@sanity/workflow-engine 0.31.0 → 0.33.0

package/dist/index.js

@@ -1,45 +1,16 @@
-import { rethrowWithContext, andConditions, deriveActivityKind, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, isAlwaysArrayFieldKind, evaluateCondition, isRecord, isSingleDocRefEntry, isAssignmentFieldEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, assignmentKindAcceptsRoles, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, classifyPrincipalId, directoryBridgeId, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, NonEmptyString, tolerantEntries, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, InstanceNotFoundError, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, firstCarriedGlobalId, driverKind, EffectNotFoundError, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
+import { rethrowWithContext, findOpenStageEntry, findCurrentActivityEntry, andConditions, deriveActivityKind, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, WorkflowError, gdrFromResource, selfGdr, isGdrUri, MUTATION_GUARD_ID_SPACES, mutationGuardActionIdSpace, LAKE_MUTATION_GUARD_ACTIONS, isBareDocumentId, toBareId, normalizeAssignmentMembers, isSingleDocRefKind, actorMatchesAssignment, assignmentMembers, resolvedChildStatus, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, isAssignmentFieldEntry, isAlwaysArrayFieldKind, evaluateCondition, isRecord, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, GUARD_ACTIONS_REQUIRED_MESSAGE, conditionEffectReads, EFFECTS_READ, datasetResourceParts, refKindAcceptsTypes, mutationGuardRequiresSplitEmission, MUTATION_GUARD_ACTIONS, assignmentKindAcceptsRoles, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, liveSubworkflows, isCascadeFired, classifyPrincipalId, directoryBridgeId, parseGdr, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, isParseableInstant, NonEmptyString, tolerantEntries, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, InstanceNotFoundError, evaluateConditionOutcome, runGroq as runGroq$1, FIELD_READ, resourceGdr, condemnSubworkflow, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, firstCarriedGlobalId, driverKind, actorFulfillsRole, condemnedSubworkflows, EffectNotFoundError, isFilterScopedOut, deriveExecutorClassification, validateTag, activeAssignmentMembers, extractDocumentId, UNIVERSAL_ROLE_ALIAS_KEY, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, effectBackoffMs, groupMembershipNames } from "./_chunks-es/invariants.js";
 
-import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SIGNAL_SEMANTICS, SYSTEM_IDENTITY, clientConfigFromResource, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
+import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SIGNAL_SEMANTICS, SYSTEM_IDENTITY, assignmentMatch, assignmentState, assignmentStateCounts, clientConfigFromResource, gdrUri, identityMatchesAssignment, instanceAssignmentStateCounts, isNotesEntry, isTodoListEntry, isTodoListItem, openActivityAssignments, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
 
-import { atomNode, dedupeBy, analyzeCondition, atomReadsDataset, checklistLines as checklistLines$1, phrase, quoted, listAnd, describeAtom as describeAtom$1, describeCondition as describeCondition$1, guillemets, formatValue, humanize, listOr, scopeReadOf, describeRead, explainCondition, dedupeReads, whatIfCondition, MAX_COUNTERFACTUAL_INDEX } from "@sanity/groq-condition-describe";
+import { atomNode, dedupeBy, analyzeCondition, atomReadsDataset, checklistLines as checklistLines$1, phrase, quoted, listAnd, describeAtom as describeAtom$1, describeCondition as describeCondition$1, guillemets, formatValue, humanize, listOr, scopeReadOf, describeRead, explainCondition, _exhaustiveOptions, whatIfCondition, runGroq, formatRead, dedupeReads, MAX_COUNTERFACTUAL_INDEX } from "@sanity/groq-condition-describe";
 
-import { MAX_COUNTERFACTUAL_INDEX as MAX_COUNTERFACTUAL_INDEX2, NEUTRAL_MARK, OUTCOME_MARKS, analyzeCondition as analyzeCondition2, atomReadsDataset as atomReadsDataset2, explainCondition as explainCondition2, formatRead, guillemets as guillemets2, humanize as humanize2, isComparisonOp, quoted as quoted2, sentenceCase, whatIfCondition as whatIfCondition2, withAssignment } from "@sanity/groq-condition-describe";
+import { MAX_COUNTERFACTUAL_INDEX as MAX_COUNTERFACTUAL_INDEX2, NEUTRAL_MARK, OUTCOME_MARKS, analyzeCondition as analyzeCondition2, atomReadsDataset as atomReadsDataset2, explainCondition as explainCondition2, formatRead as formatRead2, guillemets as guillemets2, humanize as humanize2, isComparisonOp, quoted as quoted2, sentenceCase, whatIfCondition as whatIfCondition2, withAssignment } from "@sanity/groq-condition-describe";
 
 import { evaluate, parse } from "groq-js";
 
-import * as v from "valibot";
-
-function isFilterScopedOut(entry) {
-    return entry.status === "skipped" && entry.startedAt === void 0;
-}
-
-function liveSubworkflows(host) {
-    return (host.subworkflows ?? []).filter(row => row.resolved === void 0);
-}
-
-function resolvedChildStatus(child) {
-    if (!(child.completedAt === void 0 || child.completedAt === null)) return child.abortedAt !== void 0 && child.abortedAt !== null ? "aborted" : "done";
-}
-
-function condemnedSubworkflows(host) {
-    return liveSubworkflows(host).filter(row => row.abortPending !== void 0);
-}
-
-function condemnSubworkflow(row, owed) {
-    row.abortPending !== void 0 || row.resolved !== void 0 || (row.abortPending = {
-        at: owed.at,
-        reason: owed.reason
-    });
-}
+import { getPublishedId, getDraftId, DocumentId } from "@sanity/id-utils";
 
-function findOpenStageEntry(host) {
-    return host.stages.find(s => s.name === host.currentStage && s.exitedAt === void 0);
-}
-
-function findCurrentActivityEntry(host, activityName) {
-    return findOpenStageEntry(host)?.activities.find(a => a.name === activityName);
-}
+import * as v from "valibot";
 
 const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
 
@@ -98,6 +69,10 @@ function effectiveEditable(baseline, override) {
 
 const DEFAULT_EDIT_MODE = "set";
 
+function _fieldTargetLabel(target) {
+    return [ target.scope, target.activity, target.field ].filter(Boolean).join(".");
+}
+
 function fieldSites(definition, stage) {
     const sites = [];
     for (const entry of definition.fields ?? []) sites.push({
@@ -458,6 +433,11 @@ function rolesGateOf(atom) {
     if (!(count.type !== "FuncCall" || count.name !== "count" || count.args.length !== 1)) return rolesFilterList(count.args[0]);
 }
 
+function isAssignedGate(atom) {
+    const node = atomNode(atom);
+    return !atom.negated && node.type === "Parameter" && node.name === "assigned";
+}
+
 function rolesFilterList(node) {
     if (node.type !== "Filter") return;
     const base = node.base;
@@ -1069,6 +1049,7 @@ function describeSiteHeading(address, ctx) {
         }
 
       case "action":
+      case "action-when":
         {
             const title = actionTitle(address, ctx), activity = activityTitle(address.activity, ctx);
             return phrase(id, {
@@ -1076,7 +1057,7 @@ function describeSiteHeading(address, ctx) {
                     title: title,
                     activity: activity
                 },
-                text: `action ${quoted(title)} on ${quoted(activity)} is available when:`
+                text: `action ${quoted(title)} on ${quoted(activity)} ${address.kind === "action" ? "is available" : "fires automatically"} when:`
             });
         }
 
@@ -1103,18 +1084,6 @@ function describeSiteHeading(address, ctx) {
             });
         }
 
-      case "action-when":
-        {
-            const title = actionTitle(address, ctx), activity = activityTitle(address.activity, ctx);
-            return phrase(id, {
-                params: {
-                    title: title,
-                    activity: activity
-                },
-                text: `action ${quoted(title)} on ${quoted(activity)} fires automatically when:`
-            });
-        }
-
       case "editable-field":
         {
             const field = fieldTitleOf({
@@ -1158,6 +1127,7 @@ function describeSite(site, ctx) {
         }
 
       case "action":
+      case "action-when":
         {
             const title = actionTitle(site, ctx), activity = activityTitle(site.activity, ctx);
             return phrase(id, {
@@ -1165,7 +1135,7 @@ function describeSite(site, ctx) {
                     title: title,
                     activity: activity
                 },
-                text: `the ${quoted(title)} action on ${quoted(activity)}`
+                text: `the ${quoted(title)} ${site.kind === "action" ? "action" : "trigger"} on ${quoted(activity)}`
             });
         }
 
@@ -1181,18 +1151,6 @@ function describeSite(site, ctx) {
             });
         }
 
-      case "action-when":
-        {
-            const title = actionTitle(site, ctx), activity = activityTitle(site.activity, ctx);
-            return phrase(id, {
-                params: {
-                    title: title,
-                    activity: activity
-                },
-                text: `the ${quoted(title)} trigger on ${quoted(activity)}`
-            });
-        }
-
       case "activity-filter":
         {
             const activity = activityTitle(site.activity, ctx);
@@ -1250,10 +1208,10 @@ function unsatisfiedTransitionSummaries(evaluation) {
         definition: evaluation.definition
     };
     return evaluation.currentStage.transitions.filter(t => !t.whenSatisfied).flatMap(t => {
-        const summary = describeCondition(t.insight, ctx).summary;
-        return summary !== void 0 ? [ {
+        const summary2 = describeCondition(t.insight, ctx).summary;
+        return summary2 !== void 0 ? [ {
             transition: t.transition.name,
-            summary: summary
+            summary: summary2
         } ] : [];
     });
 }
@@ -1746,27 +1704,38 @@ function startContextSyntaxIssues({groq: groq, vars: vars, context: context, ski
     return [ ...conditionParameterNames(groq) ].filter(name => !bound.has(name) && name !== skip).map(name => `reads $${name}, which the ${context} context does not bind (an unbound variable is GROQ null, so the predicate silently misevaluates — failing closed or passing vacuously by shape). Bound here: ` + vars.map(v2 => `$${v2.name}`).join(", "));
 }
 
-function getPath(value, path) {
-    let current = value;
-    for (const part of path.split(".")) {
-        if (current == null || typeof current != "object") return;
-        current = current[part];
+const GUARD_DOC_TYPE = "temp.system.guard";
+
+class MutationGuardDeniedError extends WorkflowError {
+    denied;
+    documentId;
+    action;
+    constructor(args) {
+        const ids = args.denied.map(d => d.guardId).join(", ");
+        super("mutation-guard-denied", `Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), 
+        this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, 
+        this.action = args.action;
+    }
+    static fromGuards(args) {
+        return new MutationGuardDeniedError({
+            documentId: args.documentId,
+            action: args.action,
+            denied: deniedGuardRefs(args.guards)
+        });
     }
-    return current;
 }
 
-function isReferenceObject(value) {
-    return typeof value._ref == "string";
+function deniedGuardRefs(guards) {
+    return guards.map(g => ({
+        guardId: g._id,
+        ...g.name !== void 0 ? {
+            name: g.name
+        } : {}
+    }));
 }
 
-function walkDocPath(value, path) {
-    let current = value;
-    for (const part of path.split(".")) {
-        if (current == null || typeof current != "object") return;
-        if (isReferenceObject(current) && !Object.hasOwn(current, part)) throw new Error(`cannot read "${part}" through the nested reference "${current._ref}" — the workflow only loads references it declares. Declare it as a doc.ref field entry to read through it.`);
-        current = current[part];
-    }
-    return current;
+function deniedGuardLabels(denied) {
+    return denied.map(d => d.name ?? d.guardId);
 }
 
 function mapJsonStrings(value, transform) {
@@ -1835,179 +1804,638 @@ function overlayInstanceInSnapshot(snapshot, instance) {
     };
 }
 
-function resolveFieldRead(args) {
-    const {kind: kind, value: value, path: path, snapshot: snapshot, targetKind: targetKind} = args;
-    if (isSingleDocRefKind(kind)) {
-        if (!isGdr(value)) return null;
-        if (path === void 0 && targetKind !== void 0 && isSingleDocRefKind(targetKind)) return value;
-        const base = derefBase(value, snapshot);
-        return path === void 0 ? base : walkDocPath(base, path);
-    }
-    return path !== void 0 ? getPath(value, path) : value;
+function lakeGuardId(args) {
+    return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.guardName}`;
 }
 
-function derefBase(ref, snapshot) {
-    return (snapshot !== void 0 ? findSnapshotDoc(snapshot, ref.id) : void 0) ?? {
-        _id: ref.id,
-        _type: ref.type
-    };
+function lakeActionsFor(action) {
+    return action === "publish" ? [ "create", "update" ] : action === "unpublish" ? [ "delete" ] : [ action ];
 }
 
-function buildParams(args) {
-    const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
-    return {
-        self: selfGdr(instance),
-        fields: renderedFields(instance.fields ?? [], snapshot),
-        parent: parentRef(instance)?.id ?? null,
-        ancestors: instance.ancestors.map(a => a.id),
-        stage: instance.currentStage,
-        now: now,
-        context: contextMap(instance),
-        effects: effectOutputsMap(instance),
-        effectStatus: effectStatusMap(instance),
-        activities: currentActivities2,
-        subworkflows: subworkflowVarRows(instance, snapshot),
-        ...activityGateParams(currentActivities2),
-        ...extra
-    };
+function lakeGuardActions(actions) {
+    const requested = new Set(actions.flatMap(lakeActionsFor));
+    return LAKE_MUTATION_GUARD_ACTIONS.filter(action => requested.has(action));
 }
 
-function subworkflowVarRows(instance, snapshot) {
-    const openKey = findOpenStageEntry(instance)?._key;
-    return (instance.subworkflows ?? []).map(row => ({
-        _id: toBareId(row.ref.id),
-        rowKey: row.rowKey,
-        activity: row.activity,
-        action: row.action,
-        definition: row.definition,
-        current: row.stageEntry === openKey,
-        ...childState(row, snapshot),
-        spawnedAt: row.spawnedAt
-    }));
+function publishedId(id) {
+    return getPublishedId(id);
 }
 
-function childState(row, snapshot) {
-    if (row.resolved !== void 0) return {
-        stage: row.resolved.stage ?? null,
-        status: row.resolved.aborted === !0 ? "aborted" : "done"
+function draftId(id) {
+    return getDraftId(id);
+}
+
+function versionPatternTranslation(pattern) {
+    const documentSeparator = pattern.indexOf(".", 9);
+    if (documentSeparator === -1) return {
+        issue: `id pattern "${pattern}" does not identify a versioned document`
     };
-    const doc = snapshot === void 0 ? void 0 : findSnapshotDoc(snapshot, row.ref.id);
-    return doc === void 0 ? {
-        stage: null,
-        status: "active"
+    const documentPattern = pattern.slice(documentSeparator + 1);
+    return /^\*+$/.test(documentPattern) ? {
+        issue: `id pattern "${pattern}" cannot be translated from a release version to a draft or published document without broadening it to every document`
     } : {
-        stage: doc.currentStage ?? null,
-        status: resolvedChildStatus(doc) ?? "active"
+        documentPattern: documentPattern
     };
 }
 
-function activityGateParams(activities) {
-    return {
-        allActivitiesDone: activities.every(activity => activity.status === "done" || activity.status === "skipped"),
-        anyActivityFailed: activities.some(activity => activity.status === "failed")
-    };
+function publishedPattern(pattern) {
+    if (pattern.startsWith("drafts.")) return pattern.slice(7);
+    if (!pattern.startsWith("versions.")) return pattern;
+    const translated = versionPatternTranslation(pattern);
+    if (translated.issue !== void 0) throw new Error(translated.issue);
+    return translated.documentPattern;
 }
 
-function renderedFields(entries, snapshot) {
-    const out = {};
-    for (const entry of entries) out[entry.name] = renderedValue(entry, snapshot);
-    return out;
+function draftPattern(pattern) {
+    return `drafts.${publishedPattern(pattern)}`;
 }
 
-function renderedValue(entry, snapshot) {
-    return resolveFieldRead({
-        kind: entry._type,
-        value: entry.value,
-        path: void 0,
-        snapshot: snapshot
-    });
+function idsInSpace(args) {
+    const {ids: ids, space: space, sourceInstanceId: sourceInstanceId} = args;
+    return space === "authored" ? ids : space === "published" ? [ ...new Set(ids.map(publishedId)) ] : [ ...new Set(ids.map(id => publishedId(id) === sourceInstanceId ? publishedId(id) : draftId(id))) ];
 }
 
-function scopedFieldOverlay({instance: instance, snapshot: snapshot, activityName: activityName}) {
-    const stageEntry = findOpenStageEntry(instance);
-    if (stageEntry === void 0) return {};
-    const stageFields = renderedFields(stageEntry.fields ?? [], snapshot), activity = activityName ? stageEntry.activities.find(t => t.name === activityName) : void 0;
+function patternsInSpace(patterns, space) {
+    if (space === "authored") return patterns;
+    const convert = space === "edit" ? draftPattern : publishedPattern;
+    return [ ...new Set(patterns.map(convert)) ];
+}
+
+function matchInSpace(args) {
+    const {match: match, actions: actions, space: space, sourceInstanceId: sourceInstanceId} = args;
     return {
-        ...stageFields,
-        ...renderedFields(activity?.fields ?? [], snapshot)
+        ...match,
+        ...match.idRefs !== void 0 ? {
+            idRefs: idsInSpace({
+                ids: match.idRefs,
+                space: space,
+                sourceInstanceId: sourceInstanceId
+            })
+        } : {},
+        ...match.idPatterns !== void 0 ? {
+            idPatterns: patternsInSpace(match.idPatterns, space)
+        } : {},
+        actions: lakeGuardActions(actions)
     };
 }
 
-function assignedFor({instance: instance, activityName: activityName, actor: actor, roleAliases: roleAliases}) {
-    if (actor === void 0) return !1;
-    const entry = findCurrentActivityEntry(instance, activityName)?.fields?.find(s => s._type === "assignees");
-    return entry === void 0 ? !1 : entry.value.some(a => a.type === "user" ? a.id === actor.id : actorFulfillsRole({
-        actorRoles: actor.roles,
-        required: a.role,
-        aliases: roleAliases
+function guardPartitions(id, actions) {
+    return MUTATION_GUARD_ID_SPACES.flatMap(space => {
+        const matchingActions = actions.filter(action => mutationGuardActionIdSpace(action) === space);
+        return matchingActions.length > 0 ? [ {
+            space: space,
+            actions: matchingActions
+        } ] : [];
+    }).map((partition, index) => ({
+        ...partition,
+        id: index === 0 ? id : `${id}.${partition.space}`
     }));
 }
 
-function effectStatusMap(instance) {
-    const entry = findOpenStageEntry(instance);
-    if (entry === void 0) return {};
-    const out = {};
-    for (const run of instance.effectHistory) run.stageEntryKey === entry._key && (out[run.name] = run.status);
-    return out;
+function compiledGuardIds(args) {
+    return guardPartitions(args.id, args.actions).map(partition => partition.id);
 }
 
-function contextMap(instance) {
-    const out = {};
-    for (const entry of instance.context) out[entry.name] = entry._type === "context.json" ? parseJsonContextEntry(entry) : entry.value;
-    return out;
+function lakeGuardDocument(args) {
+    return {
+        _id: args.id,
+        _type: GUARD_DOC_TYPE,
+        resourceType: args.resourceType,
+        resourceId: args.resourceId,
+        owner: args.owner,
+        sourceInstanceId: args.sourceInstanceId,
+        sourceDefinition: args.sourceDefinition,
+        sourceStage: args.sourceStage,
+        ...args.name !== void 0 ? {
+            name: args.name
+        } : {},
+        ...args.description !== void 0 ? {
+            description: args.description
+        } : {},
+        match: args.match,
+        predicate: args.predicate,
+        metadata: args.metadata
+    };
 }
 
-function effectOutputsMap(instance) {
-    const out = {};
-    for (const run of instance.effectHistory) run.outputs !== void 0 && (out[run.name] = run.outputs);
-    return out;
+function compileGuards(args) {
+    const [first, ...remaining] = guardPartitions(args.id, args.match.actions);
+    if (first === void 0) throw new Error("cannot compile a guard without an action");
+    const compilePartition = ({space: space, actions: actions, id: id}) => lakeGuardDocument({
+        ...args,
+        id: id,
+        match: matchInSpace({
+            match: args.match,
+            actions: actions,
+            space: space,
+            sourceInstanceId: args.sourceInstanceId
+        })
+    });
+    return [ compilePartition(first), ...remaining.map(compilePartition) ];
 }
 
-function parseJsonContextEntry(entry) {
-    try {
-        return JSON.parse(entry.value);
-    } catch (err) {
-        rethrowWithContext(err, `context entry "${entry.name}" holds unparseable JSON`);
-    }
+function globMatch(pattern, value) {
+    if (!pattern.includes("*")) return pattern === value;
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`).test(value);
 }
 
-function paramsForLake(params) {
-    return {
-        ...params,
-        self: typeof params.self == "string" ? toBareId(params.self) : params.self,
-        parent: typeof params.parent == "string" ? toBareId(params.parent) : params.parent,
-        ancestors: Array.isArray(params.ancestors) ? params.ancestors.map(a => typeof a == "string" ? toBareId(a) : a) : params.ancestors,
-        fields: stripFieldsForLake(params.fields)
-    };
+function guardIdPatternIssue(pattern, actions) {
+    const representativeId = pattern.replaceAll("*", "x");
+    if (!isBareDocumentId(representativeId)) return `id pattern "${pattern}" is not a valid resource-local document-id glob; use document-id characters (letters, digits, \`_\`, \`-\`, \`.\`) and \`*\` wildcards`;
+    if (actions?.some(action => mutationGuardActionIdSpace(action) !== "authored") && pattern.startsWith("versions.")) return versionPatternTranslation(pattern).issue;
 }
 
-function stripFieldsForLake(value) {
-    return mapJsonStrings(value, s => toBareId(s));
+function parseGuardPredicate(predicate) {
+    return parse(predicate, {
+        mode: "delta"
+    });
 }
 
-function resolveStaticValueExpr(src, ctx) {
-    switch (src.type) {
-      case "literal":
-        return src.value;
-
-      case "param":
-        return ctx.params?.[src.param];
-
-      case "actor":
-        return ctx.actor;
-
-      case "now":
-        return ctx.now;
+function guardPredicateSyntaxIssue(predicate) {
+    try {
+        parseGuardPredicate(predicate);
+        return;
+    } catch (error) {
+        return errorMessage(error);
     }
 }
 
-function randomKey(length = 12) {
-    const bytes = new Uint8Array(length);
-    return globalThis.crypto.getRandomValues(bytes), [ ...bytes ].map(b => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+function lakeDocumentIdForAction(id, action) {
+    return mutationGuardActionIdSpace(action) === "published" ? publishedId(id) : id;
 }
 
-function instanceDocId(tag) {
-    return `${tag}.wf-instance.${randomKey()}`;
+function legacyLifecycleActionFor(action, documentId) {
+    if (publishedId(documentId) === documentId) {
+        if (action === "create" || action === "update") return "publish";
+        if (action === "delete") return "unpublish";
+    }
+}
+
+function guardMatches({guard: guard, doc: doc, action: action}) {
+    const m = guard.match, documentId = lakeDocumentIdForAction(doc.id, action), legacyLifecycleAction = legacyLifecycleActionFor(action, documentId);
+    if (![ action, ...lakeActionsFor(action), legacyLifecycleAction ].some(candidate => candidate !== void 0 && m.actions.includes(candidate)) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type))) return !1;
+    if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
+        const byRef = m.idRefs?.includes(documentId) ?? !1, byPattern = m.idPatterns?.some(p => globMatch(p, documentId)) ?? !1;
+        if (!byRef && !byPattern) return !1;
+    }
+    return !0;
+}
+
+function guardPredicateRoot(args) {
+    return {
+        document: {
+            before: args.context.before,
+            after: args.context.after
+        },
+        guard: args.guard,
+        mutation: {
+            action: args.context.action
+        }
+    };
+}
+
+function lakeShapedSnapshotDocument(doc) {
+    return mapJsonStrings(doc, (value, key) => key === "_id" || key === "_ref" ? toBareId(value) : value);
+}
+
+function snapshotGuardDereference(args) {
+    return ({_ref: _ref}) => {
+        const lookupId = isGdrUri(_ref) ? _ref : gdrFromResource(args.resource, _ref), found = findSnapshotDoc(args.snapshot, lookupId);
+        return Promise.resolve(found === void 0 ? null : lakeShapedSnapshotDocument(found));
+    };
+}
+
+async function evaluateMutationGuard(args) {
+    const {guard: guard, context: context, dereference: dereference} = args;
+    if (guard.predicate === "") return !1;
+    const root = guardPredicateRoot({
+        guard: guard,
+        context: context
+    });
+    let dereferenceFailed = !1;
+    const guardedDereference = dereference === void 0 ? void 0 : async ref => {
+        try {
+            return await dereference(ref);
+        } catch (error) {
+            throw dereferenceFailed = !0, error;
+        }
+    };
+    try {
+        const tree = parseGuardPredicate(guard.predicate);
+        return await (await evaluate(tree, {
+            root: root,
+            before: context.before,
+            after: context.after,
+            ...guardedDereference !== void 0 ? {
+                dataset: [],
+                dereference: guardedDereference
+            } : {},
+            ...context.identity !== void 0 ? {
+                identity: context.identity
+            } : {}
+        })).get() === !0;
+    } catch (error) {
+        if (dereferenceFailed) throw error;
+        return !1;
+    }
+}
+
+async function denyingGuards(args) {
+    const {guards: guards, doc: doc, context: context, dereference: dereference} = args, denied = [];
+    for (const guard of guards) guardMatches({
+        guard: guard,
+        doc: doc,
+        action: context.action
+    }) && (await evaluateMutationGuard({
+        guard: guard,
+        context: context,
+        ...dereference !== void 0 ? {
+            dereference: dereference
+        } : {}
+    }) || denied.push(guard));
+    return denied;
+}
+
+async function documentActionDenials(args) {
+    const {mutation: mutation, resource: resource, guards: guards, identity: identity, dereference: dereference} = args, document = mutation.after ?? mutation.before;
+    if (document === null) throw new Error("a concrete Lake mutation requires a before or after image");
+    const enforceable = guards.filter(g => g.resourceType === resource.type && g.resourceId === resource.id);
+    return enforceable.length === 0 ? [] : denyingGuards({
+        guards: enforceable,
+        doc: {
+            id: document._id,
+            type: document._type
+        },
+        context: {
+            ...mutation,
+            ...identity !== void 0 ? {
+                identity: identity
+            } : {}
+        },
+        ...dereference !== void 0 ? {
+            dereference: dereference
+        } : {}
+    });
+}
+
+async function instanceWriteDenials(args) {
+    const {instance: instance, guards: guards, identity: identity, dereference: dereference} = args;
+    return documentActionDenials({
+        mutation: {
+            before: instance,
+            after: instance,
+            action: "update"
+        },
+        resource: instance.workflowResource,
+        guards: guards,
+        dereference: dereference,
+        ...identity !== void 0 ? {
+            identity: identity
+        } : {}
+    });
+}
+
+async function assertInstanceWriteAllowed(args) {
+    const denied = await instanceWriteDenials(args);
+    if (denied.length !== 0) throw MutationGuardDeniedError.fromGuards({
+        documentId: args.instance._id,
+        action: "update",
+        guards: denied
+    });
+}
+
+const ASSIGNMENT_LIST_MODEL = 9;
+
+function isAssignmentListModel(modelVersion) {
+    return modelVersion >= ASSIGNMENT_LIST_MODEL;
+}
+
+function definitionAssignmentModel(instance) {
+    if (typeof instance.definitionSnapshot != "string") return 0;
+    const modelVersion = parseDefinitionSnapshotValue({
+        _id: instance._id,
+        definitionSnapshot: instance.definitionSnapshot
+    }).modelVersion;
+    return typeof modelVersion == "number" ? modelVersion : 0;
+}
+
+function writesSingularAssignmentLists(instance) {
+    return isAssignmentListModel(definitionAssignmentModel(instance));
+}
+
+function legacyAssigneeValue(entry) {
+    return legacyAssignmentValue(entry.value, entry.name);
+}
+
+function legacyAssignmentValue(value, path) {
+    if (!Array.isArray(value)) return value;
+    if (value.length === 0) return null;
+    if (value.length === 1) return value[0];
+    throw new ContractViolationError(`legacy assignee field "${path}" cannot persist ${value.length} members; redeploy the definition at the assignment-list reader model before writing a role pool`);
+}
+
+function mapShapeValues(args) {
+    const {value: value, shapes: shapes, mapAssignee: mapAssignee, parentPath: parentPath} = args;
+    if (typeof value != "object" || value === null || Array.isArray(value)) return value;
+    const source = value, next = {
+        ...source
+    };
+    for (const shape of shapes) {
+        if (!Object.hasOwn(source, shape.name)) continue;
+        const path = `${parentPath}.${shape.name}`, member = source[shape.name], mapped = mappedShapeValue({
+            shape: shape,
+            member: member,
+            mapAssignee: mapAssignee,
+            path: path
+        });
+        mapped.found && defineOwnValue(next, {
+            name: shape.name,
+            value: mapped.value
+        });
+    }
+    return next;
+}
+
+function mappedShapeValue(args) {
+    const {shape: shape, member: member, mapAssignee: mapAssignee, path: path} = args;
+    return shape.type === "assignee" ? {
+        found: !0,
+        value: mapAssignee(member, path)
+    } : shape.type === "object" ? {
+        found: !0,
+        value: mapShapeValues({
+            value: member,
+            shapes: shape.fields ?? [],
+            mapAssignee: mapAssignee,
+            parentPath: path
+        })
+    } : shape.type !== "array" || !Array.isArray(member) ? {
+        found: !1
+    } : {
+        found: !0,
+        value: member.map((row, index) => mapShapeValues({
+            value: row,
+            shapes: shape.of ?? [],
+            mapAssignee: mapAssignee,
+            parentPath: `${path}[${index}]`
+        }))
+    };
+}
+
+function defineOwnValue(target, property) {
+    Object.defineProperty(target, property.name, {
+        configurable: !0,
+        enumerable: !0,
+        value: property.value,
+        writable: !0
+    });
+}
+
+function mapNestedAssignmentValues(entry, mapAssignee) {
+    return entry._type === "object" ? mapShapeValues({
+        value: entry.value,
+        shapes: entry.fields,
+        mapAssignee: mapAssignee,
+        parentPath: entry.name
+    }) : entry.value.map((row, index) => mapShapeValues({
+        value: row,
+        shapes: entry.of,
+        mapAssignee: mapAssignee,
+        parentPath: `${entry.name}[${index}]`
+    }));
+}
+
+function normalizeNestedAssignmentValues(entry) {
+    return entry._type !== "object" && entry._type !== "array" ? entry : {
+        ...entry,
+        value: mapNestedAssignmentValues(entry, normalizeAssignmentMembers)
+    };
+}
+
+function assignmentFieldsForWrite(fields, listModel) {
+    return listModel ? fields : fields.map(entry => entry._type === "assignee" ? {
+        ...entry,
+        value: legacyAssigneeValue(entry)
+    } : entry._type === "object" || entry._type === "array" ? {
+        ...entry,
+        value: mapNestedAssignmentValues(entry, legacyAssignmentValue)
+    } : entry);
+}
+
+function activityForWrite(activity, listModel) {
+    return {
+        ...activity,
+        ...activity.fields === void 0 ? {} : {
+            fields: assignmentFieldsForWrite(activity.fields, listModel)
+        }
+    };
+}
+
+function assignmentStagesForWrite(stages, listModel) {
+    return stages.map(stage => ({
+        ...stage,
+        fields: assignmentFieldsForWrite(stage.fields ?? [], listModel),
+        activities: stage.activities.map(activity => activityForWrite(activity, listModel))
+    }));
+}
+
+function getPath(value, path) {
+    let current = value;
+    for (const part of path.split(".")) {
+        if (current == null || typeof current != "object") return;
+        current = current[part];
+    }
+    return current;
+}
+
+function isReferenceObject(value) {
+    return typeof value._ref == "string";
+}
+
+function walkDocPath(value, path) {
+    let current = value;
+    for (const part of path.split(".")) {
+        if (current == null || typeof current != "object") return;
+        if (isReferenceObject(current) && !Object.hasOwn(current, part)) throw new Error(`cannot read "${part}" through the nested reference "${current._ref}" — the workflow only loads references it declares. Declare it as a doc.ref field entry to read through it.`);
+        current = current[part];
+    }
+    return current;
+}
+
+function resolveFieldRead(args) {
+    const {kind: kind, value: value, path: path, snapshot: snapshot, targetKind: targetKind} = args;
+    if (isSingleDocRefKind(kind)) {
+        if (!isGdr(value)) return null;
+        if (path === void 0 && targetKind !== void 0 && isSingleDocRefKind(targetKind)) return value;
+        const base = derefBase(value, snapshot);
+        return path === void 0 ? base : walkDocPath(base, path);
+    }
+    return path !== void 0 ? getPath(value, path) : value;
+}
+
+function derefBase(ref, snapshot) {
+    return (snapshot !== void 0 ? findSnapshotDoc(snapshot, ref.id) : void 0) ?? {
+        _id: ref.id,
+        _type: ref.type
+    };
+}
+
+function buildParams(args) {
+    const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
+    return {
+        self: selfGdr(instance),
+        fields: renderedFields(instance.fields ?? [], snapshot),
+        parent: parentRef(instance)?.id ?? null,
+        ancestors: instance.ancestors.map(a => a.id),
+        stage: instance.currentStage,
+        now: now,
+        context: contextMap(instance),
+        effects: effectOutputsMap(instance),
+        effectStatus: effectStatusMap(instance),
+        activities: currentActivities2,
+        subworkflows: subworkflowVarRows(instance, snapshot),
+        ...activityGateParams(currentActivities2),
+        ...extra
+    };
+}
+
+function subworkflowVarRows(instance, snapshot) {
+    const openKey = findOpenStageEntry(instance)?._key;
+    return (instance.subworkflows ?? []).map(row => ({
+        _id: toBareId(row.ref.id),
+        rowKey: row.rowKey,
+        activity: row.activity,
+        action: row.action,
+        definition: row.definition,
+        current: row.stageEntry === openKey,
+        ...childState(row, snapshot),
+        spawnedAt: row.spawnedAt
+    }));
+}
+
+function childState(row, snapshot) {
+    if (row.resolved !== void 0) return {
+        stage: row.resolved.stage ?? null,
+        status: row.resolved.aborted === !0 ? "aborted" : "done"
+    };
+    const doc = snapshot === void 0 ? void 0 : findSnapshotDoc(snapshot, row.ref.id);
+    return doc === void 0 ? {
+        stage: null,
+        status: "active"
+    } : {
+        stage: doc.currentStage ?? null,
+        status: resolvedChildStatus(doc) ?? "active"
+    };
+}
+
+function activityGateParams(activities) {
+    return {
+        allActivitiesDone: activities.every(activity => activity.status === "done" || activity.status === "skipped"),
+        anyActivityFailed: activities.some(activity => activity.status === "failed")
+    };
+}
+
+function renderedFields(entries, snapshot) {
+    const out = {};
+    for (const entry of entries) out[entry.name] = renderedValue(entry, snapshot);
+    return out;
+}
+
+function renderedValue(entry, snapshot) {
+    return resolveFieldRead({
+        kind: entry._type,
+        value: entry.value,
+        path: void 0,
+        snapshot: snapshot
+    });
+}
+
+function scopedFieldOverlay({instance: instance, snapshot: snapshot, activityName: activityName}) {
+    const stageEntry = findOpenStageEntry(instance);
+    if (stageEntry === void 0) return {};
+    const stageFields = renderedFields(stageEntry.fields ?? [], snapshot), activity = activityName ? stageEntry.activities.find(t => t.name === activityName) : void 0;
+    return {
+        ...stageFields,
+        ...renderedFields(activity?.fields ?? [], snapshot)
+    };
+}
+
+function assignedFor({instance: instance, activityName: activityName, actor: actor, roleAliases: roleAliases}) {
+    if (actor === void 0) return !1;
+    const activity = findCurrentActivityEntry(instance, activityName);
+    return actorMatchesAssignment({
+        actor: actor,
+        members: assignmentMembers(activity?.fields ?? []),
+        roleAliases: roleAliases
+    });
+}
+
+function effectStatusMap(instance) {
+    const entry = findOpenStageEntry(instance);
+    if (entry === void 0) return {};
+    const out = {};
+    for (const run of instance.effectHistory) run.stageEntryKey === entry._key && (out[run.name] = run.status);
+    return out;
+}
+
+function contextMap(instance) {
+    const out = {};
+    for (const entry of instance.context) out[entry.name] = entry._type === "context.json" ? parseJsonContextEntry(entry) : entry.value;
+    return out;
+}
+
+function effectOutputsMap(instance) {
+    const out = {};
+    for (const run of instance.effectHistory) run.outputs !== void 0 && (out[run.name] = run.outputs);
+    return out;
+}
+
+function parseJsonContextEntry(entry) {
+    try {
+        return JSON.parse(entry.value);
+    } catch (err) {
+        rethrowWithContext(err, `context entry "${entry.name}" holds unparseable JSON`);
+    }
+}
+
+function paramsForLake(params) {
+    return {
+        ...params,
+        self: typeof params.self == "string" ? toBareId(params.self) : params.self,
+        parent: typeof params.parent == "string" ? toBareId(params.parent) : params.parent,
+        ancestors: Array.isArray(params.ancestors) ? params.ancestors.map(a => typeof a == "string" ? toBareId(a) : a) : params.ancestors,
+        fields: stripFieldsForLake(params.fields)
+    };
+}
+
+function stripFieldsForLake(value) {
+    return mapJsonStrings(value, s => toBareId(s));
+}
+
+function resolveStaticValueExpr(src, ctx) {
+    switch (src.type) {
+      case "literal":
+        return src.value;
+
+      case "param":
+        return ctx.params?.[src.param];
+
+      case "actor":
+        return ctx.actor;
+
+      case "now":
+        return ctx.now;
+    }
+}
+
+function randomKey(length = 12) {
+    const bytes = new Uint8Array(length);
+    return globalThis.crypto.getRandomValues(bytes), [ ...bytes ].map(b => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
+
+function instanceDocId(tag) {
+    return `${tag}.wf-instance.${randomKey()}`;
 }
 
 function mapFieldRefValues(args) {
@@ -2254,10 +2682,12 @@ class WorkflowStateDivergedError extends WorkflowError {
 class PartialGuardDeployError extends WorkflowError {
     stageName;
     deployed;
+    rollbackError;
     constructor(args) {
         super("partial-guard-deploy", `Partial guard deploy on stage "${args.stageName}": ${args.deployed} guard(s) deployed before a later one failed.`, {
             cause: args.cause
-        }), this.name = "PartialGuardDeployError", this.stageName = args.stageName, this.deployed = args.deployed;
+        }), this.name = "PartialGuardDeployError", this.stageName = args.stageName, this.deployed = args.deployed, 
+        args.rollbackError !== void 0 && (this.rollbackError = args.rollbackError);
     }
 }
 
@@ -2298,7 +2728,23 @@ function staleClaimDetail(reason) {
 const CONCURRENT_COMMIT_MAX_ATTEMPTS = 3;
 
 function lostRaceMessage(args) {
-    return `${args.what} (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running — a concurrent writer kept committing first. Re-read and retry, or investigate a write storm on this instance.`;
+    return `${args.what} (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running — a concurrent writer kept committing first. ${args.recovery ?? "Re-read and retry, or investigate a write storm on this instance."}`;
+}
+
+function isRetryableInstanceCommitConflict(error) {
+    return !isCreateIdCollision(error) && isRevisionConflict(error);
+}
+
+class InstanceCommitRevisionConflict extends Error {
+    constructor(cause) {
+        super("Instance commit lost its revision fence", {
+            cause: cause
+        }), this.name = "InstanceCommitRevisionConflict";
+    }
+}
+
+function isInstanceCommitRevisionConflict(error) {
+    return error instanceof InstanceCommitRevisionConflict;
 }
 
 class ConcurrentFireActionError extends WorkflowError {
@@ -2316,6 +2762,19 @@ class ConcurrentFireActionError extends WorkflowError {
     }
 }
 
+class ConcurrentCascadeError extends WorkflowError {
+    instanceId;
+    attempts;
+    constructor(args) {
+        super("concurrent-cascade", lostRaceMessage({
+            what: "Automatic cascade",
+            instanceId: args.instanceId,
+            attempts: args.attempts,
+            recovery: "An earlier verb commit may already have landed. Re-read the instance and invoke tick after contention subsides."
+        })), this.name = "ConcurrentCascadeError", this.instanceId = args.instanceId, this.attempts = args.attempts;
+    }
+}
+
 function isRevisionConflict(error) {
     if (typeof error != "object" || error === null) return !1;
     const {statusCode: statusCode, message: message} = error;
@@ -2382,8 +2841,8 @@ class CascadeLimitError extends WorkflowError {
 
 const FIELD_OP_TYPES = [ "field.set", "field.setIfMissing", "field.unset", "field.append", "field.inc", "field.dec", "field.updateWhere", "field.removeWhere" ];
 
-function isFieldOp(summary) {
-    return FIELD_OP_TYPES.includes(summary.opType);
+function isFieldOp(summary2) {
+    return FIELD_OP_TYPES.includes(summary2.opType);
 }
 
 function validateActionParams({action: action, activityName: activityName, callerParams: callerParams}) {
@@ -2462,7 +2921,7 @@ async function runOps(args) {
     if (ops === void 0 || ops.length === 0) return [];
     const opsFromDefinition = origin.effect === void 0 && origin.edit !== !0, summaries = [];
     for (const op of ops) {
-        const summary = await applyOp(op, {
+        const summary2 = await applyOp(op, {
             mutation: mutation,
             stage: stage,
             activityName: origin.activity,
@@ -2476,9 +2935,9 @@ async function runOps(args) {
             memberRoles: args.memberRoles,
             roleAliases: args.roleAliases
         });
-        summaries.push(summary), shouldRecordOpApplied(summary) && mutation.history.push(opAppliedEntry({
+        summaries.push(summary2), shouldRecordOpApplied(summary2) && mutation.history.push(opAppliedEntry({
             origin: origin,
-            summary: summary,
+            summary: summary2,
             stage: stage,
             actor: actor,
             now: now
@@ -2487,12 +2946,12 @@ async function runOps(args) {
     return summaries;
 }
 
-function shouldRecordOpApplied(summary) {
-    return summary.opType !== "field.setIfMissing" || summary.resolved !== void 0;
+function shouldRecordOpApplied(summary2) {
+    return summary2.opType !== "field.setIfMissing" || summary2.resolved !== void 0;
 }
 
 function opAppliedEntry(args) {
-    const {origin: origin, summary: summary, stage: stage, actor: actor, now: now} = args;
+    const {origin: origin, summary: summary2, stage: stage, actor: actor, now: now} = args;
     return {
         _key: randomKey(),
         _type: "opApplied",
@@ -2510,12 +2969,12 @@ function opAppliedEntry(args) {
         ...origin.effect !== void 0 ? {
             effect: origin.effect
         } : {},
-        opType: summary.opType,
-        ...summary.target !== void 0 ? {
-            target: summary.target
+        opType: summary2.opType,
+        ...summary2.target !== void 0 ? {
+            target: summary2.target
         } : {},
-        ...summary.resolved !== void 0 ? {
-            resolved: summary.resolved
+        ...summary2.resolved !== void 0 ? {
+            resolved: summary2.resolved
         } : {},
         ...actor !== void 0 ? {
             actor: actor
@@ -2598,11 +3057,15 @@ function applyFieldSet(op, ctx) {
         ...entryShape(entry),
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.roleAliases,
-        ...entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
+        ...entry._type === "assignee" || entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
             previousValue: entry.value
         } : {}
     });
-    return assertRuntimeRefsWithinSurface({
+    return assertLegacySingularValue({
+        entry: entry,
+        value: validated,
+        ctx: ctx
+    }), assertRuntimeRefsWithinSurface({
         entryType: entry._type,
         entryName: entry.name,
         value: validated,
@@ -2619,12 +3082,12 @@ function applyFieldSet(op, ctx) {
 }
 
 function applyFieldSetIfMissing(op, ctx) {
-    const entry = locateEntry(ctx, op.target);
-    return isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+    const entry = locateEntry(ctx, op.target), legacySingular = isLegacySingularAssignment(entry, ctx);
+    return isAlwaysArrayFieldKind(entry._type) && !legacySingular && rejectFieldOpTarget({
         entry: entry,
         op: op,
         issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
-    }), entry.value !== null && entry.value !== void 0 ? {
+    }), entry.value !== null && entry.value !== void 0 && !(legacySingular && Array.isArray(entry.value) && entry.value.length === 0) ? {
         opType: op.type,
         target: op.target
     } : {
@@ -2744,7 +3207,14 @@ function applyFieldUnset(op, ctx) {
 }
 
 function applyFieldAppend(op, ctx) {
-    const entry = locateEntry(ctx, op.target), slot = appendItemSlot(entry), item = resolveOpValue({
+    const entry = locateEntry(ctx, op.target);
+    if (isLegacySingularAssignment(entry, ctx)) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "item",
+        issues: [ "legacy singular assignee entries do not support append; redeploy at model 9" ]
+    });
+    const slot = appendItemSlot(entry), item = resolveOpValue({
         src: op.value,
         ctx: ctx,
         ...slot !== void 0 ? {
@@ -2756,7 +3226,7 @@ function applyFieldAppend(op, ctx) {
         item: item,
         types: entry._type === "doc.refs" ? entry.types : void 0,
         of: entry._type === "array" ? entry.of : void 0,
-        roles: entry._type === "assignees" ? entry.roles : void 0,
+        roles: isAssignmentFieldEntry(entry) ? entry.roles : void 0,
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.roleAliases
     });
@@ -2768,8 +3238,16 @@ function applyFieldAppend(op, ctx) {
         ctx: ctx,
         src: op.value
     });
-    const current = Array.isArray(entry.value) ? entry.value : [];
-    return setEntryValue(entry, [ ...current, withRowKey(validated) ]), {
+    const next = [ ...Array.isArray(entry.value) ? entry.value : [], withRowKey(validated) ], value = isAssignmentFieldEntry(entry) ? validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: next,
+        ...assignmentEntryShape(entry),
+        previousValue: entry.value,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
+    }) : next;
+    return setEntryValue(entry, value), {
         opType: op.type,
         target: op.target,
         resolved: {
@@ -2846,7 +3324,14 @@ async function applyFieldUpdateWhere(op, ctx) {
 }
 
 async function applyFieldRemoveWhere(op, ctx) {
-    const entry = locateEntry(ctx, op.target), rows = requireArrayValue(entry, op), matches = await rowMatches({
+    const entry = locateEntry(ctx, op.target);
+    if (isLegacySingularAssignment(entry, ctx)) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ "legacy singular assignee entries do not support removeWhere; redeploy at model 9" ]
+    });
+    const rows = requireArrayValue(entry, op), matches = await rowMatches({
         where: op.where,
         rows: rows,
         ctx: ctx
@@ -2857,6 +3342,20 @@ async function applyFieldRemoveWhere(op, ctx) {
     };
 }
 
+function assertLegacySingularValue(args) {
+    const {entry: entry, value: value, ctx: ctx} = args;
+    if (!(!isLegacySingularAssignment(entry, ctx) || !Array.isArray(value) || value.length <= 1)) throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ "legacy singular assignee entries accept at most one total member; redeploy at model 9" ]
+    });
+}
+
+function isLegacySingularAssignment(entry, ctx) {
+    return entry._type === "assignee" && !isAssignmentListModel(ctx.mutation.definitionModelVersion);
+}
+
 function requireMergeableRows(entry, op) {
     if (entry._type !== "array") throw new Error(`${op.type} target ${op.target.scope}:"${op.target.field}" is a ${entry._type} entry — updateWhere merges declared row sub-fields, so it targets \`array\` entries only`);
 }
@@ -3032,6 +3531,14 @@ function whereParams(ctx) {
 
 function validateDefinition(definition) {
     const v2 = createDefinitionValidator();
+    validateConditionSites(v2, definition), validateStart(v2, definition);
+    for (const entry of definition.fields ?? []) v2.checkEntry(entry, `workflow.fields "${entry.name}"`);
+    for (const stage of definition.stages) validateStage(v2, stage);
+    for (const issue of checkWorkflowInvariants(definition)) v2.errors.push(`  · ${formatIssuePath(issue.path)}: ${issue.message}`);
+    if (v2.errors.length > 0) throw new Error(`validateDefinition("${definition.name}"): ${v2.errors.length} deploy-time validation error${v2.errors.length === 1 ? "" : "s"}:\n` + v2.errors.join(`\n`));
+}
+
+function validateConditionSites(v2, definition) {
     for (const site of conditionSitesOf(definition)) {
         const {address: address} = site;
         address.kind !== "editable-field" && v2.checkCondition(site.condition, conditionSiteLabel({
@@ -3039,12 +3546,11 @@ function validateDefinition(definition) {
             address: address
         }));
     }
+}
+
+function validateStart(v2, definition) {
     definition.start?.filter !== void 0 && v2.report("start.filter", startFilterSyntaxIssues(definition.start.filter));
     for (const [index, requirement] of (definition.start?.requirements ?? []).entries()) requirement.type === "groq" && v2.report(`start.requirements[${index}].query`, startRequirementSyntaxIssues(requirement.query));
-    for (const entry of definition.fields ?? []) v2.checkEntry(entry, `workflow.fields "${entry.name}"`);
-    for (const stage of definition.stages) validateStage(v2, stage);
-    for (const issue of checkWorkflowInvariants(definition)) v2.errors.push(`  · ${formatIssuePath(issue.path)}: ${issue.message}`);
-    if (v2.errors.length > 0) throw new Error(`validateDefinition("${definition.name}"): ${v2.errors.length} deploy-time validation error${v2.errors.length === 1 ? "" : "s"}:\n` + v2.errors.join(`\n`));
 }
 
 function createDefinitionValidator() {
@@ -3075,33 +3581,12 @@ function createDefinitionValidator() {
 
 function conditionSiteLabel({stage: stage, address: address}) {
     const at = `stage "${stage}"`;
-    switch (address.kind) {
-      case "predicate":
-        return `predicate "${address.predicate}"`;
-
-      case "transition":
-        return `${at} transition "${address.transition}" when`;
-
-      case "activity-filter":
-        return `${at} activity "${address.activity}".filter`;
-
-      case "requirement":
-        return `${at} activity "${address.activity}".requirements "${address.requirement}"`;
-
-      case "action":
-        return `${at} activity "${address.activity}" action "${address.action}".filter`;
-
-      case "action-when":
-        return `${at} activity "${address.activity}" action "${address.action}".when`;
-
-      case "editable-override":
-        return `${at}.editable "${address.name}"`;
-    }
+    return address.kind === "predicate" ? `predicate "${address.predicate}"` : address.kind === "transition" ? `${at} transition "${address.transition}" when` : address.kind === "activity-filter" ? `${at} activity "${address.activity}".filter` : address.kind === "requirement" ? `${at} activity "${address.activity}".requirements "${address.requirement}"` : address.kind === "action" ? `${at} activity "${address.activity}" action "${address.action}".filter` : address.kind === "action-when" ? `${at} activity "${address.activity}" action "${address.action}".when` : `${at}.editable "${address.name}"`;
 }
 
 function validateStage(v2, stage) {
     for (const entry of stage.fields ?? []) v2.checkEntry(entry, `stage "${stage.name}".fields "${entry.name}"`);
-    for (const guard of stage.guards ?? []) validateGuardReads({
+    for (const guard of stage.guards ?? []) validateGuard({
         v: v2,
         stageName: stage.name,
         guard: guard
@@ -3113,12 +3598,28 @@ function validateStage(v2, stage) {
     });
 }
 
-function validateGuardReads({v: v2, stageName: stageName, guard: guard}) {
+function validateGuard({v: v2, stageName: stageName, guard: guard}) {
     const where = `stage "${stageName}" guard "${guard.name}"`;
-    for (const expr of guard.match.idRefs ?? []) v2.checkGuardRead(expr, `${where} match.idRefs`);
+    if (validateGuardMatch({
+        v: v2,
+        where: where,
+        guard: guard
+    }), guard.predicate !== void 0 && guard.predicate !== "") {
+        const issue = guardPredicateSyntaxIssue(guard.predicate);
+        issue !== void 0 && v2.report(`${where} predicate`, [ issue ]);
+    }
     for (const [key, expr] of Object.entries(guard.metadata ?? {})) v2.checkGuardRead(expr, `${where} metadata "${key}"`);
 }
 
+function validateGuardMatch({v: v2, where: where, guard: guard}) {
+    guard.match.actions.length === 0 && v2.report(`${where} match.actions`, [ GUARD_ACTIONS_REQUIRED_MESSAGE ]);
+    for (const pattern of guard.match.idPatterns ?? []) {
+        const issue = guardIdPatternIssue(pattern, guard.match.actions);
+        issue !== void 0 && v2.report(`${where} match.idPatterns`, [ issue ]);
+    }
+    for (const expr of guard.match.idRefs ?? []) v2.checkGuardRead(expr, `${where} match.idRefs`);
+}
+
 function validateActivity({v: v2, stageName: stageName, activity: activity}) {
     const where = `stage "${stageName}" activity "${activity.name}"`;
     for (const entry of activity.fields ?? []) v2.checkEntry(entry, `${where}.fields "${entry.name}"`);
@@ -3220,214 +3721,52 @@ function buildClientForGdr(args) {
         return sameResource(target, workflowResource) ? client : siblingFor({
             client: client,
             workflowResource: workflowResource,
-            target: target,
-            parsed: parsed,
-            siblings: siblings
-        });
-    };
-}
-
-function siblingFor(args) {
-    const {client: client, workflowResource: workflowResource, target: target, parsed: parsed, siblings: siblings} = args, key = `${target.type}:${target.id}`, cached = siblings.get(key);
-    if (cached !== void 0) return cached;
-    if (client.withConfig === void 0) throw new ContractViolationError(`Cannot route "${gdrFromResource(target, parsed.documentId)}": the GDR targets ${target.type} "${target.id}", not the workflow resource (${workflowResource.type} "${workflowResource.id}"), and the workflow client cannot derive a sibling client for it (no withConfig). Pass resourceClients to route foreign resources, or use a client with withConfig (e.g. @sanity/client).`);
-    const sibling = client.withConfig(siblingConfig(target));
-    return siblings.set(key, sibling), sibling;
-}
-
-function siblingConfig(target) {
-    if (target.type === "dataset") {
-        const {projectId: projectId, dataset: dataset} = datasetResourceParts(target.id);
-        return {
-            resource: target,
-            projectId: projectId,
-            dataset: dataset
-        };
-    }
-    return {
-        resource: target
-    };
-}
-
-const wallClock = () => /* @__PURE__ */ (new Date).toISOString();
-
-function addMs(instant, ms) {
-    return new Date(Date.parse(instant) + ms).toISOString();
-}
-
-function hasPassed(instant, now) {
-    return Date.parse(instant) <= Date.parse(now);
-}
-
-const GUARD_DOC_TYPE = "temp.system.guard";
-
-class MutationGuardDeniedError extends WorkflowError {
-    denied;
-    documentId;
-    action;
-    constructor(args) {
-        const ids = args.denied.map(d => d.guardId).join(", ");
-        super("mutation-guard-denied", `Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), 
-        this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, 
-        this.action = args.action;
-    }
-    static fromGuards(args) {
-        return new MutationGuardDeniedError({
-            documentId: args.documentId,
-            action: args.action,
-            denied: deniedGuardRefs(args.guards)
-        });
-    }
-}
-
-function deniedGuardRefs(guards) {
-    return guards.map(g => ({
-        guardId: g._id,
-        ...g.name !== void 0 ? {
-            name: g.name
-        } : {}
-    }));
-}
-
-function deniedGuardLabels(denied) {
-    return denied.map(d => d.name ?? d.guardId);
-}
-
-function lakeGuardId(args) {
-    return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.guardName}`;
-}
-
-function compileGuard(args) {
-    return {
-        _id: args.id,
-        _type: GUARD_DOC_TYPE,
-        resourceType: args.resourceType,
-        resourceId: args.resourceId,
-        owner: args.owner,
-        sourceInstanceId: args.sourceInstanceId,
-        sourceDefinition: args.sourceDefinition,
-        sourceStage: args.sourceStage,
-        ...args.name !== void 0 ? {
-            name: args.name
-        } : {},
-        ...args.description !== void 0 ? {
-            description: args.description
-        } : {},
-        match: args.match,
-        predicate: args.predicate,
-        metadata: args.metadata
-    };
-}
-
-function toGroqJsPredicate(predicate) {
-    return predicate.replace(new RegExp("(?<!\\$)\\bguard\\.", "g"), "$guard.").replace(new RegExp("(?<!\\$)\\bmutation\\.", "g"), "$mutation.");
-}
-
-function globMatch(pattern, value) {
-    if (!pattern.includes("*")) return pattern === value;
-    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    return new RegExp(`^${escaped}$`).test(value);
-}
-
-function guardMatches({guard: guard, doc: doc, action: action}) {
-    const m = guard.match;
-    if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type))) return !1;
-    if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
-        const byRef = m.idRefs?.includes(doc.id) ?? !1, byPattern = m.idPatterns?.some(p => globMatch(p, doc.id)) ?? !1;
-        if (!byRef && !byPattern) return !1;
-    }
-    return !0;
-}
-
-function guardPredicateParams(args) {
-    return {
-        guard: args.guard,
-        mutation: {
-            action: args.action
-        }
-    };
-}
-
-async function evaluateMutationGuard(args) {
-    const {guard: guard, context: context} = args;
-    if (guard.predicate === "") return !1;
-    const params = guardPredicateParams({
-        guard: guard,
-        action: context.action
-    });
-    try {
-        const tree = parse(toGroqJsPredicate(guard.predicate), {
-            mode: "delta",
-            params: params
-        });
-        return await (await evaluate(tree, {
-            before: context.before,
-            after: context.after,
-            params: params,
-            ...context.identity !== void 0 ? {
-                identity: context.identity
-            } : {}
-        })).get() === !0;
-    } catch {
-        return !1;
-    }
+            target: target,
+            parsed: parsed,
+            siblings: siblings
+        });
+    };
 }
 
-async function denyingGuards(args) {
-    const {guards: guards, doc: doc, context: context} = args, denied = [];
-    for (const guard of guards) guardMatches({
-        guard: guard,
-        doc: doc,
-        action: context.action
-    }) && (await evaluateMutationGuard({
-        guard: guard,
-        context: context
-    }) || denied.push(guard));
-    return denied;
+function siblingFor(args) {
+    const {client: client, workflowResource: workflowResource, target: target, parsed: parsed, siblings: siblings} = args, key = `${target.type}:${target.id}`, cached = siblings.get(key);
+    if (cached !== void 0) return cached;
+    if (client.withConfig === void 0) throw new ContractViolationError(`Cannot route "${gdrFromResource(target, parsed.documentId)}": the GDR targets ${target.type} "${target.id}", not the workflow resource (${workflowResource.type} "${workflowResource.id}"), and the workflow client cannot derive a sibling client for it (no withConfig). Pass resourceClients to route foreign resources, or use a client with withConfig (e.g. @sanity/client).`);
+    const sibling = client.withConfig(siblingConfig(target));
+    return siblings.set(key, sibling), sibling;
 }
 
-async function documentActionDenials(args) {
-    const {doc: doc, resource: resource, action: action, guards: guards, identity: identity} = args, enforceable = guards.filter(g => g.resourceType === resource.type && g.resourceId === resource.id);
-    return enforceable.length === 0 ? [] : denyingGuards({
-        guards: enforceable,
-        doc: {
-            id: doc._id,
-            type: doc._type
-        },
-        context: {
-            action: action,
-            before: doc,
-            after: doc,
-            ...identity !== void 0 ? {
-                identity: identity
-            } : {}
-        }
-    });
+function siblingConfig(target) {
+    if (target.type === "dataset") {
+        const {projectId: projectId, dataset: dataset} = datasetResourceParts(target.id);
+        return {
+            resource: target,
+            projectId: projectId,
+            dataset: dataset
+        };
+    }
+    return {
+        resource: target
+    };
 }
 
-async function instanceWriteDenials(args) {
-    const {instance: instance, guards: guards, identity: identity} = args;
-    return documentActionDenials({
-        doc: instance,
-        resource: instance.workflowResource,
-        action: "update",
-        guards: guards,
-        ...identity !== void 0 ? {
-            identity: identity
-        } : {}
-    });
+const wallClock = () => /* @__PURE__ */ (new Date).toISOString(), tick = ms => new Promise(resolve => {
+    setTimeout(resolve, ms);
+}), wallSleeper = async ms => {
+    let left = ms;
+    for (;left > 2147483647; ) await tick(2147483647), left -= 2147483647;
+    await tick(left);
+};
+
+function addMs(instant, ms) {
+    return new Date(Date.parse(instant) + ms).toISOString();
 }
 
-async function assertInstanceWriteAllowed(args) {
-    const denied = await instanceWriteDenials(args);
-    if (denied.length !== 0) throw MutationGuardDeniedError.fromGuards({
-        documentId: args.instance._id,
-        action: "update",
-        guards: denied
-    });
+function hasPassed(instant, now) {
+    return Date.parse(instant) <= Date.parse(now);
 }
 
-const DATA_MODEL_VERSION = 8, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 8, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/workflows/prerelease";
+const DATA_MODEL_VERSION = 10, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 10, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/workflows/prerelease";
 
 class ReaderModelAcknowledgementError extends WorkflowError {
     code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
@@ -3567,6 +3906,38 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     compatibility: "reader-floor",
     applicability: "detectable",
     summary: "Assignee fields may restrict newly assigned users and collective roles by role."
+}), Object.freeze({
+    id: "split-guard-id-spaces",
+    introducedInModel: 9,
+    minReaderModel: 9,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Guards spanning edit and lifecycle id spaces emit independently retractable documents."
+}), Object.freeze({
+    id: "singular-assignee-lists",
+    introducedInModel: 9,
+    minReaderModel: 9,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Singular assignee fields use member lists with at most one user and any number of roles."
+}), Object.freeze({
+    id: "required-content-references",
+    introducedInModel: 10,
+    minReaderModel: 10,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Required content references must remain readable after initialization before actions or transitions advance."
+}), Object.freeze({
+    id: "effect-retry-policy",
+    introducedInModel: 10,
+    minReaderModel: 10,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "An effect node declares a bounded retry policy the engine enforces on every runtime."
 }) ]);
 
 function recordOf(value) {
@@ -3690,6 +4061,33 @@ function hasRoleConstrainedAssignments(document) {
     return persistedFieldEntries(document).some(entry => entryKindMatches(entry, assignmentKindAcceptsRoles) && Array.isArray(entry.roles) && entry.roles.length > 0);
 }
 
+function hasSingularAssigneeLists(document) {
+    const root = recordOf(document);
+    if (root === void 0) return !1;
+    if (typeof root.definitionSnapshot != "string") return persistedFieldEntries(document).some(entry => entryHasKind(entry, "assignee"));
+    const snapshot = parsedDefinitionSnapshot(root);
+    return typeof snapshot?.modelVersion == "number" && isAssignmentListModel(snapshot.modelVersion) && persistedFieldEntries(document).some(entry => entryHasKind(entry, "assignee"));
+}
+
+function hasEffectRetryPolicy(document) {
+    return persistedDefinitionTree(document)?.actions.some(action => recordsAt(action, "effects").some(effect => recordOf(effect.retry) !== void 0)) ?? !1;
+}
+
+function isMutationGuardAction(action) {
+    return typeof action == "string" && MUTATION_GUARD_ACTIONS.some(candidate => candidate === action);
+}
+
+function hasSplitGuardIdSpaces(document) {
+    return persistedDefinitionTree(document)?.stages.some(stage => recordsAt(stage, "guards").some(guard => {
+        const actions = recordOf(guard.match)?.actions;
+        return Array.isArray(actions) && mutationGuardRequiresSplitEmission(actions.filter(isMutationGuardAction));
+    })) ?? !1;
+}
+
+function hasRequiredContentReferences(document) {
+    return persistedDefinitionTree(document)?.roots.some(root => recordsAt(root, "fields").some(field => field.required === !0 && typeof field.type == "string" && refKindAcceptsTypes(field.type))) ?? !1;
+}
+
 const featureDetectors = {
     "governed-model-stamps": () => !0,
     "subject-field-kind": document => hasFieldKind(document, "subject"),
@@ -3702,6 +4100,10 @@ const featureDetectors = {
     "readiness-requirements": hasReadinessRequirements,
     "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
     "role-constrained-assignment-fields": hasRoleConstrainedAssignments,
+    "singular-assignee-lists": hasSingularAssigneeLists,
+    "split-guard-id-spaces": hasSplitGuardIdSpaces,
+    "required-content-references": hasRequiredContentReferences,
+    "effect-retry-policy": hasEffectRetryPolicy,
     "node-semantics": hasNodeSemantics,
     "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
     "attributes-condition-var": () => !0
@@ -3841,6 +4243,91 @@ function findActivityNode(args) {
     return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
 }
 
+function requirementDescriptor(requirement) {
+    return {
+        name: requirement.name,
+        ...requirement.title !== void 0 ? {
+            title: requirement.title
+        } : {},
+        ...requirement.description !== void 0 ? {
+            description: requirement.description
+        } : {}
+    };
+}
+
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+}
+
+class ActionDisabledError extends WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
+    }
+}
+
+class StartNotAllowedError extends WorkflowError {
+    definition;
+    unmetRequirements;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
+    }
+}
+
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+}
+
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+    "activity-not-active": r => `activity status is "${r.status}"`,
+    "stage-terminal": r => `stage "${r.stage}" is terminal`,
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
+    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
+};
+
+function actionDisabledDetail(reason) {
+    return disabledReasonDetail[reason.kind](reason);
+}
+
+function formatDisabledReason({activity: activity, action: action, reason: reason}) {
+    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+}
+
+class EditFieldDeniedError extends WorkflowError {
+    reason;
+    target;
+    constructor(args) {
+        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
+        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
+    }
+}
+
+const editDisabledReasonDetail = {
+    "not-editable": () => "field is not declared editable",
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "edit-window-closed": r => `edit window closed (${r.detail})`,
+    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
+};
+
+function formatEditDisabledReason(target, reason) {
+    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
+    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+}
+
 function liveChildrenField(instance) {
     const live = liveSubworkflows(instance).length;
     return live > 0 ? {
@@ -3853,9 +4340,13 @@ function abortReason(instance) {
 }
 
 function diagnoseInputFromEvaluation(evaluation) {
+    if (evaluation.missingDocuments?.length && evaluation.blockingMissingDocuments === void 0) throw new Error("Missing blocking document evidence in workflow evaluation");
     const stage = openStage(evaluation.instance);
     return {
         instance: evaluation.instance,
+        ...evaluation.missingDocuments !== void 0 ? {
+            missingDocuments: evaluation.blockingMissingDocuments ?? []
+        } : {},
         activities: evaluation.currentStage.activities,
         transitions: evaluation.currentStage.transitions,
         assignees: Object.fromEntries(evaluation.currentStage.activities.map(t => [ t.activity.name, assigneesOf(stage, t.activity.name) ]))
@@ -3867,7 +4358,8 @@ function openStage(instance) {
 }
 
 function assigneesOf(stage, activityName) {
-    return (stage?.activities.find(t => t.name === activityName)?.fields ?? []).filter(s => s._type === "assignees").flatMap(s => s.value);
+    const entry = stage?.activities.find(t => t.name === activityName);
+    return [ ...assignmentMembers(entry?.fields ?? []) ];
 }
 
 function isResolved(status) {
@@ -3900,11 +4392,16 @@ function failedActivityCause(input) {
 
 function waitingState(input) {
     const active = input.activities.find(t => t.status === "active" && (t.activity.actions ?? []).length > 0 && (t.unmetRequirements ?? []).length === 0);
-    if (active !== void 0) return {
+    if (active === void 0) return;
+    const actions = active.actions.filter(action => actionRendering(action) === "button" && action.allowed).map(action => action.action.name), hasManualAction = active.actions.some(action => !isCascadeFired(action.action));
+    let waitingFor = "automation";
+    return actions.length > 0 ? waitingFor = "caller" : hasManualAction && (waitingFor = "manual-action"), 
+    {
         state: "waiting",
         activity: active.activity.name,
         assignees: input.assignees[active.activity.name] ?? [],
-        actions: (active.activity.actions ?? []).filter(a => !isCascadeFired(a)).map(a => a.name)
+        actions: actions,
+        waitingFor: waitingFor
     };
 }
 
@@ -3968,7 +4465,7 @@ function diagnoseInstance(input) {
         at: instance.completedAt,
         ...liveChildrenField(instance)
     };
-    const cause = stuckFromDocumentState(input) ?? noTransitionFiresCause(input);
+    const cause = stuckFromDocumentState(input) ?? missingDocumentCause(input.missingDocuments) ?? noTransitionFiresCause(input);
     return cause !== void 0 ? {
         state: "stuck",
         cause: cause
@@ -3977,10 +4474,27 @@ function diagnoseInstance(input) {
     };
 }
 
+function missingDocumentCause(documents = []) {
+    return documents.length > 0 ? {
+        kind: "document-missing",
+        documents: documents
+    } : void 0;
+}
+
+function _additionalMissingDocuments(diagnosis, documents) {
+    return diagnosis.state === "stuck" && diagnosis.cause.kind !== "document-missing" ? documents ?? [] : [];
+}
+
 const RUNNABLE_VERBS = /* @__PURE__ */ new Set([ "set-stage", "abort", "drain-effects", "reset-activity" ]);
 
 function remediationsForCause(cause) {
     switch (cause.kind) {
+      case "document-missing":
+        return [ {
+            verb: "abort",
+            rationale: "Required content cannot be read. Investigate the referenced documents, or abort the instance if it is no longer needed."
+        } ];
+
       case "failed-effect":
         return [ {
             verb: "retry-effect",
@@ -4030,7 +4544,7 @@ function isClaimExpired(claim, now) {
     return claim.leaseExpiresAt === void 0 || hasPassed(claim.leaseExpiresAt, now);
 }
 
-const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ];
+const EFFECT_RUN_STATUSES = _exhaustiveOptions()([ "done", "failed", "cancelled" ]);
 
 function userLoginProvider(user) {
     return user?.provider ?? user?.loginProvider;
@@ -4075,12 +4589,12 @@ function joinCacheFor(client) {
 }
 
 function isClientProjectMember(value) {
-    return isRecord(value) && typeof value.id == "string";
+    return isRecord(value) && typeof value.id == "string" && (value.isRobot === void 0 || typeof value.isRobot == "boolean");
 }
 
-async function requestProjectMembers(request, projectId) {
+async function _requestProjectMembers(request, projectId) {
     const project = await request({
-        uri: `/projects/${encodeURIComponent(projectId)}`
+        url: `/projects/${encodeURIComponent(projectId)}`
     }), members = isRecord(project) ? project.members : void 0;
     if (!Array.isArray(members) || !members.every(isClientProjectMember)) throw new Error(`Project member directory response is invalid for project "${projectId}"`);
     return members;
@@ -4088,7 +4602,7 @@ async function requestProjectMembers(request, projectId) {
 
 async function requestProjectUsers(args) {
     const {request: request, projectId: projectId, memberIds: memberIds} = args, response = await request({
-        uri: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
+        url: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
     }), rows = Array.isArray(response) ? response : [ response ];
     if (!rows.every(isClientProjectUser)) throw new Error(`Project user directory response is invalid for project "${projectId}"`);
     const requested = new Set(memberIds);
@@ -4096,7 +4610,7 @@ async function requestProjectUsers(args) {
 }
 
 async function requestProjectMemberDirectory(args) {
-    const {request: request, projectId: projectId} = args, members = await requestProjectMembers(request, projectId), memberIds = members.map(member => member.id).filter(id => classifyPrincipalId(id).namespace === "project");
+    const {request: request, projectId: projectId} = args, members = await _requestProjectMembers(request, projectId), memberIds = members.map(member => member.id).filter(id => classifyPrincipalId(id).namespace === "project");
     if (memberIds.length === 0) return {
         members: members,
         globalUsers: []
@@ -4171,7 +4685,7 @@ function clientProjectUserDirectory(client, projectId) {
             });
             try {
                 const response = await client.request({
-                    uri: `/projects/${encodeURIComponent(projectId)}/users/${encodeURIComponent(id)}`
+                    url: `/projects/${encodeURIComponent(projectId)}/users/${encodeURIComponent(id)}`
                 }), candidate = Array.isArray(response) ? response[0] : response;
                 return candidate == null ? {
                     status: "missing"
@@ -4283,8 +4797,30 @@ function collectWatchRefs(instance) {
 }
 
 function collectSubjectRefs(instance) {
-    const stage = findOpenStageEntry(instance), activityFields = stage?.activities.map(activity => activity.fields) ?? [];
-    return [ ...entryDocRefs(instance.fields), ...entryDocRefs(stage?.fields), ...activityFields.flatMap(entryDocRefs), ...entryReleaseRefs(instance.fields), ...entryReleaseRefs(stage?.fields), ...activityFields.flatMap(entryReleaseRefs) ];
+    const entries = activeFieldEntries(instance).map(({entry: entry}) => entry);
+    return [ ...entryDocRefs(entries), ...entryReleaseRefs(entries) ];
+}
+
+function activeFieldEntries(instance) {
+    const stage = findOpenStageEntry(instance);
+    return [ ...scopedEntries(instance.fields, {
+        scope: "workflow"
+    }), ...scopedEntries(stage?.fields, {
+        scope: "stage"
+    }), ...(stage?.activities ?? []).flatMap(activity => scopedEntries(activity.fields, {
+        scope: "activity",
+        activity: activity.name
+    })) ];
+}
+
+function scopedEntries(entries, scope) {
+    return (entries ?? []).map(entry => ({
+        target: {
+            ...scope,
+            field: entry.name
+        },
+        entry: entry
+    }));
 }
 
 function foreignSubjectRefs(instance) {
@@ -4385,6 +4921,10 @@ function entrySubjectRefs(entries) {
     return fieldEntries(entries).flatMap(entry => (typeof entry._type == "string" && isSingleDocRefKind(entry._type) || entry._type === "release.ref") && isGdr(entry.value) ? [ entry.value ] : []);
 }
 
+function missingEntryDocRefs(entries, knownIds) {
+    return entryDocRefs(entries).filter(reference => !knownIds.has(reference.id));
+}
+
 function fieldEntries(entries) {
     return Array.isArray(entries) ? entries.filter(entry => !!entry && typeof entry == "object") : [];
 }
@@ -4812,6 +5352,96 @@ function coerceToGdr(raw, workflowResource) {
     } : null;
 }
 
+const NOW = {
+    variable: "now",
+    path: []
+}, LAST_REPRESENTABLE_MS = 864e13;
+
+function readsNowIn(reads) {
+    return reads.some(read => read.variable === "now");
+}
+
+function readsNow(condition) {
+    return readsNowIn(analyzeCondition(condition).reads);
+}
+
+async function stageTimeSites(args) {
+    const {definition: definition, stage: stage, scopeFor: scopeFor} = args, sites = [];
+    for (const site of conditionSitesOf(definition)) {
+        if (site.stage !== stage || site.address.kind === "editable-override" || !readsNow(site.condition)) continue;
+        const activity = "activity" in site.address ? site.address.activity : void 0;
+        sites.push({
+            condition: site.condition,
+            params: await scopeFor(activity)
+        });
+    }
+    return sites;
+}
+
+async function nextEvaluationInstant(args) {
+    const {sites: sites, dataset: dataset, now: now} = args, boundaries = [];
+    for (const site of sites) {
+        const boundary = await siteBoundary({
+            ...site,
+            dataset: dataset,
+            now: now
+        });
+        boundary !== void 0 && boundaries.push(boundary);
+    }
+    return [ ...boundaries ].sort(byInstant)[0];
+}
+
+function byInstant(a, b) {
+    return Date.parse(a) - Date.parse(b);
+}
+
+async function siteBoundary(args) {
+    const {condition: condition, params: params, dataset: dataset, now: now} = args, insight = await explainCondition({
+        condition: condition,
+        dataset: dataset,
+        params: params
+    });
+    for (const candidate of await candidateInstants({
+        insight: insight,
+        params: params,
+        dataset: dataset,
+        now: now
+    })) if ((await whatIfCondition({
+        condition: condition,
+        dataset: dataset,
+        params: params,
+        assign: {
+            target: NOW,
+            value: candidate
+        }
+    })).changed) return candidate;
+}
+
+async function candidateInstants(args) {
+    const {insight: insight, params: params, dataset: dataset, now: now} = args, comparands = [];
+    for (const atom of insight.atoms) readsNowIn(atom.atom.reads) && comparands.push(...await comparandsOf({
+        atom: atom,
+        params: params,
+        dataset: dataset
+    }));
+    const instants = comparands.filter(isParseableInstant).map(normalizeInstant).filter(instant => Date.parse(instant) < LAST_REPRESENTABLE_MS).flatMap(instant => [ instant, addMs(instant, 1) ]).filter(instant => !hasPassed(instant, now));
+    return [ ...new Set(instants) ].sort(byInstant);
+}
+
+function normalizeInstant(value) {
+    return new Date(Date.parse(value)).toISOString();
+}
+
+async function comparandsOf(args) {
+    const {atom: atom, params: params, dataset: dataset} = args, requirement = atom.requirement, values = requirement !== void 0 && requirement.target.variable === "now" && "value" in requirement ? [ requirement.value ] : [];
+    for (const read of atom.atom.reads) read.variable !== "now" && values.push(await runGroq({
+        groq: formatRead(read),
+        params: params,
+        dataset: dataset
+    }));
+    return values;
+}
+
 const NonEmpty = NonEmptyString, PersistedAssignmentRolesSchema = v.pipe(v.array(NonEmptyString), v.minLength(1, "assignment roles must not be empty")), UnknownRecord = v.record(v.string(), v.unknown()), PersistedChoiceOptionsSchema = v.looseObject({
     list: v.array(v.looseObject({
         title: v.string(),
@@ -4864,7 +5494,7 @@ function fieldArm(kind, value) {
     };
 }
 
-const OptionalRefTypes = v.exactOptional(v.array(v.string())), ResolvedFieldEntrySchema = v.variant("_type", [ v.looseObject(tolerantEntries()({
+const OptionalRefTypes = v.exactOptional(v.array(v.string())), RawResolvedFieldEntrySchema = v.variant("_type", [ v.looseObject(tolerantEntries()({
     ...fieldArm("doc.ref", fieldValueSchemas["doc.ref"]),
     types: OptionalRefTypes
 })), v.looseObject(tolerantEntries()({
@@ -4885,7 +5515,7 @@ const OptionalRefTypes = v.exactOptional(v.array(v.string())), ResolvedFieldEntr
 })), v.looseObject(tolerantEntries()({
     ...fieldArm("array", v.array(UnknownRecord)),
     of: v.array(PersistedFieldShapeSchema)
-})) ]), EffectOriginSchema = tolerantObject()({
+})) ]), ResolvedFieldEntrySchema = v.pipe(RawResolvedFieldEntrySchema, v.transform(normalizeNestedAssignmentValues)), EffectOriginSchema = tolerantObject()({
     kind: v.literal("action"),
     name: NonEmpty
 }), PendingEffectClaimSchema = tolerantObject()({
@@ -5565,7 +6195,7 @@ async function resolveThroughDirectory(args) {
     if (safeMisses.length === 0 || client.request === void 0) return out;
     try {
         const response = await client.request({
-            uri: `/projects/${encodeURIComponent(projectId)}/users/${safeMisses.map(encodeURIComponent).join(",")}`,
+            url: `/projects/${encodeURIComponent(projectId)}/users/${safeMisses.map(encodeURIComponent).join(",")}`,
             tag: REQUEST_TAG.accessResolveActor
         });
         ingestDirectoryRows({
@@ -5746,6 +6376,31 @@ function buildInstanceBase(args) {
     };
 }
 
+function instanceDocumentForWrite(instance) {
+    const listModel = writesSingularAssignmentLists(instance);
+    return {
+        ...instance,
+        fields: assignmentFieldsForWrite(instance.fields, listModel),
+        stages: assignmentStagesForWrite(instance.stages, listModel)
+    };
+}
+
+function memoizedBy(compute) {
+    const cache = /* @__PURE__ */ new Map;
+    return key => {
+        const hit = cache.get(key);
+        if (hit !== void 0) return hit;
+        const value = (async () => compute(key))();
+        return cache.set(key, value), value;
+    };
+}
+
+function chunks(values, size) {
+    return Array.from({
+        length: Math.ceil(values.length / size)
+    }, (_, index) => values.slice(index * size, (index + 1) * size));
+}
+
 async function hydrateSnapshot(args) {
     const {client: client, clientForGdr: clientForGdr, instance: instance, overlay: overlay} = args, loaded = [], visited = /* @__PURE__ */ new Set;
     loaded.push({
@@ -5856,12 +6511,6 @@ function groupReads(reads) {
     return [ ...byClient.values() ].flatMap(groups => [ ...groups.values() ]);
 }
 
-function chunks(values, size) {
-    return Array.from({
-        length: Math.ceil(values.length / size)
-    }, (_, index) => values.slice(index * size, (index + 1) * size));
-}
-
 function collectEntryDocUris(resolvedFieldEntries) {
     return entryDocRefs(resolvedFieldEntries).map(ref => ref.id);
 }
@@ -5896,16 +6545,26 @@ function loadCallContext({client: client, instanceId: instanceId, options: optio
 
 async function retryOnRevisionConflict(args) {
     const {client: client, instanceId: instanceId, options: options, commit: commit, onExhausted: onExhausted} = args;
-    for (let attempt = 1; attempt <= CONCURRENT_COMMIT_MAX_ATTEMPTS; attempt++) {
-        const ctx = await loadCallContext({
+    return retryCommit({
+        load: () => loadCallContext({
             client: client,
             instanceId: instanceId,
             options: options
-        });
+        }),
+        commit: commit,
+        shouldRetry: isInstanceCommitRevisionConflict,
+        onExhausted: onExhausted
+    });
+}
+
+async function retryCommit(args) {
+    const {load: load, commit: commit, shouldRetry: shouldRetry, onExhausted: onExhausted} = args;
+    for (let attempt = 1; attempt <= CONCURRENT_COMMIT_MAX_ATTEMPTS; attempt++) {
+        const ctx = await load();
         try {
             return await commit(ctx);
         } catch (error) {
-            if (!isRevisionConflict(error)) throw error;
+            if (!shouldRetry(error)) throw error;
         }
     }
     throw onExhausted();
@@ -5953,6 +6612,22 @@ async function ctxConditionParams(ctx, opts) {
     }, opts);
 }
 
+async function ctxNextEvaluationAt(ctx) {
+    if (ctx.instance.completedAt !== void 0) return;
+    const scopeFor = memoizedBy(activityName => ctxConditionParams(ctx, activityName === void 0 ? void 0 : {
+        activityName: activityName
+    })), sites = await stageTimeSites({
+        definition: ctx.definition,
+        stage: ctx.instance.currentStage,
+        scopeFor: scopeFor
+    });
+    if (sites.length !== 0) return nextEvaluationInstant({
+        sites: sites,
+        dataset: ctx.snapshot.docs,
+        now: ctx.now
+    });
+}
+
 async function ctxEvaluateConditionOutcome({ctx: ctx, condition: condition, opts: opts}) {
     return condition === void 0 ? "satisfied" : evaluateConditionOutcome({
         condition: condition,
@@ -6124,7 +6799,7 @@ async function resolveActivityFieldEntries(args) {
 
 async function resolveBindings(args) {
     const resolved = {};
-    for (const [key, groq] of Object.entries(args.bindings ?? {})) resolved[key] = await runGroq({
+    for (const [key, groq] of Object.entries(args.bindings ?? {})) resolved[key] = await runGroq$1({
         groq: groq,
         params: args.params,
         snapshot: args.snapshot
@@ -6581,7 +7256,7 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
     if (route === null) return null;
     const resource = assertSingleResource(route.targets), types = resolveMatchTypes(route.targets, guard.match.types);
     return {
-        doc: compileGuard({
+        docs: compileGuards({
             id: route.guardId,
             resourceType: resource.type,
             resourceId: resource.id,
@@ -6613,19 +7288,63 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
 async function upsertGuard(args) {
     const {client: client, doc: doc, exists: exists} = args;
     if (!exists) try {
-        await client.create(doc, {
-            ...SYNC_COMMIT,
-            tag: REQUEST_TAG.guardDeploy
-        });
-        return;
+        return {
+            created: await client.create(doc, {
+                ...SYNC_COMMIT,
+                tag: REQUEST_TAG.guardDeploy
+            })
+        };
     } catch (error) {
         if (!isCreateIdCollision(error)) throw error;
     }
     const {_id: _id, _type: _type, _rev: _rev, _createdAt: _createdAt, _updatedAt: _updatedAt, ...body} = doc;
-    await client.patch(doc._id).set(body).commit({
+    return await client.patch(doc._id).set(body).commit({
         ...SYNC_COMMIT,
         tag: REQUEST_TAG.guardRefresh
+    }), {
+        created: void 0
+    };
+}
+
+async function retractCreatedGuards(guards) {
+    for (const {client: client, doc: doc} of guards.toReversed()) {
+        if (doc._rev === void 0) return new Error(`Cannot roll back guard ${doc._id}: created document has no revision`);
+        try {
+            const revisionCheck = client.patch(doc._id).set({
+                predicate: doc.predicate
+            }).ifRevisionId(doc._rev);
+            await client.transaction().patch(revisionCheck).delete(doc._id).commit({
+                tag: REQUEST_TAG.guardDeploy
+            });
+        } catch (error) {
+            return error;
+        }
+    }
+}
+
+async function deployResolvedGuard(args) {
+    const {client: client, resourceKey: resourceKey, doc: doc, guard: guard, stageArgs: stageArgs, existingByResource: existingByResource} = args, localized = await localizeGuardMetadata({
+        doc: doc,
+        guard: guard,
+        client: client,
+        instance: stageArgs.instance,
+        definition: stageArgs.definition
     });
+    return (await upsertGuard({
+        client: client,
+        doc: localized,
+        exists: existingByResource.get(resourceKey)?.has(doc._id) ?? !1
+    })).created;
+}
+
+async function failGuardDeploy(args) {
+    const {cause: cause, stageName: stageName, deployed: deployed, createdGuards: createdGuards, updatedExistingGuard: updatedExistingGuard} = args, rollbackError = updatedExistingGuard ? void 0 : await retractCreatedGuards(createdGuards);
+    throw deployed > 0 && (updatedExistingGuard || rollbackError !== void 0) ? new PartialGuardDeployError({
+        stageName: stageName,
+        deployed: deployed,
+        cause: cause,
+        rollbackError: rollbackError
+    }) : cause;
 }
 
 function resolvedStageGuards(args) {
@@ -6638,10 +7357,12 @@ function resolvedStageGuards(args) {
             now: args.now,
             snapshot: args.snapshot
         });
-        resolved !== null && out.push({
-            client: args.clientForGdr(resolved.routeGdr),
-            resourceKey: resourceGdr(resourceFromParsed(resolved.routeGdr)),
-            value: resolved.doc,
+        if (resolved === null) continue;
+        const client = args.clientForGdr(resolved.routeGdr), resourceKey = resourceGdr(resourceFromParsed(resolved.routeGdr));
+        for (const doc of resolved.docs) out.push({
+            client: client,
+            resourceKey: resourceKey,
+            value: doc,
             guard: guard
         });
     }
@@ -6657,10 +7378,15 @@ function resolvedStageGuardRoutes(args) {
     }, out = [];
     for (const guard of stage?.guards ?? []) {
         const route = resolveGuardRoute(guard, ctx);
-        route !== null && out.push({
-            client: args.clientForGdr(route.routeGdr),
-            resourceKey: resourceGdr(resourceFromParsed(route.routeGdr)),
-            value: route.guardId
+        if (route === null) continue;
+        const client = args.clientForGdr(route.routeGdr), resourceKey = resourceGdr(resourceFromParsed(route.routeGdr));
+        for (const guardId of compiledGuardIds({
+            id: route.guardId,
+            actions: guard.match.actions
+        })) out.push({
+            client: client,
+            resourceKey: resourceKey,
+            value: guardId
         });
     }
     return out;
@@ -6716,26 +7442,30 @@ async function deployStageGuards(args) {
     if (live === void 0 || live.currentStage !== args.stageName || live.abortedAt !== void 0) return;
     const routed = resolvedStageGuards(args), existingByResource = await existingGuardIds(groupByResource(routed));
     let deployed = 0;
+    const createdGuards = [];
+    let updatedExistingGuard = !1;
     for (const {client: client, resourceKey: resourceKey, value: doc, guard: guard} of routed) {
         try {
-            const localized = await localizeGuardMetadata({
+            const created = await deployResolvedGuard({
+                client: client,
+                resourceKey: resourceKey,
                 doc: doc,
                 guard: guard,
-                client: client,
-                instance: args.instance,
-                definition: args.definition
+                stageArgs: args,
+                existingByResource: existingByResource
             });
-            await upsertGuard({
+            created === void 0 ? updatedExistingGuard = !0 : createdGuards.push({
                 client: client,
-                doc: localized,
-                exists: existingByResource.get(resourceKey)?.has(doc._id) ?? !1
+                doc: created
             });
         } catch (cause) {
-            throw deployed > 0 ? new PartialGuardDeployError({
+            await failGuardDeploy({
+                cause: cause,
                 stageName: args.stageName,
                 deployed: deployed,
-                cause: cause
-            }) : cause;
+                createdGuards: createdGuards,
+                updatedExistingGuard: updatedExistingGuard
+            });
         }
         deployed += 1;
     }
@@ -6967,7 +7697,8 @@ async function persistThenDeploy({ctx: ctx, mutation: mutation, deploy: deploy})
         committedRev: committed._rev,
         restore: instanceStateFields({
             ...ctx.instance,
-            minReaderModel: minReaderModelOf(ctx.instance)
+            minReaderModel: minReaderModelOf(ctx.instance),
+            definitionModelVersion: definitionAssignmentModel(ctx.instance)
         }),
         unset: ctx.instance.completedAt === void 0 ? [ "completedAt" ] : [],
         reversible: !spawned,
@@ -6999,6 +7730,29 @@ async function refreshStageGuards({ctx: ctx, mutation: mutation, stageName: stag
     });
 }
 
+function missingRequiredDocuments({instance: instance, definition: definition, snapshot: snapshot}) {
+    return (definition.fields ?? []).filter(field => field.required === !0 && refKindAcceptsTypes(field.type)).flatMap(field => {
+        const entry = instance.fields.find(candidate => candidate.name === field.name && candidate._type === field.type);
+        return missingEntryDocRefs(entry === void 0 ? [] : [ entry ], snapshot.knownIds).map(reference => ({
+            target: {
+                scope: "workflow",
+                field: field.name
+            },
+            reference: reference
+        }));
+    });
+}
+
+function requiredDocumentRequirements(args) {
+    return [ ...new Set(missingRequiredDocuments(args).map(({target: target}) => target.field)) ].map(field => {
+        const title = args.definition.fields?.find(entry => entry.name === field)?.title ?? field;
+        return {
+            name: `field:${field}`,
+            title: `Documents selected for “${title}” must be readable`
+        };
+    });
+}
+
 async function discoverItems(args) {
     const {client: client, groq: groq, params: params, perspective: perspective} = args;
     return client.fetch(groq, paramsForLake(params), {
@@ -7232,7 +7986,7 @@ async function projectRowFields({ctx: ctx, sub: sub, childDefinition: childDefin
     for (const [name, groq] of Object.entries(sub.with ?? {})) {
         const declared = (childDefinition.fields ?? []).find(e => e.name === name);
         if (declared === void 0) throw new Error(`spawn.with["${name}"]: subworkflow "${childDefinition.name}" declares no field entry "${name}"`);
-        const raw = await runGroq({
+        const raw = await runGroq$1({
             groq: groq,
             params: {
                 ...parentScope,
@@ -7275,7 +8029,7 @@ async function projectRowFields({ctx: ctx, sub: sub, childDefinition: childDefin
 async function resolveContextHandoff({ctx: ctx, sub: sub, parentScope: parentScope}) {
     const out = {};
     for (const [name, groq] of Object.entries(sub.context ?? {})) {
-        const v2 = await runGroq({
+        const v2 = await runGroq$1({
             groq: groq,
             params: parentScope,
             snapshot: ctx.snapshot
@@ -7574,7 +8328,7 @@ async function persistStageMove({ctx: ctx, mutation: mutation, exitedStage: exit
 }
 
 async function pickTransition(ctx, stage) {
-    for (const candidate of stage.transitions ?? []) {
+    if (!(missingRequiredDocuments(ctx).length > 0)) for (const candidate of stage.transitions ?? []) {
         const outcome = await ctxEvaluateConditionOutcome({
             ctx: ctx,
             condition: candidate.when
@@ -7676,7 +8430,7 @@ const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ ne
 
 async function resolveAccess(taggedClient, args = {}) {
     const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({url: '/users/me'})`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
     const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
         client: client,
         requestFn: requestFn,
@@ -7745,20 +8499,32 @@ function cachedByKey(args) {
 }
 
 async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    const resourceUser = await fetchCurrentUser(requestFn, "the workflow resource host"), resourceId = usableId(resourceUser), resourceGlobalId = firstCarriedGlobalId([ resourceId ]) ?? directoryBridgeId(resourceUser?.sanityUserId);
+    if (resourceGlobalId !== void 0) return identityFromUsers({
+        id: resourceGlobalId,
+        resourceUser: resourceUser
+    });
+    const globalUser = await fetchGlobalUser(client), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
     if (sessionId === void 0) return;
     const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
         client: client,
         sessionId: sessionId,
         resourceId: resourceId
     }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
-    refuseProjectScopedActor({
+    return refuseProjectScopedActor({
         id: id,
         globalUser: globalUser,
         globalHostId: globalHostId,
         bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    }), identityFromUsers({
+        id: id,
+        resourceUser: resourceUser,
+        globalUser: globalUser.user
     });
-    const roleNames = roleNamesFor(resourceUser, globalUser);
+}
+
+function identityFromUsers(args) {
+    const {id: id, resourceUser: resourceUser, globalUser: globalUser} = args, resourceId = usableId(resourceUser), roleNames = roleNamesFor(resourceUser, globalUser);
     return {
         actor: {
             kind: "person",
@@ -7774,7 +8540,7 @@ async function fetchActor(client, requestFn) {
 }
 
 function roleNamesFor(resourceUser, globalUser) {
-    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+    return (resourceUser?.roles?.length ? resourceUser : globalUser)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
 }
 
 const NO_BRIDGE = {
@@ -7838,11 +8604,11 @@ function usableId(user) {
 async function fetchCurrentUser(requestFn, hostDescription) {
     try {
         return await requestFn({
-            uri: "/users/me",
+            url: "/users/me",
             tag: REQUEST_TAG.accessResolveActor
         });
     } catch (err) {
-        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
+        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({url: '/users/me'})\`. Check the token/connectivity.`, {
             cause: err
         });
     }
@@ -7859,7 +8625,7 @@ async function fetchGlobalUser(client) {
     };
     try {
         const user = await sibling.request({
-            uri: "/users/me",
+            url: "/users/me",
             tag: REQUEST_TAG.accessResolveActor
         }), id = usableId(user);
         return sibling.requireGlobalPrincipal && id !== void 0 && classifyPrincipalId(id).namespace === "project" ? {
@@ -7982,7 +8748,7 @@ async function resolveOrganizationId(args) {
         load: async () => {
             try {
                 const project = await requestFn({
-                    uri: `/projects/${encodeURIComponent(projectId)}`,
+                    url: `/projects/${encodeURIComponent(projectId)}`,
                     tag: REQUEST_TAG.accessResolveOrg
                 });
                 if (!isRecord(project)) return;
@@ -8007,15 +8773,17 @@ function httpStatusOf(err) {
     return typeof status == "number" ? status : void 0;
 }
 
+function attributesRequestOf(client) {
+    const version = client.config?.().apiVersion, request = typeof client.withConfig == "function" || version === void 0 || version === ENGINE_API_VERSION ? lazyRequest(pinApiVersion(client)) : void 0;
+    return request === void 0 && console.warn("workflow: skipped org attributes fetch; the client cannot issue API-version-pinned requests. Advisory $attributes stays undefined (conditions referencing it fail closed)."), 
+    request;
+}
+
 async function fetchAttributesCached(args) {
-    const {client: client, orgId: orgId} = args, sibling = globalHostRequestOf(client);
-    if ("reason" in sibling) {
-        console.warn(`workflow: skipped org attributes fetch (${sibling.reason}); advisory $attributes stays undefined (conditions referencing it fail closed).`);
-        return;
-    }
-    try {
-        const response = await sibling.request({
-            uri: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
+    const {client: client, orgId: orgId} = args, request = attributesRequestOf(client);
+    if (request !== void 0) try {
+        const response = await request({
+            url: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
             tag: REQUEST_TAG.accessAttributes
         }), envelope = isRecord(response) ? response : void 0;
         if (envelope?.hasMore === !0) {
@@ -8061,91 +8829,6 @@ async function callerBoundVarsForCall(args) {
     });
 }
 
-function requirementDescriptor(requirement) {
-    return {
-        name: requirement.name,
-        ...requirement.title !== void 0 ? {
-            title: requirement.title
-        } : {},
-        ...requirement.description !== void 0 ? {
-            description: requirement.description
-        } : {}
-    };
-}
-
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
-}
-
-class ActionDisabledError extends WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
-    }
-}
-
-class StartNotAllowedError extends WorkflowError {
-    definition;
-    unmetRequirements;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
-    }
-}
-
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
-}
-
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
-    "activity-not-active": r => `activity status is "${r.status}"`,
-    "stage-terminal": r => `stage "${r.stage}" is terminal`,
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
-    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
-};
-
-function actionDisabledDetail(reason) {
-    return disabledReasonDetail[reason.kind](reason);
-}
-
-function formatDisabledReason({activity: activity, action: action, reason: reason}) {
-    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
-}
-
-class EditFieldDeniedError extends WorkflowError {
-    reason;
-    target;
-    constructor(args) {
-        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
-        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
-    }
-}
-
-const editDisabledReasonDetail = {
-    "not-editable": () => "field is not declared editable",
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "edit-window-closed": r => `edit window closed (${r.detail})`,
-    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
-};
-
-function formatEditDisabledReason(target, reason) {
-    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
-    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
-}
-
 async function fireAction(args) {
     const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
     return retryOnRevisionConflict({
@@ -8214,6 +8897,15 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
         actionName: actionName,
         status: entry?.status
     });
+    const unmetRequirements = requiredDocumentRequirements(ctx);
+    if (unmetRequirements.length > 0) throw new ActionDisabledError({
+        activity: activityName,
+        action: actionName,
+        reason: {
+            kind: "requirements-unmet",
+            unmetRequirements: unmetRequirements
+        }
+    });
     const params = validateActionParams({
         action: action,
         activityName: activityName,
@@ -8313,7 +9005,7 @@ async function commitAction({ctx: ctx, activityName: activityName, actionName: a
         actionName: actionName,
         callerParams: callerParams,
         options: options
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -8370,13 +9062,13 @@ async function runTriggeredActions({ctx: ctx, mutation: mutation, stage: stage})
 async function runActivityTriggers({ctx: ctx, mutation: mutation, activity: activity}) {
     let fires = 0, ranFieldOps = !1;
     for (const action of activity.actions ?? []) {
-        if (!isCascadeFired(action)) continue;
         const entry = currentActivities(mutation).find(e => e.name === activity.name);
         if (entry === void 0 || entry.status !== "active") break;
-        if ((entry.firedActions ?? []).includes(action.name) || !await triggerIsLive({
+        if (!await triggerIsLive({
             ctx: ctx,
             activity: activity,
-            action: action
+            action: action,
+            entry: entry
         })) continue;
         const result = await fireTriggeredAction({
             ctx: ctx,
@@ -8393,8 +9085,12 @@ async function runActivityTriggers({ctx: ctx, mutation: mutation, activity: acti
     };
 }
 
-async function triggerIsLive({ctx: ctx, activity: activity, action: action}) {
-    if (!tokenMayExecute({
+function isUnfiredTrigger(action, entry) {
+    return isCascadeFired(action) && !(entry.firedActions ?? []).includes(action.name);
+}
+
+async function triggerIsLive({ctx: ctx, activity: activity, action: action, entry: entry}) {
+    if (!isUnfiredTrigger(action, entry) || missingRequiredDocuments(ctx).length > 0 || !tokenMayExecute({
         actor: ctx.actor,
         action: action,
         ctx: ctx
@@ -8479,7 +9175,7 @@ async function primeInitialStage(args) {
         })
     });
     const terminal = isTerminalStage(stage), committed = await client.patch(instance._id).set({
-        stages: [ initialStageEntry ],
+        stages: assignmentStagesForWrite([ initialStageEntry ], writesSingularAssignmentLists(instance)),
         lastChangedAt: now,
         ...terminal ? {
             completedAt: now
@@ -8537,32 +9233,59 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
             settlingCohorts: settlingCohorts
         } : {},
         memberRolesLoader: memberRolesLoader
-    }, ctx = instance === void 0 ? await loadContext({
-        client: client,
-        instanceId: instanceId,
-        options: contextOptions
-    }) : await buildEngineContext({
-        client: client,
-        instance: instance,
-        definition: parseDefinitionSnapshot(instance),
-        ...contextOptions
+    };
+    let preloadedInstance = instance;
+    return retryCommit({
+        load: async () => {
+            if (preloadedInstance === void 0) return loadContext({
+                client: client,
+                instanceId: instanceId,
+                options: contextOptions
+            });
+            const loaded = preloadedInstance;
+            return preloadedInstance = void 0, buildEngineContext({
+                client: client,
+                instance: loaded,
+                definition: parseDefinitionSnapshot(loaded),
+                ...contextOptions
+            });
+        },
+        commit: ctx => commitCascadeHop({
+            ctx: ctx,
+            actor: actor
+        }),
+        shouldRetry: isInstanceCommitRevisionConflict,
+        onExhausted: () => new ConcurrentCascadeError({
+            instanceId: instanceId,
+            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
+        })
     });
+}
+
+async function commitCascadeHop({ctx: ctx, actor: actor}) {
     if (isTerminal(ctx)) return {
         moved: !1
     };
-    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), fired = await runTriggeredActions({
+    const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startRevisionRetryMutation(ctx.instance), fired = await runTriggeredActions({
         ctx: ctx,
         mutation: mutation,
         stage: stage
     }), hopCtx = liveViewContext(ctx, mutation), transition = await pickTransition(hopCtx, stage);
-    return transition === void 0 ? (fired.fires > 0 && await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: stage.name,
-        didChangeState: fired.ranFieldOps
-    }), {
-        moved: !1
-    }) : (await commitStageMove({
+    if (transition === void 0) {
+        const nextEvaluationAt = await ctxNextEvaluationAt(hopCtx);
+        return fired.fires > 0 && await persistThenMaybeRefresh({
+            ctx: ctx,
+            mutation: mutation,
+            stageName: stage.name,
+            didChangeState: fired.ranFieldOps
+        }), {
+            moved: !1,
+            ...nextEvaluationAt !== void 0 ? {
+                nextEvaluationAt: nextEvaluationAt
+            } : {}
+        };
+    }
+    return await commitStageMove({
         ctx: ctx,
         mutation: mutation,
         fromStage: stage,
@@ -8572,7 +9295,7 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
         actor: actor
     }), {
         moved: !0
-    });
+    };
 }
 
 async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts}) {
@@ -8588,8 +9311,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry
-        });
-        if (!(await runCascadeHop({
+        }), hop = await runCascadeHop({
             client: client,
             instanceId: instanceId,
             actor: actor,
@@ -8604,7 +9326,13 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             ...drained.drained ? {} : {
                 instance: drained.instance
             }
-        })).moved) return count;
+        });
+        if (!hop.moved) return {
+            cascaded: count,
+            ...hop.nextEvaluationAt !== void 0 ? {
+                nextEvaluationAt: hop.nextEvaluationAt
+            } : {}
+        };
         if (count++, count >= CASCADE_LIMIT) throw new CascadeLimitError({
             instanceId: instanceId,
             limit: CASCADE_LIMIT
@@ -8904,6 +9632,8 @@ async function recordOrphanedPropagation({ctx: ctx, mutation: mutation, child: c
 function startMutation(instance) {
     return {
         minReaderModel: minReaderModelOf(instance),
+        definitionSnapshot: instance.definitionSnapshot,
+        definitionModelVersion: definitionAssignmentModel(instance),
         currentStage: instance.currentStage,
         fields: (instance.fields ?? []).map(s => ({
             ...s
@@ -8951,11 +9681,17 @@ function startMutation(instance) {
     };
 }
 
+function startRevisionRetryMutation(instance) {
+    const mutation = startMutation(instance);
+    return mutation.commitErrorMapper = error => isRetryableInstanceCommitConflict(error) ? new InstanceCommitRevisionConflict(error) : error, 
+    mutation;
+}
+
 function instanceStateFields(src) {
-    const state = {
+    const listModel = isAssignmentListModel(src.definitionModelVersion), state = {
         currentStage: src.currentStage,
-        fields: src.fields,
-        stages: src.stages,
+        fields: assignmentFieldsForWrite(src.fields, listModel),
+        stages: assignmentStagesForWrite(src.stages, listModel),
         subworkflows: src.subworkflows ?? [],
         pendingEffects: src.pendingEffects,
         effectHistory: src.effectHistory,
@@ -8972,7 +9708,10 @@ function instanceStateFields(src) {
     return {
         ...modelStampFor({
             documentType: "instance",
-            document: state,
+            document: {
+                ...state,
+                definitionSnapshot: src.definitionSnapshot
+            },
             storedMinReaderModel: src.minReaderModel
         }),
         ...state
@@ -9007,11 +9746,11 @@ async function persist(ctx, mutation) {
         ...instanceStateFields(mutation),
         lastChangedAt: ctx.now
     }, pendingCreates = mutation.pendingCreates;
-    if (pendingCreates.length === 0) return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT);
+    if (pendingCreates.length === 0) return commitInstanceWrite(() => ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit(SYNC_COMMIT), mutation.commitErrorMapper);
     const tx = ctx.client.transaction();
-    for (const {body: body} of pendingCreates) tx.create(body);
+    for (const {body: body} of pendingCreates) tx.create(instanceDocumentForWrite(body));
     tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), 
-    await tx.commit(), mutation.pendingCreates = [];
+    await commitInstanceWrite(() => tx.commit(), mutation.commitErrorMapper), mutation.pendingCreates = [];
     const actorForPriming = ctx.actor, settlingCohorts = new Set(ctx.settlingCohorts).add(ctx.instance._id);
     for (const {body: body} of pendingCreates) try {
         const stepArgs = spawnStepArgs(ctx, {
@@ -9038,6 +9777,14 @@ async function persist(ctx, mutation) {
     return reloaded;
 }
 
+async function commitInstanceWrite(write, mapError) {
+    try {
+        return await write();
+    } catch (error) {
+        throw mapError?.(error) ?? error;
+    }
+}
+
 async function settleSpawnBatch(ctx, args) {
     try {
         await propagateSpawnBatch({
@@ -9300,7 +10047,7 @@ async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: sta
         outputs: outputs,
         memberRoles: ctx.memberRoles,
         roleAliases: ctx.definition.roleAliases
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -9447,7 +10194,7 @@ function staleClaimReason(args) {
     if (isClaimExpired(claim, args.now)) return "lease-expired";
 }
 
-function renewClaimLease(args) {
+function renewClaimLease$1(args) {
     const {mutation: mutation, effectKey: effectKey, now: now, leaseMs: leaseMs} = args;
     mutation.pendingEffects = mutation.pendingEffects.map(entry => entry._key === effectKey && entry.claim !== void 0 ? {
         ...entry,
@@ -9479,12 +10226,12 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         effect: pending.name,
         issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
     });
-    const mutation = startMutation(ctx.instance);
+    const mutation = startRevisionRetryMutation(ctx.instance);
     return recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
         now: ctx.now
-    }), renewClaimLease({
+    }), renewClaimLease$1({
         mutation: mutation,
         effectKey: effectKey,
         now: ctx.now,
@@ -9515,7 +10262,7 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
     };
 }
 
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
+const RESET_ACTIVITY_TARGETS = _exhaustiveOptions()([ "active", "skipped" ]);
 
 function isResetActivityTarget(value) {
     return RESET_ACTIVITY_TARGETS.includes(value);
@@ -9573,6 +10320,100 @@ async function commitResetActivity({ctx: ctx, activity: activity, to: to, reques
     };
 }
 
+const AvailabilityResponse = v.object({
+    documents: v.array(v.object({
+        _id: v.string()
+    })),
+    omitted: v.array(v.object({
+        id: v.string(),
+        reason: v.picklist([ "existence", "permission" ])
+    }))
+}), AVAILABILITY_BATCH_SIZE = 100, AVAILABILITY_CONCURRENCY = 4, pendingReads = /* @__PURE__ */ new WeakMap;
+
+function groupsFor(documents, clientForGdr) {
+    const groups = /* @__PURE__ */ new Map;
+    for (const {reference: reference} of documents) {
+        const parsed = parseGdr(reference.id), resource = resourceFromParsed(parsed), key = resourceGdr(resource), group = groups.get(key) ?? {
+            client: clientForGdr(parsed),
+            resource: resource,
+            documents: /* @__PURE__ */ new Map
+        };
+        group.documents.set(reference.id, parsed.documentId), groups.set(key, group);
+    }
+    return [ ...groups.values() ];
+}
+
+async function readGroup(group) {
+    let response;
+    try {
+        const url = documentUrl(group);
+        url !== void 0 && group.client.request !== void 0 ? response = await readResponse(group.client, url) : logUnavailable({
+            resource: group.resource,
+            reason: "unsupported-client"
+        });
+    } catch (error) {
+        logUnavailable({
+            resource: group.resource,
+            reason: v.isValiError(error) ? "invalid-response" : "request-failed",
+            error: error
+        });
+    }
+    return [ ...group.documents ].map(([uri, id]) => [ uri, availabilityOf(response, id) ]);
+}
+
+function logUnavailable({resource: resource, reason: reason, error: error}) {
+    const statusCode = typeof error == "object" && error !== null && "statusCode" in error ? error.statusCode : void 0;
+    console.warn("[workflows] Document availability could not be confirmed.", {
+        resource: resourceGdr(resource),
+        reason: reason,
+        ...typeof statusCode == "number" ? {
+            statusCode: statusCode
+        } : {}
+    });
+}
+
+function availabilityOf(response, id) {
+    if (response === void 0) return "unreadable";
+    const omissions = response.omitted.filter(entry => getPublishedId(DocumentId(entry.id)) === id);
+    return omissions.some(entry => entry.reason === "permission") ? "unreadable" : response.documents.some(doc => getPublishedId(DocumentId(doc._id)) === id) ? "outside-perspective" : omissions.some(entry => entry.id === id && entry.reason === "existence") ? "deleted" : "unreadable";
+}
+
+function documentUrl(group) {
+    const ids = [ ...new Set(group.documents.values()) ].sort().map(encodeURIComponent).join(",");
+    let url;
+    if ("getDataUrl" in group.client && group.client.getDataUrl !== void 0) url = group.client.getDataUrl("doc", ids); else {
+        if (group.resource.type !== "dataset") return;
+        const {dataset: dataset} = datasetResourceParts(group.resource.id);
+        url = `/data/doc/${dataset}/${ids}`;
+    }
+    return `${url}?includeAllVersions=true`;
+}
+
+function readResponse(client, url) {
+    const identity = unwrapRequestTag(client), pending = pendingReads.get(identity) ?? /* @__PURE__ */ new Map;
+    pendingReads.set(identity, pending);
+    const existing = pending.get(url);
+    if (existing !== void 0) return existing;
+    const result = client.request({
+        url: url
+    }).then(response => v.parse(AvailabilityResponse, response)).finally(() => pending.delete(url));
+    return pending.set(url, result), result;
+}
+
+function documentAvailabilityReader(args) {
+    return async documents => {
+        const result = /* @__PURE__ */ new Map, groups = groupsFor(documents, args.clientForGdr).flatMap(group => chunks([ ...group.documents ], AVAILABILITY_BATCH_SIZE).map(entries => ({
+            ...group,
+            documents: new Map(entries)
+        })));
+        for (const wave of chunks(groups, AVAILABILITY_CONCURRENCY)) {
+            const rows = await Promise.all(wave.map(readGroup));
+            for (const [uri, availability] of rows.flat()) result.set(uri, availability);
+        }
+        return result;
+    };
+}
+
 const REPLAY_SURFACE = {
     allows: () => !0,
     description: "any resource (in-memory replay; the committing surface enforces)"
@@ -9627,6 +10468,10 @@ function replayable(args) {
     return (stage.activities ?? []).every(declared => primed.has(declared.name)) ? !(stage.activities ?? []).flatMap(declared => declared.actions ?? []).some(sibling => isCascadeFired(sibling) && sibling.spawn !== void 0) : !1;
 }
 
+function clientGuardDereference(client) {
+    return async ({_ref: _ref}) => await client.getDocument(toBareId(_ref)) ?? null;
+}
+
 async function buildFieldInsights({sites: sites, snapshot: snapshot}) {
     const insights = [];
     for (const field of fieldsReadAcross(sites)) {
@@ -9720,6 +10565,80 @@ function fabricatable(assignment) {
     return assignment.target.path.every(segment => typeof segment != "number" || segment <= MAX_COUNTERFACTUAL_INDEX);
 }
 
+function missingDocumentsOf({instance: instance, snapshot: snapshot, definition: definition}) {
+    const stage = findStageNode({
+        definition: definition,
+        stageName: instance.currentStage
+    });
+    return activeFieldEntries(instance).flatMap(({target: target, entry: entry}) => {
+        const declarations = {
+            workflow: definition?.fields,
+            stage: stage?.fields,
+            activity: stage?.activities?.find(activity => activity.name === target.activity)?.fields
+        }, title = entry.title ?? declarations[target.scope ?? "workflow"]?.find(field => field.name === target.field)?.title;
+        return missingEntryDocRefs([ entry ], snapshot.knownIds).map(reference => ({
+            target: target,
+            reference: reference,
+            ...title !== void 0 ? {
+                title: title
+            } : {}
+        }));
+    });
+}
+
+function blockingConditions(evaluation) {
+    const transitions = evaluation.currentStage.transitions.some(entry => entry.whenSatisfied) ? [] : evaluation.currentStage.transitions;
+    return [ ...evaluation.currentStage.activities.filter(entry => entry.status === "active" && (entry.activity.actions ?? []).length > 0).flatMap(entry => (entry.unmetRequirements ?? []).map(requirement => ({
+        insight: entry.requirementInsights?.[requirement.name],
+        activity: entry.activity.name
+    }))), ...transitions.map(entry => ({
+        insight: entry.insight
+    })) ];
+}
+
+function readsDocumentContent({entry: entry, read: read, atom: atom}) {
+    return atomReadsDataset(atom) ? !0 : isSingleDocRefKind(entry._type) && read.path.length > 1 && read.path[1] !== "_id" && read.path[1] !== "_type";
+}
+
+function contentTargets({atoms: atoms, fields: fields, activity: activity}) {
+    return atoms.flatMap(atom => atom.reads.flatMap(read => {
+        if (read.variable !== "fields") return [];
+        const field = fields.findLast(({entry: entry, target: target}) => entry.name === read.path[0] && (target.scope !== "activity" || target.activity === activity));
+        return field !== void 0 && readsDocumentContent({
+            entry: field.entry,
+            read: read,
+            atom: atom
+        }) ? [ _fieldTargetLabel(field.target) ] : [];
+    }));
+}
+
+async function blockingAtoms(condition, args) {
+    const atoms = condition.insight?.blockedBy.map(({atom: atom}) => atom) ?? [], names = [ ...new Set(atoms.flatMap(atom => atom.reads).filter(read => read.path.length === 0 && args.definition.predicates?.[read.variable] !== void 0).map(read => read.variable)) ];
+    if (names.length === 0) return atoms;
+    const site = args.sites.find(entry => entry.insight === condition.insight);
+    if (site === void 0) throw new Error("Missing evaluated scope for a blocking condition");
+    const dependencies = await Promise.all(names.map(async name => {
+        const predicate = args.definition.predicates?.[name];
+        if (predicate === void 0) throw new Error(`Missing predicate "${name}"`);
+        return (await explainCondition({
+            condition: site.params[name] === !0 ? `!(${predicate})` : predicate,
+            dataset: args.snapshot.docs,
+            params: site.params
+        })).blockedBy.map(({atom: atom}) => atom);
+    }));
+    return [ ...atoms, ...dependencies.flat() ];
+}
+
+async function blockingMissingDocuments(args) {
+    if (!args.missingDocuments?.length) return [];
+    const fields = activeFieldEntries(args.instance), targets = (await Promise.all(blockingConditions(args).map(async condition => contentTargets({
+        atoms: await blockingAtoms(condition, args),
+        fields: fields,
+        activity: condition.activity
+    })))).flat(), blocked = /* @__PURE__ */ new Set([ ...targets, ...missingRequiredDocuments(args).map(({target: target}) => _fieldTargetLabel(target)) ]);
+    return args.missingDocuments.filter(({target: target}) => blocked.has(_fieldTargetLabel(target)));
+}
+
 async function subjectResourceGrants(args) {
     const {clientForGdr: clientForGdr, instance: instance} = args, clients = /* @__PURE__ */ new Map;
     for (const {parsed: parsed, resource: resource} of foreignSubjectRefs(instance)) {
@@ -9782,6 +10701,10 @@ async function evaluateInstance(args) {
         guards: guards,
         now: now,
         resourceGrants: resourceGrants,
+        documentAvailability: documentAvailabilityReader({
+            clientForGdr: clientForGdr
+        }),
+        guardDereference: clientGuardDereference(client),
         ...localPrincipalId !== void 0 ? {
             localPrincipalId: localPrincipalId
         } : {},
@@ -9794,16 +10717,6 @@ async function evaluateInstance(args) {
     });
 }
 
-function memoizedByName(render) {
-    const rendered = /* @__PURE__ */ new Map;
-    return activityName => {
-        const hit = rendered.get(activityName);
-        if (hit !== void 0) return hit;
-        const scope = render(activityName);
-        return rendered.set(activityName, scope), scope;
-    };
-}
-
 async function callerBoundProjectionScopes(args) {
     const can = await advisoryCan({
         instance: args.instance,
@@ -9824,13 +10737,17 @@ async function callerBoundProjectionScopes(args) {
     };
     return {
         scope: await renderConditionScope(args.scopeSource, opts),
-        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+        scopeForActivity: memoizedBy(activityName => renderConditionScope(args.scopeSource, {
             activityName: activityName,
             ...opts
         }))
     };
 }
 
+function clockSitesOf(instance, sites) {
+    return terminalState(instance) !== "in-flight" ? [] : sites.filter(entry => readsNowIn(entry.insight.analysis.reads));
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -9880,12 +10797,13 @@ async function evaluateFromSnapshot(args) {
         grants: grants,
         attributes: attributes,
         identity: anchorIdentity
-    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+    }), cascadeScopeForActivity = memoizedBy(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
         identity: anchorIdentity,
-        guards: args.guards
+        guards: args.guards,
+        dereference: args.guardDereference
     }), subjectDenials = await forecastSubjectDenials({
         instance: instance,
         snapshot: snapshot,
@@ -9893,7 +10811,11 @@ async function evaluateFromSnapshot(args) {
     }), subjectPermissionReason = subjectDenials.length > 0 ? {
         kind: "subject-permission-denied",
         denied: subjectDenials
-    } : void 0, sites = [], activityEvaluations = [];
+    } : void 0, sites = [], activityEvaluations = [], requiredDocuments = requiredDocumentRequirements({
+        instance: instance,
+        definition: definition,
+        snapshot: snapshot
+    });
     for (const activity of stage.activities ?? []) activityEvaluations.push(await evaluateActivity({
         activity: activity,
         statusEntry: currentActivityEntries.find(t => t.name === activity.name),
@@ -9904,36 +10826,23 @@ async function evaluateFromSnapshot(args) {
         stageHasExits: !isTerminalStage(stage),
         guardDenial: guardDenial,
         subjectPermissionReason: subjectPermissionReason,
+        requiredDocuments: requiredDocuments,
         sites: sites,
         autonomy: activityAutonomyOf(stageAutonomy2, activity.name),
         fireConsequence: fireConsequence
     }));
-    const cascadeParams = await renderConditionScope(scopeSource), transitionEvaluations = [];
-    for (const transition of stage.transitions ?? []) {
-        const insight = await explainSite({
-            site: {
-                kind: "transition",
-                transition: transition.name
-            },
-            condition: transition.when,
-            params: cascadeParams,
-            snapshot: snapshot,
-            sites: sites
-        });
-        transitionEvaluations.push({
-            transition: transition,
-            whenSatisfied: insight.outcome === "satisfied",
-            unevaluable: insight.outcome === "unevaluable",
-            insight: insight
-        });
-    }
-    const currentStage = {
+    const cascadeParams = await renderConditionScope(scopeSource), transitionEvaluations = await evaluateTransitions({
+        stage: stage,
+        cascadeParams: cascadeParams,
+        snapshot: snapshot,
+        sites: sites
+    }), currentStage = {
         stage: stage,
         ...semanticsOf(stage),
         activities: activityEvaluations,
         transitions: transitionEvaluations,
         autonomy: stageAutonomy2
-    }, pendingOnYou = activityEvaluations.filter(t => t.pendingOnActor), canInteract = activityEvaluations.some(t => t.actions.some(a => a.allowed)), editGuardDenial = guardDenial?.kind === "mutation-guard-denied" ? guardDenial : void 0, editableFields = await evaluateEditableFields({
+    }, missingDocuments = await readMissingDocuments(args), pendingOnYou = activityEvaluations.filter(t => t.pendingOnActor), canInteract = activityEvaluations.some(t => t.actions.some(a => a.allowed)), editGuardDenial = guardDenial?.kind === "mutation-guard-denied" ? guardDenial : void 0, editableFields = await evaluateEditableFields({
         instance: instance,
         definition: definition,
         stage: stage,
@@ -9942,6 +10851,10 @@ async function evaluateFromSnapshot(args) {
         scopeForActivity: scopeForActivity,
         guardDenial: editGuardDenial,
         sites: sites
+    }), nextEvaluationAt = await nextEvaluationInstant({
+        sites: clockSitesOf(instance, sites),
+        dataset: snapshot.docs,
+        now: now
     });
     return {
         instance: instance,
@@ -9956,10 +10869,60 @@ async function evaluateFromSnapshot(args) {
             sites: sites,
             snapshot: snapshot
         }),
-        autonomy: autonomy
+        ...missingDocuments.length > 0 ? {
+            missingDocuments: missingDocuments,
+            blockingMissingDocuments: await blockingMissingDocuments({
+                instance: instance,
+                definition: definition,
+                currentStage: currentStage,
+                missingDocuments: missingDocuments,
+                snapshot: snapshot,
+                sites: sites
+            })
+        } : {},
+        autonomy: autonomy,
+        ...nextEvaluationAt !== void 0 ? {
+            nextEvaluationAt: nextEvaluationAt
+        } : {}
     };
 }
 
+async function readMissingDocuments(args) {
+    const missingDocuments = missingDocumentsOf(args);
+    if (args.documentAvailability === void 0 || missingDocuments.length === 0) return missingDocuments;
+    const availability = await args.documentAvailability(missingDocuments);
+    return missingDocuments.map(document => {
+        const verdict = availability.get(document.reference.id);
+        return verdict === void 0 ? document : {
+            ...document,
+            availability: verdict
+        };
+    });
+}
+
+async function evaluateTransitions(args) {
+    const {stage: stage, cascadeParams: cascadeParams, snapshot: snapshot, sites: sites} = args, evaluations = [];
+    for (const transition of stage.transitions ?? []) {
+        const insight = await explainSite({
+            site: {
+                kind: "transition",
+                transition: transition.name
+            },
+            condition: transition.when,
+            params: cascadeParams,
+            snapshot: snapshot,
+            sites: sites
+        });
+        evaluations.push({
+            transition: transition,
+            whenSatisfied: insight.outcome === "satisfied",
+            unevaluable: insight.outcome === "unevaluable",
+            insight: insight
+        });
+    }
+    return evaluations;
+}
+
 const AUTONOMY_CACHE = /* @__PURE__ */ new WeakMap;
 
 function autonomyOf(definition) {
@@ -9970,54 +10933,56 @@ function autonomyOf(definition) {
 }
 
 async function evaluateEditableFields(args) {
-    const {instance: instance, definition: definition, stage: stage, snapshot: snapshot, scope: scope, scopeForActivity: scopeForActivity, guardDenial: guardDenial, sites: sites} = args, fields = [];
-    for (const site of editableFieldsInStage(definition, stage)) {
-        const window = fieldWindowOpen(instance, site), insight = await editPredicateInsight({
-            site: site,
-            snapshot: snapshot,
-            scope: scope,
-            scopeForActivity: scopeForActivity,
-            sites: sites
-        }), predicateSatisfied = insight === void 0 || insight.outcome === "satisfied", reason = editDisabledReason({
-            effective: site.effective,
-            instance: instance,
-            window: window,
-            guardDenial: guardDenial,
-            predicateSatisfied: predicateSatisfied
-        }), value = readFieldValue(instance, site);
-        fields.push({
-            scope: site.scope,
-            ...site.activity !== void 0 ? {
-                activity: site.activity
-            } : {},
-            name: site.name,
-            type: site.type,
-            ...site.title !== void 0 ? {
-                title: site.title
-            } : {},
-            ...site.validation !== void 0 ? {
-                validation: site.validation
-            } : {},
-            ...site.roles !== void 0 ? {
-                roles: site.roles,
-                ...definition.roleAliases !== void 0 ? {
-                    roleAliases: definition.roleAliases
-                } : {}
-            } : {},
-            value: value,
-            editable: reason === void 0,
-            ...reason !== void 0 ? {
-                disabledReason: reason
-            } : {},
-            ...fieldProvenance(instance, site.ref),
-            ...insight !== void 0 ? {
-                insight: insight
-            } : {}
-        });
-    }
+    const fields = [];
+    for (const site of editableFieldsInStage(args.definition, args.stage)) fields.push(await evaluateEditableField(args, site));
     return fields;
 }
 
+async function evaluateEditableField(args, site) {
+    const {instance: instance, definition: definition, snapshot: snapshot, scope: scope, scopeForActivity: scopeForActivity, guardDenial: guardDenial, sites: sites} = args, window = fieldWindowOpen(instance, site), insight = await editPredicateInsight({
+        site: site,
+        snapshot: snapshot,
+        scope: scope,
+        scopeForActivity: scopeForActivity,
+        sites: sites
+    }), predicateSatisfied = insight === void 0 || insight.outcome === "satisfied", reason = editDisabledReason({
+        effective: site.effective,
+        instance: instance,
+        window: window,
+        guardDenial: guardDenial,
+        predicateSatisfied: predicateSatisfied
+    });
+    return {
+        scope: site.scope,
+        ...site.activity !== void 0 ? {
+            activity: site.activity
+        } : {},
+        name: site.name,
+        type: site.type,
+        ...site.title !== void 0 ? {
+            title: site.title
+        } : {},
+        ...site.validation !== void 0 ? {
+            validation: site.validation
+        } : {},
+        ...site.roles !== void 0 ? {
+            roles: site.roles,
+            ...definition.roleAliases !== void 0 ? {
+                roleAliases: definition.roleAliases
+            } : {}
+        } : {},
+        value: readFieldValue(instance, site),
+        editable: reason === void 0,
+        ...reason !== void 0 ? {
+            disabledReason: reason
+        } : {},
+        ...fieldProvenance(instance, site.ref),
+        ...insight !== void 0 ? {
+            insight: insight
+        } : {}
+    };
+}
+
 async function editPredicateInsight(args) {
     const {site: site, snapshot: snapshot, scope: scope, scopeForActivity: scopeForActivity, sites: sites} = args;
     if (typeof site.effective != "string") return;
@@ -10041,14 +11006,10 @@ async function editPredicateInsight(args) {
 async function forecastSubjectDenials(args) {
     const {instance: instance, snapshot: snapshot, resourceGrants: resourceGrants} = args;
     if (resourceGrants === void 0 || resourceGrants.size === 0) return [];
-    const denials = [], seen = /* @__PURE__ */ new Set;
-    for (const {ref: ref, parsed: parsed, resource: resource} of foreignSubjectRefs(instance)) {
-        if (seen.has(ref.id)) continue;
-        seen.add(ref.id);
-        const access = resourceGrants.get(resourceGdr(resource));
-        if (access === void 0) continue;
-        const doc = snapshot.docs.find(d => d._id === ref.id);
-        doc !== void 0 && await subjectUpdateAllowed({
+    const denials = [], subjects = new Map(foreignSubjectRefs(instance).map(subject => [ subject.ref.id, subject ]));
+    for (const {ref: ref, parsed: parsed, resource: resource} of subjects.values()) {
+        const access = resourceGrants.get(resourceGdr(resource)), doc = snapshot.docs.find(d => d._id === ref.id);
+        access === void 0 || doc === void 0 || await subjectUpdateAllowed({
             doc: doc,
             parsed: parsed,
             grants: access.grants,
@@ -10081,13 +11042,13 @@ async function subjectUpdateAllowed(args) {
 }
 
 async function evaluateActivity(args) {
-    const {activity: activity, statusEntry: statusEntry, instance: instance, snapshot: snapshot, activityScope: activityScope, cascadeActivityScope: cascadeActivityScope, stageHasExits: stageHasExits, guardDenial: guardDenial, subjectPermissionReason: subjectPermissionReason, sites: sites, autonomy: autonomy, fireConsequence: fireConsequence} = args, status = statusEntry?.status ?? "skipped", assigned = activityScope.assigned === !0, {unmetRequirements: unmetRequirements, ...conditionInsights} = await explainActivityConditions({
+    const {activity: activity, statusEntry: statusEntry, instance: instance, snapshot: snapshot, activityScope: activityScope, cascadeActivityScope: cascadeActivityScope, stageHasExits: stageHasExits, guardDenial: guardDenial, subjectPermissionReason: subjectPermissionReason, requiredDocuments: requiredDocuments, sites: sites, autonomy: autonomy, fireConsequence: fireConsequence} = args, status = statusEntry?.status ?? "skipped", assigned = activityScope.assigned === !0, {unmetRequirements: activityRequirements, ...conditionInsights} = await explainActivityConditions({
         activity: activity,
         activityScope: activityScope,
         cascadeActivityScope: cascadeActivityScope,
         snapshot: snapshot,
         sites: sites
-    }), requirementsReason = unmetRequirements.length > 0 ? {
+    }), unmetRequirements = [ ...requiredDocuments, ...activityRequirements ], requirementsReason = unmetRequirements.length > 0 ? {
         kind: "requirements-unmet",
         unmetRequirements: unmetRequirements
     } : void 0, actions = [];
@@ -10104,7 +11065,8 @@ async function evaluateActivity(args) {
         subjectPermissionReason: subjectPermissionReason,
         requirementsReason: requirementsReason,
         sites: sites,
-        fireConsequence: a => fireConsequence(activity, a)
+        fireConsequence: a => fireConsequence(activity, a),
+        assignment: assignmentMembers(statusEntry?.fields ?? [])
     }));
     return {
         activity: activity,
@@ -10261,19 +11223,31 @@ function fireableActionVerdict({args: args, insights: insights}) {
         reason: args.requirementsReason,
         ...insights
     });
-    const {insight: insight} = insights;
-    return action.filter !== void 0 && insight !== void 0 && insight.outcome !== "satisfied" ? disabled({
+    const filterFailure = filterFailureVerdict(args, insights);
+    return filterFailure !== void 0 ? filterFailure : {
+        ...actionEvaluationIdentity(action),
+        allowed: !0,
+        ...insights
+    };
+}
+
+function filterFailureVerdict(args, insights) {
+    const {action: action} = args, {insight: insight} = insights;
+    if (action.filter === void 0 || insight === void 0 || insight.outcome === "satisfied") return;
+    const holderGate = insight.blockedBy.some(entry => isAssignedGate(entry.atom)) ? {
+        holders: [ ...activeAssignmentMembers(args.assignment) ]
+    } : void 0;
+    return disabled({
         action: action,
         reason: {
             kind: "filter-failed",
             filter: action.filter
         },
-        ...insights
-    }) : {
-        ...actionEvaluationIdentity(action),
-        allowed: !0,
-        ...insights
-    };
+        ...insights,
+        ...holderGate === void 0 ? {} : {
+            holderGate: holderGate
+        }
+    });
 }
 
 function actionEvaluationIdentity(action) {
@@ -10289,12 +11263,13 @@ function semanticsOf(node) {
     };
 }
 
-async function instanceGuardReason({instance: instance, identity: identity, guards: guards}) {
+async function instanceGuardReason({instance: instance, identity: identity, guards: guards, dereference: dereference}) {
     if (guards === void 0 || guards.length === 0) return;
     const denied = await instanceWriteDenials({
         instance: instance,
         guards: guards,
-        identity: identity
+        identity: identity,
+        dereference: dereference ?? (() => Promise.resolve(null))
     });
     if (denied.length !== 0) return {
         kind: "mutation-guard-denied",
@@ -10325,10 +11300,29 @@ function disabled(args) {
         } : {},
         ...args.whenInsight !== void 0 ? {
             whenInsight: args.whenInsight
+        } : {},
+        ...args.holderGate !== void 0 ? {
+            holderGate: args.holderGate
         } : {}
     };
 }
 
+const ASSIGNMENT_KINDS = '["assignee", "assignees"]', HAS_USER = '(count(value[@.type == "user"]) > 0 || value.type == "user")', HAS_MEMBER = "(count(value) > 0 || defined(value.type))";
+
+function assignmentActivityArm(state) {
+    const assignmentFields = `fields[_type in ${ASSIGNMENT_KINDS}]`;
+    return state === "unrouted" ? `count(${assignmentFields}[${HAS_MEMBER}]) == 0` : state === "held" ? `count(${assignmentFields}[${HAS_USER} && (count(value[@.type == "user" && id == $assignmentUserId]) > 0 || (value.type == "user" && value.id == $assignmentUserId))]) > 0` : `count(${assignmentFields}[${HAS_USER}]) == 0 && count(${assignmentFields}[count(value[@.type == "role" && role in $assignmentRoles]) > 0 || (value.type == "role" && value.role in $assignmentRoles)]) > 0`;
+}
+
+function assignmentPrefilter(assignment, params) {
+    if (assignment.userId.length === 0) throw new ContractViolationError("instancesQuery: assignment.userId must be non-empty");
+    const states = [ ...new Set(assignment.states ?? [ "unrouted", "routed", "held" ]) ];
+    if (states.length === 0) throw new ContractViolationError("instancesQuery: assignment.states must not be empty");
+    if (states.some(state => state !== "unrouted" && state !== "routed" && state !== "held")) throw new ContractViolationError("instancesQuery: assignment.states contains an unknown state");
+    return params.assignmentUserId = assignment.userId, params.assignmentRoles = [ ...new Set(assignment.roles ?? []) ].sort(), 
+    `count(stages[!defined(exitedAt)].activities[status == "active" && (${states.map(assignmentActivityArm).join(" || ")})]) > 0`;
+}
+
 function inFlightFilter() {
     return "!defined(completedAt)";
 }
@@ -10368,7 +11362,7 @@ function compiledConditions(filter, params) {
     const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, tagScopeFilter() ];
     filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
     params.definition = filter.definition), filter.stage !== void 0 && (conditions.push("currentStage == $stage"), 
-    params.stage = filter.stage);
+    params.stage = filter.stage), filter.assignment !== void 0 && conditions.push(assignmentPrefilter(filter.assignment, params));
     const cursor = beforeArm(filter, params);
     cursor !== void 0 && conditions.push(cursor);
     const arms = [ documentArm(filter, params), idsArm(filter, params) ].filter(arm => arm !== void 0);
@@ -10430,6 +11424,46 @@ function claimReleasedEntry(args) {
     };
 }
 
+const RENEW_MAX_ATTEMPTS = 3;
+
+async function claimOf(args) {
+    const {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey} = args, instance = await reload({
+        client: client,
+        instanceId: instanceId,
+        tag: tag
+    });
+    return {
+        instance: instance,
+        claim: instance.pendingEffects.find(e => e._key === effectKey)?.claim
+    };
+}
+
+async function claimStillHeld(args) {
+    const {claimToken: claimToken, ...where} = args, {claim: claim} = await claimOf(where);
+    return claim?.claimToken === claimToken;
+}
+
+async function renewClaimLease(args) {
+    const {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, holdMs: holdMs, clock: clock} = args;
+    for (let attempt = 1; attempt <= RENEW_MAX_ATTEMPTS; attempt++) {
+        const {instance: instance, claim: claim} = await claimOf({
+            client: client,
+            tag: tag,
+            instanceId: instanceId,
+            effectKey: effectKey
+        });
+        if (claim?.claimToken !== claimToken) return;
+        const until = addMs(clock(), holdMs);
+        try {
+            return await client.patch(instance._id).ifRevisionId(instance._rev).set({
+                [`pendingEffects[_key=="${effectKey}"].claim.leaseExpiresAt`]: until
+            }).commit(SYNC_COMMIT), until;
+        } catch (error) {
+            if (!isRevisionConflict(error)) throw error;
+        }
+    }
+}
+
 const SWEEP_MAX_ATTEMPTS = 5;
 
 async function sweepStaleClaims(args) {
@@ -10471,6 +11505,222 @@ function stripClaim(entry) {
     return rest;
 }
 
+function isProjectRole(value) {
+    return isRecord(value) && typeof value.name == "string";
+}
+
+async function projectRoleNames(request, projectId) {
+    const result = await request({
+        url: `/projects/${encodeURIComponent(projectId)}/roles`
+    });
+    if (!Array.isArray(result) || !result.every(isProjectRole)) throw new Error(`Project role catalog response is invalid for project "${projectId}"`);
+    return new Set(result.map(role => role.name));
+}
+
+function memberRoleNames(member, projectId) {
+    if (!Array.isArray(member.roles) || !member.roles.every(isProjectRole)) throw new Error(`Project member role directory response is invalid for project "${projectId}" and member "${member.id}"`);
+    return member.roles.map(role => role.name);
+}
+
+function heldRoleNames(members, projectId) {
+    return new Set(members.flatMap(member => member.isRobot === !0 ? [] : memberRoleNames(member, projectId)));
+}
+
+function addRoles(collector, args) {
+    for (const role of args.roles ?? []) collector.references.push({
+        definition: collector.definition,
+        path: args.path,
+        role: role
+    });
+}
+
+function visitAssigneeValue(collector, args) {
+    const members = Array.isArray(args.value) ? args.value : [ args.value ];
+    for (const [index, member] of members.entries()) !isRecord(member) || member.type !== "role" || typeof member.role != "string" || collector.references.push({
+        definition: collector.definition,
+        path: `${args.path}[${index}].role`,
+        role: member.role
+    });
+}
+
+function visitObjectValue(collector, args) {
+    for (const shape of args.fields ?? []) visitShapeValue(collector, {
+        path: `${args.path}.${shape.name}`,
+        shape: shape,
+        value: args.value[shape.name]
+    });
+}
+
+function visitArrayValue(collector, args) {
+    for (const [index, row] of args.rows.entries()) if (isRecord(row)) for (const shape of args.shapes ?? []) visitShapeValue(collector, {
+        path: `${args.path}[${index}].${shape.name}`,
+        shape: shape,
+        value: row[shape.name]
+    });
+}
+
+function visitAssignmentValue(collector, args) {
+    args.kind === "assignee" || args.kind === "assignees" ? visitAssigneeValue(collector, args) : args.kind === "object" && isRecord(args.value) ? visitObjectValue(collector, {
+        ...args,
+        value: args.value
+    }) : args.kind === "array" && Array.isArray(args.value) && visitArrayValue(collector, {
+        path: args.path,
+        rows: args.value,
+        shapes: args.of
+    });
+}
+
+function visitShapeValue(collector, args) {
+    visitAssignmentValue(collector, {
+        path: args.path,
+        kind: args.shape.type,
+        value: args.value,
+        fields: args.shape.fields,
+        of: args.shape.of
+    });
+}
+
+function visitField(collector, args) {
+    addRoles(collector, {
+        path: `${args.path}.roles`,
+        roles: args.field.roles
+    });
+    for (const shape of args.field.fields ?? args.field.of ?? []) visitFieldShape(collector, {
+        parentPath: args.path,
+        shape: shape
+    });
+    args.field.initialValue?.type === "literal" && visitAssignmentValue(collector, {
+        path: `${args.path}.initialValue.value`,
+        kind: args.field.type,
+        value: args.field.initialValue.value,
+        fields: args.field.fields,
+        of: args.field.of
+    });
+}
+
+function visitFieldShape(collector, args) {
+    const path = `${args.parentPath}.${args.shape.name}`;
+    addRoles(collector, {
+        path: `${path}.roles`,
+        roles: args.shape.roles
+    });
+    for (const child of args.shape.fields ?? args.shape.of ?? []) visitFieldShape(collector, {
+        parentPath: path,
+        shape: child
+    });
+}
+
+function rolesFromConditions(definition) {
+    return conditionSitesOf(definition).flatMap(site => {
+        try {
+            return analyzeCondition(site.condition).atoms.flatMap(atom => rolesGateOf(atom) ?? []);
+        } catch {
+            return [];
+        }
+    });
+}
+
+function visitRoleAliases(collector, aliases) {
+    for (const [role, fulfillers] of Object.entries(aliases ?? {})) role !== UNIVERSAL_ROLE_ALIAS_KEY && collector.references.push({
+        definition: collector.definition,
+        path: `roleAliases.${role}`,
+        role: role
+    }), addRoles(collector, {
+        path: `roleAliases.${role}`,
+        roles: fulfillers
+    });
+}
+
+function visitFields(collector, args) {
+    for (const [index, field] of (args.fields ?? []).entries()) visitField(collector, {
+        path: `${args.parentPath}[${index}]`,
+        field: field
+    });
+}
+
+function visitAction(collector, args) {
+    addRoles(collector, {
+        path: `${args.path}.roles`,
+        roles: args.action.roles
+    });
+    for (const [effectIndex, effect] of (args.action.effects ?? []).entries()) for (const shape of effect.outputs ?? []) visitFieldShape(collector, {
+        parentPath: `${args.path}.effects[${effectIndex}].outputs`,
+        shape: shape
+    });
+}
+
+function visitStage(collector, args) {
+    const stagePath = `stages[${args.stageIndex}]`;
+    visitFields(collector, {
+        fields: args.stage.fields,
+        parentPath: `${stagePath}.fields`
+    });
+    for (const [activityIndex, activity] of (args.stage.activities ?? []).entries()) {
+        const activityPath = `${stagePath}.activities[${activityIndex}]`;
+        visitFields(collector, {
+            fields: activity.fields,
+            parentPath: `${activityPath}.fields`
+        });
+        for (const [actionIndex, action] of (activity.actions ?? []).entries()) visitAction(collector, {
+            action: action,
+            path: `${activityPath}.actions[${actionIndex}]`
+        });
+    }
+}
+
+function addConditionReferences(collector, definition) {
+    for (const role of rolesFromConditions(definition)) collector.references.push({
+        definition: collector.definition,
+        path: "generated role condition",
+        role: role
+    });
+}
+
+function definitionRoleReferences(definition) {
+    const collector = {
+        references: [],
+        definition: definition.name
+    };
+    visitRoleAliases(collector, definition.roleAliases), visitFields(collector, {
+        fields: definition.fields,
+        parentPath: "fields"
+    });
+    for (const [stageIndex, stage] of definition.stages.entries()) visitStage(collector, {
+        stage: stage,
+        stageIndex: stageIndex
+    });
+    return addConditionReferences(collector, definition), collector.references;
+}
+
+function definitionRoleNames(definition) {
+    return [ ...new Set(definitionRoleReferences(definition).map(reference => reference.role)) ];
+}
+
+function roleCatalogProjectId(client, resource) {
+    if (resource.type === "dataset") return datasetResourceParts(resource.id).projectId;
+    const projectId = client.config?.().projectId;
+    if (typeof projectId == "string" && projectId.length > 0) return projectId;
+    throw new Error(`workflow.deployDefinitions: definitions reference project roles on ${resource.type} workflow resources, but the client does not expose a projectId for the project role catalog`);
+}
+
+async function validateDefinitionRoles(args) {
+    const references = args.definitions.flatMap(definitionRoleReferences);
+    if (references.length === 0) /* @__PURE__ */ return new Map;
+    if (args.client.request === void 0) throw new Error("workflow.deployDefinitions: definitions reference project roles, but the client cannot read the project role catalog");
+    const projectId = roleCatalogProjectId(args.client, args.workflowResource), [known, members] = await Promise.all([ projectRoleNames(args.client.request, projectId), _requestProjectMembers(args.client.request, projectId) ]), unknown = references.filter(reference => !known.has(reference.role));
+    if (unknown.length > 0) {
+        const lines = unknown.map(({definition: definition, path: path, role: role}) => `  - ${definition}: ${path} references unknown role "${role}"`);
+        throw new Error(`workflow.deployDefinitions: unknown project roles for project "${projectId}":\n${lines.join(`\n`)}`);
+    }
+    const held = heldRoleNames(members, projectId), warnings = /* @__PURE__ */ new Map;
+    for (const {definition: definition, role: role} of references) {
+        if (held.has(role)) continue;
+        const message = `Project role "${role}" has no current user holder; work routed to it has no recipient.`, definitionWarnings = warnings.get(definition) ?? [];
+        definitionWarnings.includes(message) || definitionWarnings.push(message), warnings.set(definition, definitionWarnings);
+    }
+    return warnings;
+}
+
 async function sortByDependencies({client: client, definitions: definitions, tag: tag}) {
     const byName = /* @__PURE__ */ new Map;
     for (const def of definitions) {
@@ -10587,7 +11837,7 @@ function refsOf(def) {
 }
 
 function hashDefinitionContent(def) {
-    const canonical = stableStringify(def);
+    const canonical = stableStringify(withoutAuthoringRuntime(def));
     let hash = 0xcbf29ce484222325n;
     for (let i = 0; i < canonical.length; i++) hash ^= BigInt(canonical.charCodeAt(i)), 
     hash = hash * 0x100000001b3n & 0xffffffffffffffffn;
@@ -10600,7 +11850,7 @@ function planDefinitionDeploy({def: def, latest: latest, target: target}) {
         definition: def,
         workflowResource: target.workflowResource
     });
-    const expanded = expandResourceAliases(def, target.resourceAliases), contentHash = hashDefinitionContent(expanded), unchanged = latest !== void 0 && latest.contentHash === contentHash, version = unchanged ? latest.version : (latest?.version ?? 0) + 1, docId = definitionDocId({
+    const expanded = withoutAuthoringRuntime(expandResourceAliases(def, target.resourceAliases)), contentHash = hashDefinitionContent(expanded), unchanged = latest !== void 0 && latest.contentHash === contentHash, version = unchanged ? latest.version : (latest?.version ?? 0) + 1, docId = definitionDocId({
         tag: target.tag,
         definition: expanded.name,
         version: version
@@ -10657,10 +11907,17 @@ function isDocumentEnvelopeKey(key) {
     return key.startsWith("_") || DEPLOY_STAMPED_KEYS.has(key);
 }
 
+const AUTHORING_RUNTIME_KEY = "runtime";
+
+function withoutAuthoringRuntime(def) {
+    const content = Object.entries(def).filter(([key]) => key !== AUTHORING_RUNTIME_KEY);
+    return Object.fromEntries(content);
+}
+
 function parseDefinitionInput(def, caller) {
     const label = labelFor(caller, def);
     if (def._type !== void 0 && def._type !== WORKFLOW_DEFINITION_TYPE) throw new Error(`${label}: expected a workflow definition or a "${WORKFLOW_DEFINITION_TYPE}" document, got _type "${String(def._type)}"`);
-    const content = Object.fromEntries(Object.entries(def).filter(([key]) => !isDocumentEnvelopeKey(key)));
+    const content = Object.fromEntries(Object.entries(withoutAuthoringRuntime(def)).filter(([key]) => !isDocumentEnvelopeKey(key)));
     return parseStoredDefinition(content, label);
 }
 
@@ -10771,7 +12028,7 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
         site: site,
         mode: mode,
         value: value
-    }), mutation = startMutation(ctx.instance);
+    }), mutation = startRevisionRetryMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
         record: requestRecord,
@@ -10915,14 +12172,14 @@ async function runCommitVerb(params) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    });
+    }), now = clock();
     return runDeduped({
         client: client,
         tag: tag,
         instanceId: instanceId,
         record: record,
         before: before,
-        now: clock(),
+        now: now,
         actor: context.actor,
         clientForGdr: context.clientForGdr,
         refSurface: context.refSurface,
@@ -10933,6 +12190,7 @@ async function runCommitVerb(params) {
         run: () => run({
             ...context,
             clock: clock,
+            now: now,
             record: record,
             before: before
         })
@@ -10956,7 +12214,7 @@ async function runDeduped(args) {
             client: client,
             instanceId: instanceId,
             tag: tag
-        }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+        }), settled = await cascadeAndReload({
             client: client,
             tag: tag,
             instanceId: instanceId,
@@ -10968,11 +12226,10 @@ async function runDeduped(args) {
             executionContext: executionContext,
             telemetry: telemetry
         });
-        return {
-            instance: instance,
-            cascaded: cascaded,
-            changed: instance._rev !== pre._rev
-        };
+        return settledResult({
+            ...settled,
+            changed: settled.instance._rev !== pre._rev
+        });
     };
     if (record !== void 0 && before !== void 0 && findProcessedRequest({
         instance: before,
@@ -10988,7 +12245,7 @@ async function runDeduped(args) {
 }
 
 async function cascade({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
-    const count = await cascadeAutoTransitions({
+    const settled = await cascadeAutoTransitions({
         client: client,
         instanceId: instanceId,
         actor: actor,
@@ -11024,13 +12281,13 @@ async function cascade({client: client, instanceId: instanceId, actor: actor, cl
         ...telemetry !== void 0 ? {
             telemetry: telemetry
         } : {}
-    }), count;
+    }), settled;
 }
 
 async function cascadeAndReload(args) {
     const {client: client, tag: tag, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock} = args;
     return {
-        cascaded: await cascade({
+        ...await cascade({
             client: client,
             instanceId: instanceId,
             actor: actor,
@@ -11053,6 +12310,84 @@ async function cascadeAndReload(args) {
     };
 }
 
+async function unchangedNextEvaluationAt(args) {
+    const {client: client, instance: instance, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, now: now} = args;
+    if (terminalState(instance) !== "in-flight") return;
+    const ctx = await buildEngineContext({
+        client: client,
+        instance: instance,
+        definition: parseDefinitionSnapshot(instance),
+        clientForGdr: clientForGdr,
+        refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
+        clock: () => now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {},
+        ...args.executionContext !== void 0 ? {
+            executionContext: args.executionContext
+        } : {},
+        ...args.telemetry !== void 0 ? {
+            telemetry: args.telemetry
+        } : {}
+    });
+    return ctxNextEvaluationAt(ctx);
+}
+
+async function adminOverrideResult(args) {
+    const {client: client, tag: tag, instanceId: instanceId, fired: fired, now: now, executionContext: executionContext, telemetry: telemetry, ...scope} = args, optional = {
+        ...executionContext !== void 0 ? {
+            executionContext: executionContext
+        } : {},
+        ...telemetry !== void 0 ? {
+            telemetry: telemetry
+        } : {}
+    }, settled = fired ? await cascade({
+        client: client,
+        instanceId: instanceId,
+        ...scope,
+        ...optional
+    }) : {
+        cascaded: 0
+    }, instance = await reload({
+        client: client,
+        instanceId: instanceId,
+        tag: tag
+    });
+    return settledResult({
+        ...settled,
+        instance: instance,
+        changed: fired,
+        ...fired ? {} : {
+            nextEvaluationAt: await unchangedNextEvaluationAt({
+                client: client,
+                instance: instance,
+                now: now,
+                actor: scope.actor,
+                clientForGdr: scope.clientForGdr,
+                refSurface: scope.refSurface,
+                memberRolesLoader: scope.memberRolesLoader,
+                ...optional
+            })
+        }
+    });
+}
+
+function settledResult(args) {
+    const {instance: instance, cascaded: cascaded, changed: changed, ranOps: ranOps, nextEvaluationAt: nextEvaluationAt} = args;
+    return {
+        instance: instance,
+        cascaded: cascaded,
+        changed: changed,
+        ...ranOps !== void 0 ? {
+            ranOps: ranOps
+        } : {},
+        ...nextEvaluationAt !== void 0 ? {
+            nextEvaluationAt: nextEvaluationAt
+        } : {}
+    };
+}
+
 async function settleStart(args) {
     const runArgs = {
         client: args.client,
@@ -11114,7 +12449,7 @@ async function resumeStart(args) {
         instance: existing,
         initialFieldCount: initialFieldCount,
         viaSpawn: !1
-    })), cascaded = await settleStart({
+    })), settled = await settleStart({
         ...settlementArgs,
         instanceId: existing._id,
         ...completesStart ? {
@@ -11125,11 +12460,11 @@ async function resumeStart(args) {
         instanceId: existing._id,
         tag: args.tag
     });
-    return {
+    return settledResult({
+        ...settled,
         instance: instance,
-        cascaded: cascaded,
         changed: instance._rev !== existing._rev
-    };
+    });
 }
 
 function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, executionContext: executionContext, telemetry: telemetry}) {
@@ -11228,7 +12563,7 @@ async function dispatchGatedWrite(args) {
         ...resourceClients !== void 0 ? {
             resourceClients: resourceClients
         } : {}
-    }), ranOps = await apply(args.before, evaluation), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+    }), ranOps = await apply(args.before, evaluation), settled = await cascadeAndReload({
         client: client,
         tag: tag,
         instanceId: instanceId,
@@ -11240,14 +12575,13 @@ async function dispatchGatedWrite(args) {
         executionContext: args.executionContext,
         telemetry: args.telemetry
     });
-    return {
-        instance: instance,
-        cascaded: cascaded,
+    return settledResult({
+        ...settled,
         changed: !0,
         ...ranOps !== void 0 ? {
             ranOps: ranOps
         } : {}
-    };
+    });
 }
 
 function guardDeniedError(instanceId, reason) {
@@ -11461,6 +12795,10 @@ async function abortInstances(args) {
     return aborted;
 }
 
+function lintDeadActivityInputSeeds(definition) {
+    return definition.stages.flatMap(stage => (stage.activities ?? []).flatMap(activity => (activity.fields ?? []).filter(field => field.initialValue?.type === "input").map(field => `Activity field "${stage.name}.${activity.name}.${field.name}" uses an input seed, but start/spawn inputs address workflow-scope fields only; this field will always materialize empty. Use a literal, query, field read, or working-memory field instead.`)));
+}
+
 function projectStartSliceRow(instance) {
     const subject = (instance.fields ?? []).find(field => field._type === "subject")?.value;
     return {
@@ -11488,14 +12826,18 @@ const workflow = {
         definitions.forEach(validateDefinition), assertReaderModelAcknowledgement(args.expectedMinReaderModel, {
             requiredMinReaderModel: requiredDefinitionReaderModel(definitions)
         });
-        const ordered = await sortByDependencies({
+        const roleWarnings = await validateDefinitionRoles({
+            client: client,
+            definitions: definitions,
+            workflowResource: workflowResource
+        }), ordered = await sortByDependencies({
             client: client,
             definitions: definitions,
             tag: tag
         }), results = [], deployed = [], tx = client.transaction();
         let hasWrites = !1;
         for (const def of ordered) {
-            const lint = lintEffectOutputs(def), warnings = lint.length > 0 ? {
+            const lint = [ ...lintEffectOutputs(def), ...lintDeadActivityInputSeeds(def), ...roleWarnings.get(def.name) ?? [] ], warnings = lint.length > 0 ? {
                 warnings: lint
             } : {}, latest = await loadLatestDeployed({
                 client: client,
@@ -11588,12 +12930,27 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "fireAction",
-            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
-                if (findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return {
+            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
+                if (findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return settledResult({
                     instance: before,
                     cascaded: 0,
-                    changed: !1
-                };
+                    changed: !1,
+                    nextEvaluationAt: await unchangedNextEvaluationAt({
+                        client: client,
+                        instance: before,
+                        actor: actor,
+                        clientForGdr: clientForGdr,
+                        refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
+                        now: now,
+                        ...executionContext !== void 0 ? {
+                            executionContext: executionContext
+                        } : {},
+                        ...args.telemetry !== void 0 ? {
+                            telemetry: args.telemetry
+                        } : {}
+                    })
+                });
                 const result = await dispatchGatedWrite({
                     client: client,
                     tag: tag,
@@ -11730,7 +13087,7 @@ const workflow = {
         });
     },
     completeEffect: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, now = clock(), record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "completeEffect",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11740,7 +13097,7 @@ const workflow = {
             tag: tag,
             instanceId: instanceId,
             record: record,
-            now: clock(),
+            now: now,
             ...operationContext,
             clock: clock,
             executionContext: executionContext,
@@ -11775,7 +13132,7 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+                }), settled = await cascadeAndReload({
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
@@ -11785,22 +13142,21 @@ const workflow = {
                     telemetry: args.telemetry
                 });
                 return resolveTelemetry(args.telemetry).log(WorkflowEffectCompleted, {
-                    ...definitionHashFragment(instance.pinnedContentHash),
+                    ...definitionHashFragment(settled.instance.pinnedContentHash),
                     instanceId: instanceId,
                     effect: completion.effect,
                     status: status,
                     origin: completion.origin,
-                    cascaded: cascaded
-                }), {
-                    instance: instance,
-                    cascaded: cascaded,
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     changed: !0
-                };
+                });
             }
         });
     },
     commitEffectOps: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, now = clock(), record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "commitEffectOps",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11811,7 +13167,7 @@ const workflow = {
             tag: tag,
             instanceId: instanceId,
             record: record,
-            now: clock(),
+            now: now,
             ...operationContext,
             clock: clock,
             executionContext: executionContext,
@@ -11831,7 +13187,7 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+                }), settled = await cascadeAndReload({
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
@@ -11841,15 +13197,14 @@ const workflow = {
                     telemetry: args.telemetry
                 });
                 return resolveTelemetry(args.telemetry).log(WorkflowEffectStateReported, {
-                    ...definitionHashFragment(instance.pinnedContentHash),
+                    ...definitionHashFragment(settled.instance.pinnedContentHash),
                     instanceId: instanceId,
                     effect: report.effect,
-                    cascaded: cascaded
-                }), {
-                    instance: instance,
-                    cascaded: cascaded,
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     changed: !0
-                };
+                });
             }
         });
     },
@@ -11862,9 +13217,10 @@ const workflow = {
         await assertInstanceWriteAllowed({
             instance: current,
             guards: guards,
-            identity: lakePrincipalId(access)
+            identity: lakePrincipalId(access),
+            dereference: clientGuardDereference(client)
         });
-        const {cascaded: cascaded, instance: instance} = await cascadeAndReload({
+        const settled = await cascadeAndReload({
             client: client,
             tag: tag,
             instanceId: instanceId,
@@ -11874,21 +13230,20 @@ const workflow = {
             telemetry: args.telemetry
         });
         return resolveTelemetry(args.telemetry).log(WorkflowInstanceTicked, {
-            ...definitionHashFragment(instance.pinnedContentHash),
+            ...definitionHashFragment(settled.instance.pinnedContentHash),
             instanceId: instanceId,
-            cascaded: cascaded
-        }), {
-            instance: instance,
-            cascaded: cascaded,
-            changed: instance._rev !== current._rev
-        };
+            cascaded: settled.cascaded
+        }), settledResult({
+            ...settled,
+            changed: settled.instance._rev !== current._rev
+        });
     },
     setStage: async rawArgs => {
         const args = taggedScope(rawArgs, REQUEST_TAG.setStage), {client: client, tag: tag, instanceId: instanceId, targetStage: targetStage, reason: reason, executionContext: executionContext} = args;
         return runCommitVerb({
             args: args,
             op: "setStage",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
                 const result = await setStage({
                     client: client,
                     instanceId: instanceId,
@@ -11908,34 +13263,29 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), cascaded = result.fired ? await cascade({
+                });
+                return resolveTelemetry(args.telemetry).log(WorkflowStageSet, {
+                    ...definitionHashFragment(before.pinnedContentHash),
+                    instanceId: instanceId,
+                    changed: result.fired
+                }), adminOverrideResult({
                     client: client,
+                    tag: tag,
                     instanceId: instanceId,
+                    fired: result.fired,
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
                     memberRolesLoader: memberRolesLoader,
                     clock: clock,
+                    now: now,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
                     } : {},
                     ...args.telemetry !== void 0 ? {
                         telemetry: args.telemetry
                     } : {}
-                }) : 0;
-                return resolveTelemetry(args.telemetry).log(WorkflowStageSet, {
-                    ...definitionHashFragment(before.pinnedContentHash),
-                    instanceId: instanceId,
-                    changed: result.fired
-                }), {
-                    instance: await reload({
-                        client: client,
-                        instanceId: instanceId,
-                        tag: tag
-                    }),
-                    cascaded: cascaded,
-                    changed: result.fired
-                };
+                });
             }
         });
     },
@@ -11968,7 +13318,7 @@ const workflow = {
                     ...definitionHashFragment(before.pinnedContentHash),
                     instanceId: instanceId,
                     changed: changed
-                }), {
+                }), settledResult({
                     instance: await reload({
                         client: client,
                         instanceId: instanceId,
@@ -11976,7 +13326,7 @@ const workflow = {
                     }),
                     cascaded: 0,
                     changed: changed
-                };
+                });
             }
         });
     },
@@ -11986,7 +13336,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "resetActivity",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, now: now, record: record, before: before}) => {
                 const result = await resetActivity({
                     client: client,
                     instanceId: instanceId,
@@ -12004,34 +13354,29 @@ const workflow = {
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
-                }), cascaded = result.fired ? await cascade({
+                });
+                return resolveTelemetry(args.telemetry).log(WorkflowActivityReset, {
+                    ...definitionHashFragment(before.pinnedContentHash),
+                    instanceId: instanceId,
+                    changed: result.fired
+                }), adminOverrideResult({
                     client: client,
+                    tag: tag,
                     instanceId: instanceId,
+                    fired: result.fired,
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
                     memberRolesLoader: memberRolesLoader,
                     clock: clock,
+                    now: now,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
                     } : {},
                     ...args.telemetry !== void 0 ? {
                         telemetry: args.telemetry
                     } : {}
-                }) : 0;
-                return resolveTelemetry(args.telemetry).log(WorkflowActivityReset, {
-                    ...definitionHashFragment(before.pinnedContentHash),
-                    instanceId: instanceId,
-                    changed: result.fired
-                }), {
-                    instance: await reload({
-                        client: client,
-                        instanceId: instanceId,
-                        tag: tag
-                    }),
-                    cascaded: cascaded,
-                    changed: result.fired
-                };
+                });
             }
         });
     },
@@ -12364,8 +13709,8 @@ async function startFreshInstance(args) {
             extraHistory: fieldDiscards
         } : {}
     });
-    await client.create(base, SYNC_COMMIT);
-    const cascaded = await settleStart({
+    await client.create(instanceDocumentForWrite(base), SYNC_COMMIT);
+    const settled = await settleStart({
         client: client,
         tag: tag,
         instanceId: id,
@@ -12387,15 +13732,15 @@ async function startFreshInstance(args) {
             viaSpawn: !1
         }))
     });
-    return {
+    return settledResult({
+        ...settled,
         instance: await reload({
             client: client,
             instanceId: id,
             tag: tag
         }),
-        cascaded: cascaded,
         changed: !0
-    };
+    });
 }
 
 function assertInitialStageExists(definition) {
@@ -12492,7 +13837,7 @@ function pendingEntry(args) {
 }
 
 function createEffectCommitQueue(args) {
-    const {effectKey: effectKey, claimToken: claimToken, commit: commit} = args, pending = [];
+    const {effectKey: effectKey, claimToken: claimToken, attempt: attempt, commit: commit} = args, pending = [];
     let admitted = 0, dead, closed = !1, tail = Promise.resolve();
     function assertOpen() {
         if (dead !== void 0) throw dead;
@@ -12547,7 +13892,7 @@ function createEffectCommitQueue(args) {
                         value: entry.latestValue
                     }
                 } ],
-                idempotencyKey: `effect:${effectKey}:${claimToken}:progress:${coalesceKey}:${admitted}`,
+                idempotencyKey: `effect:${effectKey}:${claimToken}:${attempt}:progress:${coalesceKey}:${admitted}`,
                 coalesceKey: coalesceKey,
                 latestValue: value
             });
@@ -12557,6 +13902,29 @@ function createEffectCommitQueue(args) {
     };
 }
 
+function effectRetryPolicy(definition, effectName) {
+    return findEffect(definition, effectName)?.retry;
+}
+
+function retryWindowClosed(policy, elapsedMs) {
+    return policy.expiryMs !== void 0 && elapsedMs >= policy.expiryMs;
+}
+
+function nextRetryDelayMs(policy, at) {
+    if (at.attempt >= policy.attempts) return;
+    const delay = effectBackoffMs(policy, at.attempt);
+    return retryWindowClosed(policy, at.elapsedMs + delay) ? void 0 : delay;
+}
+
+function retryFailedDetail(args) {
+    const window = args.windowClosed ? ", retry window expired" : "";
+    return `failed after ${args.at.attempt} of ${args.attempts} attempts${window}: ${args.error.message}`;
+}
+
+function retrySucceededDetail(args) {
+    if (args.at.attempt !== 1) return `succeeded on attempt ${args.at.attempt} of ${args.attempts}`;
+}
+
 class MissingHandlerError extends WorkflowError {
     info;
     constructor(args) {
@@ -12570,7 +13938,7 @@ function missingHandlerMessage(info) {
 }
 
 async function verifyDeployedDefinitionsInternal(args) {
-    const {tag: tag, effectHandlers: effectHandlers, missingHandler: missingHandler, logger: logger} = args, client = withRequestTag(args.client, REQUEST_TAG.verifyDefinitions);
+    const {tag: tag, handlers: handlers, missingHandler: missingHandler, logger: logger} = args, client = withRequestTag(args.client, REQUEST_TAG.verifyDefinitions);
     validateTag(tag);
     const log = logger("verifyDeployedDefinitions"), definitions = (await client.fetch(definitionsListGroq("asc"), {
         tag: tag
@@ -12580,7 +13948,7 @@ async function verifyDeployedDefinitionsInternal(args) {
         version: def.version,
         _id: def._id
     }), walkEffectNames(def, (name, location) => {
-        if (effectHandlers[name] !== void 0) return;
+        if (handlers[name] !== void 0) return;
         const key = `${name}@@${def._id}`;
         let bucket = missingByName.get(key);
         bucket === void 0 && (bucket = {
@@ -12639,7 +14007,7 @@ function isCancelledCompletion(data) {
 }
 
 async function drainEffectsInternal(args) {
-    const {tag: tag, workflowResource: workflowResource, instanceId: instanceId, effectHandlers: effectHandlers, missingHandler: missingHandler, logger: logger, handlerClient: rawHandlerClient, handlerResourceClients: rawHandlerResourceClients} = args, cascadeTelemetry = drainCascadeTelemetry(args.telemetry), {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.drain), leaseMs = args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS, clock = args.clock ?? wallClock, handlerClient = effectHandlerClient(rawHandlerClient), handlerResourceClients = effectHandlerResolver(rawHandlerResourceClients), routeGdr = buildClientForGdr({
+    const {tag: tag, workflowResource: workflowResource, instanceId: instanceId, handlers: handlers, missingHandler: missingHandler, logger: logger, handlerClient: rawHandlerClient, handlerResourceClients: rawHandlerResourceClients} = args, cascadeTelemetry = drainCascadeTelemetry(args.telemetry), {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.drain), leaseMs = args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS, clock = args.clock ?? wallClock, sleep = args.sleep ?? wallSleeper, handlerClient = effectHandlerClient(rawHandlerClient), handlerResourceClients = effectHandlerResolver(rawHandlerResourceClients), routeGdr = buildClientForGdr({
         client: handlerClient,
         workflowResource: workflowResource,
         resourceClients: handlerResourceClients
@@ -12659,12 +14027,13 @@ async function drainEffectsInternal(args) {
             resourceClients: resourceClients
         } : {},
         instanceId: instanceId,
-        effectHandlers: effectHandlers,
+        handlers: handlers,
         missingHandler: missingHandler,
         logger: logger,
         log: log,
         leaseMs: leaseMs,
         clock: clock,
+        sleep: sleep,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
         } : {},
@@ -12672,14 +14041,14 @@ async function drainEffectsInternal(args) {
         drainerActor: drainerActor,
         clientFor: clientFor,
         buckets: buckets,
-        skippedKeys: /* @__PURE__ */ new Set
+        handledKeys: /* @__PURE__ */ new Set
     };
     for (;await drainOneCandidate(pass); ) ;
     return buckets;
 }
 
 async function drainOneCandidate(pass) {
-    const {client: client, tag: tag, instanceId: instanceId, buckets: buckets, skippedKeys: skippedKeys} = pass, now = pass.clock(), before = await reload({
+    const {client: client, tag: tag, instanceId: instanceId, buckets: buckets, handledKeys: handledKeys} = pass, now = pass.clock(), before = await reload({
         client: client,
         instanceId: instanceId,
         tag: tag
@@ -12688,16 +14057,16 @@ async function drainOneCandidate(pass) {
     const candidate = findClaimableCandidate({
         instance: before,
         now: now,
-        skippedKeys: skippedKeys
+        handledKeys: handledKeys
     });
     if (candidate === void 0) return !1;
-    const handler = pass.effectHandlers[candidate.name];
+    const handler = pass.handlers[candidate.name];
     if (handler === void 0) return await assertSkippableOrThrow({
         missingHandler: pass.missingHandler,
         candidate: candidate,
         instanceId: instanceId,
         log: pass.log
-    }), buckets.skipped.push(candidate), skippedKeys.add(candidate._key), !0;
+    }), buckets.skipped.push(candidate), handledKeys.add(candidate._key), !0;
     const claimed = await claimPendingEffect({
         client: client,
         instance: before,
@@ -12710,11 +14079,15 @@ async function drainOneCandidate(pass) {
         } : {}
     });
     if (claimed === void 0) return !0;
-    const outcome = await dispatchAndReport({
+    const retry = effectRetryPolicy(parseDefinitionSnapshot(before), candidate.name), outcome = await dispatchAndReport({
         handler: handler,
         candidate: candidate,
         claimToken: claimed.claimToken,
+        ...retry !== void 0 ? {
+            retry: retry
+        } : {},
         leaseMs: pass.leaseMs,
+        sleep: pass.sleep,
         client: client,
         handlerClient: pass.handlerClient,
         tag: tag,
@@ -12732,50 +14105,80 @@ async function drainOneCandidate(pass) {
         telemetry: pass.telemetry,
         clock: pass.clock
     });
-    return buckets[outcome].push(candidate), !0;
+    return buckets[outcome].push(candidate), outcome === "lost" && handledKeys.add(candidate._key), 
+    !0;
 }
 
-function findClaimableCandidate({instance: instance, now: now, skippedKeys: skippedKeys}) {
-    return instance.pendingEffects.find(e => (e.claim === void 0 || isClaimExpired(e.claim, now)) && !skippedKeys.has(e._key));
+function findClaimableCandidate({instance: instance, now: now, handledKeys: handledKeys}) {
+    return instance.pendingEffects.find(e => (e.claim === void 0 || isClaimExpired(e.claim, now)) && !handledKeys.has(e._key));
 }
 
 async function dispatchAndReport(args) {
-    const {handler: handler, candidate: candidate, claimToken: claimToken, leaseMs: leaseMs, client: client, handlerClient: handlerClient, tag: tag, workflowResource: workflowResource, resourceClients: resourceClients, instanceId: instanceId, clientFor: clientFor, logger: logger, log: log, executionContext: executionContext, telemetry: telemetry, clock: clock} = args, commitQueue = createEffectCommitQueue({
-        effectKey: candidate._key,
-        claimToken: claimToken,
-        commit: async req => {
-            await workflow.commitEffectOps({
-                client: client,
-                tag: tag,
-                workflowResource: workflowResource,
-                ...resourceClients !== void 0 ? {
-                    resourceClients: resourceClients
-                } : {},
-                ...executionContext !== void 0 ? {
-                    executionContext: executionContext
-                } : {},
-                ...telemetry !== void 0 ? {
-                    telemetry: telemetry
-                } : {},
-                instanceId: instanceId,
-                effectKey: candidate._key,
-                claimToken: claimToken,
-                ops: req.ops,
-                idempotencyKey: req.idempotencyKey,
-                leaseMs: leaseMs,
-                clock: clock
-            });
-        }
-    }), {outputs: outputs, ops: ops, dispatchError: dispatchError} = await dispatchEffect({
+    const {handler: handler, candidate: candidate, claimToken: claimToken, retry: retry, leaseMs: leaseMs, sleep: sleep, client: client, handlerClient: handlerClient, tag: tag, workflowResource: workflowResource, resourceClients: resourceClients, instanceId: instanceId, clientFor: clientFor, logger: logger, log: log, executionContext: executionContext, telemetry: telemetry, clock: clock} = args, attemptOnce = attempt => dispatchEffect({
         handler: handler,
         candidate: candidate,
-        queue: commitQueue,
+        queue: createEffectCommitQueue({
+            effectKey: candidate._key,
+            claimToken: claimToken,
+            attempt: attempt,
+            commit: async req => {
+                await workflow.commitEffectOps({
+                    client: client,
+                    tag: tag,
+                    workflowResource: workflowResource,
+                    ...resourceClients !== void 0 ? {
+                        resourceClients: resourceClients
+                    } : {},
+                    ...executionContext !== void 0 ? {
+                        executionContext: executionContext
+                    } : {},
+                    ...telemetry !== void 0 ? {
+                        telemetry: telemetry
+                    } : {},
+                    instanceId: instanceId,
+                    effectKey: candidate._key,
+                    claimToken: claimToken,
+                    ops: req.ops,
+                    idempotencyKey: req.idempotencyKey,
+                    leaseMs: leaseMs,
+                    clock: clock
+                });
+            }
+        }),
         ctx: {
             client: handlerClient,
             clientFor: clientFor,
             instanceId: instanceId,
             logger: logger
         }
+    }), claimed = {
+        client: client,
+        tag: tag,
+        instanceId: instanceId,
+        effectKey: candidate._key,
+        claimToken: claimToken
+    }, run = await runRetryPolicy({
+        attemptOnce: attemptOnce,
+        ...retry !== void 0 ? {
+            retry: retry
+        } : {},
+        clock: clock,
+        sleep: sleep,
+        holdThrough: holdMs => renewClaimLease({
+            ...claimed,
+            holdMs: holdMs,
+            clock: clock
+        }),
+        stillHeld: () => claimStillHeld(claimed),
+        leaseMs: leaseMs
+    });
+    if (run.abandoned !== void 0) return log.warn(run.abandoned === "lease" ? `Effect "${candidate.name}" could not hold its claim between retry attempts — the run stopped with attempts left` : `Effect "${candidate.name}" was settled by another party during a retry backoff — the run stopped without dispatching again`, {
+        effectKey: candidate._key,
+        instanceId: instanceId
+    }), "lost";
+    const {outputs: outputs, ops: ops, dispatchError: dispatchError} = run.dispatch, detail = retry === void 0 ? void 0 : completionDetail({
+        run: run,
+        retry: retry
     });
     try {
         await reportEffectOutcome({
@@ -12796,6 +14199,9 @@ async function dispatchAndReport(args) {
             outputs: outputs,
             ops: ops,
             dispatchError: dispatchError,
+            ...detail !== void 0 ? {
+                detail: detail
+            } : {},
             clock: clock
         });
     } catch (error) {
@@ -12808,6 +14214,71 @@ async function dispatchAndReport(args) {
     return dispatchError === void 0 ? "drained" : "failed";
 }
 
+async function runRetryPolicy(args) {
+    const {attemptOnce: attemptOnce, retry: retry, clock: clock} = args, startedAt = Date.parse(clock()), elapsed = () => Date.parse(clock()) - startedAt;
+    let attempt = 1, dispatch = await attemptOnce(attempt);
+    for (;dispatch.dispatchError !== void 0 && retry !== void 0; ) {
+        const at = {
+            attempt: attempt,
+            elapsedMs: elapsed()
+        }, stop = await waitForNextAttempt({
+            retry: retry,
+            at: at,
+            elapsed: elapsed,
+            pace: args
+        });
+        if (stop !== void 0) return {
+            ...stop,
+            dispatch: dispatch,
+            at: at
+        };
+        attempt += 1, dispatch = await attemptOnce(attempt);
+    }
+    return {
+        dispatch: dispatch,
+        at: {
+            attempt: attempt,
+            elapsedMs: elapsed()
+        },
+        windowClosed: !1
+    };
+}
+
+async function waitForNextAttempt(args) {
+    const {retry: retry, at: at, elapsed: elapsed} = args, {clock: clock, sleep: sleep, holdThrough: holdThrough, stillHeld: stillHeld, leaseMs: leaseMs} = args.pace, delay = nextRetryDelayMs(retry, at);
+    if (delay === void 0) return {
+        windowClosed: at.attempt < retry.attempts
+    };
+    const heldUntil = await holdThrough(delay + leaseMs);
+    if (heldUntil === void 0 || hasPassed(heldUntil, addMs(clock(), delay))) return {
+        windowClosed: !1,
+        abandoned: "lease"
+    };
+    if (retryWindowClosed(retry, elapsed() + delay)) return {
+        windowClosed: !0
+    };
+    if (await sleep(delay), !await stillHeld()) return {
+        windowClosed: !1,
+        abandoned: "settled"
+    };
+    if (retryWindowClosed(retry, elapsed())) return {
+        windowClosed: !0
+    };
+}
+
+function completionDetail(args) {
+    const {run: run, retry: retry} = args, {dispatchError: dispatchError} = run.dispatch;
+    return dispatchError === void 0 ? retrySucceededDetail({
+        at: run.at,
+        attempts: retry.attempts
+    }) : retryFailedDetail({
+        at: run.at,
+        attempts: retry.attempts,
+        error: dispatchError,
+        windowClosed: run.windowClosed
+    });
+}
+
 async function reportEffectOutcome(args) {
     const {outputs: outputs, ops: ops, dispatchError: dispatchError, resourceClients: resourceClients, ...rest} = args;
     await workflow.completeEffect({
@@ -13098,8 +14569,12 @@ function createInstanceSession(args) {
             definition: definitionOf(),
             actor: actor,
             snapshot: snapshotFrom(held, normalizedSelf),
+            documentAvailability: documentAvailabilityReader({
+                clientForGdr: evalScope.clientForGdr
+            }),
             guards: guards,
             resourceGrants: resourceGrants,
+            guardDereference: clientGuardDereference(evalScope.client),
             ...localPrincipalId !== void 0 ? {
                 localPrincipalId: localPrincipalId
             } : {},
@@ -13114,7 +14589,7 @@ function createInstanceSession(args) {
             } : {}
         });
     }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope, memberRolesLoader: memberRolesLoader}) => {
-        const cascaded = await cascadeHeld({
+        const settled = await cascadeHeld({
             scope: scope,
             actor: actor,
             held: held,
@@ -13124,14 +14599,14 @@ function createInstanceSession(args) {
             client: scope.client,
             instanceId: instance._id,
             tag: tag
-        }), {
+        }), settledResult({
+            ...settled,
             instance: instance,
-            cascaded: cascaded,
             changed: !0,
             ...ranOps !== void 0 ? {
                 ranOps: ranOps
             } : {}
-        };
+        });
     }, cascadeHeld = ({scope: scope, actor: actor, held: held, memberRolesLoader: memberRolesLoader}) => cascade({
         client: scope.client,
         instanceId: instance._id,
@@ -13242,13 +14717,14 @@ function createInstanceSession(args) {
                     identity: lakePrincipalId({
                         actor: actor,
                         localPrincipalId: localPrincipalId
-                    })
+                    }),
+                    dereference: clientGuardDereference(tickScope.client)
                 });
                 const before = await reload({
                     client: tickScope.client,
                     instanceId: instance._id,
                     tag: tag
-                }), cascaded = await cascadeHeld({
+                }), settled = await cascadeHeld({
                     scope: tickScope,
                     actor: actor,
                     held: held,
@@ -13261,12 +14737,12 @@ function createInstanceSession(args) {
                 }), telemetry.log(WorkflowInstanceTicked, {
                     ...definitionHashFragment(instance.pinnedContentHash),
                     instanceId: instance._id,
-                    cascaded: cascaded
-                }), {
+                    cascaded: settled.cascaded
+                }), settledResult({
+                    ...settled,
                     instance: instance,
-                    cascaded: cascaded,
                     changed: instance._rev !== before._rev
-                };
+                });
             });
         },
         fireAction({activity: activity, action: action, params: params}) {
@@ -13416,7 +14892,10 @@ const silentLogger = {
 function createEngine(args) {
     const {workflowResource: workflowResource, clock: clock, tag: tag, executionContext: executionContext} = args, {client: client, resourceClients: resourceClients} = taggedScope(args, REQUEST_TAG.engine);
     validateTag(tag);
-    const effectHandlers = args.effectHandlers ?? {}, missingHandler = args.missingHandler ?? "fail", logger = args.loggerFactory ?? defaultLoggerFactory, telemetry = resolveTelemetry(args.telemetry), EMPTY_DRAIN_LOG_INTERVAL_MS = 6e4;
+    const effects = {
+        handlers: args.effects?.handlers ?? {},
+        missingHandler: args.effects?.missingHandler ?? "fail"
+    }, logger = args.loggerFactory ?? defaultLoggerFactory, telemetry = resolveTelemetry(args.telemetry), EMPTY_DRAIN_LOG_INTERVAL_MS = 6e4;
     let lastEmptyDrainLoggedAt;
     const emptyDrainDue = () => {
         const now = Date.parse((clock ?? wallClock)());
@@ -13447,8 +14926,7 @@ function createEngine(args) {
         client: client,
         tag: tag,
         workflowResource: workflowResource,
-        effectHandlers: effectHandlers,
-        missingHandler: missingHandler,
+        effects: effects,
         logger: logger,
         telemetry: telemetry,
         resolveActor: rest => resolveClientActor(client, rest),
@@ -13502,12 +14980,14 @@ function createEngine(args) {
                 workflowResource: workflowResource,
                 ...optionalScope,
                 instanceId: instanceId,
-                effectHandlers: effectHandlers,
-                missingHandler: missingHandler,
+                ...effects,
                 logger: logger,
                 telemetry: telemetry,
-                ...args.effectLeaseMs !== void 0 ? {
-                    leaseMs: args.effectLeaseMs
+                ...args.effects?.leaseMs !== void 0 ? {
+                    leaseMs: args.effects.leaseMs
+                } : {},
+                ...args.sleep !== void 0 ? {
+                    sleep: args.sleep
                 } : {}
             }), drained = result.drained;
             return (drained.length > 0 || emptyDrainDue()) && telemetry.log(WorkflowEffectsDrained, {
@@ -13520,8 +15000,7 @@ function createEngine(args) {
         verifyDeployedDefinitions: () => verifyDeployedDefinitionsInternal({
             client: client,
             tag: tag,
-            effectHandlers: effectHandlers,
-            missingHandler: missingHandler,
+            ...effects,
             logger: logger
         })
     };
@@ -13530,27 +15009,43 @@ function createEngine(args) {
 const CONSENT_TAG = "telemetry.consent", BATCH_TAG = "telemetry.batch";
 
 function createTelemetryIntake(args) {
-    const {client: client, projectId: projectId, denied: denied = !1} = args;
+    const {client: client, projectId: projectId, denied: denied = !1, context: context} = args;
     let cachedConsent;
     return {
         resolveConsent: async () => denied ? {
             status: "denied"
         } : (cachedConsent !== void 0 || (cachedConsent = await client.request({
-            uri: "/intake/telemetry-status",
+            url: "/intake/telemetry-status",
             tag: CONSENT_TAG
         })), cachedConsent),
         sendEvents: batch => client.request({
-            uri: "/intake/batch",
+            url: "/intake/batch",
             method: "POST",
             body: {
                 projectId: projectId,
-                batch: batch
+                batch: context === void 0 ? batch : batch.map(event => withContext(event, context))
             },
             tag: BATCH_TAG
         })
     };
 }
 
+function withContext(event, context) {
+    if (!isRecord(event)) return event;
+    const existing = isRecord(event.context) ? event.context : {};
+    return {
+        ...event,
+        context: {
+            ...existing,
+            ...context
+        }
+    };
+}
+
+function _resolveTelemetryEnvironment(nodeEnv, fallback) {
+    return nodeEnv === "production" ? "production" : nodeEnv === "development" || nodeEnv === "test" ? "development" : fallback;
+}
+
 function isTelemetryEnvDenied(env) {
     return isTrueish(env.CI) || isTrueish(env.DO_NOT_TRACK);
 }
@@ -13573,6 +15068,16 @@ function isTrueish(value) {
     return normalized !== "0" && normalized !== "false";
 }
 
+function summary(documents, deleted) {
+    if (documents.length === 0) return "";
+    const titles = [ ...new Set(documents.map(document => document.title ?? document.target.field)) ].map(title => `“${title}”`).join(", ");
+    return documents.length === 1 ? `A document selected for ${titles} ${deleted ? "has been deleted" : "can’t be read by this workflow"}` : `${documents.length} documents selected for ${titles} ${deleted ? "have been deleted" : "can’t be read by this workflow"}`;
+}
+
+function _missingDocumentsSummary(documents) {
+    return [ summary(documents.filter(document => document.availability === "deleted"), !0), summary(documents.filter(document => document.availability !== "deleted"), !1) ].filter(Boolean).join(". ");
+}
+
 function groupSitesOf(definition) {
     const sites = [], workflow2 = declarationIndex({
         groups: definition.groups,
@@ -14060,4 +15565,4 @@ function displayDescription(typeKey) {
     if (typeKey) return DISPLAY[typeKey]?.description;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MAX_READER, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DECISION_SEMANTICS, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstancePreviewSchema, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, actorFulfillsRole, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, documentStuckCause, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findActivityNode, findCurrentActivityEntry, findOpenStageEntry, findStageNode, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceChangesQuery, instanceDocId, instanceGuardQuery, instancePreviewsQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseInstancePreviewDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readInstancePreviewDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredDefinitionReaderModel, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resolveUserAttributes, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCascadeError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MAX_READER, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DECISION_SEMANTICS, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DOCUMENT_VALUE_PERMISSIONS, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstancePreviewSchema, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, _additionalMissingDocuments, _fieldTargetLabel, _missingDocumentsSummary, _requestProjectMembers, _resolveTelemetryEnvironment, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activeAssignmentMembers, activityAutonomyOf, actorFulfillsRole, actorMatchesAssignment, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, assignmentMatch, assignmentMembers, assignmentPrefilter, assignmentState, assignmentStateCounts, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientGuardDereference, clientProjectUserDirectory, compileGuards, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionRoleNames, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, documentStuckCause, driverKind, effectOutputsMap, effectSites, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findActivityNode, findCurrentActivityEntry, findOpenStageEntry, findStageNode, formatRead2 as formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, identityMatchesAssignment, inFlightFilter, initialFieldIssues, instanceAssignmentStateCounts, instanceChangesQuery, instanceDocId, instanceGuardQuery, instancePreviewsQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, openActivityAssignments, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseInstancePreviewDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readInstancePreviewDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredDefinitionReaderModel, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resolveUserAttributes, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, snapshotGuardDereference, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };