@@ -23,7 +23,7 @@ vi.mock('@/lib/workflows/editing/selector-validator', () => ({
 import { collectUnresolvedReferences } from '@/lib/workflows/editing/validation'
 import { getBlock } from '@/blocks/registry'
 
-const CTX = { userId: 'user-1', workspaceId: 'workspace-1' }
+const CTX = { userId: 'user-1', workspaceId: 'workspace-1' } as const
 
 /** The real basic member of the knowledge block's `knowledgeBaseId` canonical pair. */
 const KB_SELECTOR_ID = 'knowledgeBaseSelector'
 
@@ -1304,6 +1304,26 @@ describe('collectUnresolvedReferences', () => {
     expect(refs).toHaveLength(0)
   })
 
+  it('skips an oversized selector value instead of tokenizing it', async () => {
+    // Reference detection tokenizes the whole string and the tokenizer is superlinear in
+    // candidate count, so an implausible value is skipped rather than parsed.
+    mockValidateSelectorIds.mockResolvedValue({ valid: [], invalid: ['x'] })
+    const state = {
+      blocks: {
+        kb1: {
+          type: 'knowledge',
+          name: 'KB',
+          subBlocks: { knowledgeBaseId: { value: `kb_${'a'.repeat(10_000)}` } },
+        },
+      },
+    }
+    const startedAt = performance.now()
+    const refs = await collectUnresolvedReferences(state, CTX)
+    expect(performance.now() - startedAt).toBeLessThan(1000)
+    expect(mockValidateSelectorIds).not.toHaveBeenCalled()
+    expect(refs).toHaveLength(0)
+  })
+
   it('still validates a plain literal id (the guard must not over-skip)', async () => {
     mockValidateSelectorIds.mockResolvedValue({ valid: [], invalid: ['kb_missing'] })
     const state = {
 
@@ -1082,6 +1082,15 @@ interface SelectorFieldToValidate {
   value: string | string[]
 }
 
+/**
+ * A selector value is an id, or a short comma-separated list of them. Reference detection
+ * tokenizes the whole string and `findWorkflowReferenceTokens` is superlinear in candidate count,
+ * so an oversized value is both implausible and expensive on a write path that admits megabytes.
+ * Past this the field is skipped rather than tokenized: the lint is advisory, so declining to
+ * check is the safe direction.
+ */
+const MAX_SELECTOR_VALUE_LENGTH = 10_000
+
 /**
  * Walk a workflow state and collect selector/credential fields to validate.
  * For canonical pairs only the ACTIVE member is collected (an intentionally-empty
@@ -1135,6 +1144,9 @@ function collectSelectorFields(
 
       const subBlockValue = blockData.subBlocks?.[subBlockConfig.id]?.value
       if (!subBlockValue) continue
+      if (typeof subBlockValue === 'string' && subBlockValue.length > MAX_SELECTOR_VALUE_LENGTH) {
+        continue
+      }
 
       // Handle comma-separated values for multi-select
       let values: string | string[] = subBlockValue
 
@@ -132,15 +132,22 @@ describe('splitOutsideReferences', () => {
     expect(elapsedMs).toBeLessThan(1000)
   })
 
-  it('does not yet protect a comma inside a reference that nests an env-var placeholder', () => {
-    // Known limitation, unchanged from the plain `.split(',')` this replaced: the tokenizer
-    // reports the inner `{{A}}` and suppresses the outer `<...>` span, so the comma reads as a
-    // separator. Characterized rather than fixed - the suppression lives in the shared
-    // `@sim/utils/workflow-references` tokenizer.
+  it('protects a comma inside a reference that nests an env-var placeholder', () => {
+    // `findWorkflowReferenceTokens` is non-overlapping, so it reports only the inner `{{A}}` and
+    // drops the outer candidate. The candidate pass is what keeps the outer region protected.
     expect(splitOutsideReferences('<start.body.pick({{A}},b)>,kb_literal')).toEqual([
-      '<start.body.pick({{A}}',
-      'b)>',
+      '<start.body.pick({{A}},b)>',
       'kb_literal',
     ])
+    expect(splitOutsideReferences('<a.{{B}}x,y>,kb_literal')).toEqual([
+      '<a.{{B}}x,y>',
+      'kb_literal',
+    ])
+  })
+
+  it('still splits a near-miss that does not read as a reference', () => {
+    // `<a.b+c,d>` fails `isLikelyReferenceSegment` (the `+`), so it is not a protected region.
+    // Loud rather than silent: the fragments are reported as ids that do not resolve.
+    expect(splitOutsideReferences('<a.b+c,d>')).toEqual(['<a.b+c', 'd>'])
   })
 })
@@ -23,32 +23,78 @@ export function containsReference(value: unknown): boolean {
   return findWorkflowReferenceTokens(value).length > 0
 }
 
+/**
+ * Mark every `<...>` region that reads as a workflow reference, including one the tokenizer
+ * dropped for overlapping an `{{ENV_VAR}}` token.
+ *
+ * `findWorkflowReferenceTokens` is contractually NON-overlapping, so for `<a.pick({{B}},c)>` it
+ * reports only the inner `{{B}}` and discards the outer candidate. That is right for a tokenizer
+ * and wrong for a splitter, which needs the UNION of protected regions rather than a disjoint set.
+ */
+function markCandidateReferenceRegions(value: string, insideReference: Uint8Array): void {
+  let candidateStart = -1
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index]
+    if (character === REFERENCE.START && candidateStart === -1) {
+      candidateStart = index
+      continue
+    }
+    if (character === '\r' || character === '\n') {
+      candidateStart = -1
+      continue
+    }
+    if (character !== REFERENCE.END || candidateStart === -1) continue
+
+    const candidate = value.slice(candidateStart, index + REFERENCE.END.length)
+    const split = splitReferenceSegment(candidate)
+    if (split && isLikelyReferenceSegment(candidate)) {
+      const start = candidateStart + split.leading.length
+      const end = Math.min(start + split.reference.length, value.length)
+      for (let position = start; position < end; position += 1) {
+        insideReference[position] = 1
+      }
+    }
+    candidateStart = -1
+  }
+}
+
 /**
  * Split a comma-separated multi-select value without tearing a reference apart.
  *
  * A `<block.path>` or `{{ENV_VAR}}` token may legitimately contain a comma (`<start.pick(a,b)>`),
  * and its fragments read as plain literals once split, so a naive `.split(',')` turns one dynamic
- * value into several bogus ones. Only commas outside every reference token are separators.
+ * value into several bogus ones. Only commas outside every reference region are separators.
  */
 export function splitOutsideReferences(value: string): string[] {
-  const tokens = findWorkflowReferenceTokens(value)
-  if (tokens.length === 0) {
-    return value
+  const plainSplit = () =>
+    value
       .split(',')
       .map((part) => part.trim())
       .filter(Boolean)
+
+  if (!value.includes(REFERENCE.START) && !value.includes(REFERENCE.ENV_VAR_START)) {
+    return plainSplit()
   }
 
   // Marked once up front rather than scanned per comma: a per-comma `tokens.some()` is
   // O(commas x tokens), which reached ~2.5s on a 240KB value of repeated `{{A}},`.
+  const tokens = findWorkflowReferenceTokens(value)
   const insideReference = new Uint8Array(value.length)
+  let hasEnvironmentToken = false
   for (const token of tokens) {
+    if (token.kind === 'environment') hasEnvironmentToken = true
     const end = Math.min(token.end, value.length)
     for (let index = Math.max(token.start, 0); index < end; index += 1) {
       insideReference[index] = 1
     }
   }
 
+  // Overlap with an environment token is the only reason the tokenizer drops a workflow
+  // candidate, so without one it already reported every region and re-scanning is duplicate work.
+  if (hasEnvironmentToken) {
+    markCandidateReferenceRegions(value, insideReference)
+  }
+
   const parts: string[] = []
   let partStart = 0
   for (let index = 0; index < value.length; index += 1) {