@bjornpagen/bumbledb 0.1.0 → 0.3.0

package/src/query/lower.ts

@@ -1,26 +1,34 @@
 /**
- * `query()` and the IR lowering (PRD-08). A query is built inside a scope
- * callback (variable identity is lexical and typed) and is an INERT value:
- * `Query<Rels, Row, Params>` with `Row` inferred from `select` and
- * `Params` from every parameter the returned rules (and the predicates
- * they reach) use. Lowering is a pure function of the query value down to
- * the bridge's `ProgramIr` (`bumbledb/crates/bumbledb/src/ir.rs`, the
- * bijection target): relations and predicates by declaration ordinal (the
- * declaration-order-is-ids law the engine's manifest pins), variables by
- * dense per-rule first-occurrence ids (rule-scoped, exactly as the IR
- * scopes them), params by scope declaration order. Lowering is STABLE —
- * the same query value lowers to deeply-equal IR every time, and two
- * identically-written queries lower identically (prepared-query caching
- * upstream keys on this). Construction validates negation safety (typed,
- * naming the variable — earlier and warmer than the engine's refusal);
- * everything else (strata, types, aggregates rosters, rule caps) is the
- * ENGINE's judge, surfacing its typed errors at prepare. No invented
- * limits: rule counts and predicate counts are never pre-checked here.
+ * `query()` and the IR lowering, STRUCTURAL edition. A query is built
+ * kysely-shaped — `query(S).rule(r => r.match(Rel, { f: r.var("x") })
+ * .where(r.eq(r.var("x"), r.param("p"))).select("x"))` — and is an INERT
+ * value: `Query<Rels, Row, Params>` with `Row` inferred from each rule's
+ * `.select` and `Params` inferred to be EXACTLY the params the rules use
+ * (params are typed BY USE; a param value no rule uses never registers, so
+ * every query executes under its own inferred type). Vars are string
+ * names, domain-typed by the field they first bind and joined by reuse —
+ * the rule builder's environment carries name → field descriptor through
+ * the chain, checked structurally at every reuse (`JoinOk`), so the old
+ * brand-equal join is now the domain-equal compile error. Lowering is a
+ * pure function of the query value down to the bridge's `ProgramIr`
+ * (`bumbledb/crates/bumbledb/src/ir.rs`, the bijection target): relations
+ * by declaration ordinal (the declaration-order-is-ids law the engine's
+ * manifest pins), variables by dense per-rule first-occurrence ids
+ * (rule-scoped, exactly as the IR scopes them), params by first-use order
+ * across the program walk. Lowering is STABLE — the same query value
+ * lowers to deeply-equal IR every time, and two identically-written
+ * queries lower identically. Construction validates negation safety and
+ * name-boundness (typed, naming the variable — earlier and warmer than
+ * the engine's refusal); everything else (strata, types, aggregate
+ * rosters, rule caps) is the ENGINE's judge, surfacing its typed errors
+ * at prepare. No invented limits: rule and predicate counts are never
+ * pre-checked here.
  */
 
 import * as errors from "@superbuilders/errors"
-import { phantom } from "#brand.ts"
-import { assertDeclarationOrderKey, type FieldData } from "#fields.ts"
+import type { AnyField } from "#fields.ts"
+import { assertDeclarationOrderKey } from "#fields.ts"
+import type { ClassRecordOf, SchemaClasses } from "#law.ts"
 import type {
 	AtomIr,
 	ComparisonIr,
@@ -34,298 +42,1249 @@ import type {
 	TaggedValue,
 	TermIr
 } from "#native.ts"
-
 import type {
-	AnyBodyItem,
-	AnyCondition,
-	AtomSourceData,
+	AggData,
+	AnyCond,
+	AtomData,
+	BindEnv,
 	BindingEntry,
-	CmpOpData,
-	CmpTerm,
-	ComparisonItem,
-	MatchAtom
+	BindParamsShape,
+	CheckBindings,
+	CheckCond,
+	CmpData,
+	CmpKind,
+	CmpTermData,
+	CondData,
+	CondParamsShape,
+	MaskData,
+	MatchFields,
+	MatchOwner,
+	MatchShape,
+	ParamUse,
+	RecData,
+	RuleData,
+	RuleItem,
+	SelectColumn,
+	SelectEntryData,
+	TreeData
 } from "#query/atom.ts"
-
-import type {
-	ColumnValues,
-	Predicate,
-	PredicateColumnsInput,
-	PredicateData,
-	PredicateParams,
-	PredicateRuleInput,
-	PredicateSelf
-} from "#query/predicate.ts"
-import { makePredicate } from "#query/predicate.ts"
+import { allen, and, covers, eq, ge, gt, le, lt, ne, not, or, pointIn } from "#query/atom.ts"
 import type {
-	AnyTerm,
-	AnyVar,
-	ItemParams,
-	MaskParam,
-	Param,
-	ParamSet,
+	ClassedField,
+	EnvShape,
+	Flatten,
+	InferredOf,
+	JoinOk,
+	ParamEntry,
 	ParamsRecord,
-	ParamsShape,
-	QueryRegistry,
 	Var
 } from "#query/scope.ts"
-
-import { createRegistry, isTerm, scopeAllenParam, scopeParam, scopeParamSet, scopeVar, term } from "#query/scope.ts"
-import type { AggregateData, RowOf, SelectShape } from "#query/select.ts"
-import type { FieldRef } from "#relation.ts"
+import {
+	fieldJoins,
+	inferred,
+	isTerm,
+	makeDuration,
+	makeMaskParam,
+	makeParam,
+	makeSetParam,
+	makeVar,
+	makeVars,
+	renderFieldKind,
+	term
+} from "#query/scope.ts"
+import type { CheckNameSelect, CheckSelect, RowOfNameSelect, RowOfSelect, SelectEntry } from "#query/select.ts"
+import { argMax, argMin, count, countDistinct, max, min, pack, sum } from "#query/select.ts"
+import type { FieldsShape, RelationField } from "#relation.ts"
 import type { AnySchema, Schema, SchemaRelations } from "#schema.ts"
 
 /**
- * The scope value the `query()` build callback receives: variable and
- * parameter declaration plus predicate declaration (engine recursion).
+ * The matchable members of a schema's record — ordinary relations AND
+ * closed vocabularies (ψ query atoms: a closed atom is an ordinary EDB
+ * atom over the sealed extension; the ENGINE decides whether it folds to a
+ * plan-constant member set or joins the L1-resident virtual image — the
+ * SDK lowers pass-through and never knows which).
  */
-interface Scope<Rels extends SchemaRelations> {
-	/**
-	 * Declares one query variable, typed by the field it is declared from
-	 * — usable in ANY atom position whose field carries the same brand
-	 * (the nominal join discipline). Two calls are two variables.
-	 */
-	var<V>(field: FieldRef<keyof Rels & string, string, V>): Var<V>
-	/**
-	 * Declares one scalar parameter under a mandatory name literal — the
-	 * key of the typed params object `execute` takes.
-	 */
-	param<const Name extends string, V>(name: Name, field: FieldRef<keyof Rels & string, string, V>): Param<Name, V>
-	/**
-	 * Declares one set parameter (the IR's `ParamSet`): bound at execution
-	 * to a readonly array; a binding position matches on set membership.
-	 */
-	paramSet<const Name extends string, V>(name: Name, field: FieldRef<keyof Rels & string, string, V>): ParamSet<Name, V>
-	/**
-	 * Declares one Allen-mask parameter (`MaskTerm::Param`): the temporal
-	 * relation as a bind-time 13-bit mask argument.
-	 */
-	allenParam<const Name extends string>(name: Name): MaskParam<Name>
-	/**
-	 * Declares one IDB predicate with a named, field-typed head; its rules
-	 * are given in the declaration through a callback receiving the
-	 * predicate's own reference (self-recursion is `self.match({...})`).
-	 * `.match` on the returned value uses it as a body atom elsewhere.
-	 */
-	predicate<
-		const Cols extends PredicateColumnsInput,
-		const Rules extends readonly PredicateRuleInput<ColumnValues<Cols>>[]
-	>(
-		name: string,
-		columns: Cols,
-		rules: (self: PredicateSelf<ColumnValues<Cols>>) => Rules
-	): Predicate<ColumnValues<Cols>, PredicateParams<Rules>>
+type QueryRelation<Rels extends SchemaRelations> = Extract<Rels[keyof Rels], MatchOwner>
+
+/** The environment after one bindings record: the incoming env plus every var the record binds (as classed slots). */
+type EnvOfMatch<Env extends EnvShape, F extends FieldsShape, CR, B> =
+	Flatten<Env & BindEnv<F, CR, B>> extends infer E extends EnvShape ? E : never
+
+/** Reads an inferred-params carrier off a rec reference or rule value. */
+type ParamsOf<T> = InferredOf<T> extends { readonly params: infer P extends ParamsRecord } ? P : Record<never, never>
+
+/** Reads an inferred-row carrier off a rule value or query. */
+type RowOf<T> = InferredOf<T> extends { readonly row: infer R } ? R : never
+
+/**
+ * A recursive predicate's HEAD signature as classed slots (descriptor +
+ * law-computed class), position for position — carried on the rec
+ * reference so an `idb` join can be judged against it; `undefined` on
+ * values that carry no head (a plain query rule, or an unthreaded rec
+ * handle before its first rule).
+ */
+type HeadShape = readonly ClassedField[] | undefined
+
+/**
+ * One finished rule as a plain value: the runtime data plus the inferred
+ * row/params carrier (and, for a RECURSIVE rule, the head's positional
+ * field descriptors — the signature `idb` joins pair against).
+ * `.rule(...)` consumes it; hosts never build one by hand.
+ */
+interface RuleValue<Row, P extends ParamsRecord, Head extends HeadShape = undefined> {
+	readonly rule: RuleData
+	readonly [inferred]?: { readonly row: Row; readonly params: P; readonly head: Head }
+}
+
+/** Any finished rule value. */
+type AnyRuleValue = RuleValue<unknown, ParamsRecord, HeadShape>
+
+/** The positional head-field tuple of a recursive rule's names-only select. */
+type HeadFieldsOf<Env extends EnvShape, S extends readonly string[]> = {
+	readonly [I in keyof S]: Env[S[I] & keyof Env]
 }
 
+/** Reads an inferred-head carrier off a rule value or rec reference. */
+type HeadOf<T> = InferredOf<T> extends { readonly head: infer H extends readonly ClassedField[] } ? H : undefined
+
+/**
+ * A recursive predicate REFERENCE — the shape `idb()` targets carry: the
+ * name (type-level identity: a recursive rule's own `idb` accepts only its
+ * own name — the self-recursion cut), the runtime data (value identity),
+ * the params its attached rules have used so far, and the head signature
+ * its FIRST rule sealed (thread the value `.rule(...)` returns into an
+ * `idb` and the program's `Params` type stays exact AND the idb join is
+ * arity- and domain-checked against the head).
+ */
+interface RecRef<Name extends string, P extends ParamsRecord, Head extends HeadShape = HeadShape> {
+	readonly name: Name
+	readonly data: RecData
+	readonly [inferred]?: { readonly params: P; readonly head: Head }
+}
+
+/** One `idb` position's judgment: the var must be bound by a relation atom, class-equal to the head slot when the head is carried. */
+type IdbVarOk<Env extends EnvShape, T, F> =
+	T extends Var<infer N extends string>
+		? N extends keyof Env
+			? F extends ClassedField
+				? JoinOk<Env[N], F>
+				: true
+			: false
+		: false
+
 /**
- * What the build callback returns: `rules` is an array of conjunctions
- * (multiple rules = set union — answers are SETS, no order/limit exists;
- * the host sorts); `select` is the head record — non-aggregate entries are
- * the implicit group key.
+ * The validated `idb` variable tuple: every var must already be bound by a
+ * relation atom of the rule; and when the target carries its head
+ * signature (the threaded rec handle), the tuple must match the head's
+ * arity and every position must be class-equal to its head slot — the
+ * same wall `JoinOk` holds for EDB atoms. An unthreaded handle carries no
+ * head; its joins stay boundness-checked here and arity/class-judged at
+ * prepare (the engine's law stands behind both tiers).
  */
-interface QueryBuild {
-	readonly rules: readonly (readonly AnyBodyItem[])[]
-	readonly select: SelectShape
+type CheckIdbVars<Env extends EnvShape, V, Head extends HeadShape = undefined> = Head extends readonly ClassedField[]
+	? V extends readonly unknown[]
+		? V["length"] extends Head["length"]
+			? { readonly [I in keyof V]: IdbVarOk<Env, V[I], Head[I & keyof Head]> extends true ? V[I] : never }
+			: { readonly [I in keyof V]: never }
+		: never
+	: { readonly [I in keyof V]: IdbVarOk<Env, V[I], undefined> extends true ? V[I] : never }
+
+/**
+ * The term/predicate/aggregate constructor vocabulary every rule builder
+ * carries — pure value builders, environment-free: the chain's `.where`,
+ * `.match`, and `.select` seams judge their output against the rule
+ * environment.
+ */
+interface TermOps {
+	/** Declares/names one variable: typed by the field it first binds; reuse joins. */
+	readonly var: typeof makeVar
+	/** Mints several variables at once — `const { service, w } = r.vars("service", "w")`: each name typed exactly; duplicates refuse. */
+	readonly vars: typeof makeVars
+	/** Names one scalar parameter: typed by its use; the key of the execute params object. */
+	readonly param: typeof makeParam
+	/** Names one ∈-set parameter (the IR's `ParamSet`): bound to a readonly array at execution. */
+	readonly inSet: typeof makeSetParam
+	/** Names one Allen-mask parameter (`MaskTerm::Param`): a bind-time 13-bit mask number. */
+	readonly maskParam: typeof makeMaskParam
+	/** The measure of an interval-typed variable: `|[s, e)| = e − s`, u64. */
+	readonly duration: typeof makeDuration
+	readonly eq: typeof eq
+	readonly ne: typeof ne
+	readonly lt: typeof lt
+	readonly le: typeof le
+	readonly gt: typeof gt
+	readonly ge: typeof ge
+	readonly pointIn: typeof pointIn
+	readonly covers: typeof covers
+	readonly allen: typeof allen
+	readonly and: typeof and
+	readonly or: typeof or
+	readonly not: typeof not
+	readonly count: typeof count
+	readonly countDistinct: typeof countDistinct
+	readonly sum: typeof sum
+	readonly min: typeof min
+	readonly max: typeof max
+	readonly argMax: typeof argMax
+	readonly argMin: typeof argMin
+	readonly pack: typeof pack
 }
 
-/** One classified select column as runtime data. */
-type SelectEntryData =
-	| { readonly kind: "var"; readonly over: AnyVar }
-	| { readonly kind: "measure"; readonly over: AnyVar }
-	| { readonly kind: "aggregate"; readonly aggregate: AggregateData }
+/** The rule builder a `query(S).rule(...)` callback receives: the ops plus the first atom (`Classes` — the schema type's class map, the join judge's authority). */
+interface QueryRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> extends TermOps {
+	/** The first EDB atom of the rule: fields bind vars, params, ∈-sets, or bare literals; absence is the wildcard (same-named vars within the record join class-equal). */
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
+		relation: R,
+		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): QueryRuleChain<
+		Rels,
+		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		BindParamsShape<MatchFields<R>, B>,
+		Classes
+	>
+}
 
-/** One answer column: its name (the row object key) and its entry. */
-interface SelectColumn {
-	readonly name: string
-	readonly entry: SelectEntryData
+/** The chain of a plain query rule: more atoms, residual predicates, then the head. */
+interface QueryRuleChain<
+	Rels extends SchemaRelations,
+	Env extends EnvShape,
+	P extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
+> {
+	/** One more positive EDB atom — var reuse joins, class-equal by the environment check. */
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
+		relation: R,
+		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): QueryRuleChain<
+		Rels,
+		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
+		Classes
+	>
+	/** One residual predicate: a comparison, an `and`/`or` tree, or a negated atom (`r.not`). */
+	where<const C extends AnyCond>(
+		cond: CheckCond<Env, Classes, C> & C
+	): QueryRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
+	/** The head projection: var names, the measure, and aggregates; written order = answer column order. */
+	select<const S extends readonly SelectEntry[]>(...entries: CheckSelect<Env, S> & S): RuleValue<RowOfSelect<Env, S>, P>
 }
 
-/** A query's runtime description — everything lowering and execution read. */
+/** The rule builder an OUTPUT rule of a `program()` receives: a query rule plus finished-stratum `idb` atoms. */
+interface OutputRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> extends TermOps {
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
+		relation: R,
+		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): OutputRuleChain<
+		Rels,
+		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		BindParamsShape<MatchFields<R>, B>,
+		Classes
+	>
+}
+
+/** The chain of an output rule: atoms, predicates, `idb` joins over the program's recs, then the head. */
+interface OutputRuleChain<
+	Rels extends SchemaRelations,
+	Env extends EnvShape,
+	P extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
+> {
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
+		relation: R,
+		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): OutputRuleChain<
+		Rels,
+		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
+		Classes
+	>
+	where<const C extends AnyCond>(
+		cond: CheckCond<Env, Classes, C> & C
+	): OutputRuleChain<Rels, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
+	/**
+	 * One `idb` atom over a FINISHED stratum (any rec of this program): a
+	 * positional join against the rec's head. An idb atom is a join
+	 * position — every variable must already be bound by a relation atom of
+	 * the rule (the theory's own domain relation; the rec's answers are
+	 * theory values, so the join is identity). Threading the rec value the
+	 * last `.rule(...)` returned carries its rules' params into `Params`
+	 * AND its head signature, so the join is arity- and class-checked
+	 * against the head at compile time.
+	 */
+	idb<Target extends RecRef<string, ParamsRecord>, const V extends readonly Var<string>[]>(
+		target: Target,
+		...vars: CheckIdbVars<Env, V, HeadOf<Target>> & V
+	): OutputRuleChain<Rels, Env, Flatten<P & ParamsOf<Target>>, Classes>
+	select<const S extends readonly SelectEntry[]>(...entries: CheckSelect<Env, S> & S): RuleValue<RowOfSelect<Env, S>, P>
+}
+
+/** The rule builder a RECURSIVE rule (`rec.rule(...)`) receives. */
+interface RecRuleScope<Rels extends SchemaRelations, Self extends string, Classes extends SchemaClasses = SchemaClasses>
+	extends TermOps {
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
+		relation: R,
+		bindings: B & CheckBindings<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): RecRuleChain<
+		Rels,
+		Self,
+		EnvOfMatch<Record<never, never>, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		BindParamsShape<MatchFields<R>, B>,
+		Classes
+	>
+}
+
+/**
+ * The chain of a recursive rule. Its `idb` accepts ONLY the rec itself —
+ * the self-recursion cut as a type-level boundary (mutual recursion is
+ * unwritable; a finished lower stratum is folded by the OUTPUT rules) —
+ * and its `select` takes bound variable NAMES only: aggregates and the
+ * measure are unrepresentable in a recursive head (the strata judge's
+ * `AggregationThroughCycle`/`MeasureInRecursiveHead`, made unwritable).
+ */
+interface RecRuleChain<
+	Rels extends SchemaRelations,
+	Self extends string,
+	Env extends EnvShape,
+	P extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
+> {
+	match<R extends QueryRelation<Rels>, const B extends MatchShape<MatchFields<R>>>(
+		relation: R,
+		bindings: B & CheckBindings<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>
+	): RecRuleChain<
+		Rels,
+		Self,
+		EnvOfMatch<Env, MatchFields<R>, ClassRecordOf<Classes, R["name"]>, B>,
+		Flatten<P & BindParamsShape<MatchFields<R>, B>>,
+		Classes
+	>
+	where<const C extends AnyCond>(
+		cond: CheckCond<Env, Classes, C> & C
+	): RecRuleChain<Rels, Self, Env, Flatten<P & CondParamsShape<Env, C>>, Classes>
+	/** The self-recursive atom: `idb(self, ...boundVars)` — only this rec's own reference is accepted (threaded, its head arity- and class-checks the join). */
+	idb<Target extends RecRef<Self, ParamsRecord>, const V extends readonly Var<string>[]>(
+		target: Target,
+		...vars: CheckIdbVars<Env, V, HeadOf<Target>> & V
+	): RecRuleChain<Rels, Self, Env, P, Classes>
+	/** The recursive head: bound variable names only (the creation quarantine, restated for fixpoint topology); the value carries the head's classed slots for `idb` pairing. */
+	select<const S extends readonly string[]>(
+		...names: CheckNameSelect<Env, S> & S
+	): RuleValue<RowOfNameSelect<Env, S>, P, HeadFieldsOf<Env, S>>
+}
+
+/** A query's runtime description — everything lowering, the wire marshal, and answer decode read. */
 interface QueryData {
-	readonly registry: QueryRegistry
-	readonly rules: readonly (readonly AnyBodyItem[])[]
+	/** The program's recursive predicates in declaration order (empty for a plain query); `PredId` = index. */
+	readonly recs: readonly RecData[]
+	/** The output rules in written order (multiple rules = set union). */
+	readonly rules: readonly RuleData[]
+	/** The head columns (every rule derives the same head; written order = answer column order). */
 	readonly select: readonly SelectColumn[]
+	/** The registered params in first-use order across the program walk (= dense `ParamId`s). */
+	readonly params: readonly ParamEntry[]
 }
 
 /**
  * An inert query value. `Row` is the inferred answer-row object type;
- * `Params` the inferred execute-params object type. Prepare with
- * `db.prepare(q)`; nothing here touches an engine.
+ * `Params` the inferred execute-params object type — exactly the params
+ * the rules use. Prepare with `db.prepare(q)`; nothing here touches an
+ * engine.
  */
-interface Query<Rels extends SchemaRelations, Row, Params extends ParamsRecord> {
-	readonly schema: Schema<Rels>
+interface Query<
+	Rels extends SchemaRelations,
+	Row,
+	Params extends ParamsRecord,
+	Classes extends SchemaClasses = SchemaClasses
+> {
+	readonly schema: Schema<Rels, Classes>
 	readonly data: QueryData
-	readonly [phantom]?: { readonly row: Row; readonly params: Params }
+	/** One more rule — the query's answers are the SET UNION of its rules' answers; every rule derives the same head. */
+	rule<RV extends AnyRuleValue>(
+		build: (r: QueryRuleScope<Rels, Classes>) => RV
+	): Query<Rels, Row | RowOf<RV>, Flatten<Params & ParamsOf<RV>>, Classes>
+	readonly [inferred]?: { readonly row: Row; readonly params: Params }
 }
 
-/** Any query value, whatever its schema and inferred types. */
-type AnyQuery = Query<SchemaRelations, unknown, ParamsRecord>
+/**
+ * Any query value as lowering and the runtime consume it: the theory it
+ * was built against and its runtime description — every `Query` (typed or
+ * program-built) carries exactly this.
+ */
+interface AnyQuery {
+	readonly schema: AnySchema
+	readonly data: QueryData
+}
 
 /** Extracts a query value's inferred answer-row type. */
-type QueryRow<Q extends AnyQuery> = Exclude<Q[typeof phantom], undefined>["row"]
+type QueryRow<Q extends AnyQuery> = RowOf<Q>
 
 /** Extracts a query value's inferred execute-params type. */
-type QueryParams<Q extends AnyQuery> = Exclude<Q[typeof phantom], undefined>["params"]
+type QueryParams<Q extends AnyQuery> = ParamsOf<Q>
 
-/** The params object type a build result implies (union over every rule item). */
-type BuildParams<R extends QueryBuild> = ParamsShape<ItemParams<R["rules"][number][number]>>
+/** The entry value of `query(S)`: the first `.rule` mints the query. */
+interface QueryStart<Rels extends SchemaRelations, Classes extends SchemaClasses = SchemaClasses> {
+	rule<RV extends AnyRuleValue>(
+		build: (r: QueryRuleScope<Rels, Classes>) => RV
+	): Query<Rels, RowOf<RV>, ParamsOf<RV>, Classes>
+}
+
+/** The frozen constructor vocabulary every rule builder spreads. */
+const termOps: TermOps = Object.freeze({
+	var: makeVar,
+	vars: makeVars,
+	param: makeParam,
+	inSet: makeSetParam,
+	maskParam: makeMaskParam,
+	duration: makeDuration,
+	eq,
+	ne,
+	lt,
+	le,
+	gt,
+	ge,
+	pointIn,
+	covers,
+	allen,
+	and,
+	or,
+	not,
+	count,
+	countDistinct,
+	sum,
+	min,
+	max,
+	argMax,
+	argMin,
+	pack
+})
+
+/** One rule under construction: immutable — every chain step is a fresh state. */
+interface RuleBuildState {
+	readonly items: readonly RuleItem[]
+	readonly varFields: Readonly<Record<string, ClassedField>>
+	readonly paramUses: readonly ParamUse[]
+}
+
+/** The empty rule state. */
+const EMPTY_RULE: RuleBuildState = Object.freeze({
+	items: Object.freeze([]),
+	varFields: Object.freeze({}),
+	paramUses: Object.freeze([])
+})
+
+/** One resolved bindings record: the atom entries, the vars it binds (as classed slots), and the params it uses. */
+interface ResolvedBindings {
+	readonly atom: AtomData
+	readonly vars: ReadonlyArray<{ readonly name: string; readonly slot: ClassedField }>
+	readonly uses: readonly ParamUse[]
+}
 
 /**
- * Narrows an aggregate select value — a trusted seam over the surface's
- * own constructors (only `#query/select.ts` produces `aggregate`-carrying
- * values), the same direction as every other constructor-owned shape here.
+ * The ordered matchable fields of an atom owner — the runtime twin of the
+ * type tier's `MatchFields`: a relation's declared fields; a closed
+ * relation's SEALED shape, the synthetic `id` (the value's own
+ * roster-carrying descriptor, by identity) at ordinal 0 and the declared
+ * payload columns at declared index + 1 (the sealed shift, mirroring
+ * `spec.rs`'s resolver — a `ClosedColumn` is structurally a
+ * {@link RelationField}). The lowering golden pins this mapping.
  */
-function isAggregateEntry(value: object): value is { readonly aggregate: AggregateData } {
-	return "aggregate" in value
+function matchFieldsOf(owner: MatchOwner): readonly RelationField[] {
+	if ("axioms" in owner) {
+		return [Object.freeze({ name: "id", field: owner.id }), ...owner.data.columns]
+	}
+	return owner.data.fields
 }
 
-/** Narrows a `duration()` select value (only `duration` produces `measure`). */
-function isMeasureEntry(value: object): value is { readonly measure: AnyVar } {
-	return "measure" in value
+/**
+ * Resolves a bindings record against an atom owner's matchable fields (a
+ * relation's declared fields; a closed relation's sealed id + columns), in
+ * the record's written order: terms classify by their runtime tag,
+ * everything else is a bare literal (typed by the FIELD at lowering — the
+ * membership typing rule included). Every bound field carries its
+ * law-computed class, read off the schema value's frozen class map — the
+ * runtime twin of the type tier's `SlotAt` lookups.
+ */
+function resolveBindings(
+	context: string,
+	relation: MatchOwner,
+	bindings: Readonly<Record<string, unknown>>,
+	classes: SchemaClasses
+): ResolvedBindings {
+	const entries: BindingEntry[] = []
+	const vars: Array<{ readonly name: string; readonly slot: ClassedField }> = []
+	const uses: ParamUse[] = []
+	const relationClasses = classes[relation.name]
+	const ordered = matchFieldsOf(relation)
+	for (const [fieldName, value] of Object.entries(bindings)) {
+		if (value === undefined) {
+			continue
+		}
+		const declared = ordered.find(function byName(candidate) {
+			return candidate.name === fieldName
+		})
+		if (declared === undefined) {
+			throw errors.new(`${context} has no field ${fieldName}`)
+		}
+		const fieldClass = relationClasses?.[fieldName]
+		let bound: BindingEntry["term"]
+		if (isTerm(value)) {
+			switch (value[term]) {
+				case "var": {
+					bound = Object.freeze({ kind: "var" as const, name: value.name })
+					vars.push(
+						Object.freeze({ name: value.name, slot: Object.freeze({ field: declared.field, class: fieldClass }) })
+					)
+					break
+				}
+				case "param": {
+					bound = Object.freeze({ kind: "param" as const, name: value.name })
+					uses.push(
+						Object.freeze({ name: value.name, shape: "value" as const, anchor: declared.field, op: "binding" as const })
+					)
+					break
+				}
+				case "setParam": {
+					bound = Object.freeze({ kind: "setParam" as const, name: value.name })
+					uses.push(
+						Object.freeze({ name: value.name, shape: "set" as const, anchor: declared.field, op: "binding" as const })
+					)
+					break
+				}
+				case "maskParam":
+					throw errors.new(
+						`${context}.${fieldName}: an Allen-mask param is not a field-typed value — masks live in allen() conditions only`
+					)
+				case "duration":
+					throw errors.new(
+						`${context}.${fieldName}: the measure is not a field-typed value — it lives in comparisons and select entries`
+					)
+			}
+		} else {
+			bound = Object.freeze({ kind: "literal" as const, value })
+		}
+		entries.push(Object.freeze({ field: fieldName, data: declared.field, class: fieldClass, term: bound }))
+	}
+	return {
+		atom: Object.freeze({ relation, bindings: Object.freeze(entries) }),
+		vars,
+		uses
+	}
 }
 
-/** Classifies one select record value into its runtime entry. */
-function selectEntryOf(name: string, value: unknown): SelectEntryData {
-	if (isTerm(value)) {
-		if (value[term] !== "var") {
+/**
+ * Extends a rule state with one positive atom. Vars bind on first
+ * occurrence; every LATER occurrence (a later atom's field or a same-record
+ * sibling) is a join and must be class-equal — the construction-time twin
+ * of the type tier's `JoinOk` (bare pairs only with bare), so the domain
+ * wall holds for untyped callers too.
+ */
+function advanceMatch(
+	state: RuleBuildState,
+	relation: MatchOwner,
+	bindings: Readonly<Record<string, unknown>>,
+	classes: SchemaClasses
+): RuleBuildState {
+	const resolved = resolveBindings(`relation ${relation.name}`, relation, bindings, classes)
+	const varFields: Record<string, ClassedField> = { ...state.varFields }
+	for (const bound of resolved.vars) {
+		const existing = varFields[bound.name]
+		if (existing === undefined) {
+			varFields[bound.name] = bound.slot
+		} else if (!fieldJoins(existing, bound.slot)) {
 			throw errors.new(
-				`query select column ${name}: a ${value[term]} is not projectable — select takes variables, duration(v), or aggregates`
+				`relation ${relation.name}: the variable ${bound.name} joins domain-unequal fields — first bound at ${renderFieldKind(existing)}, reused at ${renderFieldKind(bound.slot)} (a var joins only class-equal slots; bare pairs only with bare)`
 			)
 		}
-		return Object.freeze({ kind: "var" as const, over: value })
 	}
-	if (typeof value === "object" && value !== null) {
-		if (isAggregateEntry(value)) {
-			return Object.freeze({ kind: "aggregate" as const, aggregate: value.aggregate })
+	return {
+		items: Object.freeze([...state.items, Object.freeze({ kind: "atom" as const, atom: resolved.atom })]),
+		varFields: Object.freeze(varFields),
+		paramUses: Object.freeze([...state.paramUses, ...resolved.uses])
+	}
+}
+
+/** Resolves one comparison side to its runtime term. */
+function cmpTermDataOf(op: string, value: unknown): CmpTermData {
+	if (isTerm(value)) {
+		switch (value[term]) {
+			case "var":
+				return Object.freeze({ kind: "var" as const, name: value.name })
+			case "param":
+				return Object.freeze({ kind: "param" as const, name: value.name })
+			case "setParam":
+				return Object.freeze({ kind: "setParam" as const, name: value.name })
+			case "duration":
+				return Object.freeze({ kind: "measure" as const, name: value.name })
+			case "maskParam":
+				throw errors.new(`${op}: an Allen-mask param is not a comparison term — masks live in allen()'s mask position`)
 		}
-		if (isMeasureEntry(value)) {
-			return Object.freeze({ kind: "measure" as const, over: value.measure })
+	}
+	return Object.freeze({ kind: "literal" as const, value })
+}
+
+/**
+ * One comparison side's contribution to the param census: a param/set side
+ * anchors to its SIBLING — a bound variable's field descriptor or the
+ * measure; an unanchorable use (literal or param sibling) records with no
+ * anchor and must be anchored by some other use of the same name.
+ */
+function sideUses(
+	op: CmpKind,
+	side: CmpTermData,
+	sibling: CmpTermData,
+	varFields: Readonly<Record<string, ClassedField>>,
+	uses: ParamUse[]
+): void {
+	if (side.kind !== "param" && side.kind !== "setParam") {
+		return
+	}
+	let anchor: AnyField | "measure" | undefined
+	if (sibling.kind === "var") {
+		anchor = varFields[sibling.name]?.field
+	} else if (sibling.kind === "measure") {
+		anchor = "measure"
+	} else {
+		anchor = undefined
+	}
+	uses.push(
+		Object.freeze({
+			name: side.name,
+			shape: side.kind === "param" ? ("value" as const) : ("set" as const),
+			anchor,
+			op
+		})
+	)
+}
+
+/** Lowers one condition VALUE to its runtime data, recording param uses. */
+function condDataOf(cond: AnyCond, varFields: Readonly<Record<string, ClassedField>>, uses: ParamUse[]): CondData {
+	if (cond.cond === "cmp") {
+		const lhs = cmpTermDataOf(cond.op, cond.lhs)
+		const rhs = cmpTermDataOf(cond.op, cond.rhs)
+		sideUses(cond.op, lhs, rhs, varFields, uses)
+		sideUses(cond.op, rhs, lhs, varFields, uses)
+		let mask: MaskData | undefined
+		if (cond.op === "allen") {
+			const maskValue = cond.mask
+			if (typeof maskValue === "number") {
+				mask = Object.freeze({ kind: "literal" as const, mask: maskValue })
+			} else if (isTerm(maskValue) && maskValue[term] === "maskParam") {
+				mask = Object.freeze({ kind: "param" as const, name: maskValue.name })
+				uses.push(
+					Object.freeze({ name: maskValue.name, shape: "mask" as const, anchor: undefined, op: "allen" as const })
+				)
+			} else {
+				throw errors.new("allen: the mask position takes a 13-bit mask number or a maskParam")
+			}
 		}
+		const data: CmpData = Object.freeze({ kind: "cmp" as const, op: cond.op, mask, lhs, rhs })
+		return data
+	}
+	if (cond.cond === "tree") {
+		const children = cond.children.map(function lowerChild(child) {
+			return condDataOf(child, varFields, uses)
+		})
+		const data: TreeData = Object.freeze({ kind: "tree" as const, op: cond.op, children: Object.freeze(children) })
+		return data
 	}
 	throw errors.new(
-		`query select column ${name}: not a select entry — select takes variables, duration(v), or aggregates`
+		"a negated atom is not a condition-tree node — pass not(...) to where() directly, never inside and()/or()"
 	)
 }
 
-/** Renders an atom source's name for construction diagnostics. */
-function sourceName(source: AtomSourceData): string {
-	if (source.kind === "relation") {
-		return source.relation.name
+/** Extends a rule state with one `.where` item (a condition or a negated atom). */
+function advanceWhere(state: RuleBuildState, cond: AnyCond, classes: SchemaClasses): RuleBuildState {
+	if (typeof cond !== "object" || cond === null || !("cond" in cond)) {
+		throw errors.new("where() takes a comparison, an and()/or() tree, or a negated atom")
+	}
+	if (cond.cond === "not") {
+		const relation: MatchOwner = cond.relation
+		const bindings: Readonly<Record<string, unknown>> = Object.fromEntries(
+			Object.entries(cond.bindings ?? {}).filter(function defined([, value]) {
+				return value !== undefined
+			})
+		)
+		const resolved = resolveBindings(`negated relation ${relation.name}`, relation, bindings, classes)
+		return {
+			items: Object.freeze([...state.items, Object.freeze({ kind: "negated" as const, atom: resolved.atom })]),
+			varFields: state.varFields,
+			paramUses: Object.freeze([...state.paramUses, ...resolved.uses])
+		}
+	}
+	const uses: ParamUse[] = []
+	const data = condDataOf(cond, state.varFields, uses)
+	return {
+		items: Object.freeze([...state.items, Object.freeze({ kind: "cond" as const, cond: data })]),
+		varFields: state.varFields,
+		paramUses: Object.freeze([...state.paramUses, ...uses])
+	}
+}
+
+/** Extends a rule state with one `idb` atom (vars must be bound — validated at completion). */
+function advanceIdb(state: RuleBuildState, rec: RecData, vars: readonly Var<string>[]): RuleBuildState {
+	const names = vars.map(function nameOf(variable) {
+		if (!isTerm(variable) || variable[term] !== "var") {
+			throw errors.new(`idb ${rec.name}: positions take variables — bind literals and params through where()/match()`)
+		}
+		return variable.name
+	})
+	return {
+		items: Object.freeze([...state.items, Object.freeze({ kind: "idb" as const, rec, vars: Object.freeze(names) })]),
+		varFields: state.varFields,
+		paramUses: state.paramUses
 	}
-	return `predicate ${source.pred.name}`
 }
 
-/** Collects every variable a rule's positive atoms bind. */
-function positiveVarsOf(body: readonly AnyBodyItem[]): Set<AnyVar> {
-	const positive = new Set<AnyVar>()
-	for (const item of body) {
-		if (item.item !== "atom" || item.negated) {
-			continue
+/** Narrows a select entry to an aggregate value. */
+function isAggregateEntry(
+	value: unknown
+): value is { readonly agg: string; readonly over: unknown; readonly key: unknown } {
+	return typeof value === "object" && value !== null && "agg" in value
+}
+
+/** Classifies one select entry into its named answer column. */
+function selectColumnOf(entry: unknown): SelectColumn {
+	if (typeof entry === "string") {
+		return Object.freeze({ name: entry, entry: Object.freeze({ kind: "var" as const, over: entry }) })
+	}
+	if (isTerm(entry)) {
+		if (entry[term] === "duration") {
+			return Object.freeze({ name: entry.name, entry: Object.freeze({ kind: "measure" as const, over: entry.name }) })
+		}
+		throw errors.new(
+			`query select: a ${entry[term]} is not projectable — select takes variable names, duration(v), or aggregates`
+		)
+	}
+	if (isAggregateEntry(entry)) {
+		return aggregateColumnOf(entry)
+	}
+	throw errors.new("query select: not a select entry — select takes variable names, duration(v), or aggregates")
+}
+
+/** Classifies one aggregate select entry. */
+function aggregateColumnOf(entry: {
+	readonly agg: string
+	readonly over: unknown
+	readonly key: unknown
+}): SelectColumn {
+	function column(name: string, agg: AggData): SelectColumn {
+		return Object.freeze({ name, entry: Object.freeze({ kind: "aggregate" as const, agg: Object.freeze(agg) }) })
+	}
+	const over = entry.over
+	switch (entry.agg) {
+		case "count":
+			return column("count", { op: "count" })
+		case "countDistinct": {
+			if (typeof over !== "string") {
+				throw errors.new("countDistinct takes a variable name")
+			}
+			return column(over, { op: "countDistinct", over })
+		}
+		case "sum":
+		case "min":
+		case "max": {
+			if (typeof over === "string") {
+				return column(over, { op: "fold", fold: entry.agg, over })
+			}
+			if (isTerm(over) && over[term] === "duration") {
+				return column(over.name, { op: "fold", fold: entry.agg, over: Object.freeze({ duration: over.name }) })
+			}
+			throw errors.new(`${entry.agg} takes a variable name or duration(v)`)
+		}
+		case "argMax":
+		case "argMin": {
+			if (typeof over !== "string" || typeof entry.key !== "string") {
+				throw errors.new(`${entry.agg} takes a carried variable name and an orderable key variable name`)
+			}
+			return column(over, { op: "arg", direction: entry.agg, over, key: entry.key })
 		}
-		for (const binding of item.bindings) {
-			if (binding.term.kind === "term" && binding.term.value[term] === "var") {
-				positive.add(binding.term.value)
+		case "pack": {
+			if (typeof over !== "string") {
+				throw errors.new("pack takes a variable name")
 			}
+			return column(over, { op: "pack", over })
 		}
+		default:
+			throw errors.new(`unknown aggregate ${entry.agg}`)
 	}
-	return positive
 }
 
-/** Judges one negated atom against the rule's positively-bound variables. */
-function assertNegatedAtomSafe(context: string, positive: ReadonlySet<AnyVar>, atom: MatchAtom<ParamsRecord>): void {
-	for (const binding of atom.bindings) {
-		if (binding.term.kind === "oneOf") {
-			throw errors.new(
-				`${context}: negated ${sourceName(atom.source)} atom binds ${binding.field} with oneOf(...) — its lowering mints a variable no positive atom binds (the safety rule); write one negated atom per literal, or bind a paramSet`
-			)
+/** Requires a var name to be bound by a relation atom of the rule. */
+function assertBound(context: string, varFields: Readonly<Record<string, ClassedField>>, name: string): ClassedField {
+	const slot = varFields[name]
+	if (slot === undefined) {
+		throw errors.new(`${context}: the variable ${name} is not bound by a relation atom of the rule`)
+	}
+	return slot
+}
+
+/** Requires a var name to be bound at an interval field (the measure's and pack's domain). */
+function assertIntervalBound(context: string, varFields: Readonly<Record<string, ClassedField>>, name: string): void {
+	const slot = assertBound(context, varFields, name)
+	if (slot.field.kind !== "interval") {
+		throw errors.new(
+			`${context}: ${name} is not interval-typed — the measure is defined over interval-typed variables only`
+		)
+	}
+}
+
+/**
+ * Validates one condition's variable references against the rule's bound
+ * names — and, for `eq`/`ne` over two variables, holds the class wall: the
+ * unification IS a join, so the two slots must be class-equal exactly as a
+ * match-reuse join must be (the construction-time twin of the type tier's
+ * `EqOk` → `JoinOk`; bare pairs only with bare). The engine cannot backstop
+ * this one — the query IR carries no domains — so the wall lives here for
+ * untyped callers too.
+ */
+function validateCond(context: string, varFields: Readonly<Record<string, ClassedField>>, cond: CondData): void {
+	if (cond.kind === "cmp") {
+		for (const side of [cond.lhs, cond.rhs]) {
+			if (side.kind === "var") {
+				assertBound(context, varFields, side.name)
+			}
+			if (side.kind === "measure") {
+				assertIntervalBound(context, varFields, side.name)
+			}
 		}
-		if (binding.term.kind !== "term" || binding.term.value[term] !== "var") {
-			continue
+		if ((cond.op === "eq" || cond.op === "ne") && cond.lhs.kind === "var" && cond.rhs.kind === "var") {
+			const lhs = assertBound(context, varFields, cond.lhs.name)
+			const rhs = assertBound(context, varFields, cond.rhs.name)
+			if (!fieldJoins(lhs, rhs)) {
+				throw errors.new(
+					`${context}: ${cond.op}(${cond.lhs.name}, ${cond.rhs.name}) unifies domain-unequal fields — ${cond.lhs.name} bound at ${renderFieldKind(lhs)}, ${cond.rhs.name} at ${renderFieldKind(rhs)} (a var joins only class-equal slots; bare pairs only with bare)`
+				)
+			}
 		}
-		const variable = binding.term.value
-		if (!positive.has(variable)) {
-			throw errors.new(
-				`${context}: negated ${sourceName(atom.source)} atom binds the variable declared from ${variable.relation}.${variable.field} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`
-			)
+		return
+	}
+	for (const child of cond.children) {
+		validateCond(context, varFields, child)
+	}
+}
+
+/** Validates one select column's variable references. */
+function validateColumn(
+	context: string,
+	varFields: Readonly<Record<string, ClassedField>>,
+	column: SelectColumn
+): void {
+	const entry = column.entry
+	if (entry.kind === "var") {
+		assertBound(`${context} select ${column.name}`, varFields, entry.over)
+		return
+	}
+	if (entry.kind === "measure") {
+		assertIntervalBound(`${context} select ${column.name}`, varFields, entry.over)
+		return
+	}
+	const agg = entry.agg
+	switch (agg.op) {
+		case "count":
+			return
+		case "countDistinct":
+			assertBound(`${context} select ${column.name}`, varFields, agg.over)
+			return
+		case "fold": {
+			if (typeof agg.over === "string") {
+				assertBound(`${context} select ${column.name}`, varFields, agg.over)
+				return
+			}
+			assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over.duration)
+			return
 		}
+		case "arg":
+			assertBound(`${context} select ${column.name}`, varFields, agg.over)
+			assertBound(`${context} select ${column.name}`, varFields, agg.key)
+			return
+		case "pack":
+			assertIntervalBound(`${context} select ${column.name}`, varFields, agg.over)
+			return
 	}
 }
 
 /**
- * The negation safety rule, judged at construction (earlier and warmer
- * than the engine's refusal, which also stands): every variable a negated
- * atom uses must be bound by a positive atom of the same rule — a negated
- * atom binds nothing, only rejects.
+ * Completes one rule: classifies the select record (written order = answer
+ * column order, names must be declaration-order-safe keys), and validates
+ * boundness — every condition/select/idb variable bound by a relation atom,
+ * and every NEGATED atom's variable positively bound (the safety rule: a
+ * negated atom binds nothing, only rejects).
  */
-function assertNegationSafety(context: string, body: readonly AnyBodyItem[]): void {
-	const positive = positiveVarsOf(body)
-	for (const item of body) {
-		if (item.item === "atom" && item.negated) {
-			assertNegatedAtomSafe(context, positive, item)
+function completeRule(context: string, state: RuleBuildState, columns: readonly SelectColumn[]): RuleData {
+	if (columns.length === 0) {
+		throw errors.new(`${context}: a select needs at least one entry`)
+	}
+	const seen = new Set<string>()
+	for (const column of columns) {
+		assertDeclarationOrderKey(`${context} select column`, column.name)
+		if (seen.has(column.name)) {
+			throw errors.new(`${context}: select names the answer column ${column.name} twice`)
 		}
+		seen.add(column.name)
+		validateColumn(context, state.varFields, column)
 	}
+	for (const item of state.items) {
+		if (item.kind === "negated") {
+			for (const binding of item.atom.bindings) {
+				if (binding.term.kind === "var") {
+					const bound = state.varFields[binding.term.name]
+					if (bound === undefined) {
+						throw errors.new(
+							`${context}: negated ${item.atom.relation.name} atom binds the variable ${binding.term.name} at position ${binding.field}, but no positive atom of the rule binds it — a negated atom binds nothing, only rejects (the safety rule)`
+						)
+					}
+					const negatedSlot: ClassedField = { field: binding.data, class: binding.class }
+					if (!fieldJoins(bound, negatedSlot)) {
+						throw errors.new(
+							`${context}: negated ${item.atom.relation.name} atom reuses the variable ${binding.term.name} at ${binding.field} (${renderFieldKind(negatedSlot)}), but the rule binds it at ${renderFieldKind(bound)} — a var joins only class-equal slots; bare pairs only with bare`
+						)
+					}
+				}
+			}
+		}
+		if (item.kind === "idb") {
+			const head = item.rec.rules[0]
+			item.vars.forEach(function checkIdbVar(name, position) {
+				const bound = state.varFields[name]
+				if (bound === undefined) {
+					throw errors.new(
+						`${context}: idb ${item.rec.name} names the variable ${name}, but no relation atom of the rule binds it — an idb atom is a join position; bind the variable through the theory's own relation first`
+					)
+				}
+				const column = head?.select[position]
+				if (column === undefined || column.entry.kind !== "var") {
+					return
+				}
+				const headSlot = head?.varFields[column.entry.over]
+				if (headSlot !== undefined && !fieldJoins(headSlot, bound)) {
+					throw errors.new(
+						`${context}: idb ${item.rec.name} joins the variable ${name} (${renderFieldKind(bound)}) at head position ${position} (${column.name}: ${renderFieldKind(headSlot)}) — a var joins only class-equal slots; bare pairs only with bare`
+					)
+				}
+			})
+		}
+		if (item.kind === "cond") {
+			validateCond(context, state.varFields, item.cond)
+		}
+	}
+	return Object.freeze({
+		items: state.items,
+		select: Object.freeze([...columns]),
+		varFields: state.varFields,
+		paramUses: state.paramUses
+	})
+}
+
+/** Builds one typed rule value over completed rule data. */
+function makeRuleValue<Row, P extends ParamsRecord>(rule: RuleData): RuleValue<Row, P> {
+	return Object.freeze({ rule })
 }
 
 /**
- * Builds a query as a typed value: runs `build` inside a fresh scope,
- * classifies the select record (written order = answer column order),
- * validates negation safety across every rule (the predicates' rules
- * included), and freezes. Rule counts, strata legality, and every deeper
- * roster stay the engine's judge at prepare.
+ * The one runtime chain every context shares — non-generic on purpose: the
+ * typed chain interfaces (`QueryRuleChain`/`OutputRuleChain`/`RecRuleChain`)
+ * apply at the scope factories' boundaries, and the runtime beneath them is
+ * one plain value walk. Context gates the two context-bound verbs: `idb`
+ * (a program construct — self-only inside a rec, any rec of the program in
+ * the output, refused in a plain query) and the recursive `select`
+ * (bound variable names only — the creation quarantine).
  */
-function query<Rels extends SchemaRelations, const R extends QueryBuild>(
-	theory: Schema<Rels>,
-	build: ($: Scope<Rels>) => R
-): Query<Rels, RowOf<R["select"]>, BuildParams<R>> {
-	const registry = createRegistry(theory)
-	const scope: Scope<Rels> = Object.freeze({
-		var<V>(field: FieldRef<keyof Rels & string, string, V>): Var<V> {
-			return scopeVar(registry, field)
-		},
-		param<const Name extends string, V>(name: Name, field: FieldRef<keyof Rels & string, string, V>): Param<Name, V> {
-			return scopeParam(registry, name, field)
+interface RawChain {
+	match(relation: MatchOwner, bindings: Readonly<Record<string, unknown>>): RawChain
+	where(cond: AnyCond): RawChain
+	idb(target: RecRef<string, ParamsRecord>, ...vars: readonly Var<string>[]): RawChain
+	select(...entries: readonly SelectEntry[]): RuleValue<never, never>
+}
+
+/** The runtime rule-builder shape beneath every typed scope. */
+interface RawScope extends TermOps {
+	match(relation: MatchOwner, bindings: Readonly<Record<string, unknown>>): RawChain
+}
+
+/** Which rule family a chain builds — gates `idb` and the recursive select — plus the schema's runtime class map (the join judge's authority). */
+type ChainContext = { readonly classes: SchemaClasses } & (
+	| { readonly kind: "query" }
+	| { readonly kind: "rec"; readonly self: RecData }
+	| { readonly kind: "output"; readonly program: ProgramState }
+)
+
+/** The diagnostic label of a chain context. */
+function contextLabel(context: ChainContext): string {
+	switch (context.kind) {
+		case "query":
+			return "query rule"
+		case "rec":
+			return `rec ${context.self.name} rule`
+		case "output":
+			return "program output rule"
+	}
+}
+
+/** Validates and records one `idb` atom per the context's cut. */
+function idbAdvance(
+	context: ChainContext,
+	state: RuleBuildState,
+	target: RecRef<string, ParamsRecord>,
+	vars: readonly Var<string>[]
+): RuleBuildState {
+	if (context.kind === "query") {
+		throw errors.new("idb is a program construct — declare recs and outputs through program(), never a plain query()")
+	}
+	if (context.kind === "rec") {
+		if (target.data !== context.self) {
+			throw errors.new(
+				`rec ${context.self.name}: a recursive rule's idb target must be the rec itself — the self-recursion-only cut (mutual recursion is unwritable; fold a finished stratum in the output rules)`
+			)
+		}
+		return advanceIdb(state, context.self, vars)
+	}
+	if (!context.program.recs.includes(target.data)) {
+		throw errors.new(
+			`idb ${target.name}: the rec was declared by a different program — rec identity is the membership rule`
+		)
+	}
+	return advanceIdb(state, target.data, vars)
+}
+
+/** Classifies one select tuple per the context (a recursive head projects bound NAMES only). */
+function selectColumns(context: ChainContext, entries: readonly SelectEntry[]): SelectColumn[] {
+	return entries.map(function columnOf(entry): SelectColumn {
+		if (context.kind === "rec" && typeof entry !== "string") {
+			throw errors.new(
+				`rec ${context.self.name}: a recursive head projects bound variable NAMES only — aggregates and the measure read finished sets (the strata judge's quarantine, unwritable here)`
+			)
+		}
+		return selectColumnOf(entry)
+	})
+}
+
+/** Builds one runtime chain (immutably — every step is a fresh chain over fresh state). */
+function makeRawChain(context: ChainContext, state: RuleBuildState): RawChain {
+	const chain: RawChain = {
+		match(relation, bindings) {
+			return makeRawChain(context, advanceMatch(state, relation, bindings, context.classes))
 		},
-		paramSet<const Name extends string, V>(
-			name: Name,
-			field: FieldRef<keyof Rels & string, string, V>
-		): ParamSet<Name, V> {
-			return scopeParamSet(registry, name, field)
+		where(cond) {
+			return makeRawChain(context, advanceWhere(state, cond, context.classes))
 		},
-		allenParam<const Name extends string>(name: Name): MaskParam<Name> {
-			return scopeAllenParam(registry, name)
+		idb(target, ...vars) {
+			return makeRawChain(context, idbAdvance(context, state, target, vars))
 		},
-		predicate<
-			const Cols extends PredicateColumnsInput,
-			const Rules extends readonly PredicateRuleInput<ColumnValues<Cols>>[]
-		>(
-			name: string,
-			columns: Cols,
-			rules: (self: PredicateSelf<ColumnValues<Cols>>) => Rules
-		): Predicate<ColumnValues<Cols>, PredicateParams<Rules>> {
-			return makePredicate(registry, name, columns, rules)
+		select(...entries) {
+			return makeRuleValue<never, never>(completeRule(contextLabel(context), state, selectColumns(context, entries)))
 		}
-	})
-	const built = build(scope)
-	const select: SelectColumn[] = []
-	for (const [name, value] of Object.entries(built.select)) {
-		assertDeclarationOrderKey("query select column", name)
-		select.push(Object.freeze({ name, entry: selectEntryOf(name, value) }))
-	}
-	for (const pred of registry.predicates) {
-		pred.rules.forEach(function validateRule(rule, index) {
-			assertNegationSafety(`query construction (predicate ${pred.name}, rule ${index})`, rule.body)
+	}
+	Object.freeze(chain)
+	return chain
+}
+
+/** Builds one runtime rule-builder over a context. */
+function makeRawScope(context: ChainContext): RawScope {
+	const scope: RawScope = {
+		...termOps,
+		match(relation, bindings) {
+			return makeRawChain(context, advanceMatch(EMPTY_RULE, relation, bindings, context.classes))
+		}
+	}
+	Object.freeze(scope)
+	return scope
+}
+
+/**
+ * The one trusted admission seam of the rule builders (the `relation()`
+ * `refsComplete` pattern): the raw builder is one runtime shape for every
+ * context, and this guard verifies the checkable fact — the builder verbs
+ * exist — before the value is admitted at its TYPED face. The type-level
+ * judgments (domain-equal joins, boundness, the recursion cut) live in the
+ * interfaces themselves; the runtime twin of every one of them is a
+ * construction-time validation in this module.
+ */
+function isTypedScope<S>(scope: RawScope): scope is RawScope & S {
+	return typeof scope.match === "function"
+}
+
+/** Builds one query-rule builder (the typed face of the raw builder). */
+function makeQueryRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses>(
+	classes: SchemaClasses
+): QueryRuleScope<Rels, Classes> {
+	const raw = makeRawScope({ kind: "query", classes })
+	if (!isTypedScope<QueryRuleScope<Rels, Classes>>(raw)) {
+		throw errors.new("query rule builder construction incomplete")
+	}
+	return raw
+}
+
+/** Builds one output-rule builder over a program's recs. */
+function makeOutputRuleScope<Rels extends SchemaRelations, Classes extends SchemaClasses>(
+	program: ProgramState
+): OutputRuleScope<Rels, Classes> {
+	const raw = makeRawScope({ kind: "output", program, classes: program.classes })
+	if (!isTypedScope<OutputRuleScope<Rels, Classes>>(raw)) {
+		throw errors.new("program output rule builder construction incomplete")
+	}
+	return raw
+}
+
+/** One program's build-time registry: its recs in declaration order (sealed when the output is declared) and the theory's class map. */
+interface ProgramState {
+	readonly recs: RecData[]
+	readonly classes: SchemaClasses
+	sealed: boolean
+}
+
+/** Renders one head column's signature for the rule-alignment check. */
+function headSignature(column: SelectColumn): string {
+	const entry = column.entry
+	if (entry.kind === "var" || entry.kind === "measure") {
+		return `${column.name}:var`
+	}
+	const agg = entry.agg
+	if (agg.op === "fold") {
+		return `${column.name}:${agg.fold}`
+	}
+	if (agg.op === "arg") {
+		return `${column.name}:${agg.direction}`
+	}
+	return `${column.name}:${agg.op}`
+}
+
+/**
+ * Folds every rule's param uses (recs in declaration order first, output
+ * rules last — exactly the lowering walk) into the query's registry:
+ * first use mints the dense `ParamId`, the first FIELD-ANCHORED use types
+ * the wire, and one name must keep one shape.
+ */
+function paramRegistryOf(recs: readonly RecData[], rules: readonly RuleData[]): readonly ParamEntry[] {
+	const order: string[] = []
+	const byName = new Map<string, { shape: ParamEntry["shape"]; anchor: ParamEntry["anchor"]; op: ParamEntry["op"] }>()
+	function fold(uses: readonly ParamUse[]): void {
+		for (const use of uses) {
+			const existing = byName.get(use.name)
+			if (existing === undefined) {
+				order.push(use.name)
+				byName.set(use.name, { shape: use.shape, anchor: use.anchor, op: use.op })
+				continue
+			}
+			if (existing.shape !== use.shape) {
+				throw errors.new(
+					`query param ${use.name} is used both as a ${existing.shape} param and a ${use.shape} param — one name, one shape`
+				)
+			}
+			if (existing.anchor === undefined && use.anchor !== undefined) {
+				existing.anchor = use.anchor
+				existing.op = use.op
+			}
+		}
+	}
+	for (const rec of recs) {
+		for (const rule of rec.rules) {
+			fold(rule.paramUses)
+		}
+	}
+	for (const rule of rules) {
+		fold(rule.paramUses)
+	}
+	return Object.freeze(
+		order.map(function entryOf(name): ParamEntry {
+			const entry = byName.get(name)
+			if (entry === undefined) {
+				throw errors.new(`query param ${name} lost its registry entry`)
+			}
+			return Object.freeze({ name, shape: entry.shape, anchor: entry.anchor, op: entry.op })
 		})
+	)
+}
+
+/** The runtime query shape beneath the typed `Query` face. */
+interface RawQuery {
+	readonly schema: AnySchema
+	readonly data: QueryData
+	rule(build: (r: RawScope) => RuleValue<never, never>): RawQuery
+}
+
+/**
+ * Assembles the runtime query value over completed rules: every rule must
+ * derive the SAME head (name and aggregate shape, position for position —
+ * the decode labels and the engine's alignment rule agree by
+ * construction), and the param registry folds in program-walk order.
+ */
+function makeRawQuery(theory: AnySchema, recs: readonly RecData[], rules: readonly RuleData[]): RawQuery {
+	const first = rules[0]
+	if (first === undefined) {
+		throw errors.new("a query needs at least one rule")
 	}
-	const rules = built.rules.map(function freezeRule(rule, index) {
-		assertNegationSafety(`query construction (rule ${index})`, rule)
-		return Object.freeze([...rule])
+	const signature = first.select.map(headSignature).join(", ")
+	rules.forEach(function verifyHead(rule, index) {
+		const candidate = rule.select.map(headSignature).join(", ")
+		if (candidate !== signature) {
+			throw errors.new(
+				`every rule of a query derives the same head — rule 0 selects (${signature}), rule ${index} selects (${candidate})`
+			)
+		}
 	})
-	Object.freeze(registry.params)
-	Object.freeze(registry.predicates)
-	Object.freeze(registry)
-	return Object.freeze({
-		schema: theory,
-		data: Object.freeze({ registry, rules: Object.freeze(rules), select: Object.freeze(select) })
+	const data: QueryData = Object.freeze({
+		recs: Object.freeze([...recs]),
+		rules: Object.freeze([...rules]),
+		select: first.select,
+		params: paramRegistryOf(recs, rules)
 	})
+	const value: RawQuery = {
+		schema: theory,
+		data,
+		rule(build) {
+			const built = build(makeRawScope({ kind: "query", classes: theory.classes }))
+			return makeRawQuery(theory, recs, [...rules, built.rule])
+		}
+	}
+	Object.freeze(value)
+	return value
+}
+
+/**
+ * The query values' trusted admission seam (the `refsComplete` pattern):
+ * the checkable fact — the value was assembled over the identical theory —
+ * is verified before the raw value is admitted at its typed face.
+ */
+function isQueryValue<Rels extends SchemaRelations, Row, P extends ParamsRecord, Classes extends SchemaClasses>(
+	theory: Schema<Rels, Classes>,
+	value: RawQuery
+): value is RawQuery & Query<Rels, Row, P, Classes> {
+	return value.schema === theory
+}
+
+/** Assembles one typed query value (rules already completed). */
+function makeQuery<Rels extends SchemaRelations, Row, P extends ParamsRecord, Classes extends SchemaClasses>(
+	theory: Schema<Rels, Classes>,
+	recs: readonly RecData[],
+	rules: readonly RuleData[]
+): Query<Rels, Row, P, Classes> {
+	const raw = makeRawQuery(theory, recs, rules)
+	if (!isQueryValue<Rels, Row, P, Classes>(theory, raw)) {
+		throw errors.new("query value construction incomplete")
+	}
+	return raw
+}
+
+/**
+ * Opens a query over a schema: `query(S).rule(r => ...)`. Each `.rule`
+ * adds one conjunctive rule; multiple rules are the set union (answers are
+ * SETS — no order or limit exists anywhere; hosts sort). The schema's
+ * law-computed class map rides into every rule builder — the join walls
+ * compare class names off it, at the type level and at construction alike.
+ */
+function query<Rels extends SchemaRelations, Classes extends SchemaClasses>(
+	theory: Schema<Rels, Classes>
+): QueryStart<Rels, Classes> {
+	const start: QueryStart<Rels, Classes> = {
+		rule<RV extends AnyRuleValue>(
+			build: (r: QueryRuleScope<Rels, Classes>) => RV
+		): Query<Rels, RowOf<RV>, ParamsOf<RV>, Classes> {
+			const built = build(makeQueryRuleScope<Rels, Classes>(theory.classes))
+			return makeQuery<Rels, RowOf<RV>, ParamsOf<RV>, Classes>(theory, [], [built.rule])
+		}
+	}
+	Object.freeze(start)
+	return start
 }
 
 /** The typed shape refusal of the literal tagger — a genuine failure, never data. */
@@ -345,20 +1304,62 @@ function isIntervalShaped(value: unknown): value is { readonly start: bigint; re
 	)
 }
 
+/**
+ * Tags one closed-reference literal: the bare handle id, verified against
+ * the roster (the belt the type level cannot provide — structural values
+ * make any bigint spellable here) and tagged u64 — queries cross ids,
+ * never handle names.
+ */
+function taggedHandleId(
+	context: string,
+	closed: { readonly name: string; readonly handles: readonly string[] },
+	value: unknown
+): TaggedValue {
+	if (typeof value !== "bigint") {
+		throw literalShapeError(context, `a ${closed.name} handle id (bigint)`, value)
+	}
+	if (closed.handles[Number(value)] === undefined) {
+		throw errors.new(
+			`${context}: closed relation ${closed.name} has no handle with id ${value} (roster holds ${closed.handles.length})`
+		)
+	}
+	return { kind: "u64", value }
+}
+
+/**
+ * Tags one literal in an interval element domain: a bigint tags as the
+ * element (the membership typing rule's point side), an interval-shaped
+ * value as the interval (value equality).
+ */
+function taggedAtElementDomain(context: string, element: "u64" | "i64", value: unknown): TaggedValue {
+	if (typeof value === "bigint") {
+		if (element === "u64") {
+			return { kind: "u64", value }
+		}
+		return { kind: "i64", value }
+	}
+	if (isIntervalShaped(value)) {
+		if (element === "u64") {
+			return { kind: "intervalU64", start: value.start, end: value.end }
+		}
+		return { kind: "intervalI64", start: value.start, end: value.end }
+	}
+	throw literalShapeError(context, "bigint (point) or { start, end } (interval)", value)
+}
+
 /**
  * Tags one host literal at a FIELD position (atom bindings): the field's
- * structural type directs the tag, never a guess. At an interval field a
+ * structural kind directs the tag, never a guess. At an interval field a
  * bigint literal tags as the ELEMENT type — the IR's membership typing
  * rule (point membership), an interval-shaped literal as the interval
- * (value equality). A closed-reference literal is its branded id, tagged
- * u64 after a roster re-verification (queries cross ids, never handle
- * names).
+ * (value equality). A closed-reference literal is its bare handle id,
+ * tagged u64 after a roster verification.
  */
-function taggedLiteral(context: string, field: FieldData, value: unknown): TaggedValue {
-	if (field.closed !== undefined) {
+function taggedLiteral(context: string, field: AnyField, value: unknown): TaggedValue {
+	if ("closed" in field) {
 		return taggedHandleId(context, field.closed, value)
 	}
-	switch (field.type.kind) {
+	switch (field.kind) {
 		case "bool": {
 			if (typeof value !== "boolean") {
 				throw literalShapeError(context, "boolean", value)
@@ -377,79 +1378,41 @@ function taggedLiteral(context: string, field: FieldData, value: unknown): Tagge
 			}
 			return { kind: "i64", value }
 		}
-		case "string": {
+		case "str": {
 			if (typeof value !== "string") {
 				throw literalShapeError(context, "string", value)
 			}
 			return { kind: "string", value }
 		}
-		case "fixedBytes": {
+		case "bytes": {
 			if (!(value instanceof Uint8Array)) {
 				throw literalShapeError(context, "Uint8Array", value)
 			}
 			return { kind: "fixedBytes", value }
 		}
 		case "interval":
-			return taggedAtElementDomain(context, field.type.element, value)
-	}
-}
-
-/**
- * Tags one closed-reference literal: the branded id, re-verified against
- * the roster (the belt the type level cannot provide against forged
- * brands) and tagged u64 — queries cross ids, never handle names.
- */
-function taggedHandleId(context: string, closed: NonNullable<FieldData["closed"]>, value: unknown): TaggedValue {
-	if (typeof value !== "bigint") {
-		throw literalShapeError(context, `a ${closed.name} handle id (bigint)`, value)
-	}
-	if (closed.handles[Number(value)] === undefined) {
-		throw errors.new(
-			`${context}: closed relation ${closed.name} has no handle with id ${value} (roster holds ${closed.handles.length})`
-		)
-	}
-	return { kind: "u64", value }
-}
-
-/**
- * Tags one literal in an interval element domain: a bigint tags as the
- * element (the membership typing rule's point side), an interval-shaped
- * value as the interval (value equality).
- */
-function taggedAtElementDomain(context: string, element: "u64" | "i64", value: unknown): TaggedValue {
-	if (typeof value === "bigint") {
-		if (element === "u64") {
-			return { kind: "u64", value }
-		}
-		return { kind: "i64", value }
-	}
-	if (isIntervalShaped(value)) {
-		if (element === "u64") {
-			return { kind: "intervalU64", start: value.start, end: value.end }
-		}
-		return { kind: "intervalI64", start: value.start, end: value.end }
+			return taggedAtElementDomain(context, field.element, value)
 	}
-	throw literalShapeError(context, "bigint (point) or { start, end } (interval)", value)
 }
 
 /**
- * Tags one host literal at a COMPARISON position, where no field position
- * directs the type: the sibling term's element domain does — a measure
- * sibling is u64, an interval-field sibling contributes its element type
- * (so both a point literal in `covers` and a `span` literal in `allen`
- * tag correctly), a scalar sibling its own type. At `pointIn` the operand
- * order is interval-left, point-right (`ir::CmpOp::PointIn`), so an
- * interval-shaped literal beside a scalar element-typed sibling is the
- * LEGAL lhs of `covers(span(...), t)` and tags as the interval of the
- * sibling's element domain; under every other operator an interval shape
- * against a scalar sibling stays refused (the engine's IllegalComparison
- * — eq/lt interval-vs-scalar is not a comparison).
+ * Tags one host literal at a COMPARISON or PARAM position, where the
+ * SIBLING anchors the type: a measure sibling is u64, an interval-field
+ * sibling contributes its element domain (so both a point literal in
+ * `covers` and a `span` literal in `allen` tag correctly), a scalar
+ * sibling its own type. At `pointIn` the operand order is interval-left,
+ * point-right (`ir::CmpOp::PointIn`), so an interval-shaped literal
+ * beside a scalar element-typed sibling is the LEGAL lhs of
+ * `covers(span(...), t)` and tags as the interval of the sibling's
+ * element domain; under every other operator an interval shape against a
+ * scalar sibling stays refused (the engine's IllegalComparison — the
+ * bug-hunt fix, preserved op-aware).
  */
 function taggedCmpLiteral(
 	context: string,
-	sibling: FieldData | "measure",
+	sibling: AnyField | "measure",
 	value: unknown,
-	op: CmpOpData["kind"]
+	op: CmpKind | "binding"
 ): TaggedValue {
 	if (sibling === "measure") {
 		if (typeof value !== "bigint") {
@@ -457,11 +1420,16 @@ function taggedCmpLiteral(
 		}
 		return { kind: "u64", value }
 	}
-	if (sibling.type.kind === "interval") {
-		return taggedAtElementDomain(context, sibling.type.element, value)
+	if (!("closed" in sibling) && sibling.kind === "interval") {
+		return taggedAtElementDomain(context, sibling.element, value)
 	}
-	if (op === "pointIn" && (sibling.type.kind === "u64" || sibling.type.kind === "i64") && isIntervalShaped(value)) {
-		return taggedAtElementDomain(context, sibling.type.kind, value)
+	if (
+		op === "pointIn" &&
+		!("closed" in sibling) &&
+		(sibling.kind === "u64" || sibling.kind === "i64") &&
+		isIntervalShaped(value)
+	) {
+		return taggedAtElementDomain(context, sibling.kind, value)
 	}
 	return taggedLiteral(context, sibling, value)
 }
@@ -470,225 +1438,180 @@ function taggedCmpLiteral(
 interface LowerContext {
 	readonly theory: AnySchema
 	readonly relationIds: ReadonlyMap<string, number>
-	readonly predicateIds: ReadonlyMap<PredicateData, number>
-	readonly registry: QueryRegistry
-	/** Every dense param id some lowered term referenced — the usage census the dead-declaration refusal reads. */
-	readonly usedParams: Set<number>
+	readonly recIds: ReadonlyMap<RecData, number>
+	readonly paramIds: ReadonlyMap<string, number>
+	readonly params: ReadonlyMap<string, ParamEntry>
 }
 
 /** One rule's dense variable numbering: first occurrence in written order. */
 interface VarIds {
-	of(variable: AnyVar): number
-	synthetic(): number
+	of(name: string): number
 }
 
 /** Creates one rule-scoped variable numberer. */
-function makeVarIds(registry: QueryRegistry): VarIds {
-	const assigned = new Map<AnyVar, number>()
-	const state = { next: 0 }
+function makeVarIds(): VarIds {
+	const assigned = new Map<string, number>()
 	return {
-		of(variable) {
-			const existing = assigned.get(variable)
+		of(name) {
+			const existing = assigned.get(name)
 			if (existing !== undefined) {
 				return existing
 			}
-			if (!registry.vars.has(variable)) {
-				throw errors.new(
-					`query lowering: the variable declared from ${variable.relation}.${variable.field} belongs to a different query scope`
-				)
-			}
-			const id = state.next
-			state.next += 1
-			assigned.set(variable, id)
-			return id
-		},
-		synthetic() {
-			const id = state.next
-			state.next += 1
+			const id = assigned.size
+			assigned.set(name, id)
 			return id
 		}
 	}
 }
 
-/** Resolves a param term to its dense positional id, recording the use. */
-function paramIdOf(ctx: LowerContext, value: AnyTerm, name: string): number {
-	const index = ctx.registry.paramIndex.get(value)
-	if (index === undefined) {
-		throw errors.new(`query lowering: param ${name} belongs to a different query scope`)
+/** Resolves a param name to its dense positional id. */
+function paramIdOf(ctx: LowerContext, name: string): number {
+	const id = ctx.paramIds.get(name)
+	if (id === undefined) {
+		throw errors.new(`query lowering: param ${name} is not in the query's registry`)
 	}
-	ctx.usedParams.add(index)
-	return index
+	return id
 }
 
-/** Lowers one atom (either polarity) and appends any `oneOf` disjunctions. */
-function lowerAtom(
-	ctx: LowerContext,
-	atom: MatchAtom<ParamsRecord>,
-	ids: VarIds,
-	extraConditions: ConditionTreeIr[]
-): AtomIr {
-	const source = lowerSource(ctx, atom.source)
+/**
+ * Lowers one EDB atom (either polarity). A CLOSED owner lowers through the
+ * same edb source — its ordinal is its record-declaration slot exactly like
+ * an ordinary relation's — with field ordinals over the SEALED shape: `id`
+ * at 0, each payload column at its declared index + 1 (`matchFieldsOf`
+ * carries the shift; the lowering golden pins it).
+ */
+function lowerAtom(ctx: LowerContext, atom: AtomData, ids: VarIds): AtomIr {
+	const member = ctx.theory.relations[atom.relation.name]
+	if (member !== atom.relation) {
+		throw errors.new(
+			`query lowering: relation ${atom.relation.name} is not the relation value schema ${ctx.theory.name} declares`
+		)
+	}
+	const relationId = ctx.relationIds.get(atom.relation.name)
+	if (relationId === undefined) {
+		throw errors.new(`query lowering: relation ${atom.relation.name} has no ordinal`)
+	}
+	const ordered = matchFieldsOf(atom.relation)
 	const bindings: Array<readonly [number, TermIr]> = atom.bindings.map(function lowerBinding(binding) {
-		return [
-			fieldOrdinal(atom.source, binding),
-			lowerBindingTerm(ctx, atom.source, binding, ids, extraConditions)
-		] as const
+		const ordinal = ordered.findIndex(function byName(candidate) {
+			return candidate.name === binding.field
+		})
+		if (ordinal < 0) {
+			throw errors.new(`query lowering: relation ${atom.relation.name} has no field ${binding.field}`)
+		}
+		return [ordinal, lowerBindingTerm(ctx, `${atom.relation.name}.${binding.field}`, binding, ids)] as const
 	})
-	return { source, bindings }
+	return { source: { kind: "edb", relation: relationId }, bindings }
 }
 
-/** Lowers an atom source to its numeric id, verifying scope membership. */
-function lowerSource(ctx: LowerContext, source: AtomSourceData): AtomIr["source"] {
-	if (source.kind === "relation") {
-		const member = ctx.theory.relations[source.relation.name]
-		if (member !== source.relation) {
-			throw errors.new(
-				`query lowering: relation ${source.relation.name} is not the relation value schema ${ctx.theory.name} declares`
-			)
-		}
-		const id = ctx.relationIds.get(source.relation.name)
-		if (id === undefined) {
-			throw errors.new(`query lowering: relation ${source.relation.name} has no ordinal`)
-		}
-		return { kind: "edb", relation: id }
-	}
-	const pred = ctx.predicateIds.get(source.pred)
-	if (pred === undefined) {
-		throw errors.new(`query lowering: predicate ${source.pred.name} was declared in a different query scope`)
+/** Lowers one binding term. */
+function lowerBindingTerm(ctx: LowerContext, context: string, binding: BindingEntry, ids: VarIds): TermIr {
+	const bound = binding.term
+	switch (bound.kind) {
+		case "var":
+			return { kind: "var", var: ids.of(bound.name) }
+		case "param":
+			return { kind: "param", param: paramIdOf(ctx, bound.name) }
+		case "setParam":
+			return { kind: "paramSet", param: paramIdOf(ctx, bound.name) }
+		case "literal":
+			return { kind: "literal", value: taggedLiteral(context, binding.data, bound.value) }
 	}
-	return { kind: "idb", pred }
 }
 
-/** A binding's field ordinal: declaration index (relations) or head position (predicates). */
-function fieldOrdinal(source: AtomSourceData, binding: BindingEntry): number {
-	if (source.kind === "relation") {
-		const ordinal = source.relation.data.fields.findIndex(function byName(candidate) {
-			return candidate.name === binding.field
-		})
-		if (ordinal < 0) {
-			throw errors.new(`query lowering: relation ${source.relation.name} has no field ${binding.field}`)
-		}
-		return ordinal
+/** Lowers one idb atom: positional head bindings, `FieldId(i)` = head position i. */
+function lowerIdbAtom(ctx: LowerContext, rec: RecData, vars: readonly string[], ids: VarIds): AtomIr {
+	const pred = ctx.recIds.get(rec)
+	if (pred === undefined) {
+		throw errors.new(`query lowering: rec ${rec.name} was declared by a different program`)
 	}
-	const ordinal = source.pred.columns.findIndex(function byName(candidate) {
-		return candidate.name === binding.field
-	})
-	if (ordinal < 0) {
-		throw errors.new(`query lowering: predicate ${source.pred.name} has no column ${binding.field}`)
+	const arity = rec.rules[0]?.select.length
+	if (arity !== undefined && vars.length !== arity) {
+		throw errors.new(`query lowering: idb ${rec.name} takes ${arity} positions, got ${vars.length}`)
 	}
-	return ordinal
+	const bindings: Array<readonly [number, TermIr]> = vars.map(function lowerPosition(name, position) {
+		return [position, { kind: "var", var: ids.of(name) } as const] as const
+	})
+	return { source: { kind: "idb", pred }, bindings }
 }
 
-/** Lowers one binding term; an `oneOf` mints a fresh variable + disjunction. */
-function lowerBindingTerm(
+/** Lowers one comparison side; literals tag by the sibling's anchor (op-aware at `pointIn`). */
+function lowerCmpTerm(
 	ctx: LowerContext,
-	source: AtomSourceData,
-	binding: BindingEntry,
+	rule: RuleData,
+	side: CmpTermData,
+	sibling: CmpTermData,
 	ids: VarIds,
-	extraConditions: ConditionTreeIr[]
+	op: CmpKind
 ): TermIr {
-	const context = `${sourceName(source)}.${binding.field}`
-	const bound = binding.term
-	if (bound.kind === "term") {
-		const value = bound.value
-		switch (value[term]) {
-			case "var":
-				return { kind: "var", var: ids.of(value) }
-			case "param":
-				return { kind: "param", param: paramIdOf(ctx, value, value.name) }
-			case "paramSet":
-				return { kind: "paramSet", param: paramIdOf(ctx, value, value.name) }
-			case "maskParam":
-				throw errors.new(`${context}: an Allen-mask param is not a field-typed binding`)
-		}
-	}
-	if (bound.kind === "oneOf") {
-		const minted = ids.synthetic()
-		const leaves: ConditionTreeIr[] = bound.values.map(function equalityLeaf(candidate) {
-			return {
-				kind: "leaf",
-				cmp: {
-					op: { kind: "eq" },
-					lhs: { kind: "var", var: minted },
-					rhs: { kind: "literal", value: taggedLiteral(context, binding.data, candidate) }
-				}
-			}
-		})
-		extraConditions.push({ kind: "or", children: leaves })
-		return { kind: "var", var: minted }
-	}
-	return { kind: "literal", value: taggedLiteral(context, binding.data, bound.value) }
-}
-
-/** Lowers one comparison side; literals tag by the sibling's element domain (op-aware at `pointIn`). */
-function lowerCmpTerm(ctx: LowerContext, side: CmpTerm, sibling: CmpTerm, ids: VarIds, op: CmpOpData["kind"]): TermIr {
-	if (side.kind === "term") {
-		const value = side.value
-		switch (value[term]) {
-			case "var":
-				return { kind: "var", var: ids.of(value) }
-			case "param":
-				return { kind: "param", param: paramIdOf(ctx, value, value.name) }
-			case "paramSet":
-				return { kind: "paramSet", param: paramIdOf(ctx, value, value.name) }
-			case "maskParam":
+	switch (side.kind) {
+		case "var":
+			return { kind: "var", var: ids.of(side.name) }
+		case "param":
+			return { kind: "param", param: paramIdOf(ctx, side.name) }
+		case "setParam":
+			return { kind: "paramSet", param: paramIdOf(ctx, side.name) }
+		case "measure":
+			return { kind: "measure", var: ids.of(side.name) }
+		case "literal": {
+			const anchor = cmpAnchorOf(ctx, rule, sibling)
+			if (anchor === undefined) {
 				throw errors.new(
-					"query lowering: an Allen-mask param is not a comparison term — masks live in allen()'s mask position"
+					"query lowering: a comparison literal needs a bound-variable, measure, or anchored-param sibling to type it"
 				)
+			}
+			return { kind: "literal", value: taggedCmpLiteral("comparison literal", anchor, side.value, op) }
 		}
 	}
-	if (side.kind === "measure") {
-		return { kind: "measure", var: ids.of(side.over) }
-	}
-	if (sibling.kind === "term") {
-		const value = sibling.value
-		if (value[term] === "maskParam") {
-			throw errors.new("query lowering: an Allen-mask param cannot type a literal side")
-		}
-		return {
-			kind: "literal",
-			value: taggedCmpLiteral("comparison literal", value.data, side.value, op)
-		}
+}
+
+/** Resolves the anchor a comparison literal tags by: the sibling's field, the measure, or an anchored param. */
+function cmpAnchorOf(ctx: LowerContext, rule: RuleData, sibling: CmpTermData): AnyField | "measure" | undefined {
+	if (sibling.kind === "var") {
+		return rule.varFields[sibling.name]?.field
 	}
 	if (sibling.kind === "measure") {
-		return {
-			kind: "literal",
-			value: taggedCmpLiteral("comparison literal", "measure", side.value, op)
-		}
+		return "measure"
+	}
+	if (sibling.kind === "param" || sibling.kind === "setParam") {
+		return ctx.params.get(sibling.name)?.anchor
 	}
-	throw errors.new("query lowering: a comparison without a variable or parameter side is constant-valued")
+	return undefined
 }
 
 /** Lowers one comparison. */
-function lowerComparison(ctx: LowerContext, cmp: ComparisonItem<ParamsRecord>, ids: VarIds): ComparisonIr {
-	const op = cmp.op
-	if (op.kind === "allen") {
+function lowerComparison(ctx: LowerContext, rule: RuleData, cmp: CmpData, ids: VarIds): ComparisonIr {
+	if (cmp.op === "allen") {
+		const maskData = cmp.mask
+		if (maskData === undefined) {
+			throw errors.new("query lowering: an allen comparison lost its mask")
+		}
 		const mask =
-			op.mask.kind === "literal"
-				? ({ kind: "literal", mask: op.mask.mask } as const)
-				: ({ kind: "param", param: paramIdOf(ctx, op.mask.param, op.mask.param.name) } as const)
+			maskData.kind === "literal"
+				? { kind: "literal" as const, mask: maskData.mask }
+				: { kind: "param" as const, param: paramIdOf(ctx, maskData.name) }
 		return {
 			op: { kind: "allen", mask },
-			lhs: lowerCmpTerm(ctx, cmp.lhs, cmp.rhs, ids, "allen"),
-			rhs: lowerCmpTerm(ctx, cmp.rhs, cmp.lhs, ids, "allen")
+			lhs: lowerCmpTerm(ctx, rule, cmp.lhs, cmp.rhs, ids, "allen"),
+			rhs: lowerCmpTerm(ctx, rule, cmp.rhs, cmp.lhs, ids, "allen")
 		}
 	}
 	return {
-		op: { kind: op.kind },
-		lhs: lowerCmpTerm(ctx, cmp.lhs, cmp.rhs, ids, op.kind),
-		rhs: lowerCmpTerm(ctx, cmp.rhs, cmp.lhs, ids, op.kind)
+		op: { kind: cmp.op },
+		lhs: lowerCmpTerm(ctx, rule, cmp.lhs, cmp.rhs, ids, cmp.op),
+		rhs: lowerCmpTerm(ctx, rule, cmp.rhs, cmp.lhs, ids, cmp.op)
 	}
 }
 
 /** Lowers one condition node (comparison leaf or and/or tree). */
-function lowerCondition(ctx: LowerContext, condition: AnyCondition, ids: VarIds): ConditionTreeIr {
-	if (condition.item === "cmp") {
-		return { kind: "leaf", cmp: lowerComparison(ctx, condition, ids) }
+function lowerCondition(ctx: LowerContext, rule: RuleData, cond: CondData, ids: VarIds): ConditionTreeIr {
+	if (cond.kind === "cmp") {
+		return { kind: "leaf", cmp: lowerComparison(ctx, rule, cond, ids) }
 	}
 	return {
-		kind: condition.op,
-		children: condition.children.map(function lowerChild(child) {
-			return lowerCondition(ctx, child, ids)
+		kind: cond.op,
+		children: cond.children.map(function lowerChild(child) {
+			return lowerCondition(ctx, rule, child, ids)
 		})
 	}
 }
@@ -701,41 +1624,36 @@ function lowerFind(entry: SelectEntryData, ids: VarIds): FindTermIr {
 	if (entry.kind === "measure") {
 		return { kind: "measure", var: ids.of(entry.over) }
 	}
-	const aggregate = entry.aggregate
-	switch (aggregate.op) {
+	const agg = entry.agg
+	switch (agg.op) {
 		case "count":
 			return { kind: "aggregate", op: { kind: "count" } }
 		case "countDistinct":
-			return { kind: "aggregate", op: { kind: "countDistinct" }, over: ids.of(aggregate.over) }
+			return { kind: "aggregate", op: { kind: "countDistinct" }, over: ids.of(agg.over) }
 		case "fold": {
-			const over = aggregate.over
-			if (isTerm(over)) {
-				return { kind: "aggregate", op: { kind: aggregate.fold }, over: ids.of(over) }
+			if (typeof agg.over === "string") {
+				return { kind: "aggregate", op: { kind: agg.fold }, over: ids.of(agg.over) }
 			}
-			return { kind: "aggregateMeasure", op: { kind: aggregate.fold }, over: ids.of(over.measure) }
+			return { kind: "aggregateMeasure", op: { kind: agg.fold }, over: ids.of(agg.over.duration) }
 		}
 		case "arg":
-			return {
-				kind: "aggregate",
-				op: { kind: aggregate.direction, key: ids.of(aggregate.key) },
-				over: ids.of(aggregate.over)
-			}
+			return { kind: "aggregate", op: { kind: agg.direction, key: ids.of(agg.key) }, over: ids.of(agg.over) }
 		case "pack":
-			return { kind: "aggregate", op: { kind: "pack" }, over: ids.of(aggregate.over) }
+			return { kind: "aggregate", op: { kind: "pack" }, over: ids.of(agg.over) }
 	}
 }
 
 /** One aggregate's var-free head-op kind (`AggOp::head_op`). */
-function headOpOf(aggregate: AggregateData): HeadOpIr {
-	switch (aggregate.op) {
+function headOpOf(agg: AggData): HeadOpIr {
+	switch (agg.op) {
 		case "count":
 			return "count"
 		case "countDistinct":
 			return "countDistinct"
 		case "fold":
-			return aggregate.fold
+			return agg.fold
 		case "arg":
-			return aggregate.direction
+			return agg.direction
 		case "pack":
 			return "pack"
 	}
@@ -747,43 +1665,53 @@ function headTermOf(column: SelectColumn): HeadTermIr {
 	if (entry.kind === "var" || entry.kind === "measure") {
 		return { kind: "var" }
 	}
-	return { kind: "aggregate", op: headOpOf(entry.aggregate) }
+	return { kind: "aggregate", op: headOpOf(entry.agg) }
 }
 
-/** Lowers one rule: body walked in written order, finds supplied per shape. */
-function lowerRule(ctx: LowerContext, body: readonly AnyBodyItem[], finds: (ids: VarIds) => FindTermIr[]): RuleIr {
-	const ids = makeVarIds(ctx.registry)
+/** Lowers one rule: body walked in written order (var ids by first occurrence), finds last. */
+function lowerRule(ctx: LowerContext, rule: RuleData): RuleIr {
+	const ids = makeVarIds()
 	const atoms: AtomIr[] = []
 	const negated: AtomIr[] = []
 	const conditions: ConditionTreeIr[] = []
-	const extraConditions: ConditionTreeIr[] = []
-	for (const item of body) {
-		if (item.item === "atom") {
-			const lowered = lowerAtom(ctx, item, ids, extraConditions)
-			if (item.negated) {
-				negated.push(lowered)
-			} else {
-				atoms.push(lowered)
+	for (const item of rule.items) {
+		switch (item.kind) {
+			case "atom": {
+				atoms.push(lowerAtom(ctx, item.atom, ids))
+				break
+			}
+			case "negated": {
+				negated.push(lowerAtom(ctx, item.atom, ids))
+				break
+			}
+			case "idb": {
+				atoms.push(lowerIdbAtom(ctx, item.rec, item.vars, ids))
+				break
+			}
+			case "cond": {
+				conditions.push(lowerCondition(ctx, rule, item.cond, ids))
+				break
 			}
-			continue
 		}
-		conditions.push(lowerCondition(ctx, item, ids))
 	}
 	return {
-		finds: finds(ids),
+		finds: rule.select.map(function findOf(column) {
+			return lowerFind(column.entry, ids)
+		}),
 		atoms,
 		negated,
-		conditions: [...conditions, ...extraConditions]
+		conditions
 	}
 }
 
 /**
  * Lowers a query value to the bridge's `ProgramIr` — pure and stable: the
- * declared predicates in declaration order (`PredId` = index), the output
- * predicate (built from `rules` + `select`) appended last. Relations lower
- * by declaration ordinal, the law the engine's own manifest pins;
- * `db.prepare` re-verifies the alignment against the live manifest before
- * sending.
+ * recs in declaration order (`PredId` = index), the output predicate
+ * (rules + head) appended last. Relations lower by declaration ordinal,
+ * the law the engine's own manifest pins; `db.prepare` re-verifies the
+ * alignment against the live manifest before sending. Every registered
+ * param must carry a field anchor by now — an unanchorable param (its
+ * every use beside a literal) is refused here, naming it.
  */
 function lowerQuery(q: AnyQuery): ProgramIr {
 	const theory = q.schema
@@ -791,65 +1719,68 @@ function lowerQuery(q: AnyQuery): ProgramIr {
 	Object.keys(theory.relations).forEach(function assignOrdinal(name, index) {
 		relationIds.set(name, index)
 	})
-	const registry = q.data.registry
-	const predicateIds = new Map<PredicateData, number>()
-	registry.predicates.forEach(function assignPredId(pred, index) {
-		predicateIds.set(pred, index)
+	const recIds = new Map<RecData, number>()
+	q.data.recs.forEach(function assignPredId(rec, index) {
+		recIds.set(rec, index)
 	})
-	const ctx: LowerContext = { theory, relationIds, predicateIds, registry, usedParams: new Set() }
-	const predicates: PredicateDefIr[] = registry.predicates.map(function lowerPredicate(pred) {
+	const paramIds = new Map<string, number>()
+	const params = new Map<string, ParamEntry>()
+	q.data.params.forEach(function assignParamId(entry, index) {
+		if (entry.anchor === undefined && entry.shape !== "mask") {
+			throw errors.new(
+				`query param ${entry.name} has no field-anchored use — bind it in an atom or compare it against a bound variable`
+			)
+		}
+		paramIds.set(entry.name, index)
+		params.set(entry.name, entry)
+	})
+	const ctx: LowerContext = { theory, relationIds, recIds, paramIds, params }
+	const predicates: PredicateDefIr[] = q.data.recs.map(function lowerRec(rec) {
+		const head = rec.rules[0]
+		if (head === undefined) {
+			throw errors.new(`query lowering: rec ${rec.name} has no rules`)
+		}
 		return {
-			head: pred.columns.map(function boundHead(): HeadTermIr {
-				return { kind: "var" }
-			}),
-			rules: pred.rules.map(function lowerClause(rule) {
-				return lowerRule(ctx, rule.body, function clauseFinds(ids) {
-					return rule.finds.map(function findVar(variable): FindTermIr {
-						return { kind: "var", var: ids.of(variable) }
-					})
-				})
+			head: head.select.map(headTermOf),
+			rules: rec.rules.map(function lowerRecRule(rule) {
+				return lowerRule(ctx, rule)
 			})
 		}
 	})
 	predicates.push({
 		head: q.data.select.map(headTermOf),
-		rules: q.data.rules.map(function lowerOutputRule(body) {
-			return lowerRule(ctx, body, function outputFinds(ids) {
-				return q.data.select.map(function findOf(column) {
-					return lowerFind(column.entry, ids)
-				})
-			})
+		rules: q.data.rules.map(function lowerOutputRule(rule) {
+			return lowerRule(ctx, rule)
 		})
 	})
-	/**
-	 * The dead-declaration refusal: a declared param no rule reached is
-	 * unexecutable BOTH ways — its inferred `Params` contribution is nothing
-	 * (params ride item phantoms), yet the wire marshal is the full registry
-	 * in declaration order, while the ENGINE's arity is usage-derived. The
-	 * contradiction is refused here, the earliest seam that knows usage, so
-	 * every query that lowers has registry == used set (and the dense-id
-	 * hole a skipped middle declaration would open never exists).
-	 */
-	registry.params.forEach(function assertUsed(entry, index) {
-		if (!ctx.usedParams.has(index)) {
-			throw errors.new(
-				`query declares param ${entry.name} but no rule uses it — remove the declaration or reference it`
-			)
-		}
-	})
-	return { predicates, output: registry.predicates.length }
+	return { predicates, output: q.data.recs.length }
 }
 
 export type {
 	AnyQuery,
-	BuildParams,
+	AnyRuleValue,
+	HeadFieldsOf,
+	HeadOf,
+	HeadShape,
+	OutputRuleChain,
+	OutputRuleScope,
+	ParamsOf,
+	ProgramState,
 	Query,
-	QueryBuild,
 	QueryData,
 	QueryParams,
+	QueryRelation,
 	QueryRow,
-	Scope,
-	SelectColumn,
-	SelectEntryData
+	QueryRuleChain,
+	QueryRuleScope,
+	QueryStart,
+	RawChain,
+	RawScope,
+	RecRef,
+	RecRuleChain,
+	RecRuleScope,
+	RowOf,
+	RuleValue,
+	TermOps
 }
-export { lowerQuery, query, taggedLiteral }
+export { lowerQuery, makeOutputRuleScope, makeQuery, makeRawScope, query, taggedCmpLiteral, taggedLiteral }