@sanity/workflow-engine 0.31.0 → 0.33.0

package/dist/index.d.ts

@@ -99,8 +99,10 @@ export declare function aclPathForResource(
  * only when cascade-fired (the pin on which identities may execute the
  * trigger); a fireAction-fired action's `roles` folds into `filter` at
  * desugar instead.
+ *
+ * @interface
  */
-export declare type Action = ActionFields<Op, string[]> & {
+export declare type Action = ActionFields<Op, string[], Effect> & {
   roles?: string[] | undefined;
 };
 
@@ -185,11 +187,16 @@ export declare interface ActionEvaluation {
   /** Derived state of a cascade-fired action's `when` trigger — what would
    *  fire it. Present iff the action declares `when`. */
   whenInsight?: ConditionInsight;
+  /** A canonical `$assigned` filter leg withheld this absent action. The
+   *  action still follows filter-existence semantics; this metadata lets the
+   *  owning activity explain who currently holds the work. */
+  holderGate?: {
+    holders: Assignee[];
+  };
 }
 
-/** Type-mirror of {@link actionFields}, parameterised over the op and
- *  group-membership grammars. */
-declare type ActionFields<TOp, TGroup> = {
+/** @inline */
+declare type ActionFields<TOp, TGroup, TEffect> = {
   name: string;
   semantics?: ActionSemantic[] | undefined;
   title?: string | undefined;
@@ -199,7 +206,7 @@ declare type ActionFields<TOp, TGroup> = {
   filter?: string | undefined;
   params?: ActionParam[] | undefined;
   ops?: TOp[] | undefined;
-  effects?: Effect[] | undefined;
+  effects?: TEffect[] | undefined;
   spawn?: Subworkflows | undefined;
 };
 
@@ -210,6 +217,8 @@ export declare type ActionName = string;
  * or queuing effects: a missing required param throws
  * `ActionParamsInvalidError` and the action does not commit. Resolved values
  * feed `ValueExpr.param` lookups.
+ *
+ * @interface
  */
 export declare type ActionParam = v.InferOutput<typeof ActionParamSchema>;
 
@@ -390,6 +399,11 @@ export declare function actionVerdict(
   action: ActionEvaluation,
 ): AvailableAction;
 
+/** The members that own work after direct-user membership shadows every role route. */
+export declare function activeAssignmentMembers(
+  members: readonly Assignee[],
+): readonly Assignee[];
+
 /**
  * A unit of work carrying no payload of its own — every op, effect, and
  * spawn lives on an action; an activity contributes scoped `fields`
@@ -403,6 +417,8 @@ export declare function actionVerdict(
  * `requirements` are readiness gates orthogonal to `filter` — an unmet one
  * keeps the activity visible but disables its actions with a
  * `requirements-unmet` verdict; distinct from ACL and guards.
+ *
+ * @interface
  */
 export declare type Activity = ActivityFields<
   FieldEntry,
@@ -454,19 +470,6 @@ export declare const ACTIVITY_KINDS: readonly [
   "receive",
 ];
 
-/**
- * An activity is `active` from stage entry (or `skipped` when its `filter`
- * excluded it) until a terminal status resolves it — there is no pre-active
- * state. The authored action `status:` sugar (and the `status.set` op it
- * desugars to) is constrained to {@link TerminalActivityStatus}.
- */
-declare const ACTIVITY_STATUSES: readonly [
-  "active",
-  "done",
-  "skipped",
-  "failed",
-];
-
 /** The activity slice of a stage rollup — total by construction, like
  *  {@link stageAutonomyOf}. */
 export declare function activityAutonomyOf(
@@ -548,15 +551,14 @@ export declare interface ActivityEvaluation {
    */
   scopedOut: boolean;
   /**
-   * The activity's unmet {@link Activity.requirements}, with authored display copy — present iff at least
-   * one is unmet. The activity's own readiness summary: a consumer can explain why
-   * the whole activity is gated without inspecting each action (every action also
-   * carries the matching `requirements-unmet` `disabledReason`).
+   * Unmet authored activity requirements and required-reference readability checks.
+   * Present when at least one is unmet. Required-reference descriptors use
+   * `field:<name>` and the field's declared title when available.
    */
   unmetRequirements?: RequirementDescriptor[];
-  /** Derived state per declared requirement, keyed by requirement name.
-   *  Present iff the activity declares requirements; `unmetRequirements`
-   *  contains descriptors for exactly the requirements whose insight isn't satisfied. */
+  /** Derived state per authored requirement, keyed by its declared name.
+   * Present when the activity declares requirements. Unmet authored requirements
+   * appear in `unmetRequirements`; required-reference checks have no insight entry. */
   requirementInsights?: Record<string, ConditionInsight>;
   /** Derived state of the activity's `filter` existence gate. Present iff
    *  declared. Advisory read: the engine's stage entry owns the gate itself. */
@@ -564,7 +566,7 @@ export declare interface ActivityEvaluation {
   actions: ActionEvaluation[];
 }
 
-/** Type-mirror of {@link activityFields}, parameterised over field/action/target/group. */
+/** @inline */
 declare type ActivityFields<TField, TAction, TTarget, TGroup> = {
   name: string;
   semantics?: Semantic[] | undefined;
@@ -583,7 +585,13 @@ export declare type ActivityKind = (typeof ACTIVITY_KINDS)[number];
 
 export declare type ActivityName = string;
 
-export declare type ActivityStatus = (typeof ACTIVITY_STATUSES)[number];
+/**
+ * An activity is `active` from stage entry (or `skipped` when its `filter`
+ * excluded it) until a terminal status resolves it — there is no pre-active
+ * state. The authored action `status:` sugar (and the `status.set` op it
+ * desugars to) is constrained to {@link TerminalActivityStatus}.
+ */
+export declare type ActivityStatus = "active" | "done" | "skipped" | "failed";
 
 /**
  * Who is acting — advisory provenance, not an authenticated principal. The
@@ -633,7 +641,13 @@ export declare interface Actor {
  */
 export declare const ACTOR_KINDS: readonly ["person", "agent", "system"];
 
-/** Runtime counterpart of {@link expandRequiredRoles}; both expand only the required side. */
+/**
+ * Checks whether an actor role fulfills `required`, directly or through one
+ * level of aliases. Pass `roleAliases` from a definition returned by
+ * {@link define.defineWorkflow | defineWorkflow}; its universal aliases are
+ * normalized. A raw authored `"*"` entry is not expanded here.
+ * This role check is advisory.
+ */
 export declare function actorFulfillsRole({
   actorRoles,
   required,
@@ -646,6 +660,13 @@ export declare function actorFulfillsRole({
 
 export declare type ActorKind = (typeof ACTOR_KINDS)[number];
 
+/** Assignment ownership for runtime actors, with authorization aliases applied to role members. */
+export declare function actorMatchesAssignment(args: {
+  actor: Actor | undefined;
+  members: readonly Assignee[];
+  roleAliases?: RoleAliases | undefined;
+}): boolean;
+
 export declare type ActorResolution<User> =
   | {
       readonly status: "resolved";
@@ -666,6 +687,14 @@ export declare type ActorResolution<User> =
       readonly actor: Actor;
     };
 
+/** Missing-reference evidence accompanying another primary fault, for workspace renderers only.
+ * @internal
+ */
+export declare function _additionalMissingDocuments(
+  diagnosis: Diagnosis,
+  documents: MissingDocument[] | undefined,
+): MissingDocument[];
+
 export { analyzeCondition };
 
 /** Lake `identity()` sentinel for unauthenticated callers. */
@@ -720,12 +749,13 @@ export declare function assertReaderModelAcknowledgement(
 ): asserts expectedMinReaderModel is number;
 
 /**
- * One member of an `assignees`-kind entry's value — and the value of the
- * singular `assignee` kind. The WHO-FOR spec the inbox reverse-query and the
- * rendered `$assigned` gate match against. A `role` member names a capability
- * (fulfilled by whoever deploys that role), not a concrete principal — which
- * is what distinguishes it from {@link Actor}. `id` here is a SYSTEM
- * identifier (a principal), not authored identity.
+ * One member of an `assignee` or `assignees` field. For a user member, pass a
+ * human's account-global `sanityUserId`, not a project-scoped user ID. Robot
+ * IDs are rejected.
+ *
+ * A role member identifies a project role, not an individual {@link Actor}.
+ * Direct user members take ownership ahead of role members. Role aliases apply
+ * to `$assigned` authorization, but inbox routing uses literal project roles.
  */
 export declare type Assignee =
   | {
@@ -737,6 +767,56 @@ export declare type Assignee =
       role: string;
     };
 
+export declare interface AssignmentIdentity {
+  readonly userId: string;
+  readonly roles: readonly string[];
+}
+
+/** @inline */
+declare type AssignmentInstance = Pick<
+  WorkflowInstance,
+  "currentStage" | "stages"
+>;
+
+export declare type AssignmentMatch = "user" | "role" | undefined;
+
+/** Whether an identity owns the assignment directly or through a literal project role. */
+export declare function assignmentMatch(
+  members: readonly Assignee[],
+  identity: AssignmentIdentity,
+): AssignmentMatch;
+
+/** Every member stored in assignment entries, preserving field and member order. */
+export declare function assignmentMembers(
+  entries: readonly ResolvedFieldEntry[],
+): readonly Assignee[];
+
+export declare function assignmentPrefilter(
+  assignment: NonNullable<InstancesQueryFilter["assignment"]>,
+  params: Record<string, string | string[]>,
+): string;
+
+export declare type AssignmentState = "unrouted" | "routed" | "held";
+
+/** Classify one assignment slot by whether it has no route, role routes, or a user holder. */
+export declare function assignmentState(
+  members: readonly Assignee[],
+): AssignmentState;
+
+export declare interface AssignmentStateCounts {
+  readonly unrouted: number;
+  readonly routed: number;
+  readonly held: number;
+}
+
+/** Viewer-scoped assignment counts at assignment-slot grain. Unrouted work is
+ *  visible to every viewer; routed and held count only work offered to or
+ *  held by the supplied identity. */
+export declare function assignmentStateCounts(
+  assignments: readonly (readonly Assignee[])[],
+  identity: AssignmentIdentity,
+): AssignmentStateCounts;
+
 export { AtomInsight };
 
 export { atomReadsDataset };
@@ -766,8 +846,7 @@ export declare const AUTHORING_DISPLAY: {
 };
 
 /**
- * The stored action fields plus two authoring sugars, or the
- * {@link ClaimAction} pair-half. `roles`: on a fireAction-fired action (no
+ * The stored action fields plus authoring sugar. `roles`: on a fireAction-fired action (no
  * `when`) it desugars into a `count($actor.roles[@ in [...]]) > 0` condition
  * ANDed with `filter`; on a CASCADE-FIRED action it stores VERBATIM instead —
  * the pin on which identities may execute the trigger, since folding it into
@@ -777,8 +856,9 @@ export declare const AUTHORING_DISPLAY: {
  * deliberately never implied, so a forgotten `status` is a visible stall
  * rather than a silently completed action.
  */
-export declare type AuthoringAction = AuthoringRawAction | ClaimAction;
+export declare type AuthoringAction = AuthoringRawAction;
 
+/** @interface */
 export declare type AuthoringActivity = ActivityFields<
   AuthoringFieldEntry,
   AuthoringAction,
@@ -792,41 +872,48 @@ export declare type AuthoringActivity = ActivityFields<
  * predicate `action.roles` produces. `true` opens the field to anyone in its
  * window; a bare string is a raw predicate.
  */
-export declare type AuthoringEditable = v.InferOutput<
-  typeof AuthoringEditableSchema
->;
+export declare type AuthoringEditable = true | string[] | string;
 
-declare const AuthoringEditableSchema: v.UnionSchema<
-  [
-    v.LiteralSchema<true, undefined>,
-    v.ArraySchema<
-      v.SchemaWithPipe<
-        readonly [
-          v.StringSchema<undefined>,
-          v.MinLengthAction<string, 1, "must be a non-empty string">,
-        ]
-      >,
-      undefined
-    >,
-    v.SchemaWithPipe<
-      readonly [
-        v.StringSchema<undefined>,
-        v.MinLengthAction<string, 1, "must be a non-empty string">,
-      ]
-    >,
-  ],
-  undefined
->;
+/**
+ * An {@link Effect} whose `retry` block may omit its `kind`, plus the
+ * authoring-only `runtime` block that says where the generated runtime hosts
+ * this handler. `retry` is stored; `runtime` is stripped before the deploy
+ * writes the definition.
+ *
+ * @interface
+ */
+export declare type AuthoringEffect = EffectFields<AuthoringEffectRetry> & {
+  runtime?: EffectRuntimeBlock | undefined;
+};
 
+/** An {@link EffectRetry} whose omitted `kind` defaults to `engine`. */
+export declare type AuthoringEffectRetry = EffectRetryFields & {
+  kind?: EffectRetryKind | undefined;
+};
+
+/**
+ * A raw field entry or one of the authoring-only field sugars. `todoList`
+ * expands to an array of objects with `label`, `status`, optional `assignee`,
+ * and optional `dueDate`; that due date remains an ordinary date field.
+ * `notes` expands to an array of audit-shaped objects with `body`, `actor`,
+ * and `at` fields. Sugar type names are compiled away and never become stored
+ * field kinds.
+ * See {@link FieldEntry} for scope, required-input, and field-type constraints.
+ */
 export declare type AuthoringFieldEntry =
   | AuthoringRawFieldEntry
-  | ClaimField
   | TodoListField
   | NotesField;
 
-/** A field reference with `scope` optional; desugar resolves it lexically
- *  (activity → stage → workflow) into {@link StoredFieldRef}. */
-declare type AuthoringFieldRef = v.InferOutput<typeof AuthoringFieldRefSchema>;
+/**
+ * A field reference with `scope` optional; desugar resolves it lexically
+ * (activity → stage → workflow) into {@link StoredFieldRef}.
+ *
+ * @interface
+ */
+export declare type AuthoringFieldRef = v.InferOutput<
+  typeof AuthoringFieldRefSchema
+>;
 
 declare const AuthoringFieldRefSchema: v.StrictObjectSchema<
   {
@@ -844,8 +931,26 @@ declare const AuthoringFieldRefSchema: v.StrictObjectSchema<
   undefined
 >;
 
-/** {@link Guard}'s contract as authored: `match.idRefs` and `metadata` carry
- *  typed {@link GuardRead} values that deploy resolves to bare ones. */
+/**
+ * A stage's content mutation guard. Its name must be unique across the whole
+ * definition and use lowercase letters, digits, and dashes, starting with a
+ * letter or digit. `match.actions` must contain at least one action.
+ *
+ * `match.types` intersects the ID criteria. Within the ID criteria, matching
+ * either `idRefs` or `idPatterns` is sufficient. Omitted or empty optional
+ * criteria do not constrain the match. `idRefs` uses typed {@link GuardRead}s.
+ * Patterns use resource-local document-ID characters and `*` wildcards.
+ * A release-version pattern is rejected if translating it for a lifecycle
+ * action would broaden it to every document.
+ *
+ * `predicate` is delta-mode GROQ over `document`, `guard`, and `mutation`;
+ * see {@link GUARD_PREDICATE_VARS}. Only a strict `true` allows a matching
+ * mutation. An omitted or empty predicate denies it. `metadata` resolves
+ * {@link GuardRead}s into values available as `guard.metadata` in the predicate.
+ * Engine evaluations are advisory; the Content Lake is the enforcement point.
+ *
+ * @interface
+ */
 export declare type AuthoringGuard = v.InferOutput<typeof AuthoringGuardSchema>;
 
 declare const AuthoringGuardSchema: v.StrictObjectSchema<
@@ -873,105 +978,7 @@ declare const AuthoringGuardSchema: v.StrictObjectSchema<
           undefined
         >;
         idRefs: v.OptionalSchema<
-          v.ArraySchema<
-            v.VariantSchema<
-              "type",
-              [
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"self", undefined>;
-                  },
-                  undefined
-                >,
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"now", undefined>;
-                  },
-                  undefined
-                >,
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"fieldRead", undefined>;
-                    readonly field: v.SchemaWithPipe<
-                      readonly [
-                        v.StringSchema<undefined>,
-                        v.RegexAction<string, string>,
-                      ]
-                    >;
-                    readonly path: v.OptionalSchema<
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.SchemaWithPipe<
-                            readonly [
-                              v.StringSchema<undefined>,
-                              v.MinLengthAction<
-                                string,
-                                1,
-                                "must be a non-empty string"
-                              >,
-                            ]
-                          >,
-                          v.CheckAction<
-                            string,
-                            "a guard read path cannot contain a line break"
-                          >,
-                        ]
-                      >,
-                      undefined
-                    >;
-                  },
-                  undefined
-                >,
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"effectsRead", undefined>;
-                    readonly effect: v.SchemaWithPipe<
-                      readonly [
-                        v.SchemaWithPipe<
-                          readonly [
-                            v.StringSchema<undefined>,
-                            v.MinLengthAction<
-                              string,
-                              1,
-                              "must be a non-empty string"
-                            >,
-                          ]
-                        >,
-                        v.CheckAction<
-                          string,
-                          "an effect name cannot contain `'`"
-                        >,
-                      ]
-                    >;
-                    readonly path: v.OptionalSchema<
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.SchemaWithPipe<
-                            readonly [
-                              v.StringSchema<undefined>,
-                              v.MinLengthAction<
-                                string,
-                                1,
-                                "must be a non-empty string"
-                              >,
-                            ]
-                          >,
-                          v.CheckAction<
-                            string,
-                            "a guard read path cannot contain a line break"
-                          >,
-                        ]
-                      >,
-                      undefined
-                    >;
-                  },
-                  undefined
-                >,
-              ],
-              undefined
-            >,
-            undefined
-          >,
+          v.ArraySchema<v.GenericSchema<GuardRead>, undefined>,
           undefined
         >;
         idPatterns: v.OptionalSchema<
@@ -1014,99 +1021,7 @@ declare const AuthoringGuardSchema: v.StrictObjectSchema<
             v.MinLengthAction<string, 1, "must be a non-empty string">,
           ]
         >,
-        v.VariantSchema<
-          "type",
-          [
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"self", undefined>;
-              },
-              undefined
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"now", undefined>;
-              },
-              undefined
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"fieldRead", undefined>;
-                readonly field: v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.RegexAction<string, string>,
-                  ]
-                >;
-                readonly path: v.OptionalSchema<
-                  v.SchemaWithPipe<
-                    readonly [
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.StringSchema<undefined>,
-                          v.MinLengthAction<
-                            string,
-                            1,
-                            "must be a non-empty string"
-                          >,
-                        ]
-                      >,
-                      v.CheckAction<
-                        string,
-                        "a guard read path cannot contain a line break"
-                      >,
-                    ]
-                  >,
-                  undefined
-                >;
-              },
-              undefined
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"effectsRead", undefined>;
-                readonly effect: v.SchemaWithPipe<
-                  readonly [
-                    v.SchemaWithPipe<
-                      readonly [
-                        v.StringSchema<undefined>,
-                        v.MinLengthAction<
-                          string,
-                          1,
-                          "must be a non-empty string"
-                        >,
-                      ]
-                    >,
-                    v.CheckAction<string, "an effect name cannot contain `'`">,
-                  ]
-                >;
-                readonly path: v.OptionalSchema<
-                  v.SchemaWithPipe<
-                    readonly [
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.StringSchema<undefined>,
-                          v.MinLengthAction<
-                            string,
-                            1,
-                            "must be a non-empty string"
-                          >,
-                        ]
-                      >,
-                      v.CheckAction<
-                        string,
-                        "a guard read path cannot contain a line break"
-                      >,
-                    ]
-                  >,
-                  undefined
-                >;
-              },
-              undefined
-            >,
-          ],
-          undefined
-        >,
+        v.GenericSchema<GuardRead>,
         undefined
       >,
       undefined
@@ -1117,373 +1032,64 @@ declare const AuthoringGuardSchema: v.StrictObjectSchema<
 
 /** Like {@link ManualTarget}, but the `field` variant also accepts a bare
  *  field name; desugar normalises it into {@link AuthoringFieldRef}. */
-export declare type AuthoringManualTarget = v.InferOutput<
-  typeof AuthoringManualTargetSchema
->;
-
-declare const AuthoringManualTargetSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"url", undefined>;
-        readonly url: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.UrlAction<string, "must be a valid URL">,
-            v.CheckAction<string, "must be an http(s) URL">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field", undefined>;
-        readonly field: v.UnionSchema<
-          [
-            v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly scope: v.OptionalSchema<
-                  v.PicklistSchema<
-                    readonly ["workflow", "stage", "activity"],
-                    string
-                  >,
-                  undefined
-                >;
-                readonly field: v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >;
-              },
-              undefined
-            >,
-          ],
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
+export declare type AuthoringManualTarget =
+  | {
+      type: "url";
+      url: string;
+    }
+  | {
+      type: "field";
+      field: string | AuthoringFieldRef;
+    };
 
 /** Like {@link Op}, plus: `status.set`'s `activity` is optional (desugar fills
  *  the firing activity), and the `audit` sugar — a stamped append merging
- *  `actor`/`at` {@link ValueExpr} fields into its own value. */
-export declare type AuthoringOp = v.InferOutput<typeof AuthoringOpSchema>;
-
-declare const AuthoringOpSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.set", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.setIfMissing", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.unset", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.append", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.inc", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.dec", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.updateWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.removeWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"status.set", undefined>;
-        readonly activity: v.OptionalSchema<
-          v.SchemaWithPipe<
-            readonly [
-              v.StringSchema<undefined>,
-              v.MinLengthAction<string, 1, "must be a non-empty string">,
-            ]
-          >,
-          undefined
-        >;
-        readonly status: v.PicklistSchema<
-          readonly ["active", "done", "skipped", "failed"],
-          string
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"audit", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-        readonly stampFields: v.OptionalSchema<
-          v.StrictObjectSchema<
-            {
-              readonly actor: v.OptionalSchema<
-                v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >,
-                undefined
-              >;
-              readonly at: v.OptionalSchema<
-                v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >,
-                undefined
-              >;
-            },
-            undefined
-          >,
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
+ *  `actor`/`at` {@link ValueExpr} fields into its own value.
+ */
+export declare type AuthoringOp =
+  | FieldMutationOp<AuthoringFieldRef>
+  | {
+      type: "status.set";
+      activity?: string | undefined;
+      status: ActivityStatus;
+    }
+  | {
+      type: "audit";
+      target: AuthoringFieldRef;
+      value: ValueExpr;
+      stampFields?:
+        | {
+            actor?: string | undefined;
+            at?: string | undefined;
+          }
+        | undefined;
+    };
 
-declare type AuthoringRawAction = ActionFields<AuthoringOp, GroupMembership> & {
+/** @inline */
+declare type AuthoringRawAction = ActionFields<
+  AuthoringOp,
+  GroupMembership,
+  AuthoringEffect
+> & {
   roles?: string[] | undefined;
   status?: TerminalActivityStatus | undefined;
 };
 
+/** @inline */
 declare type AuthoringRawFieldEntry = FieldEntryFields<
   AuthoringEditable,
   GroupMembership
 >;
 
+/** @inline */
+declare type AuthoringRuntimeKey = "runtime";
+
+/**
+ * A {@link Stage} accepting authoring fields, activities, transitions, guards,
+ * and role-list editability. The same terminal-stage constraints apply.
+ *
+ * @interface
+ */
 export declare type AuthoringStage = StageFields<
   AuthoringFieldEntry,
   AuthoringActivity,
@@ -1492,25 +1098,33 @@ export declare type AuthoringStage = StageFields<
   AuthoringEditable
 >;
 
+/** A {@link StartBlock} whose omitted `kind` defaults to `interactive`. */
 export declare type AuthoringStartBlock = StartFields & {
   kind?: StartKind | undefined;
 };
 
 /**
- * Authoring transitions may omit `when`; desugar fills the safe,
- * overwhelmingly-common trigger `"$allActivitiesDone"`. "Fire unconditionally"
- * stays spellable as an explicit `when: "true"`.
+ * A {@link Transition} whose `when` may be omitted, defaulting to
+ * `$allActivitiesDone`. Use `when: 'true'` for an unconditional route.
  */
 export declare type AuthoringTransition = TransitionFields & {
   when?: string | undefined;
 };
 
-/** The authoring surface: stored primitives plus the define-time sugar. */
+/**
+ * The authoring surface: stored primitives plus the define-time sugar. `runtime`
+ * says where the generated unattended runtime hosts this workflow, overriding
+ * its deployment's kind; an effect node overrides it in turn.
+ *
+ * @interface
+ */
 export declare type AuthoringWorkflow = WorkflowFields<
   AuthoringFieldEntry,
   AuthoringStage,
   AuthoringStartBlock
->;
+> & {
+  runtime?: RuntimeBlock | undefined;
+};
 
 /** The narratable answer at one rollup level: the verdict plus what it waits
  *  on. `waitsOn` may be non-empty on a `yes` verdict (an effect settle is a
@@ -1673,37 +1287,21 @@ export declare interface ChoiceOption {
   value: ChoiceValue;
 }
 
+/**
+ * A closed list of allowed non-null scalar values. The list must be nonempty,
+ * with unique values and nonempty titles. Each value must satisfy the
+ * receiving type and its validation bounds.
+ *
+ * Fields accept choices on `string`, `text`, `number`, `url`, `date`,
+ * `dueDate`, `datetime`, and `dueDatetime`. Action parameters accept choices
+ * on `string`, `number`, `url`, and `dateTime`.
+ */
 export declare interface ChoiceOptions {
   list: ChoiceOption[];
 }
 
 export declare type ChoiceValue = string | number;
 
-/** The action half of the mirrored claim pair: `field` names the actor-valued entry this action claims, resolved lexically, and the expansion
- *  adds a no-steal `!defined($fields.<field>)` filter ANDed with `roles`/`filter` plus a `field.set` ← actor op. `ops`/`status` are reserved (strictObject rejects them). */
-declare type ClaimAction = {
-  type: "claim";
-  name: string;
-  title?: string | undefined;
-  description?: string | undefined;
-  group?: GroupMembership | undefined;
-  field: string | AuthoringFieldRef;
-  roles?: string[] | undefined;
-  filter?: string | undefined;
-  params?: ActionParam[] | undefined;
-  effects?: Effect[] | undefined;
-};
-
-/** The field half of the mirrored claim pair, expanding strictly within this entry: an `actor`
- *  working-memory field with no `initialValue` — the paired {@link ClaimAction}'s op fills it. */
-declare type ClaimField = {
-  type: "claim";
-  name: string;
-  title?: string | undefined;
-  description?: string | undefined;
-  group?: GroupMembership | undefined;
-};
-
 export declare interface ClassifiedPrincipal {
   namespace: PrincipalNamespace;
   /**
@@ -1744,9 +1342,22 @@ export declare function clientConfigFromResource(res: WorkflowResource):
       resource: WorkflowResource;
     };
 
-/** The router {@link buildClientForGdr} builds — total: every parsed GDR
+/** The total GDR router — every parsed GDR
  *  resolves to a client, or the router throws. */
-declare type ClientForGdr = (parsed: ParsedGdr) => WorkflowClient;
+export declare type ClientForGdr = (parsed: ParsedGdr) => WorkflowClient;
+
+/** Stored-resource dereferencing for write pre-flights and host previews. */
+export declare function clientGuardDereference(
+  client: Pick<WorkflowClient, "getDocument">,
+): GuardDereference;
+
+/** @internal Shared member rows for workspace adapters; not a supported consumer API. */
+export declare interface _ClientProjectMember {
+  readonly id: string;
+  readonly isRobot?: boolean;
+  readonly roles?: unknown;
+  readonly [key: string]: unknown;
+}
 
 /** Native project-user response returned by Sanity's project API. */
 export declare interface ClientProjectUser {
@@ -1792,7 +1403,7 @@ export declare function clientProjectUserDirectory(
  * `createEngine({ clock })`, and tests use `@sanity/workflow-engine-test`'s
  * `setNow` / `advance` (the bench wraps the same seam). It is deliberately
  * NOT a field on the public per-verb `*Args` — the raw `workflow.*` verbs
- * accept it only through the internal {@link Clocked} seam, so prod code
+ * accept it only through the {@link Clocked} composition seam, so prod code
  * can't trivially override engine time by accident.
  *
  * `drainEffects` and `sweepStaleClaims` read the same engine clock for
@@ -1802,19 +1413,18 @@ export declare function clientProjectUserDirectory(
 export declare type Clock = () => string;
 
 /**
- * Internal clock-injection seam for the raw `workflow.*` verbs. NOT part
- * of the public per-verb args (it is deliberately not re-exported from the
- * package root) — production injects a clock ONCE via
- * `createEngine({ clock })`, and the test bench via its `setNow` /
- * `advance`. This intersection just lets those two callers thread the
- * clock into a raw verb without `clock` cluttering every documented
- * `*Args` interface as if it were an everyday option.
+ * Optional clock-injection field on the raw `workflow.*` verbs. It is
+ * exported because those verbs expose this composition helper in their
+ * public signatures, but production normally injects a clock once via
+ * `createEngine({ clock })`, and the test bench controls it through
+ * `setNow` / `advance`. The documented `*Args` interfaces omit `clock`
+ * because it is infrastructure context, not an everyday per-call option.
  */
-declare type Clocked<T> = T & {
+export declare type Clocked<T> = T & {
   clock?: Clock;
 };
 
-declare interface CommitEffectOpsArgs extends DedupableOperationArgs {
+export declare interface CommitEffectOpsArgs extends DedupableOperationArgs {
   /** The `_key` of the pending effect being reported on. */
   effectKey: string;
   /**
@@ -1841,7 +1451,7 @@ declare interface CommitEffectOpsArgs extends DedupableOperationArgs {
    */
   ops: FieldOp[];
   /** Lease duration the successful commit renews the claim to — the
-   *  drain's `effectLeaseMs`. Default `DEFAULT_EFFECT_LEASE_MS` (5 min). */
+   *  drain's `effects.leaseMs`. Default `DEFAULT_EFFECT_LEASE_MS` (5 min). */
   leaseMs?: number;
 }
 
@@ -1862,10 +1472,19 @@ export declare interface CompiledQuery {
   params: Record<string, string | string[]>;
 }
 
-/** Deliberately carries NO engine data-model stamp: the guard doc format is the lake's forthcoming contract, not ours to grow fields on (see DATAMODEL.md). */
-export declare function compileGuard(args: CompileGuardArgs): MutationGuardDoc;
+/**
+ * Translate one authored guard into the temporary documents that preview its
+ * eventual Content Lake enforcement.
+ * Content edits target draft ids, instance updates keep the instance id, and
+ * publish or unpublish targets published ids using the Lake operations those
+ * lifecycle writes perform. A mixed guard emits one document per id space so
+ * its action and id facets never form an unintended cross-product.
+ */
+export declare function compileGuards(
+  args: CompileGuardsArgs,
+): [MutationGuardDoc, ...MutationGuardDoc[]];
 
-declare interface CompileGuardArgs extends MutationGuardBody {
+export declare interface CompileGuardsArgs extends MutationGuardBody {
   id: string;
 }
 
@@ -1924,6 +1543,17 @@ export declare function computeDiffEntries<
   target: DeployTarget;
 }): Promise<DiffEntry[]>;
 
+/**
+ * Thrown when one automatic cascade hop loses every optimistic-locking
+ * attempt. An earlier verb commit may already have landed; invoke `tick`
+ * after re-reading the instance to resume convergence when contention subsides.
+ */
+export declare class ConcurrentCascadeError extends WorkflowError<"concurrent-cascade"> {
+  readonly instanceId: string;
+  readonly attempts: number;
+  constructor(args: { instanceId: string; attempts: number });
+}
+
 /** {@link ConcurrentCompleteEffectError}'s mid-dispatch sibling: a
  *  `commitEffectOps` commit lost every optimistic-locking attempt. Nothing
  *  was written; the report may be retried under the same idempotency key. */
@@ -1984,7 +1614,7 @@ export declare class ConcurrentEditFieldError extends WorkflowError<"concurrent-
 
 /**
  * Thrown when a `fireAction` commit loses the optimistic-locking race on
- * all {@link CONCURRENT_COMMIT_MAX_ATTEMPTS} attempts — every reload +
+ * every commit attempt — each reload +
  * `ifRevisionId` retry was beaten by another writer committing first.
  * Surfacing it (rather than silently overwriting) lets the caller decide
  * whether to retry later or report a write storm; nothing was committed
@@ -2011,7 +1641,7 @@ export declare class ConcurrentFireActionError extends WorkflowError<"concurrent
  * never a `_type` scan over the lake (rejected at deploy).
  *
  * There is no `{ref, args}` wrapper: parameterized reuse is a define-time
- * TypeScript function producing a condition string (see the {@link groq} tag).
+ * TypeScript function producing a condition string (see the {@link define.groq | groq} tag).
  */
 export declare type Condition = string;
 
@@ -2063,7 +1693,7 @@ export { ConditionRead };
  * then per stage — transitions, activities (filter, requirements, action
  * filters and `when` triggers), editable gates, tighten-overrides.
  * Editable gates resolve through the same helper the runtime projection uses
- * ({@link editableFieldsInStage}: entry `editable` ANDed with the stage
+ * (entry `editable` ANDed with the stage
  * tighten-override), so every live editable-field address exists here with
  * the same EFFECTIVE predicate the edit insight explains — including
  * override-only gates on `editable: true` entries, and workflow-scope fields
@@ -2098,7 +1728,7 @@ export declare type ConditionVarBinding = "always" | "caller" | "spawn";
 /**
  * The one-doc read a reactive adapter subscribes with to observe a content doc
  * under a perspective stack. It uses the same perspective semantics as
- * {@link hydrateSnapshot}: draft/version content is projected onto the published
+ * `hydrateSnapshot`: draft/version content is projected onto the published
  * id, and a doc that exists only as a draft or release version remains visible.
  */
 export declare function contentDocQuery(documentId: string): CompiledQuery;
@@ -2139,7 +1769,7 @@ export declare function contentDraftFallback(args: {
  * Note: this resolves a **single** release — the documented `instance.perspective`
  * shapes (`[release]` / `[release, "drafts"]`). The stores' per-doc reads take
  * one release, so a multi-release stack can't be observed through them; the
- * engine's own fetch path ({@link hydrateSnapshot}) — and the SDK adapter's
+ * engine's own fetch path (`hydrateSnapshot`) — and the SDK adapter's
  * query-store route for stacks without a `'drafts'` entry — honour the full
  * stack via `client.fetch({perspective})`.
  */
@@ -2250,15 +1880,12 @@ export declare class ContractViolationError extends WorkflowError<"contract-viol
  *   {@link Engine.subscriptionDocumentsForInstance} (need the pinned
  *   binding), {@link Engine.drainEffects} and
  *   {@link Engine.verifyDeployedDefinitions} (need the construction-time
- *   `effectHandlers` / `missingHandler` / `loggerFactory`).
+ *   `effects` / `loggerFactory`).
  * - Namespace-only: `workflow.permissions` — pure grant helpers that need
  *   no engine scope.
  *
- * Effect handlers + missingHandler feed {@link Engine.drainEffects}
- * (dispatch of unclaimed pending effects) and
- * {@link Engine.verifyDeployedDefinitions} (the startup audit of
- * deployed effect names). They don't change `fireAction` / `tick` /
- * `completeEffect` — the runtime still decides when to drain and
+ * The {@link EngineEffectsArgs} group changes nothing about `fireAction` /
+ * `tick` / `completeEffect` — the runtime still decides when to drain, and
  * reports outcomes via `completeEffect`.
  */
 export declare function createEngine<Client extends WorkflowClient>(
@@ -2267,8 +1894,8 @@ export declare function createEngine<Client extends WorkflowClient>(
 
 /**
  * The {@link EngineScopeArgs} scope pinned at construction, plus the
- * engine-only extras (`effectHandlers` / `missingHandler` / `loggerFactory`
- * feed `drainEffects` + `verifyDeployedDefinitions`). The `tag` partition is
+ * engine-only extras (`effects` and `loggerFactory` feed `drainEffects` +
+ * `verifyDeployedDefinitions`). The `tag` partition is
  * required and never defaulted — the engine enforces nothing, so the
  * partition is the only thing keeping reads and writes off the wrong
  * environment.
@@ -2277,18 +1904,8 @@ export declare interface CreateEngineArgs<
   Client extends WorkflowClient = WorkflowClient,
 > extends EngineScopeArgs {
   client: Client;
-  effectHandlers?: Record<string, EffectHandler<Client>>;
-  missingHandler?: MissingHandlerPolicy;
+  effects?: EngineEffectsArgs<Client>;
   loggerFactory?: LoggerFactory;
-  /**
-   * Lease duration `drainEffects` stamps on each pending-effect claim.
-   * Past the lease the claimer is presumed dead: the entry becomes
-   * recoverable by another drain's takeover or by
-   * the standalone `sweepStaleClaims` export. Default 5 minutes — size it well above
-   * the slowest handler's honest runtime, since a live-but-slow dispatch
-   * that outlives its lease can be redispatched (see {@link EffectHandler}).
-   */
-  effectLeaseMs?: number;
   /**
    * Deterministic-time seam, pinned once for this engine and threaded
    * into every verb it drives — `$now`, the `now` op-source, and the
@@ -2299,6 +1916,13 @@ export declare interface CreateEngineArgs<
    * option.
    */
   clock?: Clock;
+  /**
+   * How the engine waits out a `retry` policy's backoff between attempts.
+   * Pinned once beside {@link CreateEngineArgs.clock}; omit (the default) to
+   * spend real time. A deterministic harness passes one that moves its clock
+   * forward instead, so a paced policy runs without waiting.
+   */
+  sleep?: Sleeper;
   /**
    * Product-telemetry seam, pinned once for this engine and threaded into
    * every verb it drives. The core engine ships no metrics pipeline — it
@@ -2326,6 +1950,8 @@ export declare function createTelemetryIntake(args: {
   client: TelemetryIntakeClient;
   projectId: string;
   denied?: boolean;
+  /** Context merged into every event at send time. These values win on key collisions. */
+  context?: Record<string, unknown>;
 }): TelemetryIntake;
 
 /** A define-time validated `custom.<camelCaseMeaning>` value. */
@@ -2459,10 +2085,46 @@ export declare const DATA_MODEL_CHANGES: readonly [
     applicability: "detectable";
     summary: "Assignee fields may restrict newly assigned users and collective roles by role.";
   }>,
+  Readonly<{
+    id: "split-guard-id-spaces";
+    introducedInModel: 9;
+    minReaderModel: 9;
+    documentTypes: readonly ["definition", "instance"];
+    compatibility: "reader-floor";
+    applicability: "detectable";
+    summary: "Guards spanning edit and lifecycle id spaces emit independently retractable documents.";
+  }>,
+  Readonly<{
+    id: "singular-assignee-lists";
+    introducedInModel: 9;
+    minReaderModel: 9;
+    documentTypes: readonly ["definition", "instance"];
+    compatibility: "reader-floor";
+    applicability: "detectable";
+    summary: "Singular assignee fields use member lists with at most one user and any number of roles.";
+  }>,
+  Readonly<{
+    id: "required-content-references";
+    introducedInModel: 10;
+    minReaderModel: 10;
+    documentTypes: readonly ["definition", "instance"];
+    compatibility: "reader-floor";
+    applicability: "detectable";
+    summary: "Required content references must remain readable after initialization before actions or transitions advance.";
+  }>,
+  Readonly<{
+    id: "effect-retry-policy";
+    introducedInModel: 10;
+    minReaderModel: 10;
+    documentTypes: readonly ["definition", "instance"];
+    compatibility: "reader-floor";
+    applicability: "detectable";
+    summary: "An effect node declares a bounded retry policy the engine enforces on every runtime.";
+  }>,
 ];
 
 /** The maximum reader floor this writer can emit for a detectable feature. */
-export declare const DATA_MODEL_MAX_READER = 8;
+export declare const DATA_MODEL_MAX_READER = 10;
 
 /**
  * The unconditional model-4 reader floor for every engine-owned document.
@@ -2479,12 +2141,14 @@ export declare const DATA_MODEL_MIN_READER = 4;
  * instances are re-stamped on every full persist, so mixed-version fleets
  * honestly record whichever engine last shaped a doc.
  *
- * Bump on every declared shape change (additive included). Bumping does NOT
- * by itself lock out older engines — that is the document's derived
- * `minReaderModel` floor. Declare every bump in `DATAMODEL.md`; the model-surface snapshot test
- * fails on undeclared drift.
+ * A number is assigned per release, not per change: a declared shape change
+ * merged before this model has shipped joins it, and one merged after it has
+ * shipped moves the number on. Bumping does NOT by itself lock out older
+ * engines — that is the document's derived `minReaderModel` floor. Declare
+ * every change in `DATAMODEL.md`; the model-surface snapshot test fails on
+ * undeclared drift.
  */
-export declare const DATA_MODEL_VERSION = 8;
+export declare const DATA_MODEL_VERSION = 10;
 
 export declare interface DataModelChange {
   readonly id: string;
@@ -2561,7 +2225,7 @@ export declare interface DedupableOperationArgs extends OperationArgs {
 export declare const DEFAULT_CONTENT_PERSPECTIVE = "drafts";
 
 /** How long a fresh claim's lease runs unless the engine configured
- *  `effectLeaseMs`. */
+ *  `effects.leaseMs`. */
 export declare const DEFAULT_EFFECT_LEASE_MS: number;
 
 /** How long a recorded idempotency key dedupes retries, unless the caller
@@ -2582,6 +2246,16 @@ export declare const DEFAULT_TRANSITION_WHEN = "$allActivitiesDone";
  */
 export declare const defaultLoggerFactory: LoggerFactory;
 
+/**
+ * What `defineWorkflow` returns: the stored definition, plus `runtime` when the
+ * workflow or one of its effects declared a hosting kind. Generation and the
+ * blueprint tooling read `runtime`; the deploy drops it, so it never reaches the
+ * Content Lake and never affects a definition's content fingerprint.
+ */
+export declare type DefinedWorkflow = WorkflowDefinition & {
+  runtime?: DefinitionRuntime | undefined;
+};
+
 export declare interface DefinitionConditionSite {
   /** The stage the condition applies in; absent only for author predicates. */
   stage?: string;
@@ -2609,7 +2283,7 @@ export declare interface DefinitionGroupSite {
   members: GroupMember[];
 }
 
-declare interface DefinitionGuardsQueryArgs {
+export declare interface DefinitionGuardsQueryArgs {
   client: WorkflowClient;
   clientForGdr: ClientForGdr;
   workflowResource: WorkflowResource;
@@ -2661,6 +2335,22 @@ export declare class DefinitionNotFoundError extends WorkflowError<"definition-n
   constructor(args: { definition: string; version?: number });
 }
 
+/** Every literal project role a stored definition references, deduplicated in encounter order. */
+export declare function definitionRoleNames(
+  definition: WorkflowDefinition,
+): readonly string[];
+
+/**
+ * The hosting declarations {@link DefinedWorkflow} carries for the generator,
+ * collected out of the authored tree. `kind` is present only when the workflow
+ * declared one, so an absent `kind` inherits the deployment's. `effects` holds
+ * one entry per effect that declared a block, keyed by effect name.
+ */
+export declare interface DefinitionRuntime {
+  kind?: RuntimeKind | undefined;
+  effects?: Record<string, EffectRuntimeBlock> | undefined;
+}
+
 export declare interface DefinitionsForDocumentArgs {
   /**
    * The LOADED candidate document — unlike {@link InstancesForDocumentArgs},
@@ -2785,6 +2475,7 @@ export declare function denyingGuards(args: {
     type?: string;
   };
   context: MutationContext;
+  dereference?: GuardDereference;
 }): Promise<MutationGuardDoc[]>;
 
 export declare interface DeployDefinitionResult {
@@ -2842,14 +2533,13 @@ export declare interface DeployDefinitionsResult {
 /** A definition as fetched back from the lake. The document carries `_id` plus
  *  the deploy-stamped envelope the authored {@link WorkflowDefinition} never
  *  had: the assigned `version` and the content fingerprint it was minted from
- *  ({@link hashDefinitionContent}). A pre-fingerprint document may lack
- *  `contentHash` at runtime — see {@link LatestDeployed}. */
+ *  ({@link hashDefinitionContent}). */
 export declare type DeployedDefinition = WorkflowDefinition & {
   _id: string;
   tag?: string;
   version: number;
-  /** Optional: a document deployed before content-addressing has none — see
-   *  {@link LatestDeployed}. Every version this engine deploys carries one. */
+  /** Optional: a document deployed before content-addressing has none. Every
+   *  version this engine deploys carries one. */
   contentHash?: string;
   /** Engine data-model stamp (see {@link DATA_MODEL_VERSION}) — absent on
    *  documents deployed before the stamp existed (model 0). */
@@ -3048,6 +2738,8 @@ export declare type DiagnosedTransition = Pick<
  * builds it from a real {@link WorkflowEvaluation}.
  */
 export declare interface DiagnoseInput extends DocumentStuckInput {
+  /** Missing references read by unmet requirements or transition conditions; omit when not checked. */
+  missingDocuments?: MissingDocument[];
   instance: Pick<
     WorkflowInstance,
     | "currentStage"
@@ -3064,14 +2756,15 @@ export declare interface DiagnoseInput extends DocumentStuckInput {
 }
 
 /** Narrow a full {@link WorkflowEvaluation} to the {@link DiagnoseInput} the
- *  classifier reads. */
+ *  classifier reads. Throws when populated missing-reference evidence lacks
+ *  its blocking subset. */
 export declare function diagnoseInputFromEvaluation(
   evaluation: WorkflowEvaluation,
 ): DiagnoseInput;
 
 /**
- * Classify an instance. Terminal states win first; then the genuine stuck
- * causes (nothing advances on its own or via a normal action); then `waiting`
+ * Classify an instance. Terminal states win first; then effect or activity
+ * faults; then missing references read by unmet conditions; then transition faults; then `waiting`
  * (an action is available — healthy); then `blocked` (an active activity held by
  * an unmet requirement — healthy, not yet actionable); else `progressing` (a
  * transition is already satisfied and will cascade).
@@ -3089,16 +2782,17 @@ export declare interface DiagnoseResult {
 }
 
 /**
- * How an in-flight instance reads right now. `waiting` and `blocked` are both
- * HEALTHY, not stuck: `waiting` means an active activity has an available
- * action and advances when someone acts — how long a workflow is "allowed" to
- * wait is workflow- and team-specific, not this classifier's call — while
- * `blocked` means an active activity's declared requirements aren't all met
+ * How an instance reads right now. `waiting` and `blocked` are both healthy,
+ * not stuck. A `waiting` result says whether the activity awaits an
+ * action available to this caller (`caller`), a manual action that this caller
+ * cannot currently take (`manual-action`), or a cascade-fired action
+ * (`automation`). How long a workflow is "allowed" to wait is workflow- and
+ * team-specific, not this classifier's call. `blocked` means an active
+ * activity's declared requirements aren't all met
  * yet, and flips to `waiting` once they hold (typically a sibling activity
- * completing, or content landing). `completed` and `aborted` carry
- * `liveChildren` when spawned work is still running: a parent finishing while
- * detached children run is legal — detach means detach — but a consumer
- * should surface it loudly.
+ * completing, or content landing). Completed and aborted results include
+ * `liveChildren` while detached spawned work remains active; consumers should
+ * surface it prominently.
  */
 export declare type Diagnosis =
   | {
@@ -3109,6 +2803,7 @@ export declare type Diagnosis =
       activity: string;
       assignees: Assignee[];
       actions: string[];
+      waitingFor: "automation" | "caller" | "manual-action";
     }
   | {
       state: "blocked";
@@ -3148,7 +2843,7 @@ export declare interface DiffEntry {
 
 /**
  * Classifies `def` against the latest deployed version of its name via
- * {@link planDefinitionDeploy} — a content change is always a new version,
+ * the deploy planner — a content change is always a new version,
  * never an in-place update. `def` passes the same boundary parse deploy uses
  * ({@link parseDefinitionInput}), so diff and deploy accept and reject the
  * same input shape.
@@ -3223,12 +2918,10 @@ export declare type DisabledReason =
     }
   | {
       /**
-       * The activity's declared {@link Activity.requirements} aren't all satisfied —
-       * the readiness axis. The activity is visible and the actor authorized, but
-       * its own preconditions don't hold yet. `unmetRequirements` carries the
-       * authored descriptors so a consumer can disable the affirmative control and say
-       * which precondition is outstanding. Distinct from `filter-failed`
-       * (visibility/authorization) and `mutation-guard-denied` (content-write).
+       * An authored activity requirement is unmet, or a selected target of a
+       * required reference field cannot be read. Use `unmetRequirements` to
+       * explain what blocks the action. Required-reference descriptors use
+       * `field:<name>`; they have no entry in `requirementInsights`.
        */
       kind: "requirements-unmet";
       unmetRequirements: RequirementDescriptor[];
@@ -3279,26 +2972,25 @@ export declare interface DisplayMetadata {
 export declare function displayTitle(typeKey: string | undefined): string;
 
 /** Document-value permissions. Grants ({@link Grant} in ./authorization.ts) compose most-permissive-wins. */
-declare const DOCUMENT_VALUE_PERMISSIONS: readonly ["create", "read", "update"];
+export declare const DOCUMENT_VALUE_PERMISSIONS: readonly [
+  "create",
+  "manage",
+  "read",
+  "update",
+];
 
 /**
- * The guards that would deny a PROSPECTIVE lake action on a document — the
- * disable-this-button pre-flight, evaluated before any concrete mutation
- * exists. Advisory, like every guard verdict: the check explains and
- * disables, it never enforces.
+ * The guards that deny a concrete Lake mutation image. Advisory, like every
+ * engine-side guard verdict: the check explains and disables, it never
+ * enforces.
  */
 export declare function documentActionDenials(
   args: DocumentActionDenialsArgs,
 ): Promise<MutationGuardDoc[]>;
 
 export declare interface DocumentActionDenialsArgs {
-  /** The document's current value — both `before` and `after` of the
-   *  pre-flighted action (a prospective check has no concrete mutation, so
-   *  delta predicates see "no change"). */
-  doc: {
-    _id: string;
-    _type: string;
-  } & Record<string, unknown>;
+  /** The concrete Lake mutation the action will perform. */
+  mutation: MutationContext;
   /** The datasource the document lives in. A guard applies solely within the
    *  datasource it is registered in, so a same-id match from a foreign
    *  datasource can never gate this action and must not flip verdicts. */
@@ -3306,15 +2998,30 @@ export declare interface DocumentActionDenialsArgs {
     type: string;
     id: string;
   };
-  action: MutationGuardAction;
   guards: readonly MutationGuardDoc[];
   /** The caller's principal id in the guarded resource's own namespace,
    *  resolved as `identity()` in predicates. */
   identity?: string;
+  /** Resource-local stored-document lookup for predicates using `->`. */
+  dereference?: GuardDereference;
 }
 
-/** Compile-time mirror of {@link isDocumentEnvelopeKey}: the keys the
- *  boundary strips rather than rejects. */
+/**
+ * Completed evidence for a document absent from the snapshot. `deleted` confirms
+ * absence across versions; `outside-perspective` identifies an existing representation.
+ * `unreadable` covers denied access and unsuccessful availability checks.
+ */
+export declare type DocumentAvailability =
+  | "deleted"
+  | "unreadable"
+  | "outside-perspective";
+
+/** Supplies completed availability evidence for references absent from an evaluation snapshot. */
+export declare type DocumentAvailabilityReader = (
+  documents: readonly MissingDocument[],
+) => Promise<ReadonlyMap<string, DocumentAvailability>>;
+
+/** @inline */
 declare type DocumentEnvelopeKey =
   | `_${string}`
   | "tag"
@@ -3337,8 +3044,8 @@ export declare function documentPrefilter(
 
 /**
  * Classify an instance from its document alone — no evaluation, no reads, no
- * actor. The transition-level causes need GROQ `when` results, so only
- * {@link diagnoseInstance} reaches those.
+ * actor. Document absence and transition-level causes require an evaluation,
+ * so only {@link diagnoseInstance} reaches those.
  *
  * Sound but incomplete, and a consumer must present it that way: `undefined`
  * means "no cause this classifier can see", never "healthy". Flag an instance on
@@ -3381,10 +3088,13 @@ export declare interface DrainEffectsResult {
   failed: PendingEffect[];
   skipped: PendingEffect[];
   /**
-   * Entries this drainer dispatched whose completion lost to another party
-   * (a lease-expiry takeover finishing first, or a manual recovery). The
-   * handler's side effect ran here too — the at-least-once overlap the
-   * {@link EffectHandler} contract tells handlers to tolerate.
+   * Entries this drainer dispatched without settling. Either another party
+   * settled the entry first (a lease-expiry takeover, a manual recovery, or a
+   * completion landing while a `retry` run waited out a backoff), or a `retry`
+   * run stopped because the claim could no longer be held, which leaves the
+   * entry pending for a later drain. The handler's side effect ran here too:
+   * the at-least-once overlap the {@link EffectHandler} contract tells
+   * handlers to tolerate.
    */
   lost: PendingEffect[];
 }
@@ -3442,7 +3152,7 @@ export declare function driverKind(actor: Actor): DriverKind;
  * to decide who-may-edit. ADVISORY like every engine gate — it disables the
  * inline field and explains; a {@link Guard} declares the intended write-lock.
  */
-export declare type Editable = v.InferOutput<typeof StoredEditableSchema>;
+export declare type Editable = true | string;
 
 /**
  * One declared-editable field in the current scope, projected for an actor: its
@@ -3576,37 +3286,34 @@ export declare interface EditFieldTarget {
 export declare type EditMode = "set" | "append" | "unset";
 
 /**
- * A registered effect: `name` is its only identity (unique per definition,
- * read downstream as `$effects.<name>`) — the host app registers a handler
- * against it 1:1, and the stored definition never references code.
- * `bindings` are GROQ reads over the rendered scope, resolved to concrete
- * JSON at queue time; `input` is static config passed through verbatim.
- * `outputs` (typed {@link FieldShape}s) is a STRICT allowlist: at completion
- * an undeclared output key, or a value that doesn't fit its shape, fails the
- * completion and nothing is stored. Omitting `outputs` is an EMPTY allowlist,
- * so ANY returned output is rejected and fails the completion — the bound is
- * universal, not opt-in.
+ * External work queued for the handler registered under `name`. Names are
+ * unique within a definition; completed outputs are read as `$effects['<name>']`.
+ *
+ * `bindings` resolves GROQ expressions against the action's rendered scope
+ * when the effect is queued. The handler receives one parameter bag combining
+ * those values with static `input`. An `input` key overrides a same-named
+ * binding, including when its value is null.
+ *
+ * `outputs` declares the allowed result keys and their {@link FieldShape}s.
+ * An undeclared key or invalid value rejects the completion without storing
+ * it. Omitting `outputs` allows no output keys.
+ *
+ * `retry` ({@link EffectRetry}) bounds how many times a failing handler is
+ * attempted. Omitting it completes the effect as failed on the first failure.
+ *
+ * @interface
  */
-export declare type Effect = v.InferOutput<typeof EffectSchema>;
+export declare type Effect = EffectFields<EffectRetry>;
 
 /** Total commits one dispatch may make — the runaway-handler bound: without
  *  it, a looping reporter renews its own lease and appends history forever.
  *  2× the ceiling of 1%-granularity progress reporting. */
-export declare const EFFECT_COMMIT_DISPATCH_CAP = 200;
-
-/** Pending mid-dispatch commits one dispatch may hold before `commitOps` /
- *  `setProgress` throws synchronously. An awaiting handler never reaches it
- *  (its queue depth stays ≤ 1). */
-export declare const EFFECT_COMMIT_QUEUE_DEPTH = 32;
-
-/**
- * Every terminal state an effect run can record. `done` and `failed` are
- * reported through completion ({@link EffectCompletionStatus}); `cancelled`
- * is engine-stamped only — an abort cancelling the entry before dispatch.
- * A cancellation is not a failure: anything counting failures (dashboards,
- * retry tooling) must not count aborted-away effects among them.
- */
-declare const EFFECT_RUN_STATUSES: readonly ["done", "failed", "cancelled"];
+export declare const EFFECT_COMMIT_DISPATCH_CAP = 200;
+
+/** Pending mid-dispatch commits one dispatch may hold before `commitOps` /
+ *  `setProgress` throws synchronously. An awaiting handler never reaches it
+ *  (its queue depth stays ≤ 1). */
+export declare const EFFECT_COMMIT_QUEUE_DEPTH = 32;
 
 /**
  * A `ctx.commitOps` / `ctx.setProgress` call hit one of the dispatch's
@@ -3634,6 +3341,17 @@ export declare type EffectCompletionStatus = Exclude<
   "cancelled"
 >;
 
+/** @inline */
+declare type EffectFields<TRetry> = {
+  name: string;
+  title?: string | undefined;
+  description?: string | undefined;
+  bindings?: Record<string, string> | undefined;
+  input?: Record<string, unknown> | undefined;
+  outputs?: FieldShape[] | undefined;
+  retry?: TRetry | undefined;
+};
+
 /**
  * External effect handler — invoked at drain time with resolved `params` and
  * a context. Returning `outputs` records them on the run's `effectHistory`
@@ -3641,15 +3359,29 @@ export declare type EffectCompletionStatus = Exclude<
  * applies the state half of the effect in the completion commit (`field.*`
  * only, never `status.set`) — every returned op must explicitly set
  * `target.scope`, since completion ops have no authoring location to infer
- * one from. Throwing marks the effect failed, with no `ops`.
+ * one from. Throwing fails the attempt, with no `ops`. Without a
+ * {@link EffectRetry} policy on the node, or once one has spent its attempts
+ * or closed its window, that failure settles the effect as failed. A policy
+ * with attempts left inside its window dispatches again instead, unless the
+ * drain finds between two attempts that it no longer holds the claim: then it
+ * stops without settling and reports the entry as `lost`. That check happens
+ * between attempts only. The completion itself stays first-writer-wins, so a
+ * dispatch that runs to its end still reports its outcome and settles the
+ * entry if it gets there first.
  *
  * Delivery is at-least-once: a handler MAY run more than once for the same
- * effect (a dispatch dying after its side effect but before commit, or a
- * lease expiring mid-dispatch and being taken over). Completion is
- * first-writer-wins — the losing run's completion is reported as `lost`.
- * Write handlers to tolerate this: check `effectHistory[]` for a row keyed
- * by `ctx.effectKey` before irreversible work, and derive external
- * identifiers from `ctx.effectKey` so the receiving system can dedupe.
+ * effect. Three causes. A dispatch can die after its side effect but before
+ * commit. A lease can expire mid-dispatch and be taken over. And every
+ * admitted attempt of a `retry` policy invokes the handler again. Completion
+ * is first-writer-wins, and the losing run's completion is reported as `lost`.
+ *
+ * Write handlers to tolerate repetition. Derive external identifiers from
+ * `ctx.effectKey` so the receiving system can dedupe: the key is stable across
+ * every repeat, including all attempts of one policy run. Checking
+ * `effectHistory[]` for a row keyed by `ctx.effectKey` before irreversible
+ * work catches a repeat of an already-completed run, but never a retry
+ * attempt, because a policy writes one history row when the whole run ends and
+ * nothing records the attempt that just failed.
  *
  * The `bivarianceHack` indirection keeps this readable from the non-generic
  * `Engine` surface; only the typed drain invokes handlers.
@@ -3666,7 +3398,7 @@ export declare type EffectHandler<
   } | void>;
 }["bivarianceHack"];
 
-declare type EffectHandlerContext<Client extends WorkflowClient> = {
+export declare type EffectHandlerContext<Client extends WorkflowClient> = {
   /** A concrete sibling of the `createEngine` client, bound to the workflow resource with the
    *  same credentials; untagged handler requests carry the `workflow.effect` tag by default. */
   client: Client;
@@ -3784,45 +3516,94 @@ export declare function effectOutputsMap(
   instance: Pick<WorkflowInstance, "effectHistory">,
 ): Record<string, unknown>;
 
-export declare type EffectRunStatus = (typeof EFFECT_RUN_STATUSES)[number];
+/**
+ * A bounded retry policy for one effect. Both bounds govern one drain's run of
+ * the policy, not the effect's lifetime: a drainer that dies mid-run leaves the
+ * entry for the next drain, which starts a fresh run with the full budget, so
+ * an effect can see more handler calls in total than `attempts`.
+ *
+ * `attempts` is the total number of attempts in a run, the first included, so
+ * `1` means "never retry".
+ *
+ * `expiryMs` and the backoff a policy accumulates are each capped at 366 days
+ * (`31_622_400_000` ms), inclusive. Deploy refuses a policy declaring more,
+ * and one whose accumulated backoff reaches its own `expiryMs` before its
+ * `attempts` are spent. Those checks weigh the declared waits alone. At
+ * runtime every elapsed millisecond counts against `expiryMs`, handler time
+ * included, so a slow handler can leave attempts unused. `backoff` paces
+ * them; omitting it retries with no wait. Every duration is a whole number of
+ * milliseconds above zero, and `attempts` a whole count above zero; deploy
+ * rejects anything else.
+ *
+ * `expiryMs` decides whether a further attempt may start, measured from the
+ * moment this run dispatched its first attempt. The window closes
+ * on reaching it, so an attempt is admitted only while less than `expiryMs`
+ * has elapsed. It is not a handler timeout. An attempt already running is
+ * never interrupted, so a run can finish after the window, and a success then
+ * still counts. Omitting it leaves `attempts` as the only bound.
+ *
+ * A policy that runs out of attempts, or that `expiryMs` stops, completes the
+ * effect as failed, and `$effectStatus['<name>'] == 'failed'` routes the
+ * instance. A successful attempt completes it as done, whichever attempt
+ * succeeded. An effect with no `retry` completes as failed on its handler's
+ * first failure.
+ */
+export declare type EffectRetry = EffectRetryFields & {
+  kind: EffectRetryKind;
+};
 
-declare const EffectSchema: v.StrictObjectSchema<
-  {
-    readonly name: v.SchemaWithPipe<
-      readonly [
-        v.StringSchema<undefined>,
-        v.MinLengthAction<string, 1, "must be a non-empty string">,
-      ]
-    >;
-    readonly title: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly description: v.OptionalSchema<
-      v.StringSchema<undefined>,
-      undefined
-    >;
-    readonly bindings: v.OptionalSchema<
-      v.RecordSchema<
-        v.StringSchema<undefined>,
-        v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >,
-        undefined
-      >,
-      undefined
-    >;
-    readonly input: v.OptionalSchema<
-      v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>,
-      undefined
-    >;
-    readonly outputs: v.OptionalSchema<
-      v.ArraySchema<v.GenericSchema<FieldShape>, undefined>,
-      undefined
-    >;
-  },
-  undefined
->;
+/**
+ * How long the engine waits between two attempts. `delayMs` is that wait in
+ * milliseconds: `'fixed'` waits it every time, `'exponential'` doubles it per
+ * attempt already made (`delayMs`, then `2 × delayMs`, then `4 × delayMs`).
+ */
+export declare type EffectRetryBackoff = {
+  kind: "fixed" | "exponential";
+  delayMs: number;
+};
+
+/** @inline */
+declare type EffectRetryFields = {
+  attempts: number;
+  backoff?: EffectRetryBackoff | undefined;
+  expiryMs?: number | undefined;
+};
+
+/**
+ * Who runs a retry policy. `'engine'` is the only member: the engine loops
+ * inside the `drainEffects` call that picked the effect up, holding the claim
+ * across the waits.
+ */
+export declare type EffectRetryKind = "engine";
+
+/**
+ * Every terminal state an effect run can record. `done` and `failed` are
+ * reported through completion ({@link EffectCompletionStatus}); `cancelled`
+ * is engine-stamped only — an abort cancelling the entry before dispatch.
+ * A cancellation is not a failure: anything counting failures (dashboards,
+ * retry tooling) must not count aborted-away effects among them.
+ */
+export declare type EffectRunStatus = "done" | "failed" | "cancelled";
+
+/**
+ * The `runtime` block on an effect node, overriding its workflow's kind.
+ * `timeout` is seconds and `memory` megabytes of the function that runs this
+ * handler, and an effect declaring either gets its own drain function instead of
+ * sharing the deployment's. Both are the function budget, so both are accepted
+ * only under `'function'`.
+ */
+export declare type EffectRuntimeBlock =
+  | {
+      kind: "function";
+      timeout?: number | undefined;
+      memory?: number | undefined;
+    }
+  | {
+      kind: "durableFunction";
+    }
+  | {
+      kind: "selfHosted";
+    };
 
 /** The `effectHistory` outcome {@link EffectNotFoundError} reports when the
  *  missing key belongs to a settled run. `detail` is the row's recorded
@@ -3833,6 +3614,21 @@ export declare interface EffectSettledInfo {
   detail?: string;
 }
 
+/** One declared effect plus a structural location string identifying where it
+ *  sits in the definition (for diagnostics). */
+export declare interface EffectSite {
+  effect: Effect;
+  location: string;
+}
+
+/**
+ * Every effect a definition declares, with its location — the single source of
+ * "where effects live": action `effects[]` (actions are the only payload
+ * carriers). Effect names are unique per definition, so consumers can key by
+ * `site.effect.name` cleanly.
+ */
+export declare function effectSites(def: WorkflowDefinition): EffectSite[];
+
 export declare interface Engine {
   /** Engine-scoped bindings — exposed for the few advanced consumers
    *  (e.g. test bench, drain workers) that need them; the verbs already
@@ -3840,8 +3636,7 @@ export declare interface Engine {
   readonly client: WorkflowClient;
   readonly tag: string;
   readonly workflowResource: WorkflowResource;
-  readonly effectHandlers: Readonly<Record<string, EffectHandler>>;
-  readonly missingHandler: MissingHandlerPolicy;
+  readonly effects: ResolvedEngineEffects;
   readonly logger: LoggerFactory;
   /** The resolved telemetry logger ({@link noopTelemetry} unless injected) —
    *  exposed so adapters built on the engine log through the same seam. */
@@ -3850,6 +3645,9 @@ export declare interface Engine {
   resolveActor: (
     args: ResolveClientActorArgs,
   ) => Promise<ActorResolution<ClientProjectUser>>;
+  /** Validates and stores immutable definition versions. Content matching the
+   *  latest deployed version's fingerprint keeps that version; otherwise,
+   *  deployment creates the next version. Batch dependencies deploy children first. */
   deployDefinitions: <T extends WorkflowDefinitionInput<T>>(
     args: DeployDefinitionsArgs<T>,
   ) => Promise<DeployDefinitionsResult>;
@@ -3858,15 +3656,25 @@ export declare interface Engine {
    *  starts without complaint. `instanceId` is the idempotency key: reusing
    *  it for the same start resumes; a different start throws. */
   startInstance: (args: StartInstanceArgs) => Promise<OperationResult>;
+  /** Commits a caller-fired action and runs the resulting cascade. Actions
+   *  declaring `when` cannot be fired through this method. Dispatch queued
+   *  effects separately with {@link Engine.drainEffects}. */
   fireAction: (args: FireActionArgs) => Promise<OperationResult>;
   /** Edit a declared-editable field directly (the generic edit seam):
    *  reassign / reschedule / claim-by-hand / append-to-log, then cascade. */
   editField: (args: EditFieldArgs) => Promise<OperationResult>;
+  /** Records an effect result, applies its completion field operations, and
+   *  runs the resulting cascade. Use {@link Engine.drainEffects} to invoke
+   *  registered handlers. */
   completeEffect: (args: CompleteEffectArgs) => Promise<OperationResult>;
   /** Commit mid-dispatch field state from a running effect handler — the
    *  verb behind `ctx.commitOps`. Gated on the dispatch's exact claim token;
    *  a successful commit renews the claim's lease. */
   commitEffectOps: (args: CommitEffectOpsArgs) => Promise<OperationResult>;
+  /** Reevaluates an instance and commits enabled triggers and transitions
+   *  until progression settles. A successful call reports `changed: false`
+   *  when the instance remains unchanged. It does not run effect handlers;
+   *  dispatch queued work with {@link Engine.drainEffects}. */
   tick: (args: OperationArgs) => Promise<OperationResult>;
   /** Project the instance from an actor's perspective — per-action verdicts
    *  with structured disabled reasons. Pure read. */
@@ -3881,8 +3689,9 @@ export declare interface Engine {
   setStage: (args: SetStageArgs) => Promise<OperationResult>;
   /** Admin override — hard-stop an in-flight instance where it stands. */
   abortInstance: (args: AbortInstanceArgs) => Promise<OperationResult>;
-  /** Admin override — reset a failed/terminal activity in the current stage
-   *  back to `active` (re-run) or `skipped` (bypass), then cascade. */
+  /** Changes a terminal activity in the current stage to `active` or `skipped`,
+   *  then continues the cascade. Already-fired triggers do not fire again
+   *  during the same stage visit. */
   resetActivity: (args: ResetActivityArgs) => Promise<OperationResult>;
   /** Admin override — remove a deployed definition (instances are only ever aborted, never deleted). */
   deleteDefinition: (
@@ -3979,13 +3788,13 @@ export declare interface Engine {
   drainEffects: (args: DrainEffectsArgs) => Promise<DrainEffectsResult>;
   /**
    * Inspect every deployed definition in the engine's tag and apply
-   * the configured missingHandler policy at `phase: "deploy"` for any
+   * the configured `effects.missingHandler` policy at `phase: "deploy"` for any
    * effect name without a registered handler. Catches "definition
    * shipped, handler removed" misconfigurations at startup instead of
    * three days later when the effect fires.
    *
    * Returns the list of (definitionId, name, locations) tuples it saw.
-   * Throws if missingHandler resolved as "fail" for any of them.
+   * Throws if `effects.missingHandler` resolved as "fail" for any of them.
    */
   verifyDeployedDefinitions: () => Promise<VerifyDeployedDefinitionsResult>;
 }
@@ -4004,6 +3813,31 @@ export declare interface Engine {
  */
 export declare const ENGINE_API_VERSION = "2026-04-29";
 
+/**
+ * Everything this engine needs to run pending effects, in one group.
+ * {@link Engine.drainEffects} dispatches through `handlers` under a
+ * `leaseMs` claim, and both the drain and
+ * {@link Engine.verifyDeployedDefinitions} apply `missingHandler` to an effect
+ * name no handler covers.
+ */
+export declare interface EngineEffectsArgs<
+  Client extends WorkflowClient = WorkflowClient,
+> {
+  /** Effect handlers keyed by the effect name the definition queues. */
+  handlers?: Record<string, EffectHandler<Client>>;
+  /**
+   * Lease duration `drainEffects` stamps on each pending-effect claim.
+   * Past the lease the claimer is presumed dead: the entry becomes
+   * recoverable by another drain's takeover or by
+   * the standalone `sweepStaleClaims` export. Default 5 minutes — size it well above
+   * the slowest handler's honest runtime, since a live-but-slow dispatch
+   * that outlives its lease can be redispatched (see {@link EffectHandler}).
+   */
+  leaseMs?: number;
+  /** What to do with an effect name `handlers` doesn't cover. Default `fail`. */
+  missingHandler?: MissingHandlerPolicy;
+}
+
 export declare interface EngineLogger {
   info: (message: string, extra?: Record<string, unknown>) => void;
   warn: (message: string, extra?: Record<string, unknown>) => void;
@@ -4066,7 +3900,7 @@ export declare interface EngineScopeArgs {
 /**
  * Pull the {@link GlobalDocumentReference} values out of `doc.ref` /
  * `subject` / `doc.refs` (content) field entries. Content only — release
- * field entries come from {@link entryReleaseRefs}, so guard discovery (which
+ * field entries come from the shared release-ref projection, so guard discovery (which
  * reads this via `collectEntryDocUris`) stays scoped to content docs.
  */
 export declare function entryDocRefs(
@@ -4098,12 +3932,16 @@ export declare interface EvaluateArgs {
 }
 
 /**
- * The pure projection at the heart of {@link evaluateInstance}: given an
- * instance, its definition, the resolved actor/grants, and a snapshot,
- * compute "what can this actor do right now, and why not the rest." No
- * I/O — feed it a fresh snapshot (e.g. rebuilt from a live store on
- * change) for reactive re-evaluation. Best-effort by design: verdicts are
- * advisory, not enforcement.
+ * Evaluates an
+ * instance, its definition, resolved actor/grants, and a snapshot to
+ * report available actions and their blocking conditions. The
+ * supplied snapshot is never refetched; guards using `->` may call the
+ * supplied {@link EvaluateFromSnapshotArgs.guardDereference} resolver. An optional
+ * {@link EvaluateFromSnapshotArgs.documentAvailability} reader supplies completed
+ * evidence for missing references without replacing held content.
+ * Feed it a fresh snapshot (e.g. rebuilt from a live store on change) for
+ * reactive re-evaluation. Best-effort by design: verdicts are advisory,
+ * not enforcement.
  */
 export declare function evaluateFromSnapshot(
   args: EvaluateFromSnapshotArgs,
@@ -4134,11 +3972,14 @@ export declare interface EvaluateFromSnapshotArgs {
   attributes?: UserAttributes;
   /**
    * The in-memory snapshot to evaluate against. The caller assembles it
-   * from whatever source — a fetch (see {@link evaluateInstance}) or a
-   * live store. The `_id` of every doc must be in GDR-URI form, as
-   * {@link buildSnapshot} produces.
+   * from whatever source — a fetch-backed evaluation or a
+   * live store. Every doc's `_id` must be in GDR-URI form, and `knownIds`
+   * must contain exactly those IDs for missing-reference diagnostics.
+   * Use {@link buildSnapshot} to construct both consistently.
    */
   snapshot: HydratedSnapshot;
+  /** Resolve availability outside the snapshot's perspective. Without a reader, absence is reported without claiming deletion. */
+  documentAvailability?: DocumentAvailabilityReader;
   /**
    * The `$now` reading every condition in this projection shares. Omit to
    * use {@link wallClock}; a reactive consumer (or the bench) passes its
@@ -4151,9 +3992,14 @@ export declare interface EvaluateFromSnapshotArgs {
    * doc, so a guard that matches the instance and denies that write disables
    * every action with `mutation-guard-denied`. Omit to skip the gate in this
    * projection — the engine's verb paths load live guards and re-check at
-   * commit time ({@link evaluateInstance} fetches them itself).
+   * commit time (the runtime evaluation path fetches them itself).
    */
   guards?: readonly MutationGuardDoc[];
+  /**
+   * Stored-resource lookup for guard predicates using `->`. Omit when no
+   * guard can dereference; missing lookups resolve `null` and deny fail-closed.
+   */
+  guardDereference?: GuardDereference;
   /**
    * Per-FOREIGN-subject-resource access — the actor's ACL grants PLUS the
    * actor's principal id in that resource's own namespace — keyed by
@@ -4161,20 +4007,22 @@ export declare interface EvaluateFromSnapshotArgs {
    * effects-bearing actions ({@link SubjectPermissionDenial}). A resource
    * appears only when both halves resolved; omit it (or the whole map) to
    * skip that resource's forecast (degrade open — the subject's lake still
-   * enforces). {@link evaluateInstance} resolves this through each
-   * resource's own client via {@link subjectResourceGrants}.
+   * enforces). The runtime evaluation path resolves this through each
+   * resource's own client.
    */
   resourceGrants?: ReadonlyMap<string, SubjectResourceAccess>;
 }
 
 /**
  * Evaluate a guard predicate against a mutation. Returns `true` only when the
- * predicate is strictly `true` (ALLOW). Empty predicate denies. Fail-closed:
- * any thrown error or non-`true` result denies.
+ * predicate is strictly `true` (ALLOW). Empty predicates, parse failures, and
+ * non-`true` results deny. A supplied dereference resolver's failure propagates
+ * so infrastructure errors cannot masquerade as guard verdicts.
  */
 export declare function evaluateMutationGuard(args: {
   guard: MutationGuardDoc;
   context: MutationContext;
+  dereference?: GuardDereference;
 }): Promise<boolean>;
 
 /** Args for `evaluateStart` — the pre-flight read of `startInstance`'s gates
@@ -4297,14 +4145,14 @@ export declare type ExecutorClassification =
  * alias isn't bound: the check that stops a portable definition from deploying
  * against the wrong (or no) resource.
  *
- * Runs at deploy (inside {@link planDefinitionDeploy}), BEFORE the content
+ * Runs during deploy planning, BEFORE the content
  * fingerprint, so a deployed definition never carries a logical alias. The
  * stored references are physical, and a rebind (same source, a different alias
  * map) surfaces as changed content — a new version, never a silent shift in what
  * the workflow reads. A no-op when the definition references no aliases.
  *
- * Rewrites string VALUES only (via the shared {@link mapJsonStrings} deep-walk),
- * skipping the prose fields in {@link PROSE_KEYS}. A reference that stands alone
+ * Rewrites string VALUES only through a shared deep walk, skipping known prose
+ * fields. A reference that stands alone
  * (the whole value is `@<alias>:<id>`, e.g. a literal `doc.ref`) must expand to a
  * well-formed GDR — a malformed one (`@content:a:b`, an empty id) is rejected
  * here rather than failing when an instance later reads it.
@@ -4356,11 +4204,7 @@ export declare function extractDocumentId(gdrUriString: string): string;
 /** `resourcePath` is caller-supplied so this works for both project ACLs and a dedicated workflow-collaboration resource. */
 declare function fetchGrants(args: {
   client: {
-    request: <T>(opts: {
-      url: string;
-      signal?: AbortSignal;
-      tag?: string;
-    }) => Promise<T>;
+    request: NonNullable<WorkflowClient["request"]>;
   };
   resourcePath: string;
   signal?: AbortSignal;
@@ -4449,13 +4293,6 @@ export declare const FIELD_KIND_DISPLAY: {
   };
 };
 
-/**
- * The three field scopes a field entry can live in. Also the
- * group-declaration levels: a `groups` array lives at exactly these three
- * nodes, so `DefinitionGroupSite.level` reuses this vocabulary.
- */
-declare const FIELD_SCOPES: readonly ["workflow", "stage", "activity"];
-
 /**
  * The kinds a VALUE can take — scalars aligned to Sanity's names, the
  * reference kinds, the actor/assignee identities, and the two compositional
@@ -4490,8 +4327,7 @@ declare const FIELD_VALUE_KINDS: readonly [
   "array",
 ];
 
-/** Type-mirror of {@link fieldBase}, parameterised over the `editable` and
- *  `group` grammars (stored membership is the canonical list form). */
+/** @inline */
 declare type FieldBase<TEditable, TGroup> = {
   name: string;
   title?: string | undefined;
@@ -4509,11 +4345,33 @@ export declare interface FieldDescription {
   proposals: InsightPhrase[];
 }
 
-/** One declared field entry as authored and stored: name, value kind, and its scope's sourcing and editability. */
+/**
+ * A field declaration whose location determines its scope and lifetime.
+ * Workflow fields initialize at start; stage and activity fields initialize
+ * on each stage visit. {@link FieldSource} controls initialization;
+ * {@link Editable} controls direct edits independently.
+ *
+ * `required: true` is valid only on workflow-scope fields with an `input`
+ * source. It requires a non-null value at start or spawn. On `subject`,
+ * `doc.ref`, and `doc.refs`, selected targets must also remain readable in the
+ * workflow perspective after initialization. Missing targets block normal
+ * actions, triggered actions, and transitions. Abort and permitted field edits remain available.
+ * `subject` is also
+ * workflow-scope-only, with at most one subject per definition. Each scope
+ * may declare at most one `dueDate` or `dueDatetime` field, always top-level.
+ *
+ * `types` is a nonempty list of accepted document types on `subject`,
+ * `doc.ref`, or `doc.refs`; omit it to accept any document type. `roles`
+ * constrains assignment eligibility only on `assignee` and `assignees`.
+ * {@link FieldShape}, {@link ChoiceOptions}, and {@link ScalarValidation}
+ * define the nested-shape and scalar constraints. Authoring conveniences are
+ * accepted by {@link AuthoringFieldEntry}.
+ *
+ * @interface
+ */
 export declare type FieldEntry = FieldEntryFields<Editable, string[]>;
 
-/** Type-mirror of {@link fieldEntryFields}: a raw field entry of the given
- *  editability and group-membership grammars. */
+/** @inline */
 declare type FieldEntryFields<TEditable, TGroup> = FieldBase<
   TEditable,
   TGroup
@@ -4551,10 +4409,73 @@ export declare interface FieldInsight {
 export declare type FieldKind = keyof FieldValueMap;
 
 /**
- * A stored field mutation. `field.inc` and `field.dec` use the same names as
- * `@sanity/client` patches and default an omitted `value` to a delta of `1`.
+ * A field mutation targeting a declared field. Resolved values must satisfy
+ * that field's shape, choices, validation, and assignment constraints.
+ *
+ * `field.setIfMissing` supports nullable fields only. If a value exists, it
+ * leaves the value unchanged and records no `opApplied` history event.
+ * `field.inc` and `field.dec` require an initialized `number` field; their
+ * delta defaults to `1`. Both the delta and resulting value must be finite,
+ * and the result must satisfy the field's validation bounds.
+ *
+ * `field.append` adds one valid list member. `field.updateWhere` accepts only
+ * `array` fields and merges an object into matching rows. The merge cannot
+ * write `_key` or `_type`, and each resulting row must satisfy its declared
+ * shape. `field.removeWhere` supports list fields. See {@link Op} for row
+ * selection and history behavior.
+ */
+export declare type FieldMutationOp<
+  TTarget extends {
+    field: string;
+  },
+> =
+  | {
+      type: "field.set";
+      target: TTarget;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.setIfMissing";
+      target: TTarget;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.unset";
+      target: TTarget;
+    }
+  | {
+      type: "field.append";
+      target: TTarget;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.inc";
+      target: TTarget;
+      value?: ValueExpr | undefined;
+    }
+  | {
+      type: "field.dec";
+      target: TTarget;
+      value?: ValueExpr | undefined;
+    }
+  | {
+      type: "field.updateWhere";
+      target: TTarget;
+      where: Condition;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.removeWhere";
+      target: TTarget;
+      where: Condition;
+    };
+
+/**
+ * A {@link FieldMutationOp} whose target scope is explicit. Actions can write
+ * fields in their activity, stage, or workflow. Effect completions accept only
+ * workflow- or stage-scoped field operations, never activity status changes.
  */
-export declare type FieldOp = v.InferOutput<typeof StoredFieldOpSchema>;
+export declare type FieldOp = FieldMutationOp<StoredFieldRef>;
 
 /**
  * A concrete value a blocking atom pins for this field, with the verified
@@ -4568,6 +4489,7 @@ export declare interface FieldProposal {
   consequences: SiteConsequence[];
 }
 
+/** @inline */
 declare type FieldReadExpr = {
   type: "fieldRead";
   scope?: "workflow" | "stage" | undefined;
@@ -4575,15 +4497,24 @@ declare type FieldReadExpr = {
   path?: string | undefined;
 };
 
-export declare type FieldScope = (typeof FIELD_SCOPES)[number];
+/**
+ * The three field scopes a field entry can live in. Also the
+ * group-declaration levels: a `groups` array lives at exactly these three
+ * nodes, so `DefinitionGroupSite.level` reuses this vocabulary.
+ */
+export declare type FieldScope = "workflow" | "stage" | "activity";
 
 /**
- * A sub-field shape used inside an `object`'s `fields` or an `array`'s `of` —
- * lighter than {@link FieldEntry}: no `initialValue`/`editable`/`required`,
- * since a sub-field's value comes from the parent. An `object` kind requires
- * non-empty `fields` and no `of`; an `array` kind requires non-empty `of` and
- * no `fields`; every other kind requires neither — enforced at parse, not
- * visible in this type.
+ * A nested field shape inside an object's `fields`, an array's `of`, or an
+ * effect's `outputs`. It has no initialization, direct editability, or required
+ * setting; those belong to {@link FieldEntry}.
+ *
+ * An `object` requires nonempty `fields` and no `of`. An `array` requires
+ * nonempty `of` and no `fields`. Other types accept neither. Sibling names
+ * must be unique. Use ordinary `date` and `datetime` here; `dueDate` and
+ * `dueDatetime` are not valid nested fields or effect outputs.
+ * {@link ChoiceOptions} and {@link ScalarValidation} constrain supported
+ * scalar types. `roles` is valid only on `assignee` and `assignees` shapes.
  */
 export declare interface FieldShape {
   type: FieldValueKind;
@@ -4599,14 +4530,32 @@ export declare interface FieldShape {
 }
 
 /**
- * How a field seeds its `initialValue`, once at materialisation (advisory
- * after — the field stays freely editable). Absent means working memory: the
- * field starts empty and an op fills it later, spelled by omission rather
- * than an arm. Distinct from {@link ValueExpr}, an op's write payload; they
- * overlap only on the literal and field-read arms.
+ * Supplies a field's `initialValue` once, when the field is initialized.
+ * Omitting the source starts the field empty; an operation can fill it later.
+ * The source does not grant permission to edit. Direct editing requires an
+ * {@link Editable | editable} declaration.
+ *
+ * Distinct from {@link ValueExpr}, which supplies an operation's write value.
+ * Only the literal and field-read forms are shared.
+ *
+ * `input` reads workflow inputs supplied at start or spawn. Stage and activity
+ * input seeds receive no caller value; activity input seeds produce a deploy
+ * warning. `literal` supplies a fixed value. `query` runs against the Content
+ * Lake with earlier fields in the same scope available as `$fields`.
+ * Reference normalization can omit unrecognized values without recording
+ * `fieldQueryDiscarded`. A result that fails validation after normalization
+ * uses the field's empty value (`null` or `[]`) and records that event.
+ * A failed query throws.
+ *
+ * A `fieldRead` seed reads earlier fields in its own scope when `scope` is
+ * omitted. A stage or activity seed can read workflow fields with
+ * `scope: 'workflow'`. An activity seed cannot read stage fields. At workflow
+ * scope, omit `scope` to read an earlier workflow field. `path` selects a
+ * nested value; these reads do not load referenced documents.
  */
 export declare type FieldSource = FieldSourceInternal;
 
+/** @inline */
 declare type FieldSourceInternal =
   | {
       type: "input";
@@ -4618,6 +4567,11 @@ declare type FieldSourceInternal =
   | LiteralExpr
   | FieldReadExpr;
 
+/** Shared diagnostic field-address label for workspace consumers; unsupported outside this workspace.
+ * @internal
+ */
+export declare function _fieldTargetLabel(target: EditFieldTarget): string;
+
 /**
  * Every leaf replaced by its type name (`null` distinct from `object`); keys sorted by
  * UTF-16 code unit, not locale collation, so the shape canonicalises identically on every
@@ -4655,8 +4609,8 @@ export declare interface FieldValueMap {
   dueDatetime: string | null;
   url: string | null;
   actor: Actor | null;
-  /** A single {@link Assignee} — the singular of {@link FieldValueMap.assignees}. */
-  assignee: Assignee | null;
+  /** Assignment members with at most one user; role members do not consume that cardinality. */
+  assignee: Assignee[];
   assignees: Assignee[];
   /** An object with named sub-fields; the value is keyed by sub-field name. */
   object: Record<string, unknown> | null;
@@ -4775,16 +4729,19 @@ export declare interface FiringConsequence {
 export { formatRead };
 
 /**
- * Build a GDR URI from a workflow resource config + a document id
- * within that resource. This is how the engine mints `_id`s for
- * definitions / instances / ancestor refs into its own resource.
+ * Creates a {@link GdrUri} for a document in the supplied resource. Dataset
+ * document IDs must be stable; `drafts.` and `versions.<release>.` prefixes
+ * throw. Select draft or release content through {@link WorkflowInstance.perspective}.
  */
 export declare function gdrFromResource(
   res: WorkflowResource,
   documentId: string,
 ): GdrUri;
 
-/** Build a GDR (id + type) pointing at a document within a workflow resource. */
+/**
+ * Creates a typed document reference in the supplied resource. Dataset
+ * references require a stable document ID, as described by {@link gdrFromResource}.
+ */
 export declare function gdrRef<TType extends string = string>({
   res,
   documentId,
@@ -4820,18 +4777,21 @@ export declare type GdrScheme =
   | "dashboard";
 
 /**
- * Typed GDR URI string. The compiler rejects bare doc ids (`"doc-1"`)
- * — only `<scheme>:<...id-parts>` values typecheck. Construct one via
- * `gdrUri()` / `gdrFromResource()` / `refDataset()` etc., or by hand
- * with the scheme prefix baked in (`` `dataset:proj:ds:${docId}` `` ).
+ * Resource-qualified document URI with a {@link GdrScheme} prefix. Construct
+ * it with {@link gdrUri}, {@link gdrFromResource}, or {@link refDataset}.
+ * Use {@link parseGdr} to validate a string's complete addressing format.
  *
- * Combined with schema validation at the API boundary, this is the
- * type + runtime guarantee that no bare-string id reaches the
- * snapshot, field entry, or filter layer.
+ * Dataset URIs require the stable document ID, such as `article-1`, without
+ * a `drafts.` or `versions.<release>.` prefix. Select draft and release
+ * content through {@link WorkflowInstance.perspective}.
  */
 export declare type GdrUri = `${GdrScheme}:${string}`;
 
-/** Compose a GDR URI from parts. Inverse of `parseGdr`. */
+/**
+ * Creates a {@link GdrUri} from addressing parts. For datasets, `documentId`
+ * must be the stable ID; `drafts.` and `versions.<release>.` prefixes throw.
+ * Select draft or release content through {@link WorkflowInstance.perspective}.
+ */
 export declare function gdrUri(
   parts:
     | {
@@ -4916,8 +4876,13 @@ declare function grantsPermissionOn(args: {
   userId?: string;
 }): Promise<boolean>;
 
-/** A named readiness condition. Activities accept only `'groq'`; workflow
- *  `start.requirements` also accepts `'singleSubject'` — see {@link StartRequirement}. */
+/**
+ * A named GROQ readiness condition. Its name must be unique in the containing
+ * requirements array. Activity requirements use instance and caller variables;
+ * workflow requirements use the input and projected dataset in {@link StartBlock}.
+ * Every requirement must pass before the corresponding caller action or fresh
+ * standalone start can commit.
+ */
 export declare type GroqRequirement = RequirementBase & {
   type: "groq";
   query: string;
@@ -5018,33 +4983,15 @@ export declare function groupSitesOf(
 ): DefinitionGroupSite[];
 
 /**
- * A lake mutation guard. A FOREIGN CONTRACT mirrored 1:1: `match`,
- * `predicate`, and `metadata` are the content lake's persisted guard-document
- * API, not engine-invented surface — the stored form keeps the lake's
- * vocabulary verbatim. The engine adds exactly two things: `name` (a
- * lake-id-segment, `^[a-z0-9][a-z0-9-]*$`, unique per definition — the lake
- * `_id` derives from `(instanceId, name)` at stage entry) and the deploy-time
- * read VALUES on `match.idRefs` / `metadata` (a typed {@link GuardRead} when
- * authoring, resolved to bare values at deploy). `match` selects mutations by
- * `types` (empty matches any), `idRefs` (field reads resolved to bare ids),
- * `idPatterns` (bare glob ids), and `actions` (at least one). `predicate` is
- * lake GROQ in a distinct delta-mode eval context (`before()`/`after()`,
- * `mutation`, `guard`, `identity()`, bare ids/fields only): strictly `true`
- * ALLOWS the mutation; anything else — false, null, an evaluation error, or
- * an omitted/empty predicate — DENIES. `metadata` is the only bridge from
- * that eval context (which cannot see `$fields`) to workflow fields, read as
- * `guard.metadata.*` and re-synced by the post-field-op guard refresh. The
- * lake does not enforce the guard document type yet: a deployed guard denies
- * optimistically engine-side, and the lake ACL is the only hard gate until
- * guard enforcement ships.
+ * A stored workflow guard. Its string reads and authored lifecycle actions
+ * remain unresolved until stage entry produces the Lake-shaped documents
+ * deployed for that stage.
+ *
+ * @interface
  */
 export declare type Guard = v.InferOutput<typeof GuardSchema>;
 
 /**
- * The lake document type for a mutation guard. Single source of truth — both
- * the runtime value (id construction, `compileGuard`, queries) and the
- * {@link MutationGuardDoc} `_type` literal derive from here.
- *
  * The enforcement story hangs off this type: the lake does not evaluate
  * this doc type — it is the engine's placeholder for the lake's
  * forthcoming guard primitive (the lake reserves `system.*`). Until that
@@ -5061,21 +5008,24 @@ export declare const GUARD_OWNER = "robot:workflow-engine";
  * The identifiers a lake mutation guard's `predicate` reads — the wire
  * dialect, not the condition scope (so no {@link ConditionVarBinding}: these
  * bind only when a guard evaluates a mutation). `before()`/`after()`/
- * `identity()` are groq-js delta-mode natives on top of these. Bound in one
- * place: `guardPredicateParams` in the guard evaluator.
+ * `identity()` are groq-js delta-mode natives on top of these. The guard
+ * evaluator must bind every entry here at the predicate root.
  */
 export declare const GUARD_PREDICATE_VARS: readonly {
   name: string;
   description: string;
 }[];
 
-export declare type GuardAction = v.InferOutput<typeof GuardActionSchema>;
+export declare type GuardAction = MutationGuardAction;
 
-declare const GuardActionSchema: v.PicklistSchema<
-  readonly ["create", "update", "delete", "publish", "unpublish"],
-  string
->;
+export declare type GuardDereference = (ref: {
+  _ref: string;
+}) => PromiseLike<Record<string, unknown> | null>;
 
+/**
+ * A stored guard's match criteria. See {@link AuthoringGuard} for matching
+ * rules; stored `idRefs` contains strings instead of typed {@link GuardRead}s.
+ */
 export declare type GuardMatch = Guard["match"];
 
 /**
@@ -5096,96 +5046,31 @@ export declare function guardMatches({
 }): boolean;
 
 /**
- * A deploy-time value read on a guard's `match.idRefs` / `metadata`, typed
- * like {@link ValueExpr} (`self`/`now`/`fieldRead`, plus the guard-only
- * `effectsRead` for a completed effect's output). Workflow-scope only — a
- * guard outlives any activity, so `fieldRead` here carries no `scope`.
- * Desugar prints the STORED string spelling the deploy resolver and guard
- * refresh parse (`"$self"`, `"$now"`, `"$fields.<name>[.path]"`,
- * `"$effects['<name>'][.path]"`); those spellings are single-line strings
- * matched by anchored regexes, so a line break in a path would print an
- * unparseable read.
+ * A value read for a guard's `match.idRefs` or `metadata`, resolved when the
+ * guard is created or refreshed. `fieldRead` reads workflow fields only;
+ * stage and activity fields are unavailable. `effectsRead` reads a completed
+ * effect's output. `self` supplies the instance's GDR URI and `now` its ISO
+ * clock value.
+ * Paths cannot contain line breaks, and effect names cannot contain `'`.
+ * Stored {@link Guard} declarations carry string forms of these reads.
  */
-export declare type GuardRead = v.InferOutput<typeof GuardReadSchema>;
-
-declare const GuardReadSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"self", undefined>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"now", undefined>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"fieldRead", undefined>;
-        readonly field: v.SchemaWithPipe<
-          readonly [v.StringSchema<undefined>, v.RegexAction<string, string>]
-        >;
-        readonly path: v.OptionalSchema<
-          v.SchemaWithPipe<
-            readonly [
-              v.SchemaWithPipe<
-                readonly [
-                  v.StringSchema<undefined>,
-                  v.MinLengthAction<string, 1, "must be a non-empty string">,
-                ]
-              >,
-              v.CheckAction<
-                string,
-                "a guard read path cannot contain a line break"
-              >,
-            ]
-          >,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"effectsRead", undefined>;
-        readonly effect: v.SchemaWithPipe<
-          readonly [
-            v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >,
-            v.CheckAction<string, "an effect name cannot contain `'`">,
-          ]
-        >;
-        readonly path: v.OptionalSchema<
-          v.SchemaWithPipe<
-            readonly [
-              v.SchemaWithPipe<
-                readonly [
-                  v.StringSchema<undefined>,
-                  v.MinLengthAction<string, 1, "must be a non-empty string">,
-                ]
-              >,
-              v.CheckAction<
-                string,
-                "a guard read path cannot contain a line break"
-              >,
-            ]
-          >,
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
+export declare type GuardRead =
+  | {
+      type: "self";
+    }
+  | {
+      type: "now";
+    }
+  | {
+      type: "fieldRead";
+      field: string;
+      path?: string | undefined;
+    }
+  | {
+      type: "effectsRead";
+      effect: string;
+      path?: string | undefined;
+    };
 
 declare const GuardSchema: v.StrictObjectSchema<
   {
@@ -5235,21 +5120,12 @@ declare const GuardSchema: v.StrictObjectSchema<
           >,
           undefined
         >;
-        actions: v.SchemaWithPipe<
-          readonly [
-            v.ArraySchema<
-              v.PicklistSchema<
-                readonly ["create", "update", "delete", "publish", "unpublish"],
-                string
-              >,
-              undefined
-            >,
-            v.MinLengthAction<
-              ("create" | "update" | "delete" | "publish" | "unpublish")[],
-              1,
-              "a guard must match at least one action"
-            >,
-          ]
+        actions: v.ArraySchema<
+          v.PicklistSchema<
+            readonly ["create", "update", "delete", "publish", "unpublish"],
+            string
+          >,
+          undefined
         >;
       },
       undefined
@@ -5282,7 +5158,7 @@ declare const GuardSchema: v.StrictObjectSchema<
  * its guards statically name — no live instance required. Guard docs are
  * stamped with the version-less definition, so this spans the datasources
  * declared across ALL deployed versions
- * ({@link DefinitionGuardsQueryArgs.definitions}), not just the latest.
+ * (`definitions`), not just the latest.
  *
  * A datasource is statically reachable when a guard idRef resolves to a
  * hardcoded GDR literal — directly, or via a `fieldRead` of a field entry whose
@@ -5320,15 +5196,13 @@ export declare function guardsForResource(
 export { guillemets };
 
 /**
- * Content fingerprint of an authored definition: the canonical JSON of its
- * content, hashed. Stamped on the deployed document ({@link DeployedDefinition})
- * and pinned on every instance, so a redeploy of identical content is a no-op
- * and a definition that drifted from what an instance pinned is detectable.
- *
- * Advisory, like every engine check (the lake is the only enforcement point):
- * FNV-1a is a fast, deterministic, dependency-free, isomorphic digest — enough
- * to detect honest change and drift, not a tamper-proof seal. Kept synchronous
- * so the pure planning path ({@link planDefinitionDeploy}) needs no `await`.
+ * Computes a deterministic, non-cryptographic fingerprint of authored
+ * definition content. The result is 16 lowercase hexadecimal characters.
+ * Object-key order does not affect it; array order and field values do.
+ * Pass authored content without stored-document envelope fields: this
+ * function strips none of them. The authoring-only `runtime` block is the one
+ * key it ignores, so two definitions that differ only in a hosting kind
+ * fingerprint identically.
  */
 export declare function hashDefinitionContent(def: WorkflowDefinition): string;
 
@@ -5424,6 +5298,7 @@ export declare type HistoryEntry = HistoryEvent & {
   executionContext?: ExecutionContext;
 };
 
+/** @inline */
 declare type HistoryEvent =
   | {
       _key: string;
@@ -5589,10 +5464,18 @@ export { humanize };
 export declare interface HydratedSnapshot {
   /** Hydrated docs, keyed by GDR URI as `_id`. */
   docs: SanityDocument[];
-  /** Existence-check helper; the core eval pipeline itself doesn't read it. */
+  /** The GDR URIs of every document in `docs`, used to diagnose missing references. */
   knownIds: Set<string>;
 }
 
+/** Assignment ownership for list/read surfaces. Role aliases deliberately do
+ *  not apply: aliases widen authorization, not whose inbox a literal pool
+ *  member routes work into. */
+export declare function identityMatchesAssignment(
+  members: readonly Assignee[],
+  identity: AssignmentIdentity,
+): boolean;
+
 /**
  * The in-flight arm — the one spelling of "not completed/aborted" every
  * list surface's `includeCompleted` filter negates (the engine stamps
@@ -5712,6 +5595,12 @@ export declare type InsightSite =
       activity?: string;
     };
 
+/** Viewer-scoped assignment counts across active activities in the open stage. */
+export declare function instanceAssignmentStateCounts(
+  instance: AssignmentInstance,
+  identity: AssignmentIdentity,
+): AssignmentStateCounts;
+
 /**
  * The tag's instance partition as a listen filter — the one shared change
  * feed a preview store keeps itself fresh from (an event names the touched
@@ -5725,9 +5614,9 @@ export declare function instanceChangesQuery(args: {
 
 /**
  * Mint the Sanity document `_id` for a workflow instance — a fresh
- * {@link randomKey} suffix, so every instance (root or spawned child) gets a
+ * random suffix, so every instance (root or spawned child) gets a
  * unique doc id under its tag. Lives in the shell, not `core/`, because it
- * draws randomness; the deterministic {@link definitionDocId} is the pure-core
+ * draws randomness; the deterministic `definitionDocId` is the pure-core
  * counterpart. Bare form — Sanity rejects `:` in document IDs, so this is
  * never a GDR URI.
  */
@@ -5745,7 +5634,7 @@ export declare function instanceDocId(tag: string): string;
  */
 export declare function instanceGuardQuery(instanceId: string): CompiledQuery;
 
-declare interface InstanceGuardsQueryArgs {
+export declare interface InstanceGuardsQueryArgs {
   client: WorkflowClient;
   clientForGdr: ClientForGdr;
   instance: WorkflowInstance;
@@ -5822,8 +5711,10 @@ export declare interface InstanceSession {
   /** Best-effort projection against the held content + held guards. The first
    *  call resolves the caller's identity/grants from the client's token over
    *  the network (cached per client) — plus each foreign subject resource's
-   *  grants through its own client, for the subject-write forecast;
-   *  evaluation itself runs in-memory on groq-js. */
+   *  grants through its own client, for the subject-write forecast. The held
+   *  snapshot is not refetched. Missing references receive completed availability
+   *  metadata checks; a guard predicate using `->` reads its target
+   *  through the bound engine client. */
   evaluate(): Promise<WorkflowEvaluation>;
   /** Advance the instance against the held content: cascade auto-transitions,
    *  deploy guards, queue effects, commit with `ifRevisionId`. */
@@ -5930,6 +5821,14 @@ export declare interface InstancesQueryFilter {
   definition?: string;
   /** Current stage name. */
   stage?: string;
+  /** Current viewer assignment filter. `unrouted` needs no identity match;
+   *  `routed` matches literal role members only while no user holds the
+   *  activity; `held` matches the direct user and shadows every role. */
+  assignment?: {
+    userId: string;
+    roles?: readonly string[] | undefined;
+    states?: readonly AssignmentState[] | undefined;
+  };
   /** Include completed/aborted instances (default: in-flight only). */
   includeCompleted?: boolean;
   /**
@@ -5957,9 +5856,9 @@ export declare interface InstancesQueryFilter {
 /**
  * Whether {@link document} is in {@link instance}'s reactive watch-set — the
  * reverse of {@link subscriptionDocumentsForInstance}. Both derive from
- * {@link collectWatchRefs}, the single source of truth, so "which docs does
+ * the shared watch-ref collector, the single source of truth, so "which docs does
  * this instance watch" and "which instances watch this doc" stay in lockstep
- * — the same way {@link hydrateSnapshot}'s load-set does. Matching is on the
+ * — the same way `hydrateSnapshot`'s load-set does. Matching is on the
  * resource-qualified GDR URI, so a cross-dataset subject (`dataset:A:ds:doc`)
  * never matches a same-id doc in another resource (`dataset:B:ds:doc`).
  *
@@ -6190,6 +6089,9 @@ export declare function lakeGuardId(args: {
   guardName: string;
 }): string;
 
+/** The write operations Content Lake exposes to mutation guards. */
+export declare type LakeMutationGuardAction = "create" | "update" | "delete";
+
 /**
  * The one rule every lake-facing identity check (guard previews/pre-flights, `$can` grant filters)
  * must resolve through to agree with the lake's own `identity()`; binding `actor.id` directly at a
@@ -6248,6 +6150,7 @@ export declare function lintEffectOutputs(
   definition: WorkflowDefinition,
 ): string[];
 
+/** @inline */
 declare type LiteralExpr = {
   type: "literal";
   value: unknown;
@@ -6275,9 +6178,15 @@ export declare interface LogicalRef {
  * reference whose resolved document the consumer opens; deploy checks the
  * `field` variant points at a doc-valued entry.
  */
-export declare type ManualTarget = v.InferOutput<
-  typeof StoredManualTargetSchema
->;
+export declare type ManualTarget =
+  | {
+      type: "url";
+      url: string;
+    }
+  | {
+      type: "field";
+      field: StoredFieldRef;
+    };
 
 /** Returns true iff `document` survives `filter`'s GROQ predicate under the supplied identity. */
 declare function matchesFilter(args: {
@@ -6293,11 +6202,34 @@ declare function matchesFilter(args: {
 export { MAX_COUNTERFACTUAL_INDEX };
 
 /**
- * The engine always writes both stamps together, so a bare `modelVersion` with no
- * `minReaderModel` is malformed foreign data; that case reads the version itself as the
- * floor (conservative fallback).
+ * The engine always writes both stamps together, so a bare `modelVersion` with no
+ * `minReaderModel` is malformed foreign data; that case reads the version itself as the
+ * floor (conservative fallback).
+ */
+export declare function minReaderModelOf(doc: object): number;
+
+/**
+ * A selected document absent from the evaluated snapshot. Absence alone does
+ * not prove deletion. When present, `availability` carries the completed check.
+ * This evidence is derived for the evaluation and is never persisted.
+ */
+export declare interface MissingDocument {
+  target: EditFieldTarget;
+  reference: GlobalDocumentReference;
+  /** The declared field title, when available. */
+  title?: string;
+  /** Completed availability evidence. Failed or unsupported checks yield `unreadable`.
+   * Omitted when the caller supplied only a content snapshot. */
+  availability?: DocumentAvailability;
+}
+
+/**
+ * Shared formatter for Workflows integrations; not a supported consumer API.
+ * @internal
  */
-export declare function minReaderModelOf(doc: object): number;
+export declare function _missingDocumentsSummary(
+  documents: readonly MissingDocument[],
+): string;
 
 export declare interface MissingHandlerDeployInfo {
   phase: "deploy";
@@ -6314,7 +6246,7 @@ export declare interface MissingHandlerDrainInfo {
 }
 
 /**
- * The `missingHandler: 'fail'` policy tripped: an effect names a handler the
+ * The `effects.missingHandler: 'fail'` policy tripped: an effect names a handler the
  * runtime never registered. `info` carries the phase-specific location
  * (deploy verification vs a drain attempt) so the runtime that opted into
  * failing can report exactly which handler is missing where.
@@ -6339,9 +6271,9 @@ export declare type MissingHandlerPolicy =
  * required when it is `required` AND `input`-sourced (the only combination
  * deploy admits), and as provided when a supplied value matches its name AND
  * kind with a real (non-null) value. Keys on the same name+type as the input
- * read in {@link resolveInputValue}, but is stricter: a present-but-null/
+ * read during input resolution, but is stricter: a present-but-null/
  * undefined value counts as absent here (a required field needs a real
- * value), whereas {@link resolveInputValue} passes a null fill straight
+ * value), whereas input resolution passes a null fill straight
  * through. Exported so pre-flight validators (e.g. mapping validation) share
  * the engine's own rule instead of mirroring it.
  */
@@ -6373,15 +6305,6 @@ export declare class ModelVersionAheadError extends WorkflowError<"model-version
 /** A document with no stamp, or a non-number stamp (foreign data this engine never wrote), reads as model 0. */
 export declare function modelVersionOf(doc: object): number;
 
-/** The lake operations a guard can gate — see the guard types in ./authorization.ts. */
-declare const MUTATION_GUARD_ACTIONS: readonly [
-  "create",
-  "update",
-  "delete",
-  "publish",
-  "unpublish",
-];
-
 /**
  * Inputs to predicate evaluation: the delta-mode natives `before()`/`after()`,
  * the `mutation`, the `guard`, and `identity()`. `before` is null on create,
@@ -6400,7 +6323,7 @@ export declare interface MutationContext {
         _type: string;
       } & Record<string, unknown>)
     | null;
-  action: MutationGuardAction;
+  action: LakeMutationGuardAction;
   /**
    * The caller's principal id in the guarded resource's own namespace
    * (what that lake's `identity()` returns), resolved as `identity()` in
@@ -6410,8 +6333,11 @@ export declare interface MutationContext {
   identity?: string;
 }
 
+/** Lake operations plus the authored lifecycle actions the compiler translates. */
 export declare type MutationGuardAction =
-  (typeof MUTATION_GUARD_ACTIONS)[number];
+  | LakeMutationGuardAction
+  | "publish"
+  | "unpublish";
 
 /**
  * The persisted body of a mutation guard — every field except the lake system
@@ -6444,7 +6370,11 @@ export declare interface MutationGuardBody {
   description?: string;
   /** Bare document ids (resource-local; both published and `drafts.` forms). */
   match: MutationGuardMatch;
-  /** GROQ; empty string = unconditional deny. Bare ids/fields only — no GDRs. */
+  /**
+   * Lake delta-mode GROQ. The root exposes `document.before`,
+   * `document.after`, `mutation`, and `guard`; `identity()` and resource-local
+   * reference dereferencing are available. Empty string is unconditional deny.
+   */
   predicate: string;
   /** Caller-owned projected state the predicate reads as `guard.metadata.*`. */
   metadata: Record<string, unknown>;
@@ -6483,7 +6413,7 @@ export declare class MutationGuardDeniedError extends WorkflowError<"mutation-gu
    */
   static fromGuards(args: {
     documentId: string;
-    action: MutationGuardAction;
+    action: LakeMutationGuardAction;
     guards: readonly MutationGuardDoc[];
   }): MutationGuardDeniedError;
 }
@@ -6541,15 +6471,27 @@ export declare interface NoteItem {
   at?: string | null;
 }
 
-/** An append-only audit/comment log: sugar over `array of object {body, actor, at}` — the `actor`/`at`
- *  names match the `audit` op's stamp fields, so it pairs with it. Never a stored kind. */
+/** @inline */
 declare type NotesField = FieldBase<AuthoringEditable, GroupMembership> & {
   type: "notes";
 };
 
-/** A `field.updateWhere` / `field.removeWhere` op's `where` selects rows to
- *  mutate with rendered-scope GROQ (`$row`, `$params` bound) — row selection, not a gate; an unevaluable row never matches. */
-export declare type Op = v.InferOutput<typeof StoredOpSchema>;
+/**
+ * An action operation: a {@link FieldOp} or a status change on an activity in
+ * the current stage.
+ *
+ * For `field.updateWhere` and `field.removeWhere`, `where` evaluates each row
+ * as `$row`. Caller-fired actions also supply `$params`. Referenced document
+ * content is not loaded for row selection, and an unevaluable row never
+ * matches. An operation matching no rows still records `opApplied` history.
+ */
+export declare type Op =
+  | FieldOp
+  | {
+      type: "status.set";
+      activity: string;
+      status: ActivityStatus;
+    };
 
 /**
  * Op `type` discriminators — the stored mutation primitives.
@@ -6602,6 +6544,11 @@ export declare interface OpAppliedSummary {
   resolved?: Record<string, unknown>;
 }
 
+/** Assignment members for each active activity in the instance's open stage. */
+export declare function openActivityAssignments(
+  instance: AssignmentInstance,
+): readonly (readonly Assignee[])[];
+
 export declare interface OperationArgs {
   instanceId: string;
   /**
@@ -6612,9 +6559,10 @@ export declare interface OperationArgs {
 
 /**
  * What a state-changing verb reports back. Every mutating verb —
- * `startInstance`, `fireAction`, `editField`, `completeEffect`, `tick`,
- * `setStage`, `abortInstance` — returns this one shape, on the namespace,
- * the `Engine`, and the reactive session alike.
+ * `startInstance`, `fireAction`, `editField`, `completeEffect`,
+ * `commitEffectOps`, `tick`, `setStage`, `abortInstance`, `resetActivity` —
+ * returns this one shape, on the namespace, the `Engine`, and the reactive
+ * session alike.
  */
 export declare interface OperationResult {
   /** The instance after the operation + all cascading auto-transitions. */
@@ -6634,6 +6582,18 @@ export declare interface OperationResult {
    *  during the action commit. Surfaced for caller-side assertions and
    *  audit. */
   ranOps?: OpAppliedSummary[];
+  /**
+   * The earliest future ISO 8601 instant the engine can derive for a time-based
+   * change to the instance's evaluation. Schedule the next {@link Engine.tick | tick} for it.
+   * Excludes gates reading `$now` beside a caller variable;
+   * {@link WorkflowEvaluation.nextEvaluationAt} carries those boundaries.
+   * Derived per call, never persisted.
+   *
+   * Absent on a terminal instance or when the engine cannot derive a boundary.
+   * Conditions using date arithmetic may yield no boundary. Time can still
+   * affect a nonterminal instance when this value is absent.
+   */
+  nextEvaluationAt?: string;
 }
 
 export { OUTCOME_MARKS };
@@ -6649,10 +6609,11 @@ export declare function parentRef(
 /**
  * Parse one incoming definition at the deploy/diff boundary (`caller` prefixes
  * the error). Accepts authored content or a fetched definition document — the
- * document envelope is stripped (the inverse of the deploy serialisation, so a
- * fetched document round-trips to `unchanged` instead of fingerprinting its
- * envelope as content), then the remainder strict-parses against the stored
- * schema: any unknown key anywhere in the tree fails loud.
+ * document envelope and the authoring-only `runtime` block are stripped (the
+ * inverse of the deploy serialisation, so a fetched document round-trips to
+ * `unchanged` instead of fingerprinting its envelope as content, and a hosting
+ * kind never changes a definition's version), then the remainder strict-parses
+ * against the stored schema: any unknown key anywhere in the tree fails loud.
  */
 export declare function parseDefinitionInput(
   def: Record<string, unknown>,
@@ -6687,8 +6648,10 @@ export declare interface ParsedGdr {
 }
 
 /**
- * Parse a GDR URI into its scheme + addressing parts. Throws on
- * unknown scheme or malformed shape.
+ * Parses a GDR URI into its scheme and addressing parts. Throws for an
+ * unknown scheme, malformed addressing, or a dataset document ID prefixed
+ * with `drafts.` or `versions.<release>.`. Use the stable document ID and
+ * select draft or release content through {@link WorkflowInstance.perspective}.
  */
 export declare function parseGdr(uri: string): ParsedGdr;
 
@@ -6725,7 +6688,7 @@ export declare function parseResourceGdr(uri: string): WorkflowResource;
 /**
  * A stage's multi-guard deploy failed *after* at least one guard already landed.
  * Those partial locks can't be cleanly undone (guard docs have no transactional
- * deploy). Inside the engine {@link deployOrRollback} rolls the state move back
+ * deploy). Inside the engine `deployOrRollback` rolls the state move back
  * and escalates this to a loud {@link WorkflowStateDivergedError}; a caller that
  * invokes {@link deployStageGuards} directly (without that rollback wrapper) can
  * also see it, so it's exported to be catchable by type.
@@ -6733,7 +6696,14 @@ export declare function parseResourceGdr(uri: string): WorkflowResource;
 export declare class PartialGuardDeployError extends WorkflowError<"partial-guard-deploy"> {
   readonly stageName: string;
   readonly deployed: number;
-  constructor(args: { stageName: string; deployed: number; cause: unknown });
+  /** The cleanup failure, when newly created guards could not be retracted. */
+  readonly rollbackError?: unknown;
+  constructor(args: {
+    stageName: string;
+    deployed: number;
+    cause: unknown;
+    rollbackError?: unknown;
+  });
 }
 
 export declare interface PendingEffect {
@@ -6913,8 +6883,8 @@ export declare function projectStartSliceRow(
  * representation's stored id rides along as `_originalId` — session-side
  * conditions (including the `_originalId in path("versions.**")` shape) then
  * read the same projected identity as the engine's perspective-aware hydration.
- * Strict by construction: only the ids in
- * {@link watchRefRepresentations} are accepted — an id that merely *ends* in
+ * Strict by construction: only a canonical watch-reference representation is
+ * accepted — an id that merely *ends* in
  * the watched id (another doc's dotted id under a version prefix), a release
  * the perspective doesn't read, or a draft the perspective makes invisible is
  * a store routing bug, and projecting it would make content the engine's read
@@ -6964,8 +6934,8 @@ export declare class ReaderModelAcknowledgementError extends WorkflowError<"read
   readonly expectedMinReaderModel: unknown;
   readonly requiredMinReaderModel: number;
   readonly engineMinReaderModel = 4;
-  readonly engineMaxReaderModel = 8;
-  readonly engineModelVersion = 8;
+  readonly engineMaxReaderModel = 10;
+  readonly engineModelVersion = 10;
   readonly documentationUrl = "https://www.sanity.io/docs/workflows/prerelease";
   constructor(
     expectedMinReaderModel: unknown,
@@ -6997,7 +6967,7 @@ export declare function readInstancePreviewDoc(
  * perspective; everything else is content and resolves to its
  * version/draft/published form. This is the single encoding of the rule
  * the {@link WatchSet} `perspective` contract describes to consumers, and
- * the rule {@link hydrateSnapshot} applies on the fetch side.
+ * the rule `hydrateSnapshot` applies on the fetch side.
  */
 export declare function readsRaw(ref: { type: string }): boolean;
 
@@ -7021,7 +6991,11 @@ export declare function refDashboard<TType extends string = string>({
   type,
 }: ResourceRefArgs<TType>): GlobalDocumentReference<TType>;
 
-/** Make a GDR pointer to a project-dataset doc. */
+/**
+ * Creates a typed reference to a dataset document. Pass the stable document
+ * ID; `drafts.` and `versions.<release>.` prefixes throw. Select draft or
+ * release content through {@link WorkflowInstance.perspective}.
+ */
 export declare function refDataset<TType extends string = string>({
   projectId,
   dataset,
@@ -7122,7 +7096,7 @@ export declare function releaseRef({
  * half. Empty unless the instance is `stuck`: a `waiting` instance advances on
  * its own next action (see `availableActions`), and terminal or `progressing`
  * ones need nothing. Each verb is flagged
- * {@link SuggestedRemediation.available} from {@link RUNNABLE_VERBS}.
+ * {@link SuggestedRemediation.available} from the runnable-verb vocabulary.
  */
 export declare function remediationsFor(
   diagnosis: Diagnosis,
@@ -7141,6 +7115,12 @@ export declare type RemediationVerb =
   | "set-stage"
   | "abort";
 
+/** @internal Validated project-member reads shared by workspace adapters; not a supported consumer API. */
+export declare function _requestProjectMembers(
+  request: (options: { url: string }) => Promise<unknown>,
+  projectId: string,
+): Promise<_ClientProjectMember[]>;
+
 /** The reader model a deployment must acknowledge for its submitted definitions. */
 export declare function requiredDefinitionReaderModel(
   definitions: readonly unknown[],
@@ -7180,13 +7160,17 @@ export declare function requiredReaderModel(
   document: unknown,
 ): number;
 
+/** @inline */
 declare type RequirementBase = {
   name: string;
   title?: string | undefined;
   description?: string | undefined;
 };
 
-/** Authored identity and display copy for one readiness requirement. */
+/**
+ * Identity and display copy for an unmet requirement. Authored requirements use
+ * their declared names; required-reference readability checks use `field:<name>`.
+ */
 export declare interface RequirementDescriptor {
   name: string;
   title?: string | undefined;
@@ -7201,17 +7185,14 @@ export declare interface RequirementDescriptor {
  */
 export declare const RESERVED_CONDITION_VARS: readonly string[];
 
-declare const RESET_ACTIVITY_TARGETS: readonly ["active", "skipped"];
-
 export declare interface ResetActivityArgs extends DedupableOperationArgs {
   /** Name of the activity to reset, within the instance's current stage. */
   activity: string;
   /**
-   * What to reset it into. `active` (the default) re-runs the activity — back
-   * in progress, for a caller to drive to completion again; `skipped` bypasses
-   * it — terminal but resolved, so a `$allActivitiesDone`-gated exit transition
-   * can fire. `done` is intentionally not offered: a reset is recovery, not a
-   * silent success.
+   * The target status. `active` (the default) reopens the activity for
+   * caller-fired actions. `skipped` counts the activity as resolved for
+   * `$allActivitiesDone`. Returning to `active` does not repeat a `when`
+   * action that already fired during this stage visit.
    */
   to?: ResetActivityTarget;
 }
@@ -7236,8 +7217,7 @@ export declare type ResetActivityResult =
  * fire). `done` is deliberately absent: a reset is recovery, not a silent
  * declaration that the work succeeded.
  */
-export declare type ResetActivityTarget =
-  (typeof RESET_ACTIVITY_TARGETS)[number];
+export declare type ResetActivityTarget = "active" | "skipped";
 
 /**
  * Resolve the engine's `WorkflowAccess` for a client — actor and grants
@@ -7279,6 +7259,12 @@ export declare interface ResolveClientActorArgs {
   readonly projectId: string;
 }
 
+/** {@link EngineEffectsArgs} after the engine applied its defaults. */
+export declare interface ResolvedEngineEffects {
+  readonly handlers: Readonly<Record<string, EffectHandler>>;
+  readonly missingHandler: MissingHandlerPolicy;
+}
+
 /**
  * A resolved field entry as the engine persists it on an instance.
  * Discriminated by `_type` (bare — unique within this union); the `value`
@@ -7337,9 +7323,22 @@ export declare function resolveFieldEntry(
 ): ResolvedFieldEntry | undefined;
 
 /**
- * Resolve advisory `$attributes` for the caller-bound projection — project →
- * org → global-host attributes page. Cached per (client, orgId). Expected
- * absences (401–404) leave the bag unbound; unexpected failures throw.
+ * Resolves telemetry build or execution mode from `NODE_ENV`.
+ * `production` stays `production`; `development` and `test` map to `development`.
+ * Other values use the required fallback: CLI and MCP pass `production`, SDK
+ * passes `development`. This does not identify the target deployment or dataset.
+ * Unsupported outside the Workflows packages.
+ * @internal
+ */
+export declare function _resolveTelemetryEnvironment(
+  nodeEnv: string | undefined,
+  fallback: "development" | "production",
+): "development" | "production";
+
+/**
+ * Resolve the caller's advisory `$attributes`. Results are cached per client
+ * and organization. Expected absences (401–404) leave attributes undefined;
+ * unexpected failures throw.
  * Call only from soft-gate paths (evaluate / fireAction filter re-check /
  * editField), never from ticks or drainers.
  */
@@ -7398,7 +7397,7 @@ export declare function resourceFromParsed(parsed: ParsedGdr): WorkflowResource;
 export declare function resourceGdr(res: WorkflowResource): string;
 
 /** Args for the single-resource ref constructors ({@link refCanvas}, {@link refMediaLibrary}, {@link refDashboard}). */
-declare interface ResourceRefArgs<TType extends string> {
+export declare interface ResourceRefArgs<TType extends string> {
   resourceId: string;
   documentId: string;
   type: TType;
@@ -7436,35 +7435,30 @@ export declare function retractStageGuards(args: StageGuardArgs): Promise<void>;
  * literal ownership values and are not widened by this map. The authored `"*"`
  * key lists universal fulfillers and is normalized before persistence.
  */
-export declare type RoleAliases = v.InferOutput<typeof RoleAliasesSchema>;
+export declare type RoleAliases = Record<string, string[]>;
 
-declare const RoleAliasesSchema: v.RecordSchema<
-  v.SchemaWithPipe<
-    readonly [
-      v.StringSchema<undefined>,
-      v.MinLengthAction<string, 1, "must be a non-empty string">,
-    ]
-  >,
-  v.SchemaWithPipe<
-    readonly [
-      v.ArraySchema<
-        v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >,
-        undefined
-      >,
-      v.MinLengthAction<
-        string[],
-        1,
-        "a role alias must list at least one fulfilling role"
-      >,
-    ]
-  >,
-  undefined
->;
+/**
+ * The `runtime` block on a deployment and on `defineWorkflow`. A workflow that
+ * declares none inherits its deployment's kind, and a deployment that declares
+ * none hosts on `'function'`. Authoring-only: the deploy strips it and stores
+ * nothing.
+ *
+ * It is a hint to the generator and to callers, never a rule the engine
+ * enforces. The engine never sees it: any engine built anywhere with a handler
+ * for an effect drains that effect when it calls `drainEffects`, whatever kind
+ * the node declares, so a `'selfHosted'` effect is drained by whoever registers
+ * its handler, the Studio included.
+ */
+export declare interface RuntimeBlock {
+  kind: RuntimeKind;
+}
+
+/**
+ * Where the generated unattended runtime hosts a workflow or an effect.
+ * `'function'` is a plain Sanity Function, `'durableFunction'` a durable one,
+ * and `'selfHosted'` a process you run yourself.
+ */
+export declare type RuntimeKind = "function" | "durableFunction" | "selfHosted";
 
 /** Whether two workflow resources address the same place. */
 export declare function sameResource(
@@ -7472,8 +7466,15 @@ export declare function sameResource(
   b: WorkflowResource,
 ): boolean;
 
-/** Inclusive scalar bounds. String/text bounds measure character length;
- * number bounds measure the numeric value. */
+/**
+ * Inclusive bounds for `string`, `text`, `number`, or `progress` values.
+ * String/text bounds count characters and must be non-negative integers.
+ * Number bounds are finite numeric values. Progress bounds may only narrow
+ * its inclusive 0–100 range.
+ *
+ * Supply at least one bound. When both are present, `min` must not exceed
+ * `max`. Null values remain allowed unless an input is required separately.
+ */
 export declare interface ScalarValidation {
   min?: number | undefined;
   max?: number | undefined;
@@ -7549,6 +7550,13 @@ export declare type SignalSemantic = (typeof SIGNAL_SEMANTICS)[number];
  */
 export declare const silentLogger: EngineLogger;
 
+/**
+ * A start requirement that rejects a fresh start when an unfinished run of
+ * this definition holds the same subject, across deployed versions.
+ * The workflow must declare an input-sourced `subject` field. Names are unique
+ * within the requirements array. Like other engine checks, this is advisory;
+ * it is not Content Lake enforcement.
+ */
 export declare type SingleSubjectRequirement = RequirementBase & {
   type: "singleSubject";
 };
@@ -7584,6 +7592,24 @@ export declare interface SiteConsequence {
   after: ConditionOutcome;
 }
 
+/**
+ * Suspends for `ms` before resolving. The engine's only deliberate wait is a
+ * `retry` policy's backoff between attempts inside one `drainEffects` call, so
+ * a deterministic harness substitutes one that moves its {@link Clock} instead
+ * of spending real time. Injected once beside the clock, never per call.
+ *
+ * A substitute must not resolve before `ms` has passed on whatever clock the
+ * engine reads: a policy's pacing and its `expiryMs` window are both judged
+ * against that clock.
+ */
+export declare type Sleeper = (ms: number) => Promise<void>;
+
+/** Pure resource-local dereferencing for held snapshot evaluation. */
+export declare function snapshotGuardDereference(args: {
+  snapshot: HydratedSnapshot;
+  resource: WorkflowResource;
+}): GuardDereference;
+
 /** One statically invalid parent-to-child spawn contract found at deploy. */
 export declare type SpawnContractIssue =
   | {
@@ -7606,16 +7632,18 @@ export declare class SpawnContractsInvalidError extends WorkflowError<"spawn-con
 }
 
 /**
- * A pure container — name, fields, guards, activities, transitions, no
- * behaviour of its own. Activities own enter, transitions own exit and
- * arrival; a stage with no transitions IS terminal (structural, nothing to
- * declare or mis-declare). `guards` are lake mutation guards active while
- * the stage holds, each compiling to a persisted guard document deployed on
- * stage entry and retracted on exit. `editable` is a tighten-only override
- * for the time the stage holds, keyed by an in-scope field name: the field's
- * own `editable` is the ceiling, ANDed with the stage value at runtime, so an
- * override can only NARROW — never open a field the baseline left closed. An
- * unlisted field inherits its baseline.
+ * The fields, activities, guards, and outgoing routes for one stage visit.
+ * A stage with no transitions is terminal: entering it completes the instance,
+ * and it cannot declare activities. Put completion work in the source stage
+ * or give the working stage an outgoing transition.
+ *
+ * Guards are registered on entry and retracted on exit. `editable` overrides
+ * are keyed by in-scope field name and apply while the stage is current.
+ * Each combines with the field's own edit condition using AND, so an override
+ * can restrict editing but cannot open a field whose baseline is closed.
+ * An unlisted field inherits its baseline.
+ *
+ * @interface
  */
 export declare type Stage = StageFields<
   FieldEntry,
@@ -7662,7 +7690,7 @@ export declare interface StageEvaluation {
   autonomy: StageAutonomy;
 }
 
-/** Type-mirror of {@link stageFields}, parameterised over field/activity/transition/guard/editable. */
+/** @inline */
 declare type StageFields<TField, TActivity, TTransition, TGuard, TEditable> = {
   name: string;
   semantics?: Semantic[] | undefined;
@@ -7676,7 +7704,7 @@ declare type StageFields<TField, TActivity, TTransition, TGuard, TEditable> = {
   editable?: Record<string, TEditable> | undefined;
 };
 
-declare interface StageGuardArgs {
+export declare interface StageGuardArgs {
   client: WorkflowClient;
   clientForGdr: ClientForGdr;
   instance: WorkflowInstance;
@@ -7737,8 +7765,6 @@ export declare const START_FILTER_VARS: readonly {
   description: string;
 }[];
 
-declare const START_KINDS: readonly ["interactive", "autonomous"];
-
 /**
  * The vars a definition's start GROQ requirements read — the start-time readiness
  * dialect: everything the filter context binds ({@link START_FILTER_VARS})
@@ -7755,17 +7781,24 @@ export declare const START_REQUIREMENT_VARS: readonly {
 }[];
 
 /**
- * How standalone runs of this workflow begin. `filter` is a READ-SIDE
- * visibility predicate — "should a start surface offer this workflow for
- * this document?" — evaluated by `definitionsForDocument`/applicability in
- * the browse-time-pure start-filter context (`$tag`/`$definition`/`$now`
- * bound; `$fields` cannot exist before inputs do, so a `$fields` read here
- * is deploy-rejected). It is NOT a `startInstance` gate; the verb never
- * reads it. `requirements` are named readiness checks evaluated in author
- * order in the start-time context (GROQ nodes add `$fields`; `singleSubject`
- * is the one-in-flight-run-per-subject rule) — every node must pass before
- * `startInstance` commits. Both are advisory like every engine-side check;
- * the Content Lake remains the only enforcement point.
+ * Discovery and readiness rules for standalone starts.
+ * `filter` evaluates against a candidate document with `$tag`, `$definition`,
+ * and `$now`. It controls discovery and never gates `startInstance`.
+ * It cannot read `$fields` or caller variables.
+ *
+ * `requirements` evaluates named checks in declaration order before a fresh
+ * standalone start. All must pass. Resuming an existing start and spawning
+ * children do not rerun these checks. A GROQ requirement binds `$tag`,
+ * `$definition`, `$now`, and `$fields`, with no candidate document root.
+ * `$fields` contains supplied input values, including GDR reference envelopes;
+ * it excludes computed defaults and hydrated document content.
+ *
+ * At both sites, `*` scans projected instances in the engine's tag. Each row
+ * contains only `definition` (name), `subject` (GDR URI or null), and
+ * `completedAt` (ISO timestamp or null). Completed and aborted runs are
+ * included. Raw fields such as `_type`, `tag`, and `fields` are unavailable.
+ * Use {@link SingleSubjectRequirement} for one unfinished run per subject.
+ * These checks are advisory; the Content Lake remains the enforcement point.
  */
 export declare type StartBlock = StartFields & {
   kind: StartKind;
@@ -7828,6 +7861,7 @@ export declare interface StartEvaluation {
   invalidInitialFields: InitialFieldIssue[];
 }
 
+/** @inline */
 declare type StartFields = {
   filter?: string | undefined;
   requirements?: StartRequirement[] | undefined;
@@ -7836,7 +7870,7 @@ declare type StartFields = {
 /**
  * Project caller-supplied `initialFields` into the `$fields` map the
  * start-requirement context binds: one key per declared `input`-sourced entry,
- * resolved through {@link suppliedFieldFor} — the predicate can only ever see
+ * resolved through the supplied-field lookup — the predicate can only ever see
  * a value the input resolution would persist, and an undeclared supplied name
  * never leaks in. Unsupplied (or null-supplied) entries stay unbound, so a
  * read of one is GROQ null. Document references bind as their GDR envelopes
@@ -7870,15 +7904,19 @@ export declare interface StartInstanceArgs {
   initialFields?: InitialFieldValue[];
   ancestors?: GlobalDocumentReference[];
   /**
-   * The instance's start seed — stable named values set once at start (or
-   * handed down by a parent's `spawn.context`) and never mutated after.
+   * Stable named values supplied when starting this instance. They cannot
+   * be changed after start.
    * Effect bindings and conditions read them as `$context.<name>`; the
    * `$effects` bag is separate (completed effects' outputs only).
    *
-   * Each value may be any JSON — a scalar, a {@link GlobalDocumentReference},
+   * Values supplied directly to start may be any JSON: a scalar,
+   * a {@link GlobalDocumentReference},
    * or an arbitrary object/array. Scalars and GDRs store as their typed
    * `context` entries; anything else stores as one `context.json`
    * entry, so all forms read back the same under `$context.<name>`.
+   * A parent's `spawn.context` has a narrower contract: only strings, numbers,
+   * booleans, and full GDRs are accepted; nullish results are omitted, and
+   * other objects or arrays reject the spawn.
    */
   context?: StartContext;
   /**
@@ -7904,15 +7942,22 @@ export declare interface StartInstanceArgs {
    */
   grantsFromPath?: string;
   /**
-   * Optional read-side perspective for this instance. Threaded into
-   * field-entry query resolution and spawn `forEach.groq` discovery so
-   * a workflow can scope its reads to a Content Release stack. Child
-   * instances inherit the parent's perspective on spawn.
+   * Perspective for content reads, including field queries and subworkflow
+   * discovery. An explicit value applies to workflow-field initialization
+   * and subsequent reads.
+   *
+   * When omitted, workflow-field queries at start use `drafts`. After those
+   * fields resolve, the instance uses `[releaseName]` from its first populated
+   * workflow `release.ref` field, or `drafts` when none is populated.
+   * Under `drafts`, drafts take precedence over published content.
+   *
+   * A child's workflow fields initialize under its parent's perspective.
+   * Afterward, the child's first populated workflow `release.ref` field
+   * selects its release perspective; otherwise it inherits the parent's.
    *
-   * Pass `[releaseName]` for a workflow whose subject is a release;
-   * pass `[releaseName, "drafts"]` to also include drafts; omit for
-   * the engine's default (no perspective override = `"raw"` on the
-   * test client).
+   * Pass `[releaseName]` to read under a Content Release, or
+   * `[releaseName, 'drafts']` to include drafts. Engine-owned instance and
+   * definition documents, and `system.release` documents, always read under `raw`.
    */
   perspective?: WorkflowPerspective;
 }
@@ -7926,7 +7971,7 @@ export declare interface StartInstanceArgs {
  * path for every kind, and an interactive start of an autonomous workflow is
  * legal.
  */
-export declare type StartKind = (typeof START_KINDS)[number];
+export declare type StartKind = "interactive" | "autonomous";
 
 /**
  * The declared {@link StartKind} of a definition, defaulting the absent
@@ -7996,282 +8041,65 @@ export declare class StartNotSettledError extends WorkflowError<"start-not-settl
 /** Advisory only, per {@link isStartableDefinition} — a start surface has no parent context to give a spawn-only child, so it rejects fast with this message instead. */
 export declare function startRefusal(definition: {
   lifecycle?: WorkflowLifecycle | undefined;
-}): string | undefined;
-
-/** Every named readiness requirement accepted by workflow `start.requirements`. */
-export declare type StartRequirement =
-  | GroqRequirement
-  | SingleSubjectRequirement;
-
-export declare interface StartRequirementEvaluation extends RequirementDescriptor {
-  /** Whether this requirement is satisfied, unsatisfied, or not yet decidable. */
-  outcome: ConditionOutcome;
-  /** GROQ explanation; absent for non-GROQ requirement kinds. */
-  insight?: ConditionInsight | undefined;
-}
-
-/**
- * The caller-side half of the start contexts — everything the evaluating
- * surface knows that the definition doesn't. Every member is optional
- * because the surfaces genuinely differ (a pure consumer may hold no clock):
- * An absent binding evaluates each read of it to GROQ null, and where that
- * null lands decides the verdict — a predicate that can't decide without
- * the binding fails closed, while a count-of-matches clause over values
- * every row stores passes vacuously (in GROQ null equals only null, so the
- * unbound read matches no stored value). The vars themselves are
- * inventoried in `START_FILTER_VARS` / `START_REQUIREMENT_VARS`; the caller's
- * `$fields` map is NOT scope — `start.filter` never binds it, and
- * `explainStartRequirement` takes it as its own argument.
- */
-export declare interface StartScope {
-  /** The engine's tag partition — binds `$tag`. */
-  tag?: string | undefined;
-  /** ISO clock reading — binds `$now`. */
-  now?: string | undefined;
-  /** Resource-qualified identity of the prospective subject. Unlike a loaded
-   *  document's bare `_id`, this stays collision-free across resources. */
-  subject?: GdrUri | undefined;
-  /**
-   * The engine-owned start slice, for predicates that read `*[...]` or for a
-   * `singleSubject` requirement — invoked lazily only when evaluation needs it.
-   * Each row exposes exactly `{definition, subject, completedAt}`; completed
-   * rows are included, so authors qualify in-flight
-   * themselves (`!defined(completedAt)`). Absent ⇒ a dataset-reading filter
-   * fails closed (this surface cannot see the dataset, so it cannot decide),
-   * while a dataset-reading requirement THROWS — see
-   * {@link explainStartRequirement}.
-   */
-  fetchDataset?: (() => Promise<unknown[]>) | undefined;
-}
-
-export declare interface StartSliceRow {
-  definition: string;
-  subject: GdrUri | null;
-  completedAt: string | null;
-}
-
-declare const StoredEditableSchema: v.UnionSchema<
-  [
-    v.LiteralSchema<true, undefined>,
-    v.SchemaWithPipe<
-      readonly [
-        v.StringSchema<undefined>,
-        v.MinLengthAction<string, 1, "must be a non-empty string">,
-      ]
-    >,
-  ],
-  undefined
->;
-
-/**
- * The `field.*` subset — every mutation op EXCEPT `status.set`. Shared by the
- * boundaries that write fields but must not set an activity status: a transition
- * (its stage's activities are tearing down, so `status.set` has no coherent
- * target) and an effect's completion (an effect is OUTSIDE the activity's own
- * awaiting — it reports its result through fields, never by flipping a status;
- * the activity/stage gate then reads those fields). The full {@link StoredOpSchema}
- * (these plus `status.set`) is what actions and activity boundaries carry.
- */
-declare const StoredFieldOpSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.set", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.setIfMissing", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.unset", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.append", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.inc", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.dec", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.updateWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.removeWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
+}): string | undefined;
+
+/** Every named readiness requirement accepted by workflow `start.requirements`. */
+export declare type StartRequirement =
+  | GroqRequirement
+  | SingleSubjectRequirement;
+
+export declare interface StartRequirementEvaluation extends RequirementDescriptor {
+  /** Whether this requirement is satisfied, unsatisfied, or not yet decidable. */
+  outcome: ConditionOutcome;
+  /** GROQ explanation; absent for non-GROQ requirement kinds. */
+  insight?: ConditionInsight | undefined;
+}
+
+/**
+ * The caller-side half of the start contexts — everything the evaluating
+ * surface knows that the definition doesn't. Every member is optional
+ * because the surfaces genuinely differ (a pure consumer may hold no clock):
+ * An absent binding evaluates each read of it to GROQ null, and where that
+ * null lands decides the verdict — a predicate that can't decide without
+ * the binding fails closed, while a count-of-matches clause over values
+ * every row stores passes vacuously (in GROQ null equals only null, so the
+ * unbound read matches no stored value). The vars themselves are
+ * inventoried in `START_FILTER_VARS` / `START_REQUIREMENT_VARS`; the caller's
+ * `$fields` map is NOT scope — `start.filter` never binds it, and
+ * `explainStartRequirement` takes it as its own argument.
+ */
+export declare interface StartScope {
+  /** The engine's tag partition — binds `$tag`. */
+  tag?: string | undefined;
+  /** ISO clock reading — binds `$now`. */
+  now?: string | undefined;
+  /** Resource-qualified identity of the prospective subject. Unlike a loaded
+   *  document's bare `_id`, this stays collision-free across resources. */
+  subject?: GdrUri | undefined;
+  /**
+   * The engine-owned start slice, for predicates that read `*[...]` or for a
+   * `singleSubject` requirement — invoked lazily only when evaluation needs it.
+   * Each row exposes exactly `{definition, subject, completedAt}`; completed
+   * rows are included, so authors qualify in-flight
+   * themselves (`!defined(completedAt)`). Absent ⇒ a dataset-reading filter
+   * fails closed (this surface cannot see the dataset, so it cannot decide),
+   * while a dataset-reading requirement THROWS — see
+   * {@link explainStartRequirement}.
+   */
+  fetchDataset?: (() => Promise<unknown[]>) | undefined;
+}
+
+export declare interface StartSliceRow {
+  definition: string;
+  subject: GdrUri | null;
+  completedAt: string | null;
+}
 
-/** A field reference with `scope` already resolved — the form every op target carries. */
+/**
+ * A field reference with `scope` already resolved — the form every op target carries.
+ *
+ * @interface
+ */
 export declare type StoredFieldRef = v.InferOutput<typeof StoredFieldRefSchema>;
 
 declare const StoredFieldRefSchema: v.StrictObjectSchema<
@@ -8290,273 +8118,16 @@ declare const StoredFieldRefSchema: v.StrictObjectSchema<
   undefined
 >;
 
-declare const StoredManualTargetSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"url", undefined>;
-        readonly url: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.UrlAction<string, "must be a valid URL">,
-            v.CheckAction<string, "must be an http(s) URL">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field", undefined>;
-        readonly field: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
-
-declare const StoredOpSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.set", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.setIfMissing", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.unset", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.append", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.inc", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.dec", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.updateWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.removeWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"status.set", undefined>;
-        readonly activity: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly status: v.PicklistSchema<
-          readonly ["active", "done", "skipped", "failed"],
-          string
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
-
 export declare function stripSystemFields(
   doc: Record<string, unknown>,
 ): Record<string, unknown>;
 
 /**
- * Why an in-flight instance is genuinely blocked — nothing advances it on its
- * own OR via a normal action. Ordered most- to least-actionable in
- * {@link diagnoseInstance}: a failed effect is the root cause even when it left
- * its activity looking merely "active", so it wins over the activity- and
- * transition-level symptoms it produces. Note an active activity awaiting a human
- * action is NOT here — that's the healthy {@link Diagnosis} `waiting` state.
+ * A fault or missing dependency in an in-flight instance. Missing documents
+ * follow effect/activity faults and precede transition faults. The diagnosis
+ * is advisory: it does not prohibit actions that can still run.
+ * An active activity awaiting a human action is the healthy
+ * {@link Diagnosis} `waiting` state.
  *
  * `transition-unevaluable` is the recoverable arm: every activity resolved,
  * but an exit transition's `when` came back GROQ `null` (a referenced operand
@@ -8565,6 +8136,10 @@ export declare function stripSystemFields(
  * definite `false`. It carries the undecidable transitions.
  */
 export declare type StuckCause =
+  | {
+      kind: "document-missing";
+      documents: MissingDocument[];
+    }
   | {
       kind: "failed-effect";
       effect: EffectHistoryEntry;
@@ -8609,7 +8184,7 @@ export declare interface SubjectPermissionDenial {
   permission: DocumentValuePermission;
 }
 
-declare interface SubjectResourceAccess {
+export declare interface SubjectResourceAccess {
   grants: Grant[];
   /** The actor's principal id in this resource's own namespace: per-project user id for a dataset resource, account-global id for an org-level one. */
   actorId: string;
@@ -8719,17 +8294,29 @@ export declare interface SubworkflowEntry {
 }
 
 /**
- * Fan-out declared as an action's `spawn`, read back as `$subworkflows`.
- * `forEach` is GROQ producing one row per subworkflow (bound as `$row`); each
- * row needs an identity the engine can adopt on re-entry (`_key` ?? `_id` ??
- * GDR `id`, or the value itself for a scalar row) or the spawn fails.
- * `definition` resolves by stable `name`, ordered `version desc` unless
- * pinned. `with` seeds each child's initial fields; `context` delivers extra
- * parent-scope values into the child's `$context`. `onExit` governs only
- * still-live children when the cohort's scope stops applying: `'detach'`
- * (default) lets them run to completion, `'abort'` kills them recursively —
- * always an authored choice, never automatic. Whether the PARENT may move at
- * all is a separate gate over `$subworkflows`.
+ * Child workflows created by an action's `spawn`, exposed as `$subworkflows`.
+ * `definition` selects the highest deployed version unless a version is pinned.
+ *
+ * `forEach` evaluates with workflow fields only and no caller variables, even
+ * for a caller-fired action. Rows need unique identities: a nonempty `_key`,
+ * then `_id`, then a GDR's `id`, or a scalar's string representation.
+ * Missing or duplicate identities reject the spawn. Re-entry adopts matching
+ * live children from the same activity, action, and definition instead of
+ * duplicating them.
+ *
+ * `with` maps child input-field names to expressions evaluated with `$row`.
+ * `context` evaluates once without `$row` and supplies the child's `$context`.
+ * Both use the parent activity's field scope and the acting identity when
+ * available. Neither binds `$can`, `$attributes`, or `$params`.
+ * Context results must be strings, numbers, booleans, or full GDRs; null and
+ * undefined omit the entry. Other objects and arrays reject the spawn.
+ *
+ * `onExit` governs live children when their cohort leaves scope: `detach`
+ * (the default) leaves them running; `abort` stops them recursively. Aborting
+ * the parent always stops its children. Parent transitions must separately
+ * declare whether they wait for the cohort to settle.
+ *
+ * @interface
  */
 export declare type Subworkflows = v.InferOutput<typeof SubworkflowsSchema>;
 
@@ -8861,13 +8448,15 @@ export declare const SYSTEM_IDENTITY = "<system>";
 export declare function tagScopeFilter(): string;
 
 /**
- * Internal telemetry-injection seam for the raw `workflow.*` verbs — the
- * telemetry twin of the `Clocked` seam in `clock.ts`, deliberately not
- * re-exported from the package root. Production injects a logger ONCE via
- * `createEngine({ telemetry })`; a raw-namespace caller that omits it
- * emits nothing (the verbs default to {@link noopTelemetry}).
+ * Optional telemetry-injection field on the raw `workflow.*` verbs — the
+ * telemetry twin of the `Clocked` seam in `clock.ts`. It is exported
+ * because those verbs expose this composition helper in their public
+ * signatures, but production normally injects a logger once via
+ * `createEngine({ telemetry })`, not as an everyday per-call option. A
+ * raw-namespace caller that omits it emits nothing (the verbs default to
+ * {@link noopTelemetry}).
  */
-declare type Telemetered<T> = T & {
+export declare type Telemetered<T> = T & {
   telemetry?: WorkflowTelemetryLogger;
 };
 
@@ -8897,7 +8486,7 @@ export declare interface TelemetryIntake {
  *  closes the socket (a `Promise.race` alone cannot). */
 export declare interface TelemetryIntakeClient {
   request: <T>(opts: {
-    uri: string;
+    url: string;
     method?: string;
     body?: unknown;
     tag?: string;
@@ -8913,14 +8502,7 @@ export declare interface TelemetryIntakeClient {
  * `$allActivitiesDone` — a `failed` activity blocks it permanently, surfacing
  * via `$anyActivityFailed`.
  */
-declare const TERMINAL_ACTIVITY_STATUSES: readonly [
-  "done",
-  "skipped",
-  "failed",
-];
-
-export declare type TerminalActivityStatus =
-  (typeof TERMINAL_ACTIVITY_STATUSES)[number];
+export declare type TerminalActivityStatus = "done" | "skipped" | "failed";
 
 /** See {@link terminalState}. */
 export declare type TerminalState = "aborted" | "completed" | "in-flight";
@@ -8943,8 +8525,7 @@ export declare function terminalState(
  */
 export declare function toBareId(id: string): string;
 
-/** Ad-hoc, status-tracked work items: sugar over `array of object {label, status, assignee?, dueDate?}`; a plain checklist is that with `{label, status}` alone.
- *  Its `dueDate` is a `date` column named `dueDate`, not the elevated `dueDate` kind, which reserves one deadline slot per level. Never a stored kind. */
+/** @inline */
 declare type TodoListField = FieldBase<AuthoringEditable, GroupMembership> & {
   type: "todoList";
 };
@@ -8962,19 +8543,20 @@ export declare interface TodoListItem {
   _key: string;
   label: string;
   status?: string | null;
-  assignee?: Assignee | null;
+  /** Singular assignment slot: any number of routing roles and at most one user. */
+  assignee?: Assignee[];
   dueDate?: string | null;
 }
 
 /**
- * A pure edge — `{name, when, to}` plus presentation, no ops or effects
- * (structure never does; only actions do). Every transition is evaluated on
- * every commit and cascade; the first truthy `when` in declaration order
- * fires. No action coupling: a routing difference is written into fields by
- * an action and read by the trigger — arrival work is a `when: 'true'`
- * action in the destination stage, and exit work is an action in the source
- * stage whose `when` repeats this transition's condition (the hop rule
- * guarantees it commits before the move).
+ * A one-way route to another stage, without operations or effects. Selection
+ * checks `when` conditions in declaration order. The first satisfied condition
+ * fires; an earlier unevaluable condition, such as GROQ null, stops selection
+ * without considering later routes. A false condition permits the next route.
+ *
+ * Actions write routing decisions into fields; transitions read that state.
+ * Source-stage triggered actions run before transition selection. Arrival work
+ * belongs to a triggered action in a nonterminal destination stage.
  */
 export declare type Transition = TransitionFields & {
   when: string;
@@ -9003,8 +8585,7 @@ export declare interface TransitionEvaluation {
   insight: ConditionInsight;
 }
 
-/** Type-mirror of {@link transitionFields} minus `when` — stored requires it,
- *  authoring omits it (desugar fills the default), so each variant declares it. */
+/** @inline */
 declare type TransitionFields = {
   name: string;
   title?: string | undefined;
@@ -9094,19 +8675,28 @@ export declare function validateDefinition(
 
 export declare function validateTag(tag: string): void;
 
-declare interface ValidationIssue {
+export declare interface ValidationIssue {
   path: ReadonlyArray<PropertyKey>;
   message: string;
 }
 
 /**
- * An op's write payload, resolved to concrete JSON when the op applies. Each
- * context-bound arm has a rendered `$`-twin in conditions (`actor` ↔
- * `$actor`, `now` ↔ `$now`, `self` ↔ `$self`), so learning one side teaches
- * the other. Distinct from {@link FieldSource}, a field's seed recipe.
+ * An operation's write value, resolved when the operation applies.
+ * `param` reads a caller-supplied action argument; `actor` records the acting
+ * identity. `now` supplies the operation's ISO timestamp, `self` its instance's
+ * GDR URI, and `stage` the current stage name. `object` resolves its fields
+ * recursively.
+ *
+ * A `fieldRead` with no scope searches activity, stage, then workflow fields.
+ * An explicit scope searches only that scope. A pathless read from a subject
+ * or `doc.ref` into another subject or `doc.ref` preserves the stored reference.
+ * Other reads use the referenced snapshot document, or only its `_id` and
+ * `_type` when it is not loaded. No additional documents are fetched.
+ * Initialization uses {@link FieldSource}, whose field-read scope rules differ.
  */
 export declare type ValueExpr = ValueExprInternal;
 
+/** @inline */
 declare type ValueExprInternal =
   | LiteralExpr
   | FieldReadExpr
@@ -9207,17 +8797,20 @@ export { withAssignment };
 
 export declare const workflow: {
   /**
-   * Deploy a set of definitions as one call. Definitions are immutable and
-   * content-addressed: the author writes no version, identical content no-ops
-   * (`unchanged`), and any change mints the next version (`created`) — deploy
-   * never patches a deployed version out from under the instances pinned to it.
-   * The engine orders the batch itself (children before the parents that spawn
-   * them). Refs may point inside the batch or at already-deployed definitions;
-   * a ref resolving to neither, or a cycle, errors before any write. Input is
-   * authored content or a fetched definition document — the document envelope
-   * (`_*` system fields, `tag`, `version`, `contentHash`) is stripped at the
-   * boundary and never fingerprinted, so a fetched document redeploys as
-   * `unchanged`; any other unknown key fails loud.
+   * Deploys immutable definition versions. The engine assigns each version:
+   * content matching the latest deployed fingerprint returns `unchanged`;
+   * otherwise deployment creates the next version and returns `created`.
+   * Redeploying older content creates a new version; existing versions and
+   * their pinned instances are unchanged.
+   *
+   * Children deploy before parents. References may resolve within the batch
+   * or to deployed definitions; unresolved references and cycles reject the
+   * batch before any write.
+   *
+   * Accepts authored content or a fetched definition document. The document
+   * envelope (`_*` system fields, `tag`, `version`, `contentHash`) is excluded
+   * from the fingerprint. Fetched content follows the same latest-version
+   * comparison; any other unknown input key is rejected.
    */
   deployDefinitions: <T extends WorkflowDefinitionInput<T>>(
     rawArgs: Telemetered<DeployDefinitionsArgs<T> & EngineScopeArgs>,
@@ -9225,9 +8818,8 @@ export declare const workflow: {
   /**
    * Remove a deployed definition (all versions, or one via `version`). Refuses
    * while non-terminal instances exist unless `cascade` aborts them first —
-   * instances are never deleted, only aborted in place; see
-   * {@link deleteDefinitionInternal} for the full contract (spawn-referrer
-   * check, guard-doc housekeeping).
+   * instances are never deleted, only aborted in place. The operation also
+   * checks spawn referrers and cleans up guard documents.
    */
   deleteDefinition: (
     rawArgs: Clocked<Telemetered<DeleteDefinitionArgs & EngineScopeArgs>>,
@@ -9344,8 +8936,8 @@ export declare const workflow: {
   ) => Promise<OperationResult>;
   /**
    * Admin override — hard-stop an in-flight instance where it stands. No stage
-   * move, no transition effects, pending effects cancelled; see
-   * {@link abortAndPropagate} for the abort + ancestor-propagation contract.
+   * move, no transition effects, pending effects cancelled. The abort
+   * propagates through affected ancestor instances.
    * Propagated, not cascaded — the instance is terminal, so `cascaded` is
    * always `0` and ancestor movement is reported on the ancestors, not here.
    * `changed: false` means the instance was already terminal.
@@ -9534,8 +9126,6 @@ export declare const WORKFLOW_DEFINITION_TYPE = "sanity.workflow.definition";
  */
 export declare const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
 
-declare const WORKFLOW_LIFECYCLES: readonly ["standalone", "child"];
-
 /**
  * The engine's view of "who am I, what can I do?". `actor` is who
  * the engine stamps onto history / `completedBy` / `ValueExpr.actor` —
@@ -9593,17 +9183,20 @@ export declare interface WorkflowAutonomy extends AutonomyAnswer {
 }
 
 export declare interface WorkflowClient {
+  /** Build a resource-bound data URL, as on SanityClient. Used to confirm document availability. */
+  getDataUrl?: (operation: string, path?: string) => string;
   /**
-   * Read the effective client configuration. The engine reads two fields from
-   * it. `apiHost` is probed before deriving the global `/users/me` sibling,
-   * because `@sanity/client` shallow-merges `withConfig` overrides and
-   * otherwise preserves an explicit project host even when
-   * `useProjectHostname` is set to `false`. `projectId` addresses the project's
-   * user directory when a project-scoped principal has to be bridged to its
-   * account-global id — a client reporting none has no directory to ask, and
-   * such a session is refused rather than stamped locally.
+   * Read the effective client configuration. The engine uses `apiHost` for
+   * account-global identity routing and `projectId` for project directory and
+   * organization lookups. Without `projectId`, organization attributes cannot
+   * be loaded and project-scoped principals cannot use the directory bridge.
+   *
+   * For clients without {@link WorkflowClient.withConfig}, an omitted
+   * `apiVersion` means the implementation must already serve
+   * {@link ENGINE_API_VERSION}. A declared `apiVersion` other than that version
+   * skips organization attributes with a warning.
    */
-  config?: () => WorkflowClientConfig;
+  config?: () => WorkflowClientConfigState;
   fetch: <T = unknown>(
     query: string,
     params?: Record<string, unknown>,
@@ -9704,21 +9297,12 @@ export declare interface WorkflowClient {
    * discovery uses its dry-run fallback, while a definition containing
    * role-constrained assignment fields fails loudly because the engine cannot
    * read the project membership directory required to validate assignees.
+   *
+   * Raw request transport. The engine passes the request target through
+   * `url`; relative paths must resolve against the client's configured API
+   * host, matching supported `SanityClient.request` implementations.
    */
-  request?: <T>(opts: {
-    /** Raw URL (host + path). One of `url` / `uri` required. */
-    url?: string;
-    /**
-     * Project-scoped path resolved against the `@sanity/client`'s
-     * apiHost (e.g. `/users/me` → `https://api.sanity.io/v1/users/me`).
-     * Use this for global endpoints like `/users/me`. Mirrors
-     * `SanityClient.request({uri})` in `@sanity/client`.
-     */
-    uri?: string;
-    signal?: AbortSignal;
-    /** Optional `?tag=` query for observability — supported by `@sanity/client`. */
-    tag?: string;
-  }) => Promise<T>;
+  request?: <T>(opts: WorkflowRequestOptions) => Promise<T>;
 }
 
 /**
@@ -9744,6 +9328,17 @@ export declare interface WorkflowClientConfig {
   useProjectHostname?: boolean;
 }
 
+/** The engine reads only project and API metadata from this value. */
+export declare interface WorkflowClientConfigState extends Omit<
+  WorkflowClientConfig,
+  "resource"
+> {
+  resource?: {
+    type: string;
+    id: string;
+  };
+}
+
 export declare interface WorkflowCommitOptions {
   /**
    * When the mutation becomes visible to subsequent queries. The engine
@@ -9775,6 +9370,8 @@ export declare interface WorkflowCommitOptions {
  * logger unconditionally (CI and `DO_NOT_TRACK` included), and consent,
  * environment suppression, and transport become this implementation's
  * business.
+ *
+ * @interface
  */
 export declare type WorkflowConfig = v.InferOutput<typeof WorkflowConfigSchema>;
 
@@ -10051,44 +9648,22 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                 readonly [
                   v.ArraySchema<
                     v.CustomSchema<
-                      {
-                        name: string;
-                        semantics?: Semantic[] | undefined;
-                        title: string;
-                        description?: string | undefined;
-                        groups?: Group[] | undefined;
-                        lifecycle?: WorkflowLifecycle | undefined;
-                        start?: StartBlock | undefined;
-                        initialStage: string;
-                        fields?: FieldEntry[] | undefined;
-                        stages: Stage[];
-                        predicates?: Record<string, string> | undefined;
-                        roleAliases?: RoleAliases | undefined;
-                      },
+                      DefinedWorkflow,
                       v.ErrorMessage<v.CustomIssue> | undefined
                     >,
                     undefined
                   >,
                   v.MinLengthAction<
-                    {
-                      name: string;
-                      semantics?: Semantic[] | undefined;
-                      title: string;
-                      description?: string | undefined;
-                      groups?: Group[] | undefined;
-                      lifecycle?: WorkflowLifecycle | undefined;
-                      start?: StartBlock | undefined;
-                      initialStage: string;
-                      fields?: FieldEntry[] | undefined;
-                      stages: Stage[];
-                      predicates?: Record<string, string> | undefined;
-                      roleAliases?: RoleAliases | undefined;
-                    }[],
+                    DefinedWorkflow[],
                     1,
                     "a deployment needs at least one definition"
                   >,
                 ]
               >;
+              readonly runtime: v.OptionalSchema<
+                v.GenericSchema<RuntimeBlock>,
+                undefined
+              >;
             },
             undefined
           >,
@@ -10138,20 +9713,8 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                       };
                 }[]
               | undefined;
-            definitions: {
-              name: string;
-              semantics?: Semantic[] | undefined;
-              title: string;
-              description?: string | undefined;
-              groups?: Group[] | undefined;
-              lifecycle?: WorkflowLifecycle | undefined;
-              start?: StartBlock | undefined;
-              initialStage: string;
-              fields?: FieldEntry[] | undefined;
-              stages: Stage[];
-              predicates?: Record<string, string> | undefined;
-              roleAliases?: RoleAliases | undefined;
-            }[];
+            definitions: DefinedWorkflow[];
+            runtime?: RuntimeBlock | undefined;
           }[],
           1,
           "a config needs at least one deployment"
@@ -10200,20 +9763,8 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                       };
                 }[]
               | undefined;
-            definitions: {
-              name: string;
-              semantics?: Semantic[] | undefined;
-              title: string;
-              description?: string | undefined;
-              groups?: Group[] | undefined;
-              lifecycle?: WorkflowLifecycle | undefined;
-              start?: StartBlock | undefined;
-              initialStage: string;
-              fields?: FieldEntry[] | undefined;
-              stages: Stage[];
-              predicates?: Record<string, string> | undefined;
-              roleAliases?: RoleAliases | undefined;
-            }[];
+            definitions: DefinedWorkflow[];
+            runtime?: RuntimeBlock | undefined;
           }[],
           (
             issue: v.CheckIssue<
@@ -10260,20 +9811,8 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                           };
                     }[]
                   | undefined;
-                definitions: {
-                  name: string;
-                  semantics?: Semantic[] | undefined;
-                  title: string;
-                  description?: string | undefined;
-                  groups?: Group[] | undefined;
-                  lifecycle?: WorkflowLifecycle | undefined;
-                  start?: StartBlock | undefined;
-                  initialStage: string;
-                  fields?: FieldEntry[] | undefined;
-                  stages: Stage[];
-                  predicates?: Record<string, string> | undefined;
-                  roleAliases?: RoleAliases | undefined;
-                }[];
+                definitions: DefinedWorkflow[];
+                runtime?: RuntimeBlock | undefined;
               }[]
             >,
           ) => string
@@ -10322,20 +9861,8 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                       };
                 }[]
               | undefined;
-            definitions: {
-              name: string;
-              semantics?: Semantic[] | undefined;
-              title: string;
-              description?: string | undefined;
-              groups?: Group[] | undefined;
-              lifecycle?: WorkflowLifecycle | undefined;
-              start?: StartBlock | undefined;
-              initialStage: string;
-              fields?: FieldEntry[] | undefined;
-              stages: Stage[];
-              predicates?: Record<string, string> | undefined;
-              roleAliases?: RoleAliases | undefined;
-            }[];
+            definitions: DefinedWorkflow[];
+            runtime?: RuntimeBlock | undefined;
           }[],
           (
             issue: v.CheckIssue<
@@ -10382,20 +9909,8 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
                           };
                     }[]
                   | undefined;
-                definitions: {
-                  name: string;
-                  semantics?: Semantic[] | undefined;
-                  title: string;
-                  description?: string | undefined;
-                  groups?: Group[] | undefined;
-                  lifecycle?: WorkflowLifecycle | undefined;
-                  start?: StartBlock | undefined;
-                  initialStage: string;
-                  fields?: FieldEntry[] | undefined;
-                  stages: Stage[];
-                  predicates?: Record<string, string> | undefined;
-                  roleAliases?: RoleAliases | undefined;
-                }[];
+                definitions: DefinedWorkflow[];
+                runtime?: RuntimeBlock | undefined;
               }[]
             >,
           ) => string
@@ -10427,6 +9942,8 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
  * conditions — each `name: groq` entry is pre-evaluated and bound as the
  * boolean `$name` var; redefining a built-in var is a deploy error, never a
  * silent shadow.
+ *
+ * @interface
  */
 export declare type WorkflowDefinition = v.InferOutput<
   typeof WorkflowDefinitionSchema
@@ -10481,35 +9998,22 @@ export declare interface WorkflowDefinitionDeployedData {
  * of a literal is a finite key union that `string` never extends) — i.e. how
  * fetch results are typed (`Record<string, unknown>`), which pass through to
  * the runtime boundary parse. Everything precisely typed gets the exact
- * {@link WorkflowDefinition} contract: beyond the document envelope
- * ({@link DocumentEnvelopeKey}, so a typed {@link DeployedDefinition} passes
- * castless), unknown keys are `never` — a typo'd literal is a compile error,
- * never a silent collapse to the record arm.
+ * {@link WorkflowDefinition} contract with two accepted exceptions: the
+ * document envelope (the closed system-key union, so a typed
+ * {@link DeployedDefinition} passes castless) and the authoring-only root
+ * `runtime` block, so a {@link DefinedWorkflow} passes castless too. Every
+ * other unknown key is `never`, making a typo'd literal a compile error rather
+ * than a silent collapse to the record arm.
  */
 export declare type WorkflowDefinitionInput<T> = string extends keyof T
   ? Record<string, unknown>
   : WorkflowDefinition & {
       [K in Exclude<
         keyof T,
-        keyof WorkflowDefinition | DocumentEnvelopeKey
+        keyof WorkflowDefinition | DocumentEnvelopeKey | AuthoringRuntimeKey
       >]?: never;
     };
 
-/**
- * Structural schema for a STORED workflow definition — primitives only,
- * every reference scope resolved. Cross-field invariants (unique names,
- * transition targets, effect-name uniqueness, predicate shadowing) are
- * checked by `checkWorkflowInvariants` after desugar — see `defineWorkflow`.
- * Carries NO `version`: a definition's version and content fingerprint are
- * stamped onto the deployed document at deploy time, derived from the
- * content itself, so redeploying identical content is a no-op and any
- * change mints the next version.
- *
- * Exported (module-level, not package API) for the model-surface gate's
- * coverage test and for `parseStoredDefinition` — the boundary parse for a
- * definition that did not come out of `defineWorkflow` in-process; trusted
- * in-process desugar output is never re-parsed.
- */
 declare const WorkflowDefinitionSchema: v.GenericSchema<
   WorkflowFields<FieldEntry, Stage, StartBlock>
 >;
@@ -10521,10 +10025,22 @@ declare const WorkflowDefinitionSchema: v.GenericSchema<
 export declare type WorkflowDeployment = WorkflowConfig["deployments"][number];
 
 /**
- * What an author writes for one deployment: the highest reader model verified
- * across runtimes sharing its workflow resource. Runtime validation compares
- * it with the submitted definitions, so a dependency upgrade alone does not
- * require changing the literal.
+ * Author one deployment with a nonempty `definitions` array and a
+ * {@link WorkflowResource}. Dataset resource IDs use `<projectId>.<dataset>`.
+ *
+ * `name` and `tag` must contain only ASCII lowercase letters, digits, and dashes,
+ * starting with a letter or digit. Deployment names and `(workflowResource, tag)`
+ * pairs must be unique across the config. Optional `resourceAliases` use the same
+ * name grammar, with unique names within this deployment.
+ *
+ * `expectedMinReaderModel` is the highest reader model you have verified across
+ * runtimes sharing the workflow resource. Supply a reviewed numeric literal.
+ * Definition submission checks it against the required reader floor; upgrading
+ * a dependency alone does not require changing it.
+ *
+ * `runtime` is the default hosting kind for this deployment's workflows, which
+ * each workflow and effect may override. Omitted, its workflows host on
+ * `'function'`.
  */
 export declare type WorkflowDeploymentInput = Omit<
   WorkflowDeployment,
@@ -10602,6 +10118,7 @@ export declare type WorkflowErrorKind =
   | "partial-guard-deploy"
   | "start-not-primed"
   | "start-not-settled"
+  | "concurrent-cascade"
   | "concurrent-fire-action"
   | "concurrent-edit-field"
   | "concurrent-complete-effect"
@@ -10625,11 +10142,21 @@ export declare type WorkflowErrorKind =
 export declare interface WorkflowEvaluation {
   instance: WorkflowInstance;
   definition: WorkflowDefinition;
+  /** Missing targets of populated subject, doc.ref, and doc.refs fields in active
+   * scopes. Clears on resolution; empty fields and exited-stage fields are excluded.
+   * Required reference declarations and runtime conditions determine whether absence blocks progress. */
+  missingDocuments?: MissingDocument[];
+  /**
+   * Missing required reference targets, or references read by unmet runtime requirements or transition conditions,
+   * including named predicates in their evaluated scope. Empty when missing references
+   * are optional for current progress. Omitted when no references are missing.
+   */
+  blockingMissingDocuments?: MissingDocument[];
   /** The workflow's advisory meaning, unchanged from its definition. */
   semantics?: Semantic[] | undefined;
   actor: Actor;
   currentStage: StageEvaluation;
-  /** Active activities whose assignees-kind field entry matches the actor. */
+  /** Active activities whose singular or plural assignment entry matches the actor. */
   pendingOnYou: ActivityEvaluation[];
   /** True if at least one action on any active activity is allowed. */
   canInteract: boolean;
@@ -10655,6 +10182,17 @@ export declare interface WorkflowEvaluation {
    * evaluation time, so their legs report `conditional`.
    */
   autonomy: WorkflowAutonomy;
+  /**
+   * The earliest future ISO 8601 instant the engine can derive for a time-based
+   * change to this evaluation. Re-evaluate then. Includes a gate reading `$now`
+   * beside `$actor`, `$assigned`, `$can`, or `$attributes`, evaluated in this
+   * actor's scopes. Derived per call, never persisted.
+   *
+   * Absent on a terminal instance or when the engine cannot derive a boundary.
+   * Conditions using date arithmetic may yield no boundary. Time can still
+   * affect a nonterminal instance when this value is absent.
+   */
+  nextEvaluationAt?: string;
 }
 
 export declare interface WorkflowFetchOptions {
@@ -10682,7 +10220,7 @@ export declare interface WorkflowFieldEditedData extends InstanceScopedEventData
   mode: EditMode;
 }
 
-/** Type-mirror of {@link workflowFields}, parameterised over field/stage/start. */
+/** @inline */
 declare type WorkflowFields<TField, TStage, TStart> = {
   name: string;
   semantics?: Semantic[] | undefined;
@@ -10743,15 +10281,14 @@ export declare interface WorkflowInstance extends SanityDocument {
   /** Frozen JSON snapshot of the definition at the moment the instance started. */
   definitionSnapshot: string;
   /**
-   * Workflow-level resolved field entries.
-   * Populated from the workflow definition's `fields[]` declarations plus
-   * the caller-supplied `initialFields` at `startInstance`. Persists for
-   * the lifetime of the instance.
+   * Resolved workflow fields, retained for the instance's lifetime. Their
+   * initial values come from the definition's `fields` declarations and
+   * {@link StartInstanceArgs.initialFields}.
    *
-   * To declare "the subject document of this workflow", add a
-   * `{ type: "doc.ref", name: "subject", initialValue: { type: "input" } }`
-   * entry to the workflow definition. Conditions then read it as
-   * `$fields.subject`. There is no other subject mechanism.
+   * To declare the workflow's subject document, use
+   * `{type: 'subject', name: 'subject', initialValue: {type: 'input'}}`.
+   * Conditions read that entry as `$fields.subject`. The `subject` field
+   * type identifies its role; naming a `doc.ref` field `subject` does not.
    */
   fields: ResolvedFieldEntry[];
   /**
@@ -10767,14 +10304,13 @@ export declare interface WorkflowInstance extends SanityDocument {
    */
   ancestors: GlobalDocumentReference[];
   /**
-   * Optional perspective applied to field-entry query reads and spawn
-   * `forEach.groq` discovery. When unset the engine treats reads as
-   * `"raw"` (no filtering). Set at `startInstance` time to scope a
-   * workflow's reads to a Content Release stack (e.g. `[releaseName]`
-   * or `[releaseName, "drafts"]`).
+   * Perspective for content reads, including field queries and subworkflow
+   * discovery. Defaults to {@link DEFAULT_CONTENT_PERSPECTIVE}, where drafts
+   * take precedence over published content. Set it through
+   * {@link StartInstanceArgs.perspective}; child instances inherit it.
    *
-   * Engine-internal reads of instance / definition documents are
-   * always raw, regardless of this field.
+   * Engine-owned instance and definition documents, and `system.release`
+   * documents, always read under `raw`.
    */
   perspective?: WorkflowPerspective;
   currentStage: StageName;
@@ -10905,7 +10441,7 @@ export declare interface WorkflowInstanceTickedData extends InstanceScopedEventD
 /** How instances of a definition come to exist: started standalone (the
  *  default) or spawned by a parent. `'child'` is spawn-only — see
  *  {@link isStartableDefinition}. */
-export declare type WorkflowLifecycle = (typeof WORKFLOW_LIFECYCLES)[number];
+export declare type WorkflowLifecycle = "standalone" | "child";
 
 /**
  * The subset of `@sanity/client` the engine actually needs. The
@@ -10948,6 +10484,14 @@ export declare type WorkflowPerspective =
   | "drafts"
   | string[];
 
+export declare interface WorkflowRequestOptions {
+  /** API-relative path resolved against the configured API host, or an absolute URL. */
+  url: string;
+  signal?: AbortSignal;
+  /** Optional `?tag=` query for observability — supported by `@sanity/client`. */
+  tag?: string;
+}
+
 /**
  * The resource a Sanity client is configured against — mirrors
  * `@sanity/client`'s `ClientConfigResource` discriminator. For