@@ -247,6 +247,8 @@ function emptyCopyResult() {
 
 beforeEach(() => {
   resetDbChainMock()
+  queueTableRows(workspace, [{ name: 'Target' }])
+  queueTableRows(workspace, [{ archivedAt: null, forkSyncNewWorkflowsExcluded: false }])
   mockGetUsersWithPermissions.mockResolvedValue([])
   mockLoadSourceDeployedStates.mockResolvedValue({
     deployedWorkflows: [],
@@ -367,11 +369,6 @@ describe('promoteFork gates', () => {
 })
 
 describe('promoteFork dependent values', () => {
-  beforeEach(() => {
-    queueTableRows(workspace, [{ name: 'Target' }])
-    queueTableRows(workspace, [{ archivedAt: null, forkSyncNewWorkflowsExcluded: false }])
-  })
-
   it('unions the dependent-value picks into the copy discovery set (a re-picked document must be copied)', async () => {
     mockComputePlan.mockResolvedValue(
       makePlan({
@@ -482,8 +479,6 @@ describe('promoteFork dependent values', () => {
 
 describe('promoteFork trigger URLs', () => {
   beforeEach(() => {
-    queueTableRows(workspace, [{ name: 'Target' }])
-    queueTableRows(workspace, [{ archivedAt: null, forkSyncNewWorkflowsExcluded: false }])
     // A block only holds a public URL when its config declares a `useWebhookUrl` field, so the
     // fixture has to look like a webhook trigger to the shared predicate.
     vi.mocked(getBlock).mockReturnValue({
 
@@ -630,6 +630,8 @@ export async function promoteFork(params: PromoteForkParams): Promise<PromoteFor
       await acquireForkTargetLock(tx, targetWorkspaceId)
       await acquireForkEdgeLock(tx, edge.childWorkspaceId)
       await lockForkRevision(tx, revisionScope)
+      /** Before any target write, so a concurrent archive and this promote lock in one order. */
+      await lockActiveWorkspace(tx, targetWorkspaceId)
       if (admission) {
         await assertForkPreviewFresh(tx, revisionScope, admission)
       }
@@ -997,7 +999,6 @@ export async function promoteFork(params: PromoteForkParams): Promise<PromoteFor
       const writtenItems: typeof plan.items = []
       const needsConfiguration: PromoteTxApplied['needsConfiguration'] = []
       const clearedOptional: PromoteTxApplied['clearedOptional'] = []
-      if (plan.items.length) await lockActiveWorkspace(tx, targetWorkspaceId)
       for (const item of plan.items) {
         // Use the pre-read source state (loaded above, before the tx). An item only
         // exists when its state was present at read time, so this lookup hits; the
 
@@ -174,15 +174,21 @@ async function fixture(org = true, count = 2) {
   return { ownerId, teammateId, outsiderId, organizationId, projectId, ids, owner, teammate }
 }
 
-/** Waits until a session is blocked behind `blockerPid`'s locks. */
-async function waitUntilBlockedBy(blockerPid: number) {
+/**
+ * Waits until the operation under test is blocked behind `blockerPid`: a session whose
+ * current statement contains `waitingIn` (an advisory lock tag or row-lock clause), so an
+ * unrelated waiter cannot release the barrier early.
+ */
+async function waitUntilBlockedBy(blockerPid: number, waitingIn: string) {
   await expect
     .poll(
       async () =>
         (
-          await db.execute(
-            sql`SELECT 1 FROM pg_stat_activity WHERE ${blockerPid} = ANY(pg_blocking_pids(pid))`
-          )
+          await db.execute(sql`
+            SELECT 1 FROM pg_stat_activity
+            WHERE ${blockerPid} = ANY(pg_blocking_pids(pid))
+              AND position(${waitingIn.toLowerCase()} in lower(query)) > 0
+          `)
         ).length,
       { timeout: 2000, interval: 10 }
     )
@@ -457,7 +463,7 @@ describe('Project foundation at the database and application boundary', () => {
       name: 'Concurrent child',
     })
     try {
-      await waitUntilBlockedBy(await locked.promise)
+      await waitUntilBlockedBy(await locked.promise, "lock='project_backfill'")
     } finally {
       release.resolve()
     }
@@ -841,7 +847,7 @@ describe('Project foundation at the database and application boundary', () => {
         {}
       )
       try {
-        await waitUntilBlockedBy(blocker)
+        await waitUntilBlockedBy(blocker, 'for share')
       } finally {
         release.resolve()
         await archive
@@ -870,7 +876,7 @@ describe('Project foundation at the database and application boundary', () => {
       (error: unknown) => error
     )
     try {
-      await waitUntilBlockedBy(blocker)
+      await waitUntilBlockedBy(blocker, 'for share')
     } finally {
       release.resolve()
       await archive
@@ -1196,7 +1202,7 @@ describe('Project foundation at the database and application boundary', () => {
         prepareProjectsForAccountDeletion(tx, f.ownerId, [f.ids[1]])
       )
       try {
-        await waitUntilBlockedBy(blocker)
+        await waitUntilBlockedBy(blocker, "lock='project'")
       } finally {
         release.resolve()
         await unlink
@@ -1226,7 +1232,7 @@ describe('Project foundation at the database and application boundary', () => {
       const blocker = await held.promise
       const ban = disableUserResources(f.ownerId)
       try {
-        await waitUntilBlockedBy(blocker)
+        await waitUntilBlockedBy(blocker, "lock='project'")
       } finally {
         release.resolve()
         await transfer
 
@@ -39,15 +39,20 @@ type ProjectDeletionDecision =
   | { remove: true }
   | { archive: boolean; ownerId?: string }
 
-/** An org admin, else a teammate who administers every surviving environment. */
+/**
+ * An org admin, else a teammate who administers every surviving environment. With `hold`,
+ * the successor's membership or grants stay share-locked until commit, so the handoff
+ * cannot land on someone demoted concurrently.
+ */
 async function findProjectSuccessor(
   executor: DbOrTx,
   record: typeof project.$inferSelect,
   userId: string,
-  survivorIds: string[]
+  survivorIds: string[],
+  hold: boolean
 ): Promise<string | null> {
   if (record.organizationId) {
-    const [admin] = await executor
+    const adminQuery = executor
       .select({ userId: member.userId })
       .from(member)
       .where(
@@ -59,6 +64,7 @@ async function findProjectSuccessor(
       )
       .orderBy(asc(member.userId))
       .limit(1)
+    const [admin] = await (hold ? adminQuery.for('share') : adminQuery)
     if (admin) return admin.userId
   }
   const [teammate] = await executor
@@ -76,7 +82,20 @@ async function findProjectSuccessor(
     .having(sql`count(*) = ${survivorIds.length}`)
     .orderBy(asc(permissions.userId))
     .limit(1)
-  return teammate?.userId ?? null
+  if (!teammate || !hold) return teammate?.userId ?? null
+  const held = await executor
+    .select({ id: permissions.id })
+    .from(permissions)
+    .where(
+      and(
+        eq(permissions.entityType, 'workspace'),
+        eq(permissions.permissionType, 'admin'),
+        eq(permissions.userId, teammate.userId),
+        inArray(permissions.entityId, survivorIds)
+      )
+    )
+    .for('share')
+  return held.length === survivorIds.length ? teammate.userId : null
 }
 
 interface ProjectEnvironment {
@@ -111,7 +130,8 @@ async function planProjectDeletion(
   record: typeof project.$inferSelect,
   members: ProjectEnvironment[],
   userId: string,
-  doomed: Set<string>
+  doomed: Set<string>,
+  hold: boolean
 ): Promise<ProjectDeletionDecision> {
   const survivors = members.filter((row) => !doomed.has(row.id))
   if (!survivors.length) {
@@ -125,7 +145,8 @@ async function planProjectDeletion(
     executor,
     record,
     userId,
-    survivors.map((row) => row.id)
+    survivors.map((row) => row.id),
+    hold
   )
   return ownerId
     ? { archive, ownerId }
@@ -153,7 +174,8 @@ export async function getProjectAccountDeletionBlockers(
       record,
       environments.get(record.id) ?? [],
       userId,
-      doomed
+      doomed,
+      false
     )
     if ('blocker' in decision) blockers.push(decision.blocker)
   }
@@ -198,7 +220,8 @@ export async function prepareProjectsForAccountDeletion(
       record,
       environments.get(record.id) ?? [],
       userId,
-      doomed
+      doomed,
+      true
     )
     if ('blocker' in decision) throw new ProjectConflictError(decision.blocker)
     if ('remove' in decision) {
 
@@ -1,10 +1,18 @@
 import type { Principal, SessionPrincipal } from '@sim/auth/principal'
-import { member, permissions, project, projectWorkspace, workspace } from '@sim/db/schema'
+import {
+  member,
+  permissionGroup,
+  permissions,
+  project,
+  projectWorkspace,
+  workspace,
+} from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { isOrgAdminRole } from '@sim/platform-authz/workspace'
-import { and, asc, eq, inArray } from 'drizzle-orm'
+import { and, asc, eq, inArray, sql } from 'drizzle-orm'
 import { PrincipalKindAuthorizationError } from '@/lib/core/application/workspace-authorization'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { textArrayLiteral } from '@/lib/db/arrays'
 import type { DbTransaction } from '@/lib/db/types'
 import { CAPABILITY_RULES, refuseCapability } from '@/lib/permission-groups/capabilities'
 import { acquirePermissionGroupOrgLock } from '@/lib/permission-groups/locks'
@@ -48,7 +56,8 @@ type ProjectAccess = Awaited<ReturnType<typeof loadProjectAccess>>
 
 /**
  * Loads the caller's org role and every environment with its grant for `records` in three
- * queries, whatever their count.
+ * queries, whatever their count. A snapshot read also learns, in one more query, which
+ * records any permission group restricts, so unrestricted ones skip per-environment policy.
  */
 async function loadProjectAccess(
   tx: DbTransaction,
@@ -106,7 +115,27 @@ async function loadProjectAccess(
     if (rows) rows.push(access)
     else environmentsByProject.set(projectId, [access])
   }
+  const organizationIds = [
+    ...new Set(records.flatMap((record) => (record.organizationId ? [record.organizationId] : []))),
+  ]
+  const restricted =
+    mode === 'snapshot' && organizationIds.length
+      ? new Set(
+          (
+            await tx.execute<{ id: string }>(sql`
+              SELECT DISTINCT denied.id FROM ${permissionGroup},
+                jsonb_array_elements_text(
+                  COALESCE(${permissionGroup.config}->'deniedPartialAccessProjectIssues', '[]'::jsonb)
+                ) AS denied(id)
+              WHERE ${inArray(permissionGroup.organizationId, organizationIds)}
+                AND denied.id = ANY(${textArrayLiteral(records.map((record) => record.id))})
+            `)
+          ).map((row) => row.id)
+        )
+      : null
   return {
+    /** Whether a permission group might restrict Issues for the Project; held reads check all. */
+    mayRestrictIssues: (projectId: string) => restricted === null || restricted.has(projectId),
     isOrgAdmin: (organizationId: string | null) =>
       organizationId !== null &&
       membership?.organizationId === organizationId &&
@@ -145,7 +174,12 @@ async function evaluateProjectAccess(
       'Organization admin or admin access to every environment is required'
     )
   let canUseIssues = !record.archivedAt && visible.length > 0
-  if (canUseIssues && visible.length < active.length && record.organizationId) {
+  if (
+    canUseIssues &&
+    visible.length < active.length &&
+    record.organizationId &&
+    access.mayRestrictIssues(record.id)
+  ) {
     for (const environment of visible) {
       const { config } = await resolveVerifiedUserAccessControlContext(
         principal.userId,
 
@@ -241,7 +241,7 @@ async function archiveWorkspaceRecordsInTransaction(
       isPublic: false,
       updatedAt: now,
     })
-    .where(and(eq(workflowMcpServer.workspaceId, workspaceId), isNull(workflowMcpServer.deletedAt)))
+    .where(eq(workflowMcpServer.workspaceId, workspaceId))
     .returning({ id: workflowMcpServer.id })
 
   await tx