === "active" ? {
         open: !0
     } : {
@@ -208,7 +177,7 @@ function resolveFieldEntry$1(instance, site) {
 
 function fieldEntryHost(instance, site) {
     if (site.scope === "workflow") return instance.fields;
-    const stageEntry = findOpenStageEntry(instance);
+    const stageEntry = invariants.findOpenStageEntry(instance);
     return site.scope === "stage" ? stageEntry?.fields : stageEntry?.activities.find(t => t.name === site.activity)?.fields;
 }
 
@@ -390,7 +359,7 @@ function instanceStartedDataFor(args) {
 }
 
 function stageTransitionedData(args) {
-    const stageIndex = name => args.definition.stages.findIndex(stage => stage.name === name), openEntry = findOpenStageEntry(args.instance), dwellMs = openEntry !== void 0 ? Date.parse(args.at) - Date.parse(openEntry.enteredAt) : Number.NaN;
+    const stageIndex = name => args.definition.stages.findIndex(stage => stage.name === name), openEntry = invariants.findOpenStageEntry(args.instance), dwellMs = openEntry !== void 0 ? Date.parse(args.at) - Date.parse(openEntry.enteredAt) : Number.NaN;
     return {
         ...definitionHashFragment(args.instance.pinnedContentHash),
         instanceId: args.instance._id,
@@ -472,6 +441,11 @@ function rolesGateOf(atom) {
     if (!(count.type !== "FuncCall" || count.name !== "count" || count.args.length !== 1)) return rolesFilterList(count.args[0]);
 }
 
+function isAssignedGate(atom) {
+    const node = groqConditionDescribe.atomNode(atom);
+    return !atom.negated && node.type === "Parameter" && node.name === "assigned";
+}
+
 function rolesFilterList(node) {
     if (node.type !== "Filter") return;
     const base = node.base;
@@ -1760,27 +1734,38 @@ function startContextSyntaxIssues({groq: groq, vars: vars, context: context, ski
     return [ ...invariants.conditionParameterNames(groq) ].filter(name => !bound.has(name) && name !== skip).map(name => `reads $${name}, which the ${context} context does not bind (an unbound variable is GROQ null, so the predicate silently misevaluates — failing closed or passing vacuously by shape). Bound here: ` + vars.map(v2 => `$${v2.name}`).join(", "));
 }
 
-function getPath(value, path) {
-    let current = value;
-    for (const part of path.split(".")) {
-        if (current == null || typeof current != "object") return;
-        current = current[part];
+const GUARD_DOC_TYPE = "temp.system.guard";
+
+class MutationGuardDeniedError extends invariants.WorkflowError {
+    denied;
+    documentId;
+    action;
+    constructor(args) {
+        const ids = args.denied.map(d => d.guardId).join(", ");
+        super("mutation-guard-denied", `Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), 
+        this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, 
+        this.action = args.action;
+    }
+    static fromGuards(args) {
+        return new MutationGuardDeniedError({
+            documentId: args.documentId,
+            action: args.action,
+            denied: deniedGuardRefs(args.guards)
+        });
     }
-    return current;
 }
 
-function isReferenceObject(value) {
-    return typeof value._ref == "string";
+function deniedGuardRefs(guards) {
+    return guards.map(g => ({
+        guardId: g._id,
+        ...g.name !== void 0 ? {
+            name: g.name
+        } : {}
+    }));
 }
 
-function walkDocPath(value, path) {
-    let current = value;
-    for (const part of path.split(".")) {
-        if (current == null || typeof current != "object") return;
-        if (isReferenceObject(current) && !Object.hasOwn(current, part)) throw new Error(`cannot read "${part}" through the nested reference "${current._ref}" — the workflow only loads references it declares. Declare it as a doc.ref field entry to read through it.`);
-        current = current[part];
-    }
-    return current;
+function deniedGuardLabels(denied) {
+    return denied.map(d => d.name ?? d.guardId);
 }
 
 function mapJsonStrings(value, transform) {
@@ -1849,205 +1834,664 @@ function overlayInstanceInSnapshot(snapshot, instance) {
     };
 }
 
-function resolveFieldRead(args) {
-    const {kind: kind, value: value, path: path, snapshot: snapshot, targetKind: targetKind} = args;
-    if (invariants.isSingleDocRefKind(kind)) {
-        if (!invariants.isGdr(value)) return null;
-        if (path === void 0 && targetKind !== void 0 && invariants.isSingleDocRefKind(targetKind)) return value;
-        const base = derefBase(value, snapshot);
-        return path === void 0 ? base : walkDocPath(base, path);
-    }
-    return path !== void 0 ? getPath(value, path) : value;
+function lakeGuardId(args) {
+    return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.guardName}`;
 }
 
-function derefBase(ref, snapshot) {
-    return (snapshot !== void 0 ? findSnapshotDoc(snapshot, ref.id) : void 0) ?? {
-        _id: ref.id,
-        _type: ref.type
-    };
+function lakeActionsFor(action) {
+    return action === "publish" ? [ "create", "update" ] : action === "unpublish" ? [ "delete" ] : [ action ];
 }
 
-function buildParams(args) {
-    const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
-    return {
-        self: invariants.selfGdr(instance),
-        fields: renderedFields(instance.fields ?? [], snapshot),
-        parent: parentRef(instance)?.id ?? null,
-        ancestors: instance.ancestors.map(a => a.id),
-        stage: instance.currentStage,
-        now: now,
-        context: contextMap(instance),
-        effects: effectOutputsMap(instance),
-        effectStatus: effectStatusMap(instance),
-        activities: currentActivities2,
-        subworkflows: subworkflowVarRows(instance, snapshot),
-        ...activityGateParams(currentActivities2),
-        ...extra
-    };
+function lakeGuardActions(actions) {
+    const requested = new Set(actions.flatMap(lakeActionsFor));
+    return invariants.LAKE_MUTATION_GUARD_ACTIONS.filter(action => requested.has(action));
 }
 
-function subworkflowVarRows(instance, snapshot) {
-    const openKey = findOpenStageEntry(instance)?._key;
-    return (instance.subworkflows ?? []).map(row => ({
-        _id: invariants.toBareId(row.ref.id),
-        rowKey: row.rowKey,
-        activity: row.activity,
-        action: row.action,
-        definition: row.definition,
-        current: row.stageEntry === openKey,
-        ...childState(row, snapshot),
-        spawnedAt: row.spawnedAt
-    }));
+function publishedId(id) {
+    return idUtils.getPublishedId(id);
 }
 
-function childState(row, snapshot) {
-    if (row.resolved !== void 0) return {
-        stage: row.resolved.stage ?? null,
-        status: row.resolved.aborted === !0 ? "aborted" : "done"
+function draftId(id) {
+    return idUtils.getDraftId(id);
+}
+
+function versionPatternTranslation(pattern) {
+    const documentSeparator = pattern.indexOf(".", 9);
+    if (documentSeparator === -1) return {
+        issue: `id pattern "${pattern}" does not identify a versioned document`
     };
-    const doc = snapshot === void 0 ? void 0 : findSnapshotDoc(snapshot, row.ref.id);
-    return doc === void 0 ? {
-        stage: null,
-        status: "active"
+    const documentPattern = pattern.slice(documentSeparator + 1);
+    return /^\*+$/.test(documentPattern) ? {
+        issue: `id pattern "${pattern}" cannot be translated from a release version to a draft or published document without broadening it to every document`
     } : {
-        stage: doc.currentStage ?? null,
-        status: resolvedChildStatus(doc) ?? "active"
+        documentPattern: documentPattern
     };
 }
 
-function activityGateParams(activities) {
-    return {
-        allActivitiesDone: activities.every(activity => activity.status === "done" || activity.status === "skipped"),
-        anyActivityFailed: activities.some(activity => activity.status === "failed")
-    };
+function publishedPattern(pattern) {
+    if (pattern.startsWith("drafts.")) return pattern.slice(7);
+    if (!pattern.startsWith("versions.")) return pattern;
+    const translated = versionPatternTranslation(pattern);
+    if (translated.issue !== void 0) throw new Error(translated.issue);
+    return translated.documentPattern;
 }
 
-function renderedFields(entries, snapshot) {
-    const out = {};
-    for (const entry of entries) out[entry.name] = renderedValue(entry, snapshot);
-    return out;
+function draftPattern(pattern) {
+    return `drafts.${publishedPattern(pattern)}`;
 }
 
-function renderedValue(entry, snapshot) {
-    return resolveFieldRead({
-        kind: entry._type,
-        value: entry.value,
-        path: void 0,
-        snapshot: snapshot
-    });
+function idsInSpace(args) {
+    const {ids: ids, space: space, sourceInstanceId: sourceInstanceId} = args;
+    return space === "authored" ? ids : space === "published" ? [ ...new Set(ids.map(publishedId)) ] : [ ...new Set(ids.map(id => publishedId(id) === sourceInstanceId ? publishedId(id) : draftId(id))) ];
 }
 
-function scopedFieldOverlay({instance: instance, snapshot: snapshot, activityName: activityName}) {
-    const stageEntry = findOpenStageEntry(instance);
-    if (stageEntry === void 0) return {};
-    const stageFields = renderedFields(stageEntry.fields ?? [], snapshot), activity = activityName ? stageEntry.activities.find(t => t.name === activityName) : void 0;
+function patternsInSpace(patterns, space) {
+    if (space === "authored") return patterns;
+    const convert = space === "edit" ? draftPattern : publishedPattern;
+    return [ ...new Set(patterns.map(convert)) ];
+}
+
+function matchInSpace(args) {
+    const {match: match, actions: actions, space: space, sourceInstanceId: sourceInstanceId} = args;
     return {
-        ...stageFields,
-        ...renderedFields(activity?.fields ?? [], snapshot)
+        ...match,
+        ...match.idRefs !== void 0 ? {
+            idRefs: idsInSpace({
+                ids: match.idRefs,
+                space: space,
+                sourceInstanceId: sourceInstanceId
+            })
+        } : {},
+        ...match.idPatterns !== void 0 ? {
+            idPatterns: patternsInSpace(match.idPatterns, space)
+        } : {},
+        actions: lakeGuardActions(actions)
     };
 }
 
-function assignedFor({instance: instance, activityName: activityName, actor: actor, roleAliases: roleAliases}) {
-    if (actor === void 0) return !1;
-    const entry = findCurrentActivityEntry(instance, activityName)?.fields?.find(s => s._type === "assignees");
-    return entry === void 0 ? !1 : entry.value.some(a => a.type === "user" ? a.id === actor.id : invariants.actorFulfillsRole({
-        actorRoles: actor.roles,
-        required: a.role,
-        aliases: roleAliases
+function guardPartitions(id, actions) {
+    return invariants.MUTATION_GUARD_ID_SPACES.flatMap(space => {
+        const matchingActions = actions.filter(action => invariants.mutationGuardActionIdSpace(action) === space);
+        return matchingActions.length > 0 ? [ {
+            space: space,
+            actions: matchingActions
+        } ] : [];
+    }).map((partition, index) => ({
+        ...partition,
+        id: index === 0 ? id : `${id}.${partition.space}`
     }));
 }
 
-function effectStatusMap(instance) {
-    const entry = findOpenStageEntry(instance);
-    if (entry === void 0) return {};
-    const out = {};
-    for (const run of instance.effectHistory) run.stageEntryKey === entry._key && (out[run.name] = run.status);
-    return out;
+function compiledGuardIds(args) {
+    return guardPartitions(args.id, args.actions).map(partition => partition.id);
 }
 
-function contextMap(instance) {
-    const out = {};
-    for (const entry of instance.context) out[entry.name] = entry._type === "context.json" ? parseJsonContextEntry(entry) : entry.value;
-    return out;
+function lakeGuardDocument(args) {
+    return {
+        _id: args.id,
+        _type: GUARD_DOC_TYPE,
+        resourceType: args.resourceType,
+        resourceId: args.resourceId,
+        owner: args.owner,
+        sourceInstanceId: args.sourceInstanceId,
+        sourceDefinition: args.sourceDefinition,
+        sourceStage: args.sourceStage,
+        ...args.name !== void 0 ? {
+            name: args.name
+        } : {},
+        ...args.description !== void 0 ? {
+            description: args.description
+        } : {},
+        match: args.match,
+        predicate: args.predicate,
+        metadata: args.metadata
+    };
 }
 
-function effectOutputsMap(instance) {
-    const out = {};
-    for (const run of instance.effectHistory) run.outputs !== void 0 && (out[run.name] = run.outputs);
-    return out;
+function compileGuards(args) {
+    const [first, ...remaining] = guardPartitions(args.id, args.match.actions);
+    if (first === void 0) throw new Error("cannot compile a guard without an action");
+    const compilePartition = ({space: space, actions: actions, id: id}) => lakeGuardDocument({
+        ...args,
+        id: id,
+        match: matchInSpace({
+            match: args.match,
+            actions: actions,
+            space: space,
+            sourceInstanceId: args.sourceInstanceId
+        })
+    });
+    return [ compilePartition(first), ...remaining.map(compilePartition) ];
 }
 
-function parseJsonContextEntry(entry) {
-    try {
-        return JSON.parse(entry.value);
-    } catch (err) {
-        invariants.rethrowWithContext(err, `context entry "${entry.name}" holds unparseable JSON`);
-    }
+function globMatch(pattern, value) {
+    if (!pattern.includes("*")) return pattern === value;
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`).test(value);
 }
 
-function paramsForLake(params) {
-    return {
-        ...params,
-        self: typeof params.self == "string" ? invariants.toBareId(params.self) : params.self,
-        parent: typeof params.parent == "string" ? invariants.toBareId(params.parent) : params.parent,
-        ancestors: Array.isArray(params.ancestors) ? params.ancestors.map(a => typeof a == "string" ? invariants.toBareId(a) : a) : params.ancestors,
-        fields: stripFieldsForLake(params.fields)
-    };
+function guardIdPatternIssue(pattern, actions) {
+    const representativeId = pattern.replaceAll("*", "x");
+    if (!invariants.isBareDocumentId(representativeId)) return `id pattern "${pattern}" is not a valid resource-local document-id glob; use document-id characters (letters, digits, \`_\`, \`-\`, \`.\`) and \`*\` wildcards`;
+    if (actions?.some(action => invariants.mutationGuardActionIdSpace(action) !== "authored") && pattern.startsWith("versions.")) return versionPatternTranslation(pattern).issue;
 }
 
-function stripFieldsForLake(value) {
-    return mapJsonStrings(value, s => invariants.toBareId(s));
+function parseGuardPredicate(predicate) {
+    return groqJs.parse(predicate, {
+        mode: "delta"
+    });
 }
 
-function resolveStaticValueExpr(src, ctx) {
-    switch (src.type) {
-      case "literal":
-        return src.value;
-
-      case "param":
-        return ctx.params?.[src.param];
+function guardPredicateSyntaxIssue(predicate) {
+    try {
+        parseGuardPredicate(predicate);
+        return;
+    } catch (error) {
+        return invariants.errorMessage(error);
+    }
+}
 
-      case "actor":
-        return ctx.actor;
+function lakeDocumentIdForAction(id, action) {
+    return invariants.mutationGuardActionIdSpace(action) === "published" ? publishedId(id) : id;
+}
 
-      case "now":
-        return ctx.now;
+function legacyLifecycleActionFor(action, documentId) {
+    if (publishedId(documentId) === documentId) {
+        if (action === "create" || action === "update") return "publish";
+        if (action === "delete") return "unpublish";
     }
 }
 
-function randomKey(length = 12) {
-    const bytes = new Uint8Array(length);
-    return globalThis.crypto.getRandomValues(bytes), [ ...bytes ].map(b => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+function guardMatches({guard: guard, doc: doc, action: action}) {
+    const m = guard.match, documentId = lakeDocumentIdForAction(doc.id, action), legacyLifecycleAction = legacyLifecycleActionFor(action, documentId);
+    if (![ action, ...lakeActionsFor(action), legacyLifecycleAction ].some(candidate => candidate !== void 0 && m.actions.includes(candidate)) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type))) return !1;
+    if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
+        const byRef = m.idRefs?.includes(documentId) ?? !1, byPattern = m.idPatterns?.some(p => globMatch(p, documentId)) ?? !1;
+        if (!byRef && !byPattern) return !1;
+    }
+    return !0;
 }
 
-function instanceDocId(tag) {
-    return `${tag}.wf-instance.${randomKey()}`;
+function guardPredicateRoot(args) {
+    return {
+        document: {
+            before: args.context.before,
+            after: args.context.after
+        },
+        guard: args.guard,
+        mutation: {
+            action: args.context.action
+        }
+    };
 }
 
-function mapFieldRefValues(args) {
-    const {entryType: entryType, value: value, fields: fields, of: of, mapRef: mapRef} = args;
-    return value == null ? value : invariants.isSingleDocRefKind(entryType) || entryType === "release.ref" ? mapRef(value) : entryType === "doc.refs" ? mapItems(value, mapRef) : entryType === "object" ? mapRowRefValues({
-        row: value,
-        shapes: fields ?? [],
-        mapRef: mapRef
-    }) : entryType === "array" ? mapItems(value, row => mapRowRefValues({
-        row: row,
-        shapes: of ?? [],
-        mapRef: mapRef
-    })) : value;
+function lakeShapedSnapshotDocument(doc) {
+    return mapJsonStrings(doc, (value, key) => key === "_id" || key === "_ref" ? invariants.toBareId(value) : value);
 }
 
-function mapItems(value, mapItem) {
-    return Array.isArray(value) ? value.map(mapItem) : value;
+function snapshotGuardDereference(args) {
+    return ({_ref: _ref}) => {
+        const lookupId = invariants.isGdrUri(_ref) ? _ref : invariants.gdrFromResource(args.resource, _ref), found = findSnapshotDoc(args.snapshot, lookupId);
+        return Promise.resolve(found === void 0 ? null : lakeShapedSnapshotDocument(found));
+    };
 }
 
-function mapRowRefValues(args) {
-    const {row: row, shapes: shapes, mapRef: mapRef} = args;
-    if (typeof row != "object" || row === null || Array.isArray(row)) return row;
-    const record = row, out = {
-        ...record
-    };
-    for (const shape of shapes) shape.name in record && (out[shape.name] = mapFieldRefValues({
+async function evaluateMutationGuard(args) {
+    const {guard: guard, context: context, dereference: dereference} = args;
+    if (guard.predicate === "") return !1;
+    const root = guardPredicateRoot({
+        guard: guard,
+        context: context
+    });
+    let dereferenceFailed = !1;
+    const guardedDereference = dereference === void 0 ? void 0 : async ref => {
+        try {
+            return await dereference(ref);
+        } catch (error) {
+            throw dereferenceFailed = !0, error;
+        }
+    };
+    try {
+        const tree = parseGuardPredicate(guard.predicate);
+        return await (await groqJs.evaluate(tree, {
+            root: root,
+            before: context.before,
+            after: context.after,
+            ...guardedDereference !== void 0 ? {
+                dataset: [],
+                dereference: guardedDereference
+            } : {},
+            ...context.identity !== void 0 ? {
+                identity: context.identity
+            } : {}
+        })).get() === !0;
+    } catch (error) {
+        if (dereferenceFailed) throw error;
+        return !1;
+    }
+}
+
+async function denyingGuards(args) {
+    const {guards: guards, doc: doc, context: context, dereference: dereference} = args, denied = [];
+    for (const guard of guards) guardMatches({
+        guard: guard,
+        doc: doc,
+        action: context.action
+    }) && (await evaluateMutationGuard({
+        guard: guard,
+        context: context,
+        ...dereference !== void 0 ? {
+            dereference: dereference
+        } : {}
+    }) || denied.push(guard));
+    return denied;
+}
+
+async function documentActionDenials(args) {
+    const {mutation: mutation, resource: resource, guards: guards, identity: identity, dereference: dereference} = args, document = mutation.after ?? mutation.before;
+    if (document === null) throw new Error("a concrete Lake mutation requires a before or after image");
+    const enforceable = guards.filter(g => g.resourceType === resource.type && g.resourceId === resource.id);
+    return enforceable.length === 0 ? [] : denyingGuards({
+        guards: enforceable,
+        doc: {
+            id: document._id,
+            type: document._type
+        },
+        context: {
+            ...mutation,
+            ...identity !== void 0 ? {
+                identity: identity
+            } : {}
+        },
+        ...dereference !== void 0 ? {
+            dereference: dereference
+        } : {}
+    });
+}
+
+async function instanceWriteDenials(args) {
+    const {instance: instance, guards: guards, identity: identity, dereference: dereference} = args;
+    return documentActionDenials({
+        mutation: {
+            before: instance,
+            after: instance,
+            action: "update"
+        },
+        resource: instance.workflowResource,
+        guards: guards,
+        dereference: dereference,
+        ...identity !== void 0 ? {
+            identity: identity
+        } : {}
+    });
+}
+
+async function assertInstanceWriteAllowed(args) {
+    const denied = await instanceWriteDenials(args);
+    if (denied.length !== 0) throw MutationGuardDeniedError.fromGuards({
+        documentId: args.instance._id,
+        action: "update",
+        guards: denied
+    });
+}
+
+const ASSIGNMENT_LIST_MODEL = 9;
+
+function isAssignmentListModel(modelVersion) {
+    return modelVersion >= ASSIGNMENT_LIST_MODEL;
+}
+
+function definitionAssignmentModel(instance) {
+    if (typeof instance.definitionSnapshot != "string") return 0;
+    const modelVersion = parseDefinitionSnapshotValue({
+        _id: instance._id,
+        definitionSnapshot: instance.definitionSnapshot
+    }).modelVersion;
+    return typeof modelVersion == "number" ? modelVersion : 0;
+}
+
+function writesSingularAssignmentLists(instance) {
+    return isAssignmentListModel(definitionAssignmentModel(instance));
+}
+
+function legacyAssigneeValue(entry) {
+    return legacyAssignmentValue(entry.value, entry.name);
+}
+
+function legacyAssignmentValue(value, path) {
+    if (!Array.isArray(value)) return value;
+    if (value.length === 0) return null;
+    if (value.length === 1) return value[0];
+    throw new invariants.ContractViolationError(`legacy assignee field "${path}" cannot persist ${value.length} members; redeploy the definition at the assignment-list reader model before writing a role pool`);
+}
+
+function mapShapeValues(args) {
+    const {value: value, shapes: shapes, mapAssignee: mapAssignee, parentPath: parentPath} = args;
+    if (typeof value != "object" || value === null || Array.isArray(value)) return value;
+    const source = value, next = {
+        ...source
+    };
+    for (const shape of shapes) {
+        if (!Object.hasOwn(source, shape.name)) continue;
+        const path = `${parentPath}.${shape.name}`, member = source[shape.name], mapped = mappedShapeValue({
+            shape: shape,
+            member: member,
+            mapAssignee: mapAssignee,
+            path: path
+        });
+        mapped.found && defineOwnValue(next, {
+            name: shape.name,
+            value: mapped.value
+        });
+    }
+    return next;
+}
+
+function mappedShapeValue(args) {
+    const {shape: shape, member: member, mapAssignee: mapAssignee, path: path} = args;
+    return shape.type === "assignee" ? {
+        found: !0,
+        value: mapAssignee(member, path)
+    } : shape.type === "object" ? {
+        found: !0,
+        value: mapShapeValues({
+            value: member,
+            shapes: shape.fields ?? [],
+            mapAssignee: mapAssignee,
+            parentPath: path
+        })
+    } : shape.type !== "array" || !Array.isArray(member) ? {
+        found: !1
+    } : {
+        found: !0,
+        value: member.map((row, index) => mapShapeValues({
+            value: row,
+            shapes: shape.of ?? [],
+            mapAssignee: mapAssignee,
+            parentPath: `${path}[${index}]`
+        }))
+    };
+}
+
+function defineOwnValue(target, property) {
+    Object.defineProperty(target, property.name, {
+        configurable: !0,
+        enumerable: !0,
+        value: property.value,
+        writable: !0
+    });
+}
+
+function mapNestedAssignmentValues(entry, mapAssignee) {
+    return entry._type === "object" ? mapShapeValues({
+        value: entry.value,
+        shapes: entry.fields,
+        mapAssignee: mapAssignee,
+        parentPath: entry.name
+    }) : entry.value.map((row, index) => mapShapeValues({
+        value: row,
+        shapes: entry.of,
+        mapAssignee: mapAssignee,
+        parentPath: `${entry.name}[${index}]`
+    }));
+}
+
+function normalizeNestedAssignmentValues(entry) {
+    return entry._type !== "object" && entry._type !== "array" ? entry : {
+        ...entry,
+        value: mapNestedAssignmentValues(entry, invariants.normalizeAssignmentMembers)
+    };
+}
+
+function assignmentFieldsForWrite(fields, listModel) {
+    return listModel ? fields : fields.map(entry => entry._type === "assignee" ? {
+        ...entry,
+        value: legacyAssigneeValue(entry)
+    } : entry._type === "object" || entry._type === "array" ? {
+        ...entry,
+        value: mapNestedAssignmentValues(entry, legacyAssignmentValue)
+    } : entry);
+}
+
+function activityForWrite(activity, listModel) {
+    return {
+        ...activity,
+        ...activity.fields === void 0 ? {} : {
+            fields: assignmentFieldsForWrite(activity.fields, listModel)
+        }
+    };
+}
+
+function assignmentStagesForWrite(stages, listModel) {
+    return stages.map(stage => ({
+        ...stage,
+        fields: assignmentFieldsForWrite(stage.fields ?? [], listModel),
+        activities: stage.activities.map(activity => activityForWrite(activity, listModel))
+    }));
+}
+
+function getPath(value, path) {
+    let current = value;
+    for (const part of path.split(".")) {
+        if (current == null || typeof current != "object") return;
+        current = current[part];
+    }
+    return current;
+}
+
+function isReferenceObject(value) {
+    return typeof value._ref == "string";
+}
+
+function walkDocPath(value, path) {
+    let current = value;
+    for (const part of path.split(".")) {
+        if (current == null || typeof current != "object") return;
+        if (isReferenceObject(current) && !Object.hasOwn(current, part)) throw new Error(`cannot read "${part}" through the nested reference "${current._ref}" — the workflow only loads references it declares. Declare it as a doc.ref field entry to read through it.`);
+        current = current[part];
+    }
+    return current;
+}
+
+function resolveFieldRead(args) {
+    const {kind: kind, value: value, path: path, snapshot: snapshot, targetKind: targetKind} = args;
+    if (invariants.isSingleDocRefKind(kind)) {
+        if (!invariants.isGdr(value)) return null;
+        if (path === void 0 && targetKind !== void 0 && invariants.isSingleDocRefKind(targetKind)) return value;
+        const base = derefBase(value, snapshot);
+        return path === void 0 ? base : walkDocPath(base, path);
+    }
+    return path !== void 0 ? getPath(value, path) : value;
+}
+
+function derefBase(ref, snapshot) {
+    return (snapshot !== void 0 ? findSnapshotDoc(snapshot, ref.id) : void 0) ?? {
+        _id: ref.id,
+        _type: ref.type
+    };
+}
+
+function buildParams(args) {
+    const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = invariants.findOpenStageEntry(instance)?.activities ?? [];
+    return {
+        self: invariants.selfGdr(instance),
+        fields: renderedFields(instance.fields ?? [], snapshot),
+        parent: parentRef(instance)?.id ?? null,
+        ancestors: instance.ancestors.map(a => a.id),
+        stage: instance.currentStage,
+        now: now,
+        context: contextMap(instance),
+        effects: effectOutputsMap(instance),
+        effectStatus: effectStatusMap(instance),
+        activities: currentActivities2,
+        subworkflows: subworkflowVarRows(instance, snapshot),
+        ...activityGateParams(currentActivities2),
+        ...extra
+    };
+}
+
+function subworkflowVarRows(instance, snapshot) {
+    const openKey = invariants.findOpenStageEntry(instance)?._key;
+    return (instance.subworkflows ?? []).map(row => ({
+        _id: invariants.toBareId(row.ref.id),
+        rowKey: row.rowKey,
+        activity: row.activity,
+        action: row.action,
+        definition: row.definition,
+        current: row.stageEntry === openKey,
+        ...childState(row, snapshot),
+        spawnedAt: row.spawnedAt
+    }));
+}
+
+function childState(row, snapshot) {
+    if (row.resolved !== void 0) return {
+        stage: row.resolved.stage ?? null,
+        status: row.resolved.aborted === !0 ? "aborted" : "done"
+    };
+    const doc = snapshot === void 0 ? void 0 : findSnapshotDoc(snapshot, row.ref.id);
+    return doc === void 0 ? {
+        stage: null,
+        status: "active"
+    } : {
+        stage: doc.currentStage ?? null,
+        status: invariants.resolvedChildStatus(doc) ?? "active"
+    };
+}
+
+function activityGateParams(activities) {
+    return {
+        allActivitiesDone: activities.every(activity => activity.status === "done" || activity.status === "skipped"),
+        anyActivityFailed: activities.some(activity => activity.status === "failed")
+    };
+}
+
+function renderedFields(entries, snapshot) {
+    const out = {};
+    for (const entry of entries) out[entry.name] = renderedValue(entry, snapshot);
+    return out;
+}
+
+function renderedValue(entry, snapshot) {
+    return resolveFieldRead({
+        kind: entry._type,
+        value: entry.value,
+        path: void 0,
+        snapshot: snapshot
+    });
+}
+
+function scopedFieldOverlay({instance: instance, snapshot: snapshot, activityName: activityName}) {
+    const stageEntry = invariants.findOpenStageEntry(instance);
+    if (stageEntry === void 0) return {};
+    const stageFields = renderedFields(stageEntry.fields ?? [], snapshot), activity = activityName ? stageEntry.activities.find(t => t.name === activityName) : void 0;
+    return {
+        ...stageFields,
+        ...renderedFields(activity?.fields ?? [], snapshot)
+    };
+}
+
+function assignedFor({instance: instance, activityName: activityName, actor: actor, roleAliases: roleAliases}) {
+    if (actor === void 0) return !1;
+    const activity = invariants.findCurrentActivityEntry(instance, activityName);
+    return invariants.actorMatchesAssignment({
+        actor: actor,
+        members: invariants.assignmentMembers(activity?.fields ?? []),
+        roleAliases: roleAliases
+    });
+}
+
+function effectStatusMap(instance) {
+    const entry = invariants.findOpenStageEntry(instance);
+    if (entry === void 0) return {};
+    const out = {};
+    for (const run of instance.effectHistory) run.stageEntryKey === entry._key && (out[run.name] = run.status);
+    return out;
+}
+
+function contextMap(instance) {
+    const out = {};
+    for (const entry of instance.context) out[entry.name] = entry._type === "context.json" ? parseJsonContextEntry(entry) : entry.value;
+    return out;
+}
+
+function effectOutputsMap(instance) {
+    const out = {};
+    for (const run of instance.effectHistory) run.outputs !== void 0 && (out[run.name] = run.outputs);
+    return out;
+}
+
+function parseJsonContextEntry(entry) {
+    try {
+        return JSON.parse(entry.value);
+    } catch (err) {
+        invariants.rethrowWithContext(err, `context entry "${entry.name}" holds unparseable JSON`);
+    }
+}
+
+function paramsForLake(params) {
+    return {
+        ...params,
+        self: typeof params.self == "string" ? invariants.toBareId(params.self) : params.self,
+        parent: typeof params.parent == "string" ? invariants.toBareId(params.parent) : params.parent,
+        ancestors: Array.isArray(params.ancestors) ? params.ancestors.map(a => typeof a == "string" ? invariants.toBareId(a) : a) : params.ancestors,
+        fields: stripFieldsForLake(params.fields)
+    };
+}
+
+function stripFieldsForLake(value) {
+    return mapJsonStrings(value, s => invariants.toBareId(s));
+}
+
+function resolveStaticValueExpr(src, ctx) {
+    switch (src.type) {
+      case "literal":
+        return src.value;
+
+      case "param":
+        return ctx.params?.[src.param];
+
+      case "actor":
+        return ctx.actor;
+
+      case "now":
+        return ctx.now;
+    }
+}
+
+function randomKey(length = 12) {
+    const bytes = new Uint8Array(length);
+    return globalThis.crypto.getRandomValues(bytes), [ ...bytes ].map(b => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
+
+function instanceDocId(tag) {
+    return `${tag}.wf-instance.${randomKey()}`;
+}
+
+function mapFieldRefValues(args) {
+    const {entryType: entryType, value: value, fields: fields, of: of, mapRef: mapRef} = args;
+    return value == null ? value : invariants.isSingleDocRefKind(entryType) || entryType === "release.ref" ? mapRef(value) : entryType === "doc.refs" ? mapItems(value, mapRef) : entryType === "object" ? mapRowRefValues({
+        row: value,
+        shapes: fields ?? [],
+        mapRef: mapRef
+    }) : entryType === "array" ? mapItems(value, row => mapRowRefValues({
+        row: row,
+        shapes: of ?? [],
+        mapRef: mapRef
+    })) : value;
+}
+
+function mapItems(value, mapItem) {
+    return Array.isArray(value) ? value.map(mapItem) : value;
+}
+
+function mapRowRefValues(args) {
+    const {row: row, shapes: shapes, mapRef: mapRef} = args;
+    if (typeof row != "object" || row === null || Array.isArray(row)) return row;
+    const record = row, out = {
+        ...record
+    };
+    for (const shape of shapes) shape.name in record && (out[shape.name] = mapFieldRefValues({
         entryType: shape.type,
         value: record[shape.name],
         fields: shape.fields,
@@ -2269,10 +2713,12 @@ class WorkflowStateDivergedError extends invariants.WorkflowError {
 class PartialGuardDeployError extends invariants.WorkflowError {
     stageName;
     deployed;
+    rollbackError;
     constructor(args) {
         super("partial-guard-deploy", `Partial guard deploy on stage "${args.stageName}": ${args.deployed} guard(s) deployed before a later one failed.`, {
             cause: args.cause
-        }), this.name = "PartialGuardDeployError", this.stageName = args.stageName, this.deployed = args.deployed;
+        }), this.name = "PartialGuardDeployError", this.stageName = args.stageName, this.deployed = args.deployed, 
+        args.rollbackError !== void 0 && (this.rollbackError = args.rollbackError);
     }
 }
 
@@ -2313,7 +2759,23 @@ function staleClaimDetail(reason) {
 const CONCURRENT_COMMIT_MAX_ATTEMPTS = 3;
 
 function lostRaceMessage(args) {
-    return `${args.what} (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running — a concurrent writer kept committing first. Re-read and retry, or investigate a write storm on this instance.`;
+    return `${args.what} (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running — a concurrent writer kept committing first. ${args.recovery ?? "Re-read and retry, or investigate a write storm on this instance."}`;
+}
+
+function isRetryableInstanceCommitConflict(error) {
+    return !isCreateIdCollision(error) && isRevisionConflict(error);
+}
+
+class InstanceCommitRevisionConflict extends Error {
+    constructor(cause) {
+        super("Instance commit lost its revision fence", {
+            cause: cause
+        }), this.name = "InstanceCommitRevisionConflict";
+    }
+}
+
+function isInstanceCommitRevisionConflict(error) {
+    return error instanceof InstanceCommitRevisionConflict;
 }
 
 class ConcurrentFireActionError extends invariants.WorkflowError {
@@ -2331,6 +2793,19 @@ class ConcurrentFireActionError extends invariants.WorkflowError {
     }
 }
 
+class ConcurrentCascadeError extends invariants.WorkflowError {
+    instanceId;
+    attempts;
+    constructor(args) {
+        super("concurrent-cascade", lostRaceMessage({
+            what: "Automatic cascade",
+            instanceId: args.instanceId,
+            attempts: args.attempts,
+            recovery: "An earlier verb commit may already have landed. Re-read the instance and invoke tick after contention subsides."
+        })), this.name = "ConcurrentCascadeError", this.instanceId = args.instanceId, this.attempts = args.attempts;
+    }
+}
+
 function isRevisionConflict(error) {
     if (typeof error != "object" || error === null) return !1;
     const {statusCode: statusCode, message: message} = error;
@@ -2613,11 +3088,15 @@ function applyFieldSet(op, ctx) {
         ...entryShape(entry),
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.roleAliases,
-        ...entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
+        ...entry._type === "assignee" || entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
             previousValue: entry.value
         } : {}
     });
-    return assertRuntimeRefsWithinSurface({
+    return assertLegacySingularValue({
+        entry: entry,
+        value: validated,
+        ctx: ctx
+    }), assertRuntimeRefsWithinSurface({
         entryType: entry._type,
         entryName: entry.name,
         value: validated,
@@ -2634,12 +3113,12 @@ function applyFieldSet(op, ctx) {
 }
 
 function applyFieldSetIfMissing(op, ctx) {
-    const entry = locateEntry(ctx, op.target);
-    return invariants.isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+    const entry = locateEntry(ctx, op.target), legacySingular = isLegacySingularAssignment(entry, ctx);
+    return invariants.isAlwaysArrayFieldKind(entry._type) && !legacySingular && rejectFieldOpTarget({
         entry: entry,
         op: op,
         issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
-    }), entry.value !== null && entry.value !== void 0 ? {
+    }), entry.value !== null && entry.value !== void 0 && !(legacySingular && Array.isArray(entry.value) && entry.value.length === 0) ? {
         opType: op.type,
         target: op.target
     } : {
@@ -2760,7 +3239,14 @@ function applyFieldUnset(op, ctx) {
 }
 
 function applyFieldAppend(op, ctx) {
-    const entry = locateEntry(ctx, op.target), slot = appendItemSlot(entry), item = resolveOpValue({
+    const entry = locateEntry(ctx, op.target);
+    if (isLegacySingularAssignment(entry, ctx)) throw new invariants.FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "item",
+        issues: [ "legacy singular assignee entries do not support append; redeploy at model 9" ]
+    });
+    const slot = appendItemSlot(entry), item = resolveOpValue({
         src: op.value,
         ctx: ctx,
         ...slot !== void 0 ? {
@@ -2772,7 +3258,7 @@ function applyFieldAppend(op, ctx) {
         item: item,
         types: entry._type === "doc.refs" ? entry.types : void 0,
         of: entry._type === "array" ? entry.of : void 0,
-        roles: entry._type === "assignees" ? entry.roles : void 0,
+        roles: invariants.isAssignmentFieldEntry(entry) ? entry.roles : void 0,
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.roleAliases
     });
@@ -2784,8 +3270,16 @@ function applyFieldAppend(op, ctx) {
         ctx: ctx,
         src: op.value
     });
-    const current = Array.isArray(entry.value) ? entry.value : [];
-    return setEntryValue(entry, [ ...current, withRowKey(validated) ]), {
+    const next = [ ...Array.isArray(entry.value) ? entry.value : [], withRowKey(validated) ], value = invariants.isAssignmentFieldEntry(entry) ? invariants.validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: next,
+        ...assignmentEntryShape(entry),
+        previousValue: entry.value,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
+    }) : next;
+    return setEntryValue(entry, value), {
         opType: op.type,
         target: op.target,
         resolved: {
@@ -2862,7 +3356,14 @@ async function applyFieldUpdateWhere(op, ctx) {
 }
 
 async function applyFieldRemoveWhere(op, ctx) {
-    const entry = locateEntry(ctx, op.target), rows = requireArrayValue(entry, op), matches = await rowMatches({
+    const entry = locateEntry(ctx, op.target);
+    if (isLegacySingularAssignment(entry, ctx)) throw new invariants.FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ "legacy singular assignee entries do not support removeWhere; redeploy at model 9" ]
+    });
+    const rows = requireArrayValue(entry, op), matches = await rowMatches({
         where: op.where,
         rows: rows,
         ctx: ctx
@@ -2873,6 +3374,20 @@ async function applyFieldRemoveWhere(op, ctx) {
     };
 }
 
+function assertLegacySingularValue(args) {
+    const {entry: entry, value: value, ctx: ctx} = args;
+    if (!(!isLegacySingularAssignment(entry, ctx) || !Array.isArray(value) || value.length <= 1)) throw new invariants.FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ "legacy singular assignee entries accept at most one total member; redeploy at model 9" ]
+    });
+}
+
+function isLegacySingularAssignment(entry, ctx) {
+    return entry._type === "assignee" && !isAssignmentListModel(ctx.mutation.definitionModelVersion);
+}
+
 function requireMergeableRows(entry, op) {
     if (entry._type !== "array") throw new Error(`${op.type} target ${op.target.scope}:"${op.target.field}" is a ${entry._type} entry — updateWhere merges declared row sub-fields, so it targets \`array\` entries only`);
 }
@@ -2893,7 +3408,7 @@ function requireArrayValue(entry, op) {
 }
 
 function applyStatusSet(op, ctx) {
-    const entry = findCurrentActivityEntry(ctx.mutation, op.activity);
+    const entry = invariants.findCurrentActivityEntry(ctx.mutation, op.activity);
     if (entry === void 0) throw new Error(`status.set targets activity "${op.activity}" which has no entry in the open stage`);
     return applyActivityStatusChange({
         entry: entry,
@@ -2925,7 +3440,7 @@ function locateEntry(ctx, target) {
 
 function fieldHost(ctx, scope) {
     if (scope === "workflow") return ctx.mutation.fields;
-    const stageEntry = findOpenStageEntry(ctx.mutation);
+    const stageEntry = invariants.findOpenStageEntry(ctx.mutation);
     if (scope === "stage") return stageEntry?.fields;
     const activity = stageEntry?.activities.find(t => t.name === ctx.activityName);
     return activity !== void 0 && activity.fields === void 0 && (activity.fields = []), 
@@ -2997,10 +3512,10 @@ function resolveAtomicOpValue(src, ctx) {
 }
 
 function readEntryFromMutation(ctx, src) {
-    const scopes = src.scope !== void 0 ? [ src.scope ] : [ "activity", "stage", "workflow" ], stageEntry = findOpenStageEntry(ctx.mutation);
+    const scopes = src.scope !== void 0 ? [ src.scope ] : [ "activity", "stage", "workflow" ], stageEntry = invariants.findOpenStageEntry(ctx.mutation);
     for (const scope of scopes) {
         let host;
-        scope === "workflow" ? host = ctx.mutation.fields : scope === "stage" ? host = stageEntry?.fields : host = findCurrentActivityEntry(ctx.mutation, ctx.activityName)?.fields;
+        scope === "workflow" ? host = ctx.mutation.fields : scope === "stage" ? host = stageEntry?.fields : host = invariants.findCurrentActivityEntry(ctx.mutation, ctx.activityName)?.fields;
         const entry = host?.find(s => s.name === src.field);
         if (entry !== void 0) return entry;
     }
@@ -3023,7 +3538,7 @@ async function rowMatches({where: where, rows: rows, ctx: ctx}) {
 const WHERE_SCOPE_PARAM_NAMES = [ "row", "params", "actor", "now", "self", "stage", "fields", "context", "effects", "effectStatus", "activities", "allActivitiesDone", "anyActivityFailed" ];
 
 function whereParams(ctx) {
-    const activities = findOpenStageEntry(ctx.mutation)?.activities ?? [];
+    const activities = invariants.findOpenStageEntry(ctx.mutation)?.activities ?? [];
     return {
         params: ctx.params,
         actor: ctx.actor ?? null,
@@ -3048,6 +3563,14 @@ function whereParams(ctx) {
 
 function validateDefinition(definition) {
     const v2 = createDefinitionValidator();
+    validateConditionSites(v2, definition), validateStart(v2, definition);
+    for (const entry of definition.fields ?? []) v2.checkEntry(entry, `workflow.fields "${entry.name}"`);
+    for (const stage of definition.stages) validateStage(v2, stage);
+    for (const issue of invariants.checkWorkflowInvariants(definition)) v2.errors.push(`  · ${invariants.formatIssuePath(issue.path)}: ${issue.message}`);
+    if (v2.errors.length > 0) throw new Error(`validateDefinition("${definition.name}"): ${v2.errors.length} deploy-time validation error${v2.errors.length === 1 ? "" : "s"}:\n` + v2.errors.join(`\n`));
+}
+
+function validateConditionSites(v2, definition) {
     for (const site of conditionSitesOf(definition)) {
         const {address: address} = site;
         address.kind !== "editable-field" && v2.checkCondition(site.condition, conditionSiteLabel({
@@ -3055,12 +3578,11 @@ function validateDefinition(definition) {
             address: address
         }));
     }
+}
+
+function validateStart(v2, definition) {
     definition.start?.filter !== void 0 && v2.report("start.filter", startFilterSyntaxIssues(definition.start.filter));
     for (const [index, requirement] of (definition.start?.requirements ?? []).entries()) requirement.type === "groq" && v2.report(`start.requirements[${index}].query`, startRequirementSyntaxIssues(requirement.query));
-    for (const entry of definition.fields ?? []) v2.checkEntry(entry, `workflow.fields "${entry.name}"`);
-    for (const stage of definition.stages) validateStage(v2, stage);
-    for (const issue of invariants.checkWorkflowInvariants(definition)) v2.errors.push(`  · ${invariants.formatIssuePath(issue.path)}: ${issue.message}`);
-    if (v2.errors.length > 0) throw new Error(`validateDefinition("${definition.name}"): ${v2.errors.length} deploy-time validation error${v2.errors.length === 1 ? "" : "s"}:\n` + v2.errors.join(`\n`));
 }
 
 function createDefinitionValidator() {
@@ -3091,33 +3613,12 @@ function createDefinitionValidator() {
 
 function conditionSiteLabel({stage: stage, address: address}) {
     const at = `stage "${stage}"`;
-    switch (address.kind) {
-      case "predicate":
-        return `predicate "${address.predicate}"`;
-
-      case "transition":
-        return `${at} transition "${address.transition}" when`;
-
-      case "activity-filter":
-        return `${at} activity "${address.activity}".filter`;
-
-      case "requirement":
-        return `${at} activity "${address.activity}".requirements "${address.requirement}"`;
-
-      case "action":
-        return `${at} activity "${address.activity}" action "${address.action}".filter`;
-
-      case "action-when":
-        return `${at} activity "${address.activity}" action "${address.action}".when`;
-
-      case "editable-override":
-        return `${at}.editable "${address.name}"`;
-    }
+    return address.kind === "predicate" ? `predicate "${address.predicate}"` : address.kind === "transition" ? `${at} transition "${address.transition}" when` : address.kind === "activity-filter" ? `${at} activity "${address.activity}".filter` : address.kind === "requirement" ? `${at} activity "${address.activity}".requirements "${address.requirement}"` : address.kind === "action" ? `${at} activity "${address.activity}" action "${address.action}".filter` : address.kind === "action-when" ? `${at} activity "${address.activity}" action "${address.action}".when` : `${at}.editable "${address.name}"`;
 }
 
 function validateStage(v2, stage) {
     for (const entry of stage.fields ?? []) v2.checkEntry(entry, `stage "${stage.name}".fields "${entry.name}"`);
-    for (const guard of stage.guards ?? []) validateGuardReads({
+    for (const guard of stage.guards ?? []) validateGuard({
         v: v2,
         stageName: stage.name,
         guard: guard
@@ -3129,12 +3630,28 @@ function validateStage(v2, stage) {
     });
 }
 
-function validateGuardReads({v: v2, stageName: stageName, guard: guard}) {
+function validateGuard({v: v2, stageName: stageName, guard: guard}) {
     const where = `stage "${stageName}" guard "${guard.name}"`;
-    for (const expr of guard.match.idRefs ?? []) v2.checkGuardRead(expr, `${where} match.idRefs`);
+    if (validateGuardMatch({
+        v: v2,
+        where: where,
+        guard: guard
+    }), guard.predicate !== void 0 && guard.predicate !== "") {
+        const issue = guardPredicateSyntaxIssue(guard.predicate);
+        issue !== void 0 && v2.report(`${where} predicate`, [ issue ]);
+    }
     for (const [key, expr] of Object.entries(guard.metadata ?? {})) v2.checkGuardRead(expr, `${where} metadata "${key}"`);
 }
 
+function validateGuardMatch({v: v2, where: where, guard: guard}) {
+    guard.match.actions.length === 0 && v2.report(`${where} match.actions`, [ invariants.GUARD_ACTIONS_REQUIRED_MESSAGE ]);
+    for (const pattern of guard.match.idPatterns ?? []) {
+        const issue = guardIdPatternIssue(pattern, guard.match.actions);
+        issue !== void 0 && v2.report(`${where} match.idPatterns`, [ issue ]);
+    }
+    for (const expr of guard.match.idRefs ?? []) v2.checkGuardRead(expr, `${where} match.idRefs`);
+}
+
 function validateActivity({v: v2, stageName: stageName, activity: activity}) {
     const where = `stage "${stageName}" activity "${activity.name}"`;
     for (const entry of activity.fields ?? []) v2.checkEntry(entry, `${where}.fields "${entry.name}"`);
@@ -3239,211 +3756,43 @@ function buildClientForGdr(args) {
             target: target,
             parsed: parsed,
             siblings: siblings
-        });
-    };
-}
-
-function siblingFor(args) {
-    const {client: client, workflowResource: workflowResource, target: target, parsed: parsed, siblings: siblings} = args, key = `${target.type}:${target.id}`, cached = siblings.get(key);
-    if (cached !== void 0) return cached;
-    if (client.withConfig === void 0) throw new invariants.ContractViolationError(`Cannot route "${invariants.gdrFromResource(target, parsed.documentId)}": the GDR targets ${target.type} "${target.id}", not the workflow resource (${workflowResource.type} "${workflowResource.id}"), and the workflow client cannot derive a sibling client for it (no withConfig). Pass resourceClients to route foreign resources, or use a client with withConfig (e.g. @sanity/client).`);
-    const sibling = client.withConfig(siblingConfig(target));
-    return siblings.set(key, sibling), sibling;
-}
-
-function siblingConfig(target) {
-    if (target.type === "dataset") {
-        const {projectId: projectId, dataset: dataset} = invariants.datasetResourceParts(target.id);
-        return {
-            resource: target,
-            projectId: projectId,
-            dataset: dataset
-        };
-    }
-    return {
-        resource: target
-    };
-}
-
-const wallClock = () => /* @__PURE__ */ (new Date).toISOString();
-
-function addMs(instant, ms) {
-    return new Date(Date.parse(instant) + ms).toISOString();
-}
-
-function hasPassed(instant, now) {
-    return Date.parse(instant) <= Date.parse(now);
-}
-
-const GUARD_DOC_TYPE = "temp.system.guard";
-
-class MutationGuardDeniedError extends invariants.WorkflowError {
-    denied;
-    documentId;
-    action;
-    constructor(args) {
-        const ids = args.denied.map(d => d.guardId).join(", ");
-        super("mutation-guard-denied", `Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), 
-        this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, 
-        this.action = args.action;
-    }
-    static fromGuards(args) {
-        return new MutationGuardDeniedError({
-            documentId: args.documentId,
-            action: args.action,
-            denied: deniedGuardRefs(args.guards)
-        });
-    }
-}
-
-function deniedGuardRefs(guards) {
-    return guards.map(g => ({
-        guardId: g._id,
-        ...g.name !== void 0 ? {
-            name: g.name
-        } : {}
-    }));
-}
-
-function deniedGuardLabels(denied) {
-    return denied.map(d => d.name ?? d.guardId);
-}
-
-function lakeGuardId(args) {
-    return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.guardName}`;
-}
-
-function compileGuard(args) {
-    return {
-        _id: args.id,
-        _type: GUARD_DOC_TYPE,
-        resourceType: args.resourceType,
-        resourceId: args.resourceId,
-        owner: args.owner,
-        sourceInstanceId: args.sourceInstanceId,
-        sourceDefinition: args.sourceDefinition,
-        sourceStage: args.sourceStage,
-        ...args.name !== void 0 ? {
-            name: args.name
-        } : {},
-        ...args.description !== void 0 ? {
-            description: args.description
-        } : {},
-        match: args.match,
-        predicate: args.predicate,
-        metadata: args.metadata
+        });
     };
 }
 
-function toGroqJsPredicate(predicate) {
-    return predicate.replace(new RegExp("(?<!\\$)\\bguard\\.", "g"), "$guard.").replace(new RegExp("(?<!\\$)\\bmutation\\.", "g"), "$mutation.");
-}
-
-function globMatch(pattern, value) {
-    if (!pattern.includes("*")) return pattern === value;
-    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    return new RegExp(`^${escaped}$`).test(value);
+function siblingFor(args) {
+    const {client: client, workflowResource: workflowResource, target: target, parsed: parsed, siblings: siblings} = args, key = `${target.type}:${target.id}`, cached = siblings.get(key);
+    if (cached !== void 0) return cached;
+    if (client.withConfig === void 0) throw new invariants.ContractViolationError(`Cannot route "${invariants.gdrFromResource(target, parsed.documentId)}": the GDR targets ${target.type} "${target.id}", not the workflow resource (${workflowResource.type} "${workflowResource.id}"), and the workflow client cannot derive a sibling client for it (no withConfig). Pass resourceClients to route foreign resources, or use a client with withConfig (e.g. @sanity/client).`);
+    const sibling = client.withConfig(siblingConfig(target));
+    return siblings.set(key, sibling), sibling;
 }
 
-function guardMatches({guard: guard, doc: doc, action: action}) {
-    const m = guard.match;
-    if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type))) return !1;
-    if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
-        const byRef = m.idRefs?.includes(doc.id) ?? !1, byPattern = m.idPatterns?.some(p => globMatch(p, doc.id)) ?? !1;
-        if (!byRef && !byPattern) return !1;
+function siblingConfig(target) {
+    if (target.type === "dataset") {
+        const {projectId: projectId, dataset: dataset} = invariants.datasetResourceParts(target.id);
+        return {
+            resource: target,
+            projectId: projectId,
+            dataset: dataset
+        };
     }
-    return !0;
-}
-
-function guardPredicateParams(args) {
     return {
-        guard: args.guard,
-        mutation: {
-            action: args.action
-        }
+        resource: target
     };
 }
 
-async function evaluateMutationGuard(args) {
-    const {guard: guard, context: context} = args;
-    if (guard.predicate === "") return !1;
-    const params = guardPredicateParams({
-        guard: guard,
-        action: context.action
-    });
-    try {
-        const tree = groqJs.parse(toGroqJsPredicate(guard.predicate), {
-            mode: "delta",
-            params: params
-        });
-        return await (await groqJs.evaluate(tree, {
-            before: context.before,
-            after: context.after,
-            params: params,
-            ...context.identity !== void 0 ? {
-                identity: context.identity
-            } : {}
-        })).get() === !0;
-    } catch {
-        return !1;
-    }
-}
-
-async function denyingGuards(args) {
-    const {guards: guards, doc: doc, context: context} = args, denied = [];
-    for (const guard of guards) guardMatches({
-        guard: guard,
-        doc: doc,
-        action: context.action
-    }) && (await evaluateMutationGuard({
-        guard: guard,
-        context: context
-    }) || denied.push(guard));
-    return denied;
-}
-
-async function documentActionDenials(args) {
-    const {doc: doc, resource: resource, action: action, guards: guards, identity: identity} = args, enforceable = guards.filter(g => g.resourceType === resource.type && g.resourceId === resource.id);
-    return enforceable.length === 0 ? [] : denyingGuards({
-        guards: enforceable,
-        doc: {
-            id: doc._id,
-            type: doc._type
-        },
-        context: {
-            action: action,
-            before: doc,
-            after: doc,
-            ...identity !== void 0 ? {
-                identity: identity
-            } : {}
-        }
-    });
-}
+const wallClock = () => /* @__PURE__ */ (new Date).toISOString();
 
-async function instanceWriteDenials(args) {
-    const {instance: instance, guards: guards, identity: identity} = args;
-    return documentActionDenials({
-        doc: instance,
-        resource: instance.workflowResource,
-        action: "update",
-        guards: guards,
-        ...identity !== void 0 ? {
-            identity: identity
-        } : {}
-    });
+function addMs(instant, ms) {
+    return new Date(Date.parse(instant) + ms).toISOString();
 }
 
-async function assertInstanceWriteAllowed(args) {
-    const denied = await instanceWriteDenials(args);
-    if (denied.length !== 0) throw MutationGuardDeniedError.fromGuards({
-        documentId: args.instance._id,
-        action: "update",
-        guards: denied
-    });
+function hasPassed(instant, now) {
+    return Date.parse(instant) <= Date.parse(now);
 }
 
-const DATA_MODEL_VERSION = 8, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 8, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/workflows/prerelease";
+const DATA_MODEL_VERSION = 9, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 9, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/workflows/prerelease";
 
 class ReaderModelAcknowledgementError extends invariants.WorkflowError {
     code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
@@ -3583,6 +3932,22 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     compatibility: "reader-floor",
     applicability: "detectable",
     summary: "Assignee fields may restrict newly assigned users and collective roles by role."
+}), Object.freeze({
+    id: "split-guard-id-spaces",
+    introducedInModel: 9,
+    minReaderModel: 9,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Guards spanning edit and lifecycle id spaces emit independently retractable documents."
+}), Object.freeze({
+    id: "singular-assignee-lists",
+    introducedInModel: 9,
+    minReaderModel: 9,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Singular assignee fields use member lists with at most one user and any number of roles."
 }) ]);
 
 function recordOf(value) {
@@ -3706,6 +4071,25 @@ function hasRoleConstrainedAssignments(document) {
     return persistedFieldEntries(document).some(entry => entryKindMatches(entry, invariants.assignmentKindAcceptsRoles) && Array.isArray(entry.roles) && entry.roles.length > 0);
 }
 
+function hasSingularAssigneeLists(document) {
+    const root = recordOf(document);
+    if (root === void 0) return !1;
+    if (typeof root.definitionSnapshot != "string") return persistedFieldEntries(document).some(entry => entryHasKind(entry, "assignee"));
+    const snapshot = parsedDefinitionSnapshot(root);
+    return typeof snapshot?.modelVersion == "number" && isAssignmentListModel(snapshot.modelVersion) && persistedFieldEntries(document).some(entry => entryHasKind(entry, "assignee"));
+}
+
+function isMutationGuardAction(action) {
+    return typeof action == "string" && invariants.MUTATION_GUARD_ACTIONS.some(candidate => candidate === action);
+}
+
+function hasSplitGuardIdSpaces(document) {
+    return persistedDefinitionTree(document)?.stages.some(stage => recordsAt(stage, "guards").some(guard => {
+        const actions = recordOf(guard.match)?.actions;
+        return Array.isArray(actions) && invariants.mutationGuardRequiresSplitEmission(actions.filter(isMutationGuardAction));
+    })) ?? !1;
+}
+
 const featureDetectors = {
     "governed-model-stamps": () => !0,
     "subject-field-kind": document => hasFieldKind(document, "subject"),
@@ -3718,6 +4102,8 @@ const featureDetectors = {
     "readiness-requirements": hasReadinessRequirements,
     "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
     "role-constrained-assignment-fields": hasRoleConstrainedAssignments,
+    "singular-assignee-lists": hasSingularAssigneeLists,
+    "split-guard-id-spaces": hasSplitGuardIdSpaces,
     "node-semantics": hasNodeSemantics,
     "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
     "attributes-condition-var": () => !0
@@ -3857,8 +4243,93 @@ function findActivityNode(args) {
     return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
 }
 
+function requirementDescriptor(requirement) {
+    return {
+        name: requirement.name,
+        ...requirement.title !== void 0 ? {
+            title: requirement.title
+        } : {},
+        ...requirement.description !== void 0 ? {
+            description: requirement.description
+        } : {}
+    };
+}
+
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+}
+
+class ActionDisabledError extends invariants.WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
+    }
+}
+
+class StartNotAllowedError extends invariants.WorkflowError {
+    definition;
+    unmetRequirements;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
+    }
+}
+
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+}
+
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+    "activity-not-active": r => `activity status is "${r.status}"`,
+    "stage-terminal": r => `stage "${r.stage}" is terminal`,
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
+    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
+};
+
+function actionDisabledDetail(reason) {
+    return disabledReasonDetail[reason.kind](reason);
+}
+
+function formatDisabledReason({activity: activity, action: action, reason: reason}) {
+    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+}
+
+class EditFieldDeniedError extends invariants.WorkflowError {
+    reason;
+    target;
+    constructor(args) {
+        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
+        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
+    }
+}
+
+const editDisabledReasonDetail = {
+    "not-editable": () => "field is not declared editable",
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "edit-window-closed": r => `edit window closed (${r.detail})`,
+    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
+};
+
+function formatEditDisabledReason(target, reason) {
+    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
+    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+}
+
 function liveChildrenField(instance) {
-    const live = liveSubworkflows(instance).length;
+    const live = invariants.liveSubworkflows(instance).length;
     return live > 0 ? {
         liveChildren: live
     } : {};
@@ -3879,11 +4350,12 @@ function diagnoseInputFromEvaluation(evaluation) {
 }
 
 function openStage(instance) {
-    return findOpenStageEntry(instance);
+    return invariants.findOpenStageEntry(instance);
 }
 
 function assigneesOf(stage, activityName) {
-    return (stage?.activities.find(t => t.name === activityName)?.fields ?? []).filter(s => s._type === "assignees").flatMap(s => s.value);
+    const entry = stage?.activities.find(t => t.name === activityName);
+    return [ ...invariants.assignmentMembers(entry?.fields ?? []) ];
 }
 
 function isResolved(status) {
@@ -3916,11 +4388,16 @@ function failedActivityCause(input) {
 
 function waitingState(input) {
     const active = input.activities.find(t => t.status === "active" && (t.activity.actions ?? []).length > 0 && (t.unmetRequirements ?? []).length === 0);
-    if (active !== void 0) return {
+    if (active === void 0) return;
+    const actions = active.actions.filter(action => actionRendering(action) === "button" && action.allowed).map(action => action.action.name), hasManualAction = active.actions.some(action => !invariants.isCascadeFired(action.action));
+    let waitingFor = "automation";
+    return actions.length > 0 ? waitingFor = "caller" : hasManualAction && (waitingFor = "manual-action"), 
+    {
         state: "waiting",
         activity: active.activity.name,
         assignees: input.assignees[active.activity.name] ?? [],
-        actions: (active.activity.actions ?? []).filter(a => !invariants.isCascadeFired(a)).map(a => a.name)
+        actions: actions,
+        waitingFor: waitingFor
     };
 }
 
@@ -3950,7 +4427,7 @@ function stuckFromDocumentState(input) {
 }
 
 function documentStuckCause(args) {
-    const stage = findOpenStageEntry(args.instance);
+    const stage = invariants.findOpenStageEntry(args.instance);
     if (stage !== void 0) return stuckFromDocumentState({
         instance: args.instance,
         activities: stage.activities.map(entry => ({
@@ -4046,7 +4523,7 @@ function isClaimExpired(claim, now) {
     return claim.leaseExpiresAt === void 0 || hasPassed(claim.leaseExpiresAt, now);
 }
 
-const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ];
+const EFFECT_RUN_STATUSES = groqConditionDescribe._exhaustiveOptions()([ "done", "failed", "cancelled" ]);
 
 function userLoginProvider(user) {
     return user?.provider ?? user?.loginProvider;
@@ -4299,7 +4776,7 @@ function collectWatchRefs(instance) {
 }
 
 function collectSubjectRefs(instance) {
-    const stage = findOpenStageEntry(instance), activityFields = stage?.activities.map(activity => activity.fields) ?? [];
+    const stage = invariants.findOpenStageEntry(instance), activityFields = stage?.activities.map(activity => activity.fields) ?? [];
     return [ ...entryDocRefs(instance.fields), ...entryDocRefs(stage?.fields), ...activityFields.flatMap(entryDocRefs), ...entryReleaseRefs(instance.fields), ...entryReleaseRefs(stage?.fields), ...activityFields.flatMap(entryReleaseRefs) ];
 }
 
@@ -4317,7 +4794,7 @@ function foreignSubjectRefs(instance) {
 }
 
 function liveSubworkflowRefs(instance) {
-    return liveSubworkflows(instance).map(row => row.ref);
+    return invariants.liveSubworkflows(instance).map(row => row.ref);
 }
 
 function readsRaw(ref) {
@@ -4800,32 +5277,122 @@ function normalizeQueryResult({entryType: entryType, raw: raw, workflowResource:
     }
 }
 
-function coerceGdrShape(raw, workflowResource) {
-    if (!("id" in raw) || !("type" in raw)) return null;
-    const r = raw;
-    return typeof r.id != "string" || typeof r.type != "string" ? null : invariants.isGdrUri(r.id) ? {
-        id: r.id,
-        type: r.type
-    } : workflowResource ? {
-        id: invariants.toPhysicalGdr(r.id, workflowResource),
-        type: r.type
-    } : null;
+function coerceGdrShape(raw, workflowResource) {
+    if (!("id" in raw) || !("type" in raw)) return null;
+    const r = raw;
+    return typeof r.id != "string" || typeof r.type != "string" ? null : invariants.isGdrUri(r.id) ? {
+        id: r.id,
+        type: r.type
+    } : workflowResource ? {
+        id: invariants.toPhysicalGdr(r.id, workflowResource),
+        type: r.type
+    } : null;
+}
+
+function coerceRefEnvelope(raw, workflowResource) {
+    if (!("_ref" in raw)) return null;
+    const r = raw;
+    return typeof r._ref != "string" || !workflowResource ? null : {
+        id: invariants.toPhysicalGdr(r._ref, workflowResource),
+        type: "document"
+    };
+}
+
+function coerceToGdr(raw, workflowResource) {
+    return raw == null ? null : typeof raw == "object" ? coerceGdrShape(raw, workflowResource) ?? coerceRefEnvelope(raw, workflowResource) : typeof raw == "string" && workflowResource ? {
+        id: invariants.toPhysicalGdr(raw, workflowResource),
+        type: "document"
+    } : null;
+}
+
+const NOW = {
+    variable: "now",
+    path: []
+}, LAST_REPRESENTABLE_MS = 864e13;
+
+function readsNowIn(reads) {
+    return reads.some(read => read.variable === "now");
+}
+
+function readsNow(condition) {
+    return readsNowIn(groqConditionDescribe.analyzeCondition(condition).reads);
+}
+
+async function stageTimeSites(args) {
+    const {definition: definition, stage: stage, scopeFor: scopeFor} = args, sites = [];
+    for (const site of conditionSitesOf(definition)) {
+        if (site.stage !== stage || site.address.kind === "editable-override" || !readsNow(site.condition)) continue;
+        const activity = "activity" in site.address ? site.address.activity : void 0;
+        sites.push({
+            condition: site.condition,
+            params: await scopeFor(activity)
+        });
+    }
+    return sites;
+}
+
+async function nextEvaluationInstant(args) {
+    const {sites: sites, dataset: dataset, now: now} = args, boundaries = [];
+    for (const site of sites) {
+        const boundary = await siteBoundary({
+            ...site,
+            dataset: dataset,
+            now: now
+        });
+        boundary !== void 0 && boundaries.push(boundary);
+    }
+    return [ ...boundaries ].sort(byInstant)[0];
+}
+
+function byInstant(a, b) {
+    return Date.parse(a) - Date.parse(b);
+}
+
+async function siteBoundary(args) {
+    const {condition: condition, params: params, dataset: dataset, now: now} = args, insight = await groqConditionDescribe.explainCondition({
+        condition: condition,
+        dataset: dataset,
+        params: params
+    });
+    for (const candidate of await candidateInstants({
+        insight: insight,
+        params: params,
+        dataset: dataset,
+        now: now
+    })) if ((await groqConditionDescribe.whatIfCondition({
+        condition: condition,
+        dataset: dataset,
+        params: params,
+        assign: {
+            target: NOW,
+            value: candidate
+        }
+    })).changed) return candidate;
+}
+
+async function candidateInstants(args) {
+    const {insight: insight, params: params, dataset: dataset, now: now} = args, comparands = [];
+    for (const atom of insight.atoms) readsNowIn(atom.atom.reads) && comparands.push(...await comparandsOf({
+        atom: atom,
+        params: params,
+        dataset: dataset
+    }));
+    const instants = comparands.filter(invariants.isParseableInstant).map(normalizeInstant).filter(instant => Date.parse(instant) < LAST_REPRESENTABLE_MS).flatMap(instant => [ instant, addMs(instant, 1) ]).filter(instant => !hasPassed(instant, now));
+    return [ ...new Set(instants) ].sort(byInstant);
 }
 
-function coerceRefEnvelope(raw, workflowResource) {
-    if (!("_ref" in raw)) return null;
-    const r = raw;
-    return typeof r._ref != "string" || !workflowResource ? null : {
-        id: invariants.toPhysicalGdr(r._ref, workflowResource),
-        type: "document"
-    };
+function normalizeInstant(value) {
+    return new Date(Date.parse(value)).toISOString();
 }
 
-function coerceToGdr(raw, workflowResource) {
-    return raw == null ? null : typeof raw == "object" ? coerceGdrShape(raw, workflowResource) ?? coerceRefEnvelope(raw, workflowResource) : typeof raw == "string" && workflowResource ? {
-        id: invariants.toPhysicalGdr(raw, workflowResource),
-        type: "document"
-    } : null;
+async function comparandsOf(args) {
+    const {atom: atom, params: params, dataset: dataset} = args, requirement = atom.requirement, values = requirement !== void 0 && requirement.target.variable === "now" && "value" in requirement ? [ requirement.value ] : [];
+    for (const read of atom.atom.reads) read.variable !== "now" && values.push(await groqConditionDescribe.runGroq({
+        groq: groqConditionDescribe.formatRead(read),
+        params: params,
+        dataset: dataset
+    }));
+    return values;
 }
 
 const NonEmpty = invariants.NonEmptyString, PersistedAssignmentRolesSchema = v__namespace.pipe(v__namespace.array(invariants.NonEmptyString), v__namespace.minLength(1, "assignment roles must not be empty")), UnknownRecord = v__namespace.record(v__namespace.string(), v__namespace.unknown()), PersistedChoiceOptionsSchema = v__namespace.looseObject({
@@ -4880,7 +5447,7 @@ function fieldArm(kind, value) {
     };
 }
 
-const OptionalRefTypes = v__namespace.exactOptional(v__namespace.array(v__namespace.string())), ResolvedFieldEntrySchema = v__namespace.variant("_type", [ v__namespace.looseObject(invariants.tolerantEntries()({
+const OptionalRefTypes = v__namespace.exactOptional(v__namespace.array(v__namespace.string())), RawResolvedFieldEntrySchema = v__namespace.variant("_type", [ v__namespace.looseObject(invariants.tolerantEntries()({
     ...fieldArm("doc.ref", invariants.fieldValueSchemas["doc.ref"]),
     types: OptionalRefTypes
 })), v__namespace.looseObject(invariants.tolerantEntries()({
@@ -4901,7 +5468,7 @@ const OptionalRefTypes = v__namespace.exactOptional(v__namespace.array(v__namesp
 })), v__namespace.looseObject(invariants.tolerantEntries()({
     ...fieldArm("array", v__namespace.array(UnknownRecord)),
     of: v__namespace.array(PersistedFieldShapeSchema)
-})) ]), EffectOriginSchema = invariants.tolerantObject()({
+})) ]), ResolvedFieldEntrySchema = v__namespace.pipe(RawResolvedFieldEntrySchema, v__namespace.transform(normalizeNestedAssignmentValues)), EffectOriginSchema = invariants.tolerantObject()({
     kind: v__namespace.literal("action"),
     name: NonEmpty
 }), PendingEffectClaimSchema = invariants.tolerantObject()({
@@ -5762,6 +6329,25 @@ function buildInstanceBase(args) {
     };
 }
 
+function instanceDocumentForWrite(instance) {
+    const listModel = writesSingularAssignmentLists(instance);
+    return {
+        ...instance,
+        fields: assignmentFieldsForWrite(instance.fields, listModel),
+        stages: assignmentStagesForWrite(instance.stages, listModel)
+    };
+}
+
+function memoizedBy(compute) {
+    const cache = /* @__PURE__ */ new Map;
+    return key => {
+        const hit = cache.get(key);
+        if (hit !== void 0) return hit;
+        const value = (async () => compute(key))();
+        return cache.set(key, value), value;
+    };
+}
+
 async function hydrateSnapshot(args) {
     const {client: client, clientForGdr: clientForGdr, instance: instance, overlay: overlay} = args, loaded = [], visited = /* @__PURE__ */ new Set;
     loaded.push({
@@ -5912,16 +6498,26 @@ function loadCallContext({client: client, instanceId: instanceId, options: optio
 
 async function retryOnRevisionConflict(args) {
     const {client: client, instanceId: instanceId, options: options, commit: commit, onExhausted: onExhausted} = args;
-    for (let attempt = 1; attempt <= CONCURRENT_COMMIT_MAX_ATTEMPTS; attempt++) {
-        const ctx = await loadCallContext({
+    return retryCommit({
+        load: () => loadCallContext({
             client: client,
             instanceId: instanceId,
             options: options
-        });
+        }),
+        commit: commit,
+        shouldRetry: isInstanceCommitRevisionConflict,
+        onExhausted: onExhausted
+    });
+}
+
+async function retryCommit(args) {
+    const {load: load, commit: commit, shouldRetry: shouldRetry, onExhausted: onExhausted} = args;
+    for (let attempt = 1; attempt <= CONCURRENT_COMMIT_MAX_ATTEMPTS; attempt++) {
+        const ctx = await load();
         try {
             return await commit(ctx);
         } catch (error) {
-            if (!isRevisionConflict(error)) throw error;
+            if (!shouldRetry(error)) throw error;
         }
     }
     throw onExhausted();
@@ -5969,6 +6565,22 @@ async function ctxConditionParams(ctx, opts) {
     }, opts);
 }
 
+async function ctxNextEvaluationAt(ctx) {
+    if (ctx.instance.completedAt !== void 0) return;
+    const scopeFor = memoizedBy(activityName => ctxConditionParams(ctx, activityName === void 0 ? void 0 : {
+        activityName: activityName
+    })), sites = await stageTimeSites({
+        definition: ctx.definition,
+        stage: ctx.instance.currentStage,
+        scopeFor: scopeFor
+    });
+    if (sites.length !== 0) return nextEvaluationInstant({
+        sites: sites,
+        dataset: ctx.snapshot.docs,
+        now: ctx.now
+    });
+}
+
 async function ctxEvaluateConditionOutcome({ctx: ctx, condition: condition, opts: opts}) {
     return condition === void 0 ? "satisfied" : invariants.evaluateConditionOutcome({
         condition: condition,
@@ -6597,7 +7209,7 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
     if (route === null) return null;
     const resource = assertSingleResource(route.targets), types = resolveMatchTypes(route.targets, guard.match.types);
     return {
-        doc: compileGuard({
+        docs: compileGuards({
             id: route.guardId,
             resourceType: resource.type,
             resourceId: resource.id,
@@ -6629,19 +7241,63 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
 async function upsertGuard(args) {
     const {client: client, doc: doc, exists: exists} = args;
     if (!exists) try {
-        await client.create(doc, {
-            ...SYNC_COMMIT,
-            tag: REQUEST_TAG.guardDeploy
-        });
-        return;
+        return {
+            created: await client.create(doc, {
+                ...SYNC_COMMIT,
+                tag: REQUEST_TAG.guardDeploy
+            })
+        };
     } catch (error) {
         if (!isCreateIdCollision(error)) throw error;
     }
     const {_id: _id, _type: _type, _rev: _rev, _createdAt: _createdAt, _updatedAt: _updatedAt, ...body} = doc;
-    await client.patch(doc._id).set(body).commit({
+    return await client.patch(doc._id).set(body).commit({
         ...SYNC_COMMIT,
         tag: REQUEST_TAG.guardRefresh
+    }), {
+        created: void 0
+    };
+}
+
+async function retractCreatedGuards(guards) {
+    for (const {client: client, doc: doc} of guards.toReversed()) {
+        if (doc._rev === void 0) return new Error(`Cannot roll back guard ${doc._id}: created document has no revision`);
+        try {
+            const revisionCheck = client.patch(doc._id).set({
+                predicate: doc.predicate
+            }).ifRevisionId(doc._rev);
+            await client.transaction().patch(revisionCheck).delete(doc._id).commit({
+                tag: REQUEST_TAG.guardDeploy
+            });
+        } catch (error) {
+            return error;
+        }
+    }
+}
+
+async function deployResolvedGuard(args) {
+    const {client: client, resourceKey: resourceKey, doc: doc, guard: guard, stageArgs: stageArgs, existingByResource: existingByResource} = args, localized = await localizeGuardMetadata({
+        doc: doc,
+        guard: guard,
+        client: client,
+        instance: stageArgs.instance,
+        definition: stageArgs.definition
     });
+    return (await upsertGuard({
+        client: client,
+        doc: localized,
+        exists: existingByResource.get(resourceKey)?.has(doc._id) ?? !1
+    })).created;
+}
+
+async function failGuardDeploy(args) {
+    const {cause: cause, stageName: stageName, deployed: deployed, createdGuards: createdGuards, updatedExistingGuard: updatedExistingGuard} = args, rollbackError = updatedExistingGuard ? void 0 : await retractCreatedGuards(createdGuards);
+    throw deployed > 0 && (updatedExistingGuard || rollbackError !== void 0) ? new PartialGuardDeployError({
+        stageName: stageName,
+        deployed: deployed,
+        cause: cause,
+        rollbackError: rollbackError
+    }) : cause;
 }
 
 function resolvedStageGuards(args) {
@@ -6654,10 +7310,12 @@ function resolvedStageGuards(args) {
             now: args.now,
             snapshot: args.snapshot
         });
-        resolved !== null && out.push({
-            client: args.clientForGdr(resolved.routeGdr),
-            resourceKey: invariants.resourceGdr(invariants.resourceFromParsed(resolved.routeGdr)),
-            value: resolved.doc,
+        if (resolved === null) continue;
+        const client = args.clientForGdr(resolved.routeGdr), resourceKey = invariants.resourceGdr(invariants.resourceFromParsed(resolved.routeGdr));
+        for (const doc of resolved.docs) out.push({
+            client: client,
+            resourceKey: resourceKey,
+            value: doc,
             guard: guard
         });
     }
@@ -6673,10 +7331,15 @@ function resolvedStageGuardRoutes(args) {
     }, out = [];
     for (const guard of stage?.guards ?? []) {
         const route = resolveGuardRoute(guard, ctx);
-        route !== null && out.push({
-            client: args.clientForGdr(route.routeGdr),
-            resourceKey: invariants.resourceGdr(invariants.resourceFromParsed(route.routeGdr)),
-            value: route.guardId
+        if (route === null) continue;
+        const client = args.clientForGdr(route.routeGdr), resourceKey = invariants.resourceGdr(invariants.resourceFromParsed(route.routeGdr));
+        for (const guardId of compiledGuardIds({
+            id: route.guardId,
+            actions: guard.match.actions
+        })) out.push({
+            client: client,
+            resourceKey: resourceKey,
+            value: guardId
         });
     }
     return out;
@@ -6732,26 +7395,30 @@ async function deployStageGuards(args) {
     if (live === void 0 || live.currentStage !== args.stageName || live.abortedAt !== void 0) return;
     const routed = resolvedStageGuards(args), existingByResource = await existingGuardIds(groupByResource(routed));
     let deployed = 0;
+    const createdGuards = [];
+    let updatedExistingGuard = !1;
     for (const {client: client, resourceKey: resourceKey, value: doc, guard: guard} of routed) {
         try {
-            const localized = await localizeGuardMetadata({
+            const created = await deployResolvedGuard({
+                client: client,
+                resourceKey: resourceKey,
                 doc: doc,
                 guard: guard,
-                client: client,
-                instance: args.instance,
-                definition: args.definition
+                stageArgs: args,
+                existingByResource: existingByResource
             });
-            await upsertGuard({
+            created === void 0 ? updatedExistingGuard = !0 : createdGuards.push({
                 client: client,
-                doc: localized,
-                exists: existingByResource.get(resourceKey)?.has(doc._id) ?? !1
+                doc: created
             });
         } catch (cause) {
-            throw deployed > 0 ? new PartialGuardDeployError({
+            await failGuardDeploy({
+                cause: cause,
                 stageName: args.stageName,
                 deployed: deployed,
-                cause: cause
-            }) : cause;
+                createdGuards: createdGuards,
+                updatedExistingGuard: updatedExistingGuard
+            });
         }
         deployed += 1;
     }
@@ -6830,9 +7497,9 @@ async function commitAbort({ctx: ctx, reason: reason, requestRecord: requestReco
         record: requestRecord,
         now: ctx.now
     });
-    const at = ctx.now, openEntry = findOpenStageEntry(mutation);
+    const at = ctx.now, openEntry = invariants.findOpenStageEntry(mutation);
     openEntry !== void 0 && (openEntry.exitedAt = at);
-    for (const row of liveSubworkflows(mutation)) condemnSubworkflow(row, {
+    for (const row of invariants.liveSubworkflows(mutation)) invariants.condemnSubworkflow(row, {
         at: at,
         reason: "parent instance aborted"
     });
@@ -6983,7 +7650,8 @@ async function persistThenDeploy({ctx: ctx, mutation: mutation, deploy: deploy})
         committedRev: committed._rev,
         restore: instanceStateFields({
             ...ctx.instance,
-            minReaderModel: minReaderModelOf(ctx.instance)
+            minReaderModel: minReaderModelOf(ctx.instance),
+            definitionModelVersion: definitionAssignmentModel(ctx.instance)
         }),
         unset: ctx.instance.completedAt === void 0 ? [ "completedAt" ] : [],
         reversible: !spawned,
@@ -7039,7 +7707,7 @@ function subworkflowsOnExit(sub) {
 
 async function spawnSubworkflows({ctx: ctx, mutation: mutation, activity: activity, action: action, sub: sub, actor: actor}) {
     assertSpawnDepth(ctx, activity);
-    const openEntry = findOpenStageEntry(mutation);
+    const openEntry = invariants.findOpenStageEntry(mutation);
     if (openEntry === void 0) throw new Error(`Mutation invariant broken: no open StageEntry while spawning on activity "${activity.name}" of ${ctx.instance._id}`);
     const definition = await requireChildDefinition({
         ctx: ctx,
@@ -7054,7 +7722,7 @@ async function spawnSubworkflows({ctx: ctx, mutation: mutation, activity: activi
         activity: activity.name,
         action: action.name,
         instanceId: ctx.instance._id
-    }), live = liveSubworkflows(mutation).filter(r => r.activity === activity.name && r.action === action.name && r.definition === sub.definition.name && r.abortPending === void 0);
+    }), live = invariants.liveSubworkflows(mutation).filter(r => r.activity === activity.name && r.action === action.name && r.definition === sub.definition.name && r.abortPending === void 0);
     adoptRediscoveredRows({
         mutation: mutation,
         live: live,
@@ -7193,8 +7861,8 @@ function condemnOnExitCohorts({mutation: mutation, stage: stage, exitedEntry: ex
         action: action.name
     })));
     for (const cohort of abortCohorts) {
-        const owed = liveSubworkflows(mutation).filter(row => row.activity === cohort.activity && row.action === cohort.action && row.stageEntry === exitedEntry._key);
-        for (const row of owed) condemnSubworkflow(row, {
+        const owed = invariants.liveSubworkflows(mutation).filter(row => row.activity === cohort.activity && row.action === cohort.action && row.stageEntry === exitedEntry._key);
+        for (const row of owed) invariants.condemnSubworkflow(row, {
             at: at,
             reason: `stage "${stage.name}" exited with the child still live (onExit: "abort" on action "${cohort.action}" of activity "${cohort.activity}")`
         });
@@ -7557,7 +8225,7 @@ function emitStageTransitioned({ctx: ctx, nextStage: nextStage, at: at, via: via
 }
 
 function exitOpenStage({mutation: mutation, stage: stage, at: at}) {
-    const priorEntry = findOpenStageEntry(mutation);
+    const priorEntry = invariants.findOpenStageEntry(mutation);
     priorEntry !== void 0 && (priorEntry.exitedAt = at, condemnOnExitCohorts({
         mutation: mutation,
         stage: stage,
@@ -8078,91 +8746,6 @@ async function callerBoundVarsForCall(args) {
     });
 }
 
-function requirementDescriptor(requirement) {
-    return {
-        name: requirement.name,
-        ...requirement.title !== void 0 ? {
-            title: requirement.title
-        } : {},
-        ...requirement.description !== void 0 ? {
-            description: requirement.description
-        } : {}
-    };
-}
-
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
-}
-
-class ActionDisabledError extends invariants.WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
-    }
-}
-
-class StartNotAllowedError extends invariants.WorkflowError {
-    definition;
-    unmetRequirements;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
-    }
-}
-
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
-}
-
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
-    "activity-not-active": r => `activity status is "${r.status}"`,
-    "stage-terminal": r => `stage "${r.stage}" is terminal`,
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
-    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
-};
-
-function actionDisabledDetail(reason) {
-    return disabledReasonDetail[reason.kind](reason);
-}
-
-function formatDisabledReason({activity: activity, action: action, reason: reason}) {
-    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
-}
-
-class EditFieldDeniedError extends invariants.WorkflowError {
-    reason;
-    target;
-    constructor(args) {
-        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
-        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
-    }
-}
-
-const editDisabledReasonDetail = {
-    "not-editable": () => "field is not declared editable",
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "edit-window-closed": r => `edit window closed (${r.detail})`,
-    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
-};
-
-function formatEditDisabledReason(target, reason) {
-    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
-    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
-}
-
 async function fireAction(args) {
     const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
     return retryOnRevisionConflict({
@@ -8330,7 +8913,7 @@ async function commitAction({ctx: ctx, activityName: activityName, actionName: a
         actionName: actionName,
         callerParams: callerParams,
         options: options
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -8496,7 +9079,7 @@ async function primeInitialStage(args) {
         })
     });
     const terminal = isTerminalStage(stage), committed = await client.patch(instance._id).set({
-        stages: [ initialStageEntry ],
+        stages: assignmentStagesForWrite([ initialStageEntry ], writesSingularAssignmentLists(instance)),
         lastChangedAt: now,
         ...terminal ? {
             completedAt: now
@@ -8554,32 +9137,59 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
             settlingCohorts: settlingCohorts
         } : {},
         memberRolesLoader: memberRolesLoader
-    }, ctx = instance === void 0 ? await loadContext({
-        client: client,
-        instanceId: instanceId,
-        options: contextOptions
-    }) : await buildEngineContext({
-        client: client,
-        instance: instance,
-        definition: parseDefinitionSnapshot(instance),
-        ...contextOptions
+    };
+    let preloadedInstance = instance;
+    return retryCommit({
+        load: async () => {
+            if (preloadedInstance === void 0) return loadContext({
+                client: client,
+                instanceId: instanceId,
+                options: contextOptions
+            });
+            const loaded = preloadedInstance;
+            return preloadedInstance = void 0, buildEngineContext({
+                client: client,
+                instance: loaded,
+                definition: parseDefinitionSnapshot(loaded),
+                ...contextOptions
+            });
+        },
+        commit: ctx => commitCascadeHop({
+            ctx: ctx,
+            actor: actor
+        }),
+        shouldRetry: isInstanceCommitRevisionConflict,
+        onExhausted: () => new ConcurrentCascadeError({
+            instanceId: instanceId,
+            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
+        })
     });
+}
+
+async function commitCascadeHop({ctx: ctx, actor: actor}) {
     if (isTerminal(ctx)) return {
         moved: !1
     };
-    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), fired = await runTriggeredActions({
+    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startRevisionRetryMutation(ctx.instance), fired = await runTriggeredActions({
         ctx: ctx,
         mutation: mutation,
         stage: stage
     }), hopCtx = liveViewContext(ctx, mutation), transition = await pickTransition(hopCtx, stage);
-    return transition === void 0 ? (fired.fires > 0 && await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: stage.name,
-        didChangeState: fired.ranFieldOps
-    }), {
-        moved: !1
-    }) : (await commitStageMove({
+    if (transition === void 0) {
+        const nextEvaluationAt = await ctxNextEvaluationAt(hopCtx);
+        return fired.fires > 0 && await persistThenMaybeRefresh({
+            ctx: ctx,
+            mutation: mutation,
+            stageName: stage.name,
+            didChangeState: fired.ranFieldOps
+        }), {
+            moved: !1,
+            ...nextEvaluationAt !== void 0 ? {
+                nextEvaluationAt: nextEvaluationAt
+            } : {}
+        };
+    }
+    return await commitStageMove({
         ctx: ctx,
         mutation: mutation,
         fromStage: stage,
@@ -8589,7 +9199,7 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
         actor: actor
     }), {
         moved: !0
-    });
+    };
 }
 
 async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts}) {
@@ -8605,8 +9215,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry
-        });
-        if (!(await runCascadeHop({
+        }), hop = await runCascadeHop({
             client: client,
             instanceId: instanceId,
             actor: actor,
@@ -8621,7 +9230,13 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             ...drained.drained ? {} : {
                 instance: drained.instance
             }
-        })).moved) return count;
+        });
+        if (!hop.moved) return {
+            cascaded: count,
+            ...hop.nextEvaluationAt !== void 0 ? {
+                nextEvaluationAt: hop.nextEvaluationAt
+            } : {}
+        };
         if (count++, count >= CASCADE_LIMIT) throw new CascadeLimitError({
             instanceId: instanceId,
             limit: CASCADE_LIMIT
@@ -8640,7 +9255,7 @@ async function drainCondemnedChildren({client: client, instanceId: instanceId, a
         instance: void 0,
         drained: !1
     };
-    const condemned = condemnedSubworkflows(instance);
+    const condemned = invariants.condemnedSubworkflows(instance);
     if (condemned.length === 0) return {
         instance: instance,
         drained: !1
@@ -8754,7 +9369,7 @@ async function loadInstancesById(client, ids) {
 }
 
 function terminalResolution(child) {
-    const status = resolvedChildStatus(child);
+    const status = invariants.resolvedChildStatus(child);
     if (!(status === void 0 || child.completedAt === void 0 || child.completedAt === null)) return {
         at: child.completedAt,
         stage: child.currentStage,
@@ -8921,6 +9536,8 @@ async function recordOrphanedPropagation({ctx: ctx, mutation: mutation, child: c
 function startMutation(instance) {
     return {
         minReaderModel: minReaderModelOf(instance),
+        definitionSnapshot: instance.definitionSnapshot,
+        definitionModelVersion: definitionAssignmentModel(instance),
         currentStage: instance.currentStage,
         fields: (instance.fields ?? []).map(s => ({
             ...s
@@ -8968,11 +9585,17 @@ function startMutation(instance) {
     };
 }
 
+function startRevisionRetryMutation(instance) {
+    const mutation = startMutation(instance);
+    return mutation.commitErrorMapper = error => isRetryableInstanceCommitConflict(error) ? new InstanceCommitRevisionConflict(error) : error, 
+    mutation;
+}
+
 function instanceStateFields(src) {
-    const state = {
+    const listModel = isAssignmentListModel(src.definitionModelVersion), state = {
         currentStage: src.currentStage,
-        fields: src.fields,
-        stages: src.stages,
+        fields: assignmentFieldsForWrite(src.fields, listModel),
+        stages: assignmentStagesForWrite(src.stages, listModel),
         subworkflows: src.subworkflows ?? [],
         pendingEffects: src.pendingEffects,
         effectHistory: src.effectHistory,
@@ -8989,7 +9612,10 @@ function instanceStateFields(src) {
     return {
         ...modelStampFor({
             documentType: "instance",
-            document: state,
+            document: {
+                ...state,
+                definitionSnapshot: src.definitionSnapshot
+            },
             storedMinReaderModel: src.minReaderModel
         }),
         ...state
@@ -9024,11 +9650,11 @@ async function persist(ctx, mutation) {
         ...instanceStateFields(mutation),
         lastChangedAt: ctx.now
     }, pendingCreates = mutation.pendingCreates;
-    if (pendingCreates.length === 0) return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT);
+    if (pendingCreates.length === 0) return commitInstanceWrite(() => ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT), mutation.commitErrorMapper);
     const tx = ctx.client.transaction();
-    for (const {body: body} of pendingCreates) tx.create(body);
+    for (const {body: body} of pendingCreates) tx.create(instanceDocumentForWrite(body));
     tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), 
-    await tx.commit(), mutation.pendingCreates = [];
+    await commitInstanceWrite(() => tx.commit(), mutation.commitErrorMapper), mutation.pendingCreates = [];
     const actorForPriming = ctx.actor, settlingCohorts = new Set(ctx.settlingCohorts).add(ctx.instance._id);
     for (const {body: body} of pendingCreates) try {
         const stepArgs = spawnStepArgs(ctx, {
@@ -9055,6 +9681,14 @@ async function persist(ctx, mutation) {
     return reloaded;
 }
 
+async function commitInstanceWrite(write, mapError) {
+    try {
+        return await write();
+    } catch (error) {
+        throw mapError?.(error) ?? error;
+    }
+}
+
 async function settleSpawnBatch(ctx, args) {
     try {
         await propagateSpawnBatch({
@@ -9096,7 +9730,7 @@ function stampExecutionContext(ctx, mutation) {
 }
 
 function currentStageEntry(mutation) {
-    const entry = findOpenStageEntry(mutation);
+    const entry = invariants.findOpenStageEntry(mutation);
     if (entry === void 0) throw new Error(`Mutation invariant broken: no current (un-exited) StageEntry for currentStage "${mutation.currentStage}"`);
     return entry;
 }
@@ -9121,7 +9755,7 @@ function requireMutationActivityEntry(mutation, activity) {
 }
 
 function findCurrentStageEntry(instance) {
-    return findOpenStageEntry(instance);
+    return invariants.findOpenStageEntry(instance);
 }
 
 function findCurrentActivities(instance) {
@@ -9317,7 +9951,7 @@ async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: sta
         outputs: outputs,
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.definition.roleAliases
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -9406,7 +10040,7 @@ async function queueEffects({ctx: ctx, mutation: mutation, effects: effects, ori
     const now = ctx.now, liveCtx = {
         ...ctx,
         instance: materializeInstance(ctx.instance, mutation)
-    }, stageEntryKey = opts?.stageEntryKey ?? findOpenStageEntry(liveCtx.instance)?._key, params = await ctxConditionParams(liveCtx, {
+    }, stageEntryKey = opts?.stageEntryKey ?? invariants.findOpenStageEntry(liveCtx.instance)?._key, params = await ctxConditionParams(liveCtx, {
         ...opts?.activityName !== void 0 ? {
             activityName: opts.activityName
         } : {},
@@ -9496,7 +10130,7 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         effect: pending.name,
         issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
     });
-    const mutation = startMutation(ctx.instance);
+    const mutation = startRevisionRetryMutation(ctx.instance);
     return recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -9532,7 +10166,7 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
     };
 }
 
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
+const RESET_ACTIVITY_TARGETS = groqConditionDescribe._exhaustiveOptions()([ "active", "skipped" ]);
 
 function isResetActivityTarget(value) {
     return RESET_ACTIVITY_TARGETS.includes(value);
@@ -9561,7 +10195,7 @@ async function commitResetActivity({ctx: ctx, activity: activity, to: to, reques
     }), isTerminal(ctx)) return {
         fired: !1
     };
-    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
+    const mutation = startMutation(ctx.instance), openStage2 = invariants.findOpenStageEntry(mutation), entry = invariants.findCurrentActivityEntry(mutation, activity);
     if (openStage2 === void 0 || entry === void 0) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
     const from = entry.status;
     if (from === to) return {
@@ -9640,10 +10274,14 @@ async function whatIfFireAction(args) {
 function replayable(args) {
     const {instance: instance, stage: stage, action: action} = args;
     if (terminalState(instance) !== "in-flight" || (action.params ?? []).length > 0 || action.spawn !== void 0) return !1;
-    const primed = new Set((findOpenStageEntry(instance)?.activities ?? []).map(e => e.name));
+    const primed = new Set((invariants.findOpenStageEntry(instance)?.activities ?? []).map(e => e.name));
     return (stage.activities ?? []).every(declared => primed.has(declared.name)) ? !(stage.activities ?? []).flatMap(declared => declared.actions ?? []).some(sibling => invariants.isCascadeFired(sibling) && sibling.spawn !== void 0) : !1;
 }
 
+function clientGuardDereference(client) {
+    return async ({_ref: _ref}) => await client.getDocument(invariants.toBareId(_ref)) ?? null;
+}
+
 async function buildFieldInsights({sites: sites, snapshot: snapshot}) {
     const insights = [];
     for (const field of fieldsReadAcross(sites)) {
@@ -9799,6 +10437,7 @@ async function evaluateInstance(args) {
         guards: guards,
         now: now,
         resourceGrants: resourceGrants,
+        guardDereference: clientGuardDereference(client),
         ...localPrincipalId !== void 0 ? {
             localPrincipalId: localPrincipalId
         } : {},
@@ -9811,16 +10450,6 @@ async function evaluateInstance(args) {
     });
 }
 
-function memoizedByName(render) {
-    const rendered = /* @__PURE__ */ new Map;
-    return activityName => {
-        const hit = rendered.get(activityName);
-        if (hit !== void 0) return hit;
-        const scope = render(activityName);
-        return rendered.set(activityName, scope), scope;
-    };
-}
-
 async function callerBoundProjectionScopes(args) {
     const can = await advisoryCan({
         instance: args.instance,
@@ -9841,13 +10470,17 @@ async function callerBoundProjectionScopes(args) {
     };
     return {
         scope: await renderConditionScope(args.scopeSource, opts),
-        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+        scopeForActivity: memoizedBy(activityName => renderConditionScope(args.scopeSource, {
             activityName: activityName,
             ...opts
         }))
     };
 }
 
+function clockSitesOf(instance, sites) {
+    return terminalState(instance) !== "in-flight" ? [] : sites.filter(entry => readsNowIn(entry.insight.analysis.reads));
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -9897,12 +10530,13 @@ async function evaluateFromSnapshot(args) {
         grants: grants,
         attributes: attributes,
         identity: anchorIdentity
-    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+    }), cascadeScopeForActivity = memoizedBy(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
-    })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
+    })), currentActivityEntries = invariants.findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
         identity: anchorIdentity,
-        guards: args.guards
+        guards: args.guards,
+        dereference: args.guardDereference
     }), subjectDenials = await forecastSubjectDenials({
         instance: instance,
         snapshot: snapshot,
@@ -9959,6 +10593,10 @@ async function evaluateFromSnapshot(args) {
         scopeForActivity: scopeForActivity,
         guardDenial: editGuardDenial,
         sites: sites
+    }), nextEvaluationAt = await nextEvaluationInstant({
+        sites: clockSitesOf(instance, sites),
+        dataset: snapshot.docs,
+        now: now
     });
     return {
         instance: instance,
@@ -9973,7 +10611,10 @@ async function evaluateFromSnapshot(args) {
             sites: sites,
             snapshot: snapshot
         }),
-        autonomy: autonomy
+        autonomy: autonomy,
+        ...nextEvaluationAt !== void 0 ? {
+            nextEvaluationAt: nextEvaluationAt
+        } : {}
     };
 }
 
@@ -10121,7 +10762,8 @@ async function evaluateActivity(args) {
         subjectPermissionReason: subjectPermissionReason,
         requirementsReason: requirementsReason,
         sites: sites,
-        fireConsequence: a => fireConsequence(activity, a)
+        fireConsequence: a => fireConsequence(activity, a),
+        assignment: invariants.assignmentMembers(statusEntry?.fields ?? [])
     }));
     return {
         activity: activity,
@@ -10131,7 +10773,7 @@ async function evaluateActivity(args) {
         classification: invariants.deriveExecutorClassification(activity),
         autonomy: autonomy,
         pendingOnActor: status === "active" && assigned,
-        scopedOut: isFilterScopedOut({
+        scopedOut: invariants.isFilterScopedOut({
             status: status,
             startedAt: statusEntry?.startedAt
         }),
@@ -10278,19 +10920,31 @@ function fireableActionVerdict({args: args, insights: insights}) {
         reason: args.requirementsReason,
         ...insights
     });
-    const {insight: insight} = insights;
-    return action.filter !== void 0 && insight !== void 0 && insight.outcome !== "satisfied" ? disabled({
+    const filterFailure = filterFailureVerdict(args, insights);
+    return filterFailure !== void 0 ? filterFailure : {
+        ...actionEvaluationIdentity(action),
+        allowed: !0,
+        ...insights
+    };
+}
+
+function filterFailureVerdict(args, insights) {
+    const {action: action} = args, {insight: insight} = insights;
+    if (action.filter === void 0 || insight === void 0 || insight.outcome === "satisfied") return;
+    const holderGate = insight.blockedBy.some(entry => isAssignedGate(entry.atom)) ? {
+        holders: [ ...invariants.activeAssignmentMembers(args.assignment) ]
+    } : void 0;
+    return disabled({
         action: action,
         reason: {
             kind: "filter-failed",
             filter: action.filter
         },
-        ...insights
-    }) : {
-        ...actionEvaluationIdentity(action),
-        allowed: !0,
-        ...insights
-    };
+        ...insights,
+        ...holderGate === void 0 ? {} : {
+            holderGate: holderGate
+        }
+    });
 }
 
 function actionEvaluationIdentity(action) {
@@ -10306,12 +10960,13 @@ function semanticsOf(node) {
     };
 }
 
-async function instanceGuardReason({instance: instance, identity: identity, guards: guards}) {
+async function instanceGuardReason({instance: instance, identity: identity, guards: guards, dereference: dereference}) {
     if (guards === void 0 || guards.length === 0) return;
     const denied = await instanceWriteDenials({
         instance: instance,
         guards: guards,
-        identity: identity
+        identity: identity,
+        dereference: dereference ?? (() => Promise.resolve(null))
     });
     if (denied.length !== 0) return {
         kind: "mutation-guard-denied",
@@ -10342,10 +10997,29 @@ function disabled(args) {
         } : {},
         ...args.whenInsight !== void 0 ? {
             whenInsight: args.whenInsight
+        } : {},
+        ...args.holderGate !== void 0 ? {
+            holderGate: args.holderGate
         } : {}
     };
 }
 
+const ASSIGNMENT_KINDS = '["assignee", "assignees"]', HAS_USER = '(count(value[@.type == "user"]) > 0 || value.type == "user")', HAS_MEMBER = "(count(value) > 0 || defined(value.type))";
+
+function assignmentActivityArm(state) {
+    const assignmentFields = `fields[_type in ${ASSIGNMENT_KINDS}]`;
+    return state === "unrouted" ? `count(${assignmentFields}[${HAS_MEMBER}]) == 0` : state === "held" ? `count(${assignmentFields}[${HAS_USER} && (count(value[@.type == "user" && id == $assignmentUserId]) > 0 || (value.type == "user" && value.id == $assignmentUserId))]) > 0` : `count(${assignmentFields}[${HAS_USER}]) == 0 && count(${assignmentFields}[count(value[@.type == "role" && role in $assignmentRoles]) > 0 || (value.type == "role" && value.role in $assignmentRoles)]) > 0`;
+}
+
+function assignmentPrefilter(assignment, params) {
+    if (assignment.userId.length === 0) throw new invariants.ContractViolationError("instancesQuery: assignment.userId must be non-empty");
+    const states = [ ...new Set(assignment.states ?? [ "unrouted", "routed", "held" ]) ];
+    if (states.length === 0) throw new invariants.ContractViolationError("instancesQuery: assignment.states must not be empty");
+    if (states.some(state => state !== "unrouted" && state !== "routed" && state !== "held")) throw new invariants.ContractViolationError("instancesQuery: assignment.states contains an unknown state");
+    return params.assignmentUserId = assignment.userId, params.assignmentRoles = [ ...new Set(assignment.roles ?? []) ].sort(), 
+    `count(stages[!defined(exitedAt)].activities[status == "active" && (${states.map(assignmentActivityArm).join(" || ")})]) > 0`;
+}
+
 function inFlightFilter() {
     return "!defined(completedAt)";
 }
@@ -10385,7 +11059,7 @@ function compiledConditions(filter, params) {
     const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, invariants.tagScopeFilter() ];
     filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
     params.definition = filter.definition), filter.stage !== void 0 && (conditions.push("currentStage == $stage"), 
-    params.stage = filter.stage);
+    params.stage = filter.stage), filter.assignment !== void 0 && conditions.push(assignmentPrefilter(filter.assignment, params));
     const cursor = beforeArm(filter, params);
     cursor !== void 0 && conditions.push(cursor);
     const arms = [ documentArm(filter, params), idsArm(filter, params) ].filter(arm => arm !== void 0);
@@ -10488,6 +11162,222 @@ function stripClaim(entry) {
     return rest;
 }
 
+function isProjectRole(value) {
+    return invariants.isRecord(value) && typeof value.name == "string";
+}
+
+async function projectRoleNames(request, projectId) {
+    const result = await request({
+        uri: `/projects/${encodeURIComponent(projectId)}/roles`
+    });
+    if (!Array.isArray(result) || !result.every(isProjectRole)) throw new Error(`Project role catalog response is invalid for project "${projectId}"`);
+    return new Set(result.map(role => role.name));
+}
+
+function memberRoleNames(member, projectId) {
+    if (!Array.isArray(member.roles) || !member.roles.every(isProjectRole)) throw new Error(`Project member role directory response is invalid for project "${projectId}" and member "${member.id}"`);
+    return member.roles.map(role => role.name);
+}
+
+function heldRoleNames(members, projectId) {
+    return new Set(members.flatMap(member => member.isRobot === !0 ? [] : memberRoleNames(member, projectId)));
+}
+
+function addRoles(collector, args) {
+    for (const role of args.roles ?? []) collector.references.push({
+        definition: collector.definition,
+        path: args.path,
+        role: role
+    });
+}
+
+function visitAssigneeValue(collector, args) {
+    const members = Array.isArray(args.value) ? args.value : [ args.value ];
+    for (const [index, member] of members.entries()) !invariants.isRecord(member) || member.type !== "role" || typeof member.role != "string" || collector.references.push({
+        definition: collector.definition,
+        path: `${args.path}[${index}].role`,
+        role: member.role
+    });
+}
+
+function visitObjectValue(collector, args) {
+    for (const shape of args.fields ?? []) visitShapeValue(collector, {
+        path: `${args.path}.${shape.name}`,
+        shape: shape,
+        value: args.value[shape.name]
+    });
+}
+
+function visitArrayValue(collector, args) {
+    for (const [index, row] of args.rows.entries()) if (invariants.isRecord(row)) for (const shape of args.shapes ?? []) visitShapeValue(collector, {
+        path: `${args.path}[${index}].${shape.name}`,
+        shape: shape,
+        value: row[shape.name]
+    });
+}
+
+function visitAssignmentValue(collector, args) {
+    args.kind === "assignee" || args.kind === "assignees" ? visitAssigneeValue(collector, args) : args.kind === "object" && invariants.isRecord(args.value) ? visitObjectValue(collector, {
+        ...args,
+        value: args.value
+    }) : args.kind === "array" && Array.isArray(args.value) && visitArrayValue(collector, {
+        path: args.path,
+        rows: args.value,
+        shapes: args.of
+    });
+}
+
+function visitShapeValue(collector, args) {
+    visitAssignmentValue(collector, {
+        path: args.path,
+        kind: args.shape.type,
+        value: args.value,
+        fields: args.shape.fields,
+        of: args.shape.of
+    });
+}
+
+function visitField(collector, args) {
+    addRoles(collector, {
+        path: `${args.path}.roles`,
+        roles: args.field.roles
+    });
+    for (const shape of args.field.fields ?? args.field.of ?? []) visitFieldShape(collector, {
+        parentPath: args.path,
+        shape: shape
+    });
+    args.field.initialValue?.type === "literal" && visitAssignmentValue(collector, {
+        path: `${args.path}.initialValue.value`,
+        kind: args.field.type,
+        value: args.field.initialValue.value,
+        fields: args.field.fields,
+        of: args.field.of
+    });
+}
+
+function visitFieldShape(collector, args) {
+    const path = `${args.parentPath}.${args.shape.name}`;
+    addRoles(collector, {
+        path: `${path}.roles`,
+        roles: args.shape.roles
+    });
+    for (const child of args.shape.fields ?? args.shape.of ?? []) visitFieldShape(collector, {
+        parentPath: path,
+        shape: child
+    });
+}
+
+function rolesFromConditions(definition) {
+    return conditionSitesOf(definition).flatMap(site => {
+        try {
+            return groqConditionDescribe.analyzeCondition(site.condition).atoms.flatMap(atom => rolesGateOf(atom) ?? []);
+        } catch {
+            return [];
+        }
+    });
+}
+
+function visitRoleAliases(collector, aliases) {
+    for (const [role, fulfillers] of Object.entries(aliases ?? {})) role !== invariants.UNIVERSAL_ROLE_ALIAS_KEY && collector.references.push({
+        definition: collector.definition,
+        path: `roleAliases.${role}`,
+        role: role
+    }), addRoles(collector, {
+        path: `roleAliases.${role}`,
+        roles: fulfillers
+    });
+}
+
+function visitFields(collector, args) {
+    for (const [index, field] of (args.fields ?? []).entries()) visitField(collector, {
+        path: `${args.parentPath}[${index}]`,
+        field: field
+    });
+}
+
+function visitAction(collector, args) {
+    addRoles(collector, {
+        path: `${args.path}.roles`,
+        roles: args.action.roles
+    });
+    for (const [effectIndex, effect] of (args.action.effects ?? []).entries()) for (const shape of effect.outputs ?? []) visitFieldShape(collector, {
+        parentPath: `${args.path}.effects[${effectIndex}].outputs`,
+        shape: shape
+    });
+}
+
+function visitStage(collector, args) {
+    const stagePath = `stages[${args.stageIndex}]`;
+    visitFields(collector, {
+        fields: args.stage.fields,
+        parentPath: `${stagePath}.fields`
+    });
+    for (const [activityIndex, activity] of (args.stage.activities ?? []).entries()) {
+        const activityPath = `${stagePath}.activities[${activityIndex}]`;
+        visitFields(collector, {
+            fields: activity.fields,
+            parentPath: `${activityPath}.fields`
+        });
+        for (const [actionIndex, action] of (activity.actions ?? []).entries()) visitAction(collector, {
+            action: action,
+            path: `${activityPath}.actions[${actionIndex}]`
+        });
+    }
+}
+
+function addConditionReferences(collector, definition) {
+    for (const role of rolesFromConditions(definition)) collector.references.push({
+        definition: collector.definition,
+        path: "generated role condition",
+        role: role
+    });
+}
+
+function definitionRoleReferences(definition) {
+    const collector = {
+        references: [],
+        definition: definition.name
+    };
+    visitRoleAliases(collector, definition.roleAliases), visitFields(collector, {
+        fields: definition.fields,
+        parentPath: "fields"
+    });
+    for (const [stageIndex, stage] of definition.stages.entries()) visitStage(collector, {
+        stage: stage,
+        stageIndex: stageIndex
+    });
+    return addConditionReferences(collector, definition), collector.references;
+}
+
+function definitionRoleNames(definition) {
+    return [ ...new Set(definitionRoleReferences(definition).map(reference => reference.role)) ];
+}
+
+function roleCatalogProjectId(client, resource) {
+    if (resource.type === "dataset") return invariants.datasetResourceParts(resource.id).projectId;
+    const projectId = client.config?.().projectId;
+    if (typeof projectId == "string" && projectId.length > 0) return projectId;
+    throw new Error(`workflow.deployDefinitions: definitions reference project roles on ${resource.type} workflow resources, but the client does not expose a projectId for the project role catalog`);
+}
+
+async function validateDefinitionRoles(args) {
+    const references = args.definitions.flatMap(definitionRoleReferences);
+    if (references.length === 0) /* @__PURE__ */ return new Map;
+    if (args.client.request === void 0) throw new Error("workflow.deployDefinitions: definitions reference project roles, but the client cannot read the project role catalog");
+    const projectId = roleCatalogProjectId(args.client, args.workflowResource), [known, members] = await Promise.all([ projectRoleNames(args.client.request, projectId), requestProjectMembers(args.client.request, projectId) ]), unknown = references.filter(reference => !known.has(reference.role));
+    if (unknown.length > 0) {
+        const lines = unknown.map(({definition: definition, path: path, role: role}) => `  - ${definition}: ${path} references unknown role "${role}"`);
+        throw new Error(`workflow.deployDefinitions: unknown project roles for project "${projectId}":\n${lines.join(`\n`)}`);
+    }
+    const held = heldRoleNames(members, projectId), warnings = /* @__PURE__ */ new Map;
+    for (const {definition: definition, role: role} of references) {
+        if (held.has(role)) continue;
+        const message = `Project role "${role}" has no current user holder; work routed to it has no recipient.`, definitionWarnings = warnings.get(definition) ?? [];
+        definitionWarnings.includes(message) || definitionWarnings.push(message), warnings.set(definition, definitionWarnings);
+    }
+    return warnings;
+}
+
 async function sortByDependencies({client: client, definitions: definitions, tag: tag}) {
     const byName = /* @__PURE__ */ new Map;
     for (const def of definitions) {
@@ -10788,7 +11678,7 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
         site: site,
         mode: mode,
         value: value
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -10932,14 +11822,14 @@ async function runCommitVerb(params) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    });
+    }), now = clock();
     return runDeduped({
         client: client,
         tag: tag,
         instanceId: instanceId,
         record: record,
         before: before,
-        now: clock(),
+        now: now,
         actor: context.actor,
         clientForGdr: context.clientForGdr,
         refSurface: context.refSurface,
@@ -10950,6 +11840,7 @@ async function runCommitVerb(params) {
         run: () => run({
             ...context,
             clock: clock,
+            now: now,
             record: record,
             before: before
         })
@@ -10973,7 +11864,7 @@ async function runDeduped(args) {
             client: client,
             instanceId: instanceId,
             tag: tag
-        }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+        }), settled = await cascadeAndReload({
             client: client,
             tag: tag,
             instanceId: instanceId,
@@ -10985,11 +11876,10 @@ async function runDeduped(args) {
             executionContext: executionContext,
             telemetry: telemetry
         });
-        return {
-            instance: instance,
-            cascaded: cascaded,
-            changed: instance._rev !== pre._rev
-        };
+        return settledResult({
+            ...settled,
+            changed: settled.instance._rev !== pre._rev
+        });
     };
     if (record !== void 0 && before !== void 0 && findProcessedRequest({
         instance: before,
@@ -11005,7 +11895,7 @@ async function runDeduped(args) {
 }
 
 async function cascade({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
-    const count = await cascadeAutoTransitions({
+    const settled = await cascadeAutoTransitions({
         client: client,
         instanceId: instanceId,
         actor: actor,
@@ -11041,13 +11931,13 @@ async function cascade({client: client, instanceId: instanceId, actor: actor, cl
         ...telemetry !== void 0 ? {
             telemetry: telemetry
         } : {}
-    }), count;
+    }), settled;
 }
 
 async function cascadeAndReload(args) {
     const {client: client, tag: tag, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock} = args;
     return {
-        cascaded: await cascade({
+        ...await cascade({
             client: client,
             instanceId: instanceId,
             actor: actor,
@@ -11070,6 +11960,84 @@ async function cascadeAndReload(args) {
     };
 }
 
+async function unchangedNextEvaluationAt(args) {
+    const {client: client, instance: instance, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, now: now} = args;
+    if (terminalState(instance) !== "in-flight") return;
+    const ctx = await buildEngineContext({
+        client: client,
+        instance: instance,
+        definition: parseDefinitionSnapshot(instance),
+        clientForGdr: clientForGdr,
+        refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
+        clock: () => now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {},
+        ...args.executionContext !== void 0 ? {
+            executionContext: args.executionContext
+        } : {},
+        ...args.telemetry !== void 0 ? {
+            telemetry: args.telemetry
+        } : {}
+    });
+    return ctxNextEvaluationAt(ctx);
+}
+
+async function adminOverrideResult(args) {
+    const {client: client, tag: tag, instanceId: instanceId, fired: fired, now: now, executionContext: executionContext, telemetry: telemetry, ...scope} = args, optional = {
+        ...executionContext !== void 0 ? {
+            executionContext: executionContext
+        } : {},
+        ...telemetry !== void 0 ? {
+            telemetry: telemetry
+        } : {}
+    }, settled = fired ? await cascade({
+        client: client,
+        instanceId: instanceId,
+        ...scope,
+        ...optional
+    }) : {
+        cascaded: 0
+    }, instance = await reload({
+        client: client,
+        instanceId: instanceId,
+        tag: tag
+    });
+    return settledResult({
+        ...settled,
+        instance: instance,
+        changed: fired,
+        ...fired ? {} : {
+            nextEvaluationAt: await unchangedNextEvaluationAt({
+                client: client,
+                instance: instance,
+                now: now,
+                actor: scope.actor,
+                clientForGdr: scope.clientForGdr,
+                refSurface: scope.refSurface,
+                memberRolesLoader: scope.memberRolesLoader,
+                ...optional
+            })
+        }
+    });
+}
+
+function settledResult(args) {
+    const {instance: instance, cascaded: cascaded, changed: changed, ranOps: ranOps, nextEvaluationAt: nextEvaluationAt} = args;
+    return {
+        instance: instance,
+        cascaded: cascaded,
+        changed: changed,
+        ...ranOps !== void 0 ? {
+            ranOps: ranOps
+        } : {},
+        ...nextEvaluationAt !== void 0 ? {
+            nextEvaluationAt: nextEvaluationAt
+        } : {}
+    };
+}
+
 async function settleStart(args) {
     const runArgs = {
         client: args.client,
@@ -11131,7 +12099,7 @@ async function resumeStart(args) {
         instance: existing,
         initialFieldCount: initialFieldCount,
         viaSpawn: !1
-    })), cascaded = await settleStart({
+    })), settled = await settleStart({
         ...settlementArgs,
         instanceId: existing._id,
         ...completesStart ? {
@@ -11142,11 +12110,11 @@ async function resumeStart(args) {
         instanceId: existing._id,
         tag: args.tag
     });
-    return {
+    return settledResult({
+        ...settled,
         instance: instance,
-        cascaded: cascaded,
         changed: instance._rev !== existing._rev
-    };
+    });
 }
 
 function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, executionContext: executionContext, telemetry: telemetry}) {
@@ -11245,7 +12213,7 @@ async function dispatchGatedWrite(args) {
         ...resourceClients !== void 0 ? {
             resourceClients: resourceClients
         } : {}
-    }), ranOps = await apply(args.before, evaluation), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+    }), ranOps = await apply(args.before, evaluation), settled = await cascadeAndReload({
         client: client,
         tag: tag,
         instanceId: instanceId,
@@ -11257,14 +12225,13 @@ async function dispatchGatedWrite(args) {
         executionContext: args.executionContext,
         telemetry: args.telemetry
     });
-    return {
-        instance: instance,
-        cascaded: cascaded,
+    return settledResult({
+        ...settled,
         changed: !0,
         ...ranOps !== void 0 ? {
             ranOps: ranOps
         } : {}
-    };
+    });
 }
 
 function guardDeniedError(instanceId, reason) {
@@ -11478,6 +12445,10 @@ async function abortInstances(args) {
     return aborted;
 }
 
+function lintDeadActivityInputSeeds(definition) {
+    return definition.stages.flatMap(stage => (stage.activities ?? []).flatMap(activity => (activity.fields ?? []).filter(field => field.initialValue?.type === "input").map(field => `Activity field "${stage.name}.${activity.name}.${field.name}" uses an input seed, but start/spawn inputs address workflow-scope fields only; this field will always materialize empty. Use a literal, query, field read, or working-memory field instead.`)));
+}
+
 function projectStartSliceRow(instance) {
     const subject = (instance.fields ?? []).find(field => field._type === "subject")?.value;
     return {
@@ -11505,14 +12476,18 @@ const workflow = {
         definitions.forEach(validateDefinition), assertReaderModelAcknowledgement(args.expectedMinReaderModel, {
             requiredMinReaderModel: requiredDefinitionReaderModel(definitions)
         });
-        const ordered = await sortByDependencies({
+        const roleWarnings = await validateDefinitionRoles({
+            client: client,
+            definitions: definitions,
+            workflowResource: workflowResource
+        }), ordered = await sortByDependencies({
             client: client,
             definitions: definitions,
             tag: tag
         }), results = [], deployed = [], tx = client.transaction();
         let hasWrites = !1;
         for (const def of ordered) {
-            const lint = lintEffectOutputs(def), warnings = lint.length > 0 ? {
+            const lint = [ ...lintEffectOutputs(def), ...lintDeadActivityInputSeeds(def), ...roleWarnings.get(def.name) ?? [] ], warnings = lint.length > 0 ? {
                 warnings: lint
             } : {}, latest = await loadLatestDeployed({
                 client: client,
@@ -11605,12 +12580,27 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "fireAction",
-            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
-                if (findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return {
+            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
+                if (invariants.findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return settledResult({
                     instance: before,
                     cascaded: 0,
-                    changed: !1
-                };
+                    changed: !1,
+                    nextEvaluationAt: await unchangedNextEvaluationAt({
+                        client: client,
+                        instance: before,
+                        actor: actor,
+                        clientForGdr: clientForGdr,
+                        refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
+                        now: now,
+                        ...executionContext !== void 0 ? {
+                            executionContext: executionContext
+                        } : {},
+                        ...args.telemetry !== void 0 ? {
+                            telemetry: args.telemetry
+                        } : {}
+                    })
+                });
                 const result = await dispatchGatedWrite({
                     client: client,
                     tag: tag,
@@ -11747,7 +12737,7 @@ const workflow = {
         });
     },
     completeEffect: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, now = clock(), record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "completeEffect",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11757,7 +12747,7 @@ const workflow = {
             tag: tag,
             instanceId: instanceId,
             record: record,
-            now: clock(),
+            now: now,
             ...operationContext,
             clock: clock,
             executionContext: executionContext,
@@ -11792,7 +12782,7 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+                }), settled = await cascadeAndReload({
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
@@ -11802,22 +12792,21 @@ const workflow = {
                     telemetry: args.telemetry
                 });
                 return resolveTelemetry(args.telemetry).log(WorkflowEffectCompleted, {
-                    ...definitionHashFragment(instance.pinnedContentHash),
+                    ...definitionHashFragment(settled.instance.pinnedContentHash),
                     instanceId: instanceId,
                     effect: completion.effect,
                     status: status,
                     origin: completion.origin,
-                    cascaded: cascaded
-                }), {
-                    instance: instance,
-                    cascaded: cascaded,
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     changed: !0
-                };
+                });
             }
         });
     },
     commitEffectOps: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, now = clock(), record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "commitEffectOps",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11828,7 +12817,7 @@ const workflow = {
             tag: tag,
             instanceId: instanceId,
             record: record,
-            now: clock(),
+            now: now,
             ...operationContext,
             clock: clock,
             executionContext: executionContext,
@@ -11848,7 +12837,7 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+                }), settled = await cascadeAndReload({
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
@@ -11858,15 +12847,14 @@ const workflow = {
                     telemetry: args.telemetry
                 });
                 return resolveTelemetry(args.telemetry).log(WorkflowEffectStateReported, {
-                    ...definitionHashFragment(instance.pinnedContentHash),
+                    ...definitionHashFragment(settled.instance.pinnedContentHash),
                     instanceId: instanceId,
                     effect: report.effect,
-                    cascaded: cascaded
-                }), {
-                    instance: instance,
-                    cascaded: cascaded,
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     changed: !0
-                };
+                });
             }
         });
     },
@@ -11879,9 +12867,10 @@ const workflow = {
         await assertInstanceWriteAllowed({
             instance: current,
             guards: guards,
-            identity: invariants.lakePrincipalId(access)
+            identity: invariants.lakePrincipalId(access),
+            dereference: clientGuardDereference(client)
         });
-        const {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+        const settled = await cascadeAndReload({
             client: client,
             tag: tag,
             instanceId: instanceId,
@@ -11891,21 +12880,20 @@ const workflow = {
             telemetry: args.telemetry
         });
         return resolveTelemetry(args.telemetry).log(WorkflowInstanceTicked, {
-            ...definitionHashFragment(instance.pinnedContentHash),
+            ...definitionHashFragment(settled.instance.pinnedContentHash),
             instanceId: instanceId,
-            cascaded: cascaded
-        }), {
-            instance: instance,
-            cascaded: cascaded,
-            changed: instance._rev !== current._rev
-        };
+            cascaded: settled.cascaded
+        }), settledResult({
+            ...settled,
+            changed: settled.instance._rev !== current._rev
+        });
     },
     setStage: async rawArgs => {
         const args = taggedScope(rawArgs, REQUEST_TAG.setStage), {client: client, tag: tag, instanceId: instanceId, targetStage: targetStage, reason: reason, executionContext: executionContext} = args;
         return runCommitVerb({
             args: args,
             op: "setStage",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
                 const result = await setStage({
                     client: client,
                     instanceId: instanceId,
@@ -11925,34 +12913,29 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), cascaded = result.fired ? await cascade({
+                });
+                return resolveTelemetry(args.telemetry).log(WorkflowStageSet, {
+                    ...definitionHashFragment(before.pinnedContentHash),
+                    instanceId: instanceId,
+                    changed: result.fired
+                }), adminOverrideResult({
                     client: client,
+                    tag: tag,
                     instanceId: instanceId,
+                    fired: result.fired,
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
                     memberRolesLoader: memberRolesLoader,
                     clock: clock,
+                    now: now,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
                     } : {},
                     ...args.telemetry !== void 0 ? {
                         telemetry: args.telemetry
                     } : {}
-                }) : 0;
-                return resolveTelemetry(args.telemetry).log(WorkflowStageSet, {
-                    ...definitionHashFragment(before.pinnedContentHash),
-                    instanceId: instanceId,
-                    changed: result.fired
-                }), {
-                    instance: await reload({
-                        client: client,
-                        instanceId: instanceId,
-                        tag: tag
-                    }),
-                    cascaded: cascaded,
-                    changed: result.fired
-                };
+                });
             }
         });
     },
@@ -11985,7 +12968,7 @@ const workflow = {
                     ...definitionHashFragment(before.pinnedContentHash),
                     instanceId: instanceId,
                     changed: changed
-                }), {
+                }), settledResult({
                     instance: await reload({
                         client: client,
                         instanceId: instanceId,
@@ -11993,7 +12976,7 @@ const workflow = {
                     }),
                     cascaded: 0,
                     changed: changed
-                };
+                });
             }
         });
     },
@@ -12003,7 +12986,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "resetActivity",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
                 const result = await resetActivity({
                     client: client,
                     instanceId: instanceId,
@@ -12021,34 +13004,29 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), cascaded = result.fired ? await cascade({
+                });
+                return resolveTelemetry(args.telemetry).log(WorkflowActivityReset, {
+                    ...definitionHashFragment(before.pinnedContentHash),
+                    instanceId: instanceId,
+                    changed: result.fired
+                }), adminOverrideResult({
                     client: client,
+                    tag: tag,
                     instanceId: instanceId,
+                    fired: result.fired,
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
                     memberRolesLoader: memberRolesLoader,
                     clock: clock,
+                    now: now,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
                     } : {},
                     ...args.telemetry !== void 0 ? {
                         telemetry: args.telemetry
                     } : {}
-                }) : 0;
-                return resolveTelemetry(args.telemetry).log(WorkflowActivityReset, {
-                    ...definitionHashFragment(before.pinnedContentHash),
-                    instanceId: instanceId,
-                    changed: result.fired
-                }), {
-                    instance: await reload({
-                        client: client,
-                        instanceId: instanceId,
-                        tag: tag
-                    }),
-                    cascaded: cascaded,
-                    changed: result.fired
-                };
+                });
             }
         });
     },
@@ -12381,8 +13359,8 @@ async function startFreshInstance(args) {
             extraHistory: fieldDiscards
         } : {}
     });
-    await client.create(base, SYNC_COMMIT);
-    const cascaded = await settleStart({
+    await client.create(instanceDocumentForWrite(base), SYNC_COMMIT);
+    const settled = await settleStart({
         client: client,
         tag: tag,
         instanceId: id,
@@ -12404,15 +13382,15 @@ async function startFreshInstance(args) {
             viaSpawn: !1
         }))
     });
-    return {
+    return settledResult({
+        ...settled,
         instance: await reload({
             client: client,
             instanceId: id,
             tag: tag
         }),
-        cascaded: cascaded,
         changed: !0
-    };
+    });
 }
 
 function assertInitialStageExists(definition) {
@@ -12587,7 +13565,7 @@ function missingHandlerMessage(info) {
 }
 
 async function verifyDeployedDefinitionsInternal(args) {
-    const {tag: tag, effectHandlers: effectHandlers, missingHandler: missingHandler, logger: logger} = args, client = withRequestTag(args.client, REQUEST_TAG.verifyDefinitions);
+    const {tag: tag, handlers: handlers, missingHandler: missingHandler, logger: logger} = args, client = withRequestTag(args.client, REQUEST_TAG.verifyDefinitions);
     invariants.validateTag(tag);
     const log = logger("verifyDeployedDefinitions"), definitions = (await client.fetch(definitionsListGroq("asc"), {
         tag: tag
@@ -12597,7 +13575,7 @@ async function verifyDeployedDefinitionsInternal(args) {
         version: def.version,
         _id: def._id
     }), walkEffectNames(def, (name, location) => {
-        if (effectHandlers[name] !== void 0) return;
+        if (handlers[name] !== void 0) return;
         const key = `${name}@@${def._id}`;
         let bucket = missingByName.get(key);
         bucket === void 0 && (bucket = {
@@ -12656,7 +13634,7 @@ function isCancelledCompletion(data) {
 }
 
 async function drainEffectsInternal(args) {
-    const {tag: tag, workflowResource: workflowResource, instanceId: instanceId, effectHandlers: effectHandlers, missingHandler: missingHandler, logger: logger, handlerClient: rawHandlerClient, handlerResourceClients: rawHandlerResourceClients} = args, cascadeTelemetry = drainCascadeTelemetry(args.telemetry), {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.drain), leaseMs = args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS, clock = args.clock ?? wallClock, handlerClient = effectHandlerClient(rawHandlerClient), handlerResourceClients = effectHandlerResolver(rawHandlerResourceClients), routeGdr = buildClientForGdr({
+    const {tag: tag, workflowResource: workflowResource, instanceId: instanceId, handlers: handlers, missingHandler: missingHandler, logger: logger, handlerClient: rawHandlerClient, handlerResourceClients: rawHandlerResourceClients} = args, cascadeTelemetry = drainCascadeTelemetry(args.telemetry), {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.drain), leaseMs = args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS, clock = args.clock ?? wallClock, handlerClient = effectHandlerClient(rawHandlerClient), handlerResourceClients = effectHandlerResolver(rawHandlerResourceClients), routeGdr = buildClientForGdr({
         client: handlerClient,
         workflowResource: workflowResource,
         resourceClients: handlerResourceClients
@@ -12676,7 +13654,7 @@ async function drainEffectsInternal(args) {
             resourceClients: resourceClients
         } : {},
         instanceId: instanceId,
-        effectHandlers: effectHandlers,
+        handlers: handlers,
         missingHandler: missingHandler,
         logger: logger,
         log: log,
@@ -12708,7 +13686,7 @@ async function drainOneCandidate(pass) {
         skippedKeys: skippedKeys
     });
     if (candidate === void 0) return !1;
-    const handler = pass.effectHandlers[candidate.name];
+    const handler = pass.handlers[candidate.name];
     if (handler === void 0) return await assertSkippableOrThrow({
         missingHandler: pass.missingHandler,
         candidate: candidate,
@@ -13077,7 +14055,7 @@ function createInstanceSession(args) {
             } : {}
         };
         previewOp(site, preview);
-        const visit = site.scope === "workflow" ? void 0 : findOpenStageEntry(instance)?._key, row = {
+        const visit = site.scope === "workflow" ? void 0 : invariants.findOpenStageEntry(instance)?._key, row = {
             preview: preview,
             ...visit !== void 0 ? {
                 visit: visit
@@ -13086,7 +14064,7 @@ function createInstanceSession(args) {
         return previews.set(key, preview.mode === "append" ? [ ...rows, row ] : [ row ]), 
         key;
     }, optimisticSelf = () => {
-        const visit = findOpenStageEntry(instance)?._key;
+        const visit = invariants.findOpenStageEntry(instance)?._key;
         for (const [key, rows] of previews) {
             const live = rows.filter(row => row.visit === void 0 || row.visit === visit), target = live[0]?.preview.target;
             target === void 0 || previewSiteOf({
@@ -13117,6 +14095,7 @@ function createInstanceSession(args) {
             snapshot: snapshotFrom(held, normalizedSelf),
             guards: guards,
             resourceGrants: resourceGrants,
+            guardDereference: clientGuardDereference(evalScope.client),
             ...localPrincipalId !== void 0 ? {
                 localPrincipalId: localPrincipalId
             } : {},
@@ -13131,7 +14110,7 @@ function createInstanceSession(args) {
             } : {}
         });
     }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope, memberRolesLoader: memberRolesLoader}) => {
-        const cascaded = await cascadeHeld({
+        const settled = await cascadeHeld({
             scope: scope,
             actor: actor,
             held: held,
@@ -13141,14 +14120,14 @@ function createInstanceSession(args) {
             client: scope.client,
             instanceId: instance._id,
             tag: tag
-        }), {
+        }), settledResult({
+            ...settled,
             instance: instance,
-            cascaded: cascaded,
             changed: !0,
             ...ranOps !== void 0 ? {
                 ranOps: ranOps
             } : {}
-        };
+        });
     }, cascadeHeld = ({scope: scope, actor: actor, held: held, memberRolesLoader: memberRolesLoader}) => cascade({
         client: scope.client,
         instanceId: instance._id,
@@ -13259,13 +14238,14 @@ function createInstanceSession(args) {
                     identity: invariants.lakePrincipalId({
                         actor: actor,
                         localPrincipalId: localPrincipalId
-                    })
+                    }),
+                    dereference: clientGuardDereference(tickScope.client)
                 });
                 const before = await reload({
                     client: tickScope.client,
                     instanceId: instance._id,
                     tag: tag
-                }), cascaded = await cascadeHeld({
+                }), settled = await cascadeHeld({
                     scope: tickScope,
                     actor: actor,
                     held: held,
@@ -13278,12 +14258,12 @@ function createInstanceSession(args) {
                 }), telemetry.log(WorkflowInstanceTicked, {
                     ...definitionHashFragment(instance.pinnedContentHash),
                     instanceId: instance._id,
-                    cascaded: cascaded
-                }), {
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     instance: instance,
-                    cascaded: cascaded,
                     changed: instance._rev !== before._rev
-                };
+                });
             });
         },
         fireAction({activity: activity, action: action, params: params}) {
@@ -13433,7 +14413,10 @@ const silentLogger = {
 function createEngine(args) {
     const {workflowResource: workflowResource, clock: clock, tag: tag, executionContext: executionContext} = args, {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.engine);
     invariants.validateTag(tag);
-    const effectHandlers = args.effectHandlers ?? {}, missingHandler = args.missingHandler ?? "fail", logger = args.loggerFactory ?? defaultLoggerFactory, telemetry = resolveTelemetry(args.telemetry), EMPTY_DRAIN_LOG_INTERVAL_MS = 6e4;
+    const effects = {
+        handlers: args.effects?.handlers ?? {},
+        missingHandler: args.effects?.missingHandler ?? "fail"
+    }, logger = args.loggerFactory ?? defaultLoggerFactory, telemetry = resolveTelemetry(args.telemetry), EMPTY_DRAIN_LOG_INTERVAL_MS = 6e4;
     let lastEmptyDrainLoggedAt;
     const emptyDrainDue = () => {
         const now = Date.parse((clock ?? wallClock)());
@@ -13464,8 +14447,7 @@ function createEngine(args) {
         client: client,
         tag: tag,
         workflowResource: workflowResource,
-        effectHandlers: effectHandlers,
-        missingHandler: missingHandler,
+        effects: effects,
         logger: logger,
         telemetry: telemetry,
         resolveActor: rest => resolveClientActor(client, rest),
@@ -13519,12 +14501,11 @@ function createEngine(args) {
                 workflowResource: workflowResource,
                 ...optionalScope,
                 instanceId: instanceId,
-                effectHandlers: effectHandlers,
-                missingHandler: missingHandler,
+                ...effects,
                 logger: logger,
                 telemetry: telemetry,
-                ...args.effectLeaseMs !== void 0 ? {
-                    leaseMs: args.effectLeaseMs
+                ...args.effects?.leaseMs !== void 0 ? {
+                    leaseMs: args.effects.leaseMs
                 } : {}
             }), drained = result.drained;
             return (drained.length > 0 || emptyDrainDue()) && telemetry.log(WorkflowEffectsDrained, {
@@ -13537,8 +14518,7 @@ function createEngine(args) {
         verifyDeployedDefinitions: () => verifyDeployedDefinitionsInternal({
             client: client,
             tag: tag,
-            effectHandlers: effectHandlers,
-            missingHandler: missingHandler,
+            ...effects,
             logger: logger
         })
     };
@@ -14093,6 +15073,8 @@ exports.DECISION_SEMANTICS = invariants.DECISION_SEMANTICS;
 
 exports.DEFAULT_TRANSITION_WHEN = invariants.DEFAULT_TRANSITION_WHEN;
 
+exports.DOCUMENT_VALUE_PERMISSIONS = invariants.DOCUMENT_VALUE_PERMISSIONS;
+
 exports.DRIVER_KINDS = invariants.DRIVER_KINDS;
 
 exports.DefinitionInUseError = invariants.DefinitionInUseError;
@@ -14131,8 +15113,20 @@ exports.WORKFLOW_DEFINITION_TYPE = invariants.WORKFLOW_DEFINITION_TYPE;
 
 exports.WorkflowError = invariants.WorkflowError;
 
+exports.activeAssignmentMembers = invariants.activeAssignmentMembers;
+
 exports.actorFulfillsRole = invariants.actorFulfillsRole;
 
+exports.actorMatchesAssignment = invariants.actorMatchesAssignment;
+
+exports.assignmentMatch = invariants.assignmentMatch;
+
+exports.assignmentMembers = invariants.assignmentMembers;
+
+exports.assignmentState = invariants.assignmentState;
+
+exports.assignmentStateCounts = invariants.assignmentStateCounts;
+
 exports.classifyPrincipalId = invariants.classifyPrincipalId;
 
 exports.clientConfigFromResource = invariants.clientConfigFromResource;
@@ -14151,6 +15145,10 @@ exports.errorMessage = invariants.errorMessage;
 
 exports.extractDocumentId = invariants.extractDocumentId;
 
+exports.findCurrentActivityEntry = invariants.findCurrentActivityEntry;
+
+exports.findOpenStageEntry = invariants.findOpenStageEntry;
+
 exports.gdrFromResource = invariants.gdrFromResource;
 
 exports.gdrRef = invariants.gdrRef;
@@ -14159,8 +15157,14 @@ exports.gdrUri = invariants.gdrUri;
 
 exports.groupMembershipNames = invariants.groupMembershipNames;
 
+exports.identityMatchesAssignment = invariants.identityMatchesAssignment;
+
+exports.instanceAssignmentStateCounts = invariants.instanceAssignmentStateCounts;
+
 exports.isCascadeFired = invariants.isCascadeFired;
 
+exports.isFilterScopedOut = invariants.isFilterScopedOut;
+
 exports.isGdr = invariants.isGdr;
 
 exports.isInputSourced = invariants.isInputSourced;
@@ -14183,6 +15187,8 @@ exports.isTodoListItem = invariants.isTodoListItem;
 
 exports.lakePrincipalId = invariants.lakePrincipalId;
 
+exports.openActivityAssignments = invariants.openActivityAssignments;
+
 exports.parseGdr = invariants.parseGdr;
 
 exports.parseResourceGdr = invariants.parseResourceGdr;
@@ -14337,6 +15343,8 @@ exports.CONTEXT_ENTRY_DISPLAY = CONTEXT_ENTRY_DISPLAY;
 
 exports.CascadeLimitError = CascadeLimitError;
 
+exports.ConcurrentCascadeError = ConcurrentCascadeError;
+
 exports.ConcurrentCommitEffectOpsError = ConcurrentCommitEffectOpsError;
 
 exports.ConcurrentCompleteEffectError = ConcurrentCompleteEffectError;
@@ -14475,6 +15483,8 @@ exports.assertReadableModel = assertReadableModel;
 
 exports.assertReaderModelAcknowledgement = assertReaderModelAcknowledgement;
 
+exports.assignmentPrefilter = assignmentPrefilter;
+
 exports.autonomySummary = autonomySummary;
 
 exports.availableActions = availableActions;
@@ -14485,9 +15495,11 @@ exports.buildSnapshot = buildSnapshot;
 
 exports.checklistLines = checklistLines;
 
+exports.clientGuardDereference = clientGuardDereference;
+
 exports.clientProjectUserDirectory = clientProjectUserDirectory;
 
-exports.compileGuard = compileGuard;
+exports.compileGuards = compileGuards;
 
 exports.computeDiffEntries = computeDiffEntries;
 
@@ -14511,6 +15523,8 @@ exports.definitionDeployedData = definitionDeployedData;
 
 exports.definitionLookupGroq = definitionLookupGroq;
 
+exports.definitionRoleNames = definitionRoleNames;
+
 exports.definitionTagsGroq = definitionTagsGroq;
 
 exports.definitionsListGroq = definitionsListGroq;
@@ -14577,10 +15591,6 @@ exports.fieldTreeShape = fieldTreeShape;
 
 exports.findActivityNode = findActivityNode;
 
-exports.findCurrentActivityEntry = findCurrentActivityEntry;
-
-exports.findOpenStageEntry = findOpenStageEntry;
-
 exports.findStageNode = findStageNode;
 
 exports.groupSitesOf = groupSitesOf;
@@ -14621,8 +15631,6 @@ exports.isClientProjectUser = isClientProjectUser;
 
 exports.isDefinitionApplicable = isDefinitionApplicable;
 
-exports.isFilterScopedOut = isFilterScopedOut;
-
 exports.isProjectUserNotFoundError = isProjectUserNotFoundError;
 
 exports.isRevisionConflict = isRevisionConflict;
@@ -14703,6 +15711,8 @@ exports.silentLogger = silentLogger;
 
 exports.singleSubjectRequirementRefused = singleSubjectRequirementRefused;
 
+exports.snapshotGuardDereference = snapshotGuardDereference;
+
 exports.stageAutonomyOf = stageAutonomyOf;
 
 exports.startFieldsParam = startFieldsParam;